ACS ACR33U-A1 User Manual

ACR33U-A1

SmartDuo

Smart Card Reader

Reference Manual V1.02

Subject to change without prior notice [e-mail]

www.acs.com.hk

Table of Contents

1.0. Introduction ............................................................................................................. 4

1.1. Reference Documents ........................................................................................................... 4

1.2. Symbols and Abbreviations ................................................................................................... 4

2.0. Features ................................................................................................................... 5

3.0. Smart Card Support ................................................................................................ 6

3.1. MCU Cards ............................................................................................................................ 6

3.2. Memory-based Smart Cards.................................................................................................. 6

4.0. Smart Card Interface ............................................................................................... 7

4.1. Smart Card Power Supply VCC (C1) .................................................................................... 7

4.2. Programming Voltage VPP (C6) ............................................................................................ 7

4.3. Card Type Selection .............................................................................................................. 7

4.4. Interface for Microcontroller-based Cards ............................................................................. 7

4.5. Card Tearing Protection ......................................................................................................... 7

5.0. Power Supply ........................................................................................................... 8

5.1. Status LED ............................................................................................................................. 8

6.0. USB Interface ........................................................................................................... 9

6.1. Communication Parameters .................................................................................................. 9

6.2. Endpoints ............................................................................................................................... 9

7.0. Communication Protocol ...................................................................................... 10

8.0. Commands ............................................................................................................. 12

8.1. CCID Command Pipe Bulk-OUT Messages ........................................................................ 12

8.1.1. PC_to_RDR_IccPowerOn ........................................................................................... 12

8.1.2. PC_to_RDR_IccPowerOff ........................................................................................... 13

8.1.3. PC_to_RDR_GetSlotStatus ........................................................................................ 14

8.1.4. PC_to_RDR_XfrBlock ................................................................................................. 15

8.1.5. PC_to_RDR_GetParameters ...................................................................................... 16

8.1.6. PC_to_RDR_SetParameters ...................................................................................... 17

8.1.7. PC_to_RDR_Escape .................................................................................................. 19

8.2. CCID Bulk-IN Messages ...................................................................................................... 21

8.2.1. RDR_to_PC_DataBlock .............................................................................................. 21

8.2.2. RDR_to_PC_SlotStatus .............................................................................................. 21

8.2.3. RDR_to_PC_Parameters ............................................................................................ 22

8.2.4. RDR_to_PC_Escape .................................................................................................. 24

8.3. Memory Card Access via PC_to_RDR_XfrBlock ................................................................ 26

8.3.1. Memory Card – 1, 2, 4, 8, 16 kbit I2C Card ................................................................ 26

8.3.2. Memory Card – 32, 64, 128, 256, 512, 1024 kbit I2C Card ........................................ 29

8.3.3. Memory Card – ATMEL AT88SC153.......................................................................... 32

8.3.4. Memory Card – ATMEL AT88SC1608........................................................................ 36

8.3.5. Memory Card – SLE4418/SLE4428/SLE5518/SLE5528 ............................................ 40

8.3.6. Memory Card – SLE4432/SLE4442/SLE5532/SLE5542 ............................................ 45

8.3.7. Memory Card – SLE4406/SLE4436/SLE5536/SLE6636 ............................................ 50

8.3.8. Memory Card – AT88SC101 / AT88SC102 / AT88SC1003 ....................................... 54

Appendix A. CCID Response Error Codes .................................................................... 60

Page 2 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

Tables

Table 1 : Symbols and Abbreviations ..................................................................................................... 4

Table 2 : USB Interface Wiring ............................................................................................................... 9

Table 3 : CCID Response Error Codes ................................................................................................ 60

Page 3 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

1.0. Introduction

The ACR33U-A1 SmartDuo PC-linked Smart Card Reader acts as an interface for the communication
between a computer and a smart card. Different types of smart cards have different commands and
different communication protocols, which, in most cases, prevent direct communication between a
smart card and a computer. The ACR33U-A1 SmartDuo Smart Card Reader establishes a uniform
interface from the computer to the smart card for a wide variety of cards. By taking care of the card’s
particulars, it releases the computer software programmer from being responsible with smart card
operations’ technical details, which in many cases, are not relevant to the implementation of a smart
card system.

1.1. Reference Documents

The following related documents are available from www.usb.org

• Universal Serial Bus Specification 2.0 (also referred to as the USB specification), April 27,
2000

• Universal Serial Bus Common Class Specification 1.0, December 16, 1997

• Universal Serial Bus Device Class: Smart Card CCID Specification for Integrated Circuit(s)

Cards Interface Devices, Revision 1.1, April 22, 2005

The following related documents can be ordered through www.ansi.org

• ISO/IEC 7816-1; Identification Cards – Integrated circuit(s) cards with contacts - Part 1:
Physical Characteristics

• ISO/IEC 7816-2; Identification Cards – Integrated circuit(s) cards with contacts - Part 2:
Dimensions and Locations of the contacts

• ISO/IEC 7816-3; Identification Cards – Integrated circuit(s) cards with contacts - Part 3:
Electronic signals and transmission protocols

1.2. Symbols and Abbreviations

Abbreviation Description

ATR Answer-to-reset

CCID Chip/Smart Card Interface Device

ICC Integrated Circuit Cards

IFSC Information Field Sized for ICC for protocol T=1

IFSD Information Field Sized for CCID for protocol T=1

NAD Node Address

PPS Protocol and Parameters Selection

RFU Reserved for future use*

TPDU Transport Protocol Data Unit

USB Universal Serial Bus

Table 1: Symbols and Abbreviations

*Note: Must be set to zero unless stated differently.

Page 4 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

2.0. Features

• USB Full Speed Interface

• Plug-and-Play – CCID support brings utmost compatibility

• Dual Slots for Full-Sized Smart Cards

• Three SAM (Secure Access Module) Card Slots

• Smart Card Reader:

o Supports ISO 7816 Class A (5 V) smart cards

o Supports microprocessor cards with T=0 and T=1 protocol

o Supports memory cards

o Supports PPS (Protocol and Parameters Selection)

o Features Short Circuit Protection

• User controllable peripherals:

o Tri-Color LED (Green, Red, Blue)

o Buzzer

• Application Programming Interface:

o Supports PC/SC

o Supports CT-API (through wrapper on top of PC/SC)

• Supports Android™ OS 3.1 and above

• Compliant with the following international standards:

o ISO 7816

o CE

o FCC

o VCCI

o PC/SC

o CCID

o Microsoft WHQL

o RoHS

Page 5 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

3.0. Smart Card Support

3.1. MCU Cards

The ACR33U-A1 is a PC/SC compliant smart card reader that supports ISO 7816 Class A (5 V) smart
card. It also works with MCU cards following either the T=0 and T=1 protocol.

The card ATR indicates the specific operation mode (TA2 present; bit b5 of TA2 must be 0) and when
that the particular mode is not supported by the ACR33U-A1; the reader will reset the card to a
negotiable mode. If the card cannot be set to negotiable mode, the reader will then reject the card.

When the card ATR indicates the negotiable mode (TA2 not present) and communication parameters
other than the default parameters, the ACR33U-A1 will execute the PPS and try to use the
communication parameters that the card suggested in its ATR. If the card does not accept the PPS,
the reader will use the default parameters (F=372, D=1).

For the meaning of the aforementioned parameters, please refer to ISO 7816-3.

3.2. Memory-based Smart Cards

The ACR33U-A1 works with several memory-based smart cards such as:

• Cards following the I2Cbus protocol (free memory cards) with maximum 128 bytes page with
capability, including:

o Atmel: AT24C01/02/04/08/16/32/64/128/256/512/1024

• Cards with secure memory IC with password and authentication, including:

o Atmel: AT88SC153 and AT88SC1608

• Cards with intelligent 1k bytes EEPROM with write-protect function, including:

o Infineon: SLE4418, SLE4428, SLE5518 and SLE5528

• Cards with intelligent 256 bytes EEPROM with write-protect function, including:

o Infineon: SLE4432, SLE4442, SLE5532 and SLE5542

• Cards with ‘104’ type EEPROM non-reloadable token counter cards, including:

o Infineon: SLE4406, SLE4436, SLE5536 and SLE6636

• Cards with Security Logic with Application Zone(s), including:

o Atmel: AT88SC101, AT88SC102 and AT88SC1003

Note: Memory card is supported in ICC Slot 0 only of ACR33U-A1 SmartDuo Smart Card Reader.

Page 6 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

4.0. Smart Card Interface

The interface between the ACR33U-A1 and the inserted smart card follows the specifications of ISO
7816-3 with certain restrictions or enhancements to increase the practical functionality of the
ACR33U-A1.

4.1. Smart Card Power Supply VCC (C1)

The current consumption of the inserted card must not be higher than 50 mA.

4.2. Programming Voltage VPP (C6)

According to ISO 7816-3, the smart card contact C6 (VPP) supplies the programming voltage to the
smart card. Since all common smart cards in the market are EEPROM-based and do not require the
provision of an external programming voltage, the contact C6 (VPP) has been implemented as a
normal control signal in the ACR33U-A1. The electrical specifications of this contact are identical to
those of the signal RST (at contact C2).

4.3. Card Type Selection

The controlling PC must always select the card type through the proper command sent to the
ACR33U-A1 prior to activating the inserted card. This includes both the memory cards and MCU­based cards.

For MCU-based cards the reader allows to select the preferred protocol, T=0 or T=1. However, this
selection is only accepted and carried out by the reader through the PPS when the card inserted in
the reader supports both protocol types. Whenever an MCU-based card supports only one protocol
type, T=0 or T=1, the reader automatically uses that protocol type, regardless of the protocol type
selected by the application.

4.4. Interface for Microcontroller-based Cards

For microcontroller-based smart cards only the contacts C1 (VCC), C2 (RST), C3 (CLK), C5 (GND)
and C7 (I/O) are used. A frequency of 4 MHz is applied to the CLK signal (C3).

4.5. Card Tearing Protection

The ACR33U-A1 provides a mechanism to protect the inserted card when it is suddenly withdrawn
while it is powered up. The power supply to the card and the signal lines between the ACR33U-A1
and the card is immediately deactivated when the card is removed. However, as a rule to avoid any
electrical damage, a card should only be removed from the reader while it is powered down.

Note: ACR33U-A1 does not switch on the power supply to the inserted card by itself. This can be
done by the controlling computer through the proper command sent to the reader.

Page 7 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

5.0. Power Supply

The ACR33U-A1 requires a voltage of 5 V DC, 100 mA, regulated, power supply. The ACR33U-A1
gets the power supply from the computer (through the cable supplied along with each type of reader).

5.1. Status LED

The LED indicates the activation status of the smart card interface:

• Flashing slowly (turns on 200 ms every 2 seconds)
Indicates ACR33U-A1 is powered up and in the standby state. Either the smart card has not
been inserted or the smart card has not been powered up (if it is inserted).

• Lighting up
Indicates power supply to the smart card is switched on, i.e., the smart card is activated.

• Flashing quickly
Indicates there are communications between ACR33U-A1 and smart card.

The different LED colors indicate the different states of the ACR33U-A1, where:

• Red LED
Power status

• Green LED
Main card slot status (ICC Slot 0)

• Blue LED
Slave card slot status (ICC Slot 1)

Page 8 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

6.0. USB Interface

6.1. Communication Parameters

The ACR33U-A1 is connected to a computer through USB as specified in the USB Specification 2.0.
The ACR33U-A1 is working in full speed mode, i.e. 12 Mbps.

Pin Signal Function

1 VBUS +5 V power supply for the reader

2 D- Differential signal transmits data between ACR33U-A1 and PC

3 D+ Differential signal transmits data between ACR33U-A1 and PC

4 GND Reference voltage level for power supply

Table 2: USB Interface Wiring

Note: In order for the ACR33U-A1 to function properly through USB interface, either ACS proprietary
device driver or ACS PC/SC device driver has to be installed.

6.2. Endpoints

The ACR33U-A1 uses the following endpoints to communicate with the host computer:

Control Endpoint

Bulk OUT

Bulk IN

Interrupt IN

For setup and control purpose

For command to be sent from host to ACR33U-A1
(data packet size is 64 bytes)

For response to be sent from ACR33U-A1 to host
(data packet size is 64 bytes)

For card status message to sent from ACR33U-A1 to host
(data packet size is 8 bytes)

Page 9 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

7.0. Communication Protocol

ACR33U-A1 shall interface with the host through the USB connection. A specification, namely CCID,
has been released within the industry defining such a protocol for the USB chip-card interface
devices. CCID covers all the protocols required for operating smart cards.

The configurations and usage of USB endpoints on ACR33U-A1 shall follow CCID Section 3.

An overview is summarized below:

1. Control Commands are sent on control pipe (default pipe). These include class-specific
requests and USB standard requests. Commands that are sent on the default pipe report
information back to the host on the default pipe.

2. CCID Events are sent on the interrupt pipe.

3. CCID Commands are sent on BULK-OUT endpoint. Each command sent to ACR33U-A1 has
an associated ending response. Some commands can also have intermediate responses.

4. CCID Responses are sent on BULK-IN endpoint. All commands sent to ACR33U-A1 have to
be sent synchronously (e.g., bMaxCCIDBusySlots is equal to 01h for ACR33U-A1).

The ACR33U-A1 supported CCID features are indicated in its Class Descriptor:

Offset Field Size Value Description

0

1

2

4

5

6

10

14

18

19

23

27

bLength

bDescriptorType

bcdCCID

bMaxSlotIndex

bVoltageSupport

dwProtocols

dwDefaultClock

dwMaximumClock

bNumClockSupported

dwDataRate

dwMaxDataRate

bNumDataRatesSupported

1 36h Size of this descriptor, in bytes

1 21h CCID Functional Descriptor type

2 0100h

1 05h

1 01h ACR33U-A1 can supply 5 V to its slot

4 00000003h

4 00000FA0h Default ICC clock frequency is 4 MHz

4 00000FA0h

1 00h

4 00002A00h Default ICC I/O data rate is 10752 bps

4 00054024h

1 00h

CCID Specification Release Number in
Binary-Coded decimal

2 big slots and 3 SAM slots are available
on ACR33U-A1

ACR33U-A1 supports T=0 and T=1
protocol

Maximum supported ICC clock
frequency is 4 MHz

Does not support manual setting of
clock frequency

Maximum supported ICC I/O data rate is
344100 bps

Does not support manual setting of data
rates

28

32

36

dwMaxIFSD

dwSynchProtocols

dwMechanical

4 00000FEh

4 00000000h

4 00000000h

Maximum IFSD supported by ACR33U­A1 for protocol T=1 is 254

ACR33U-A1 does not support
synchronous card

ACR33U-A1 does not support special
mechanical characteristics

Page 10 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

Offset Field Size Value Description

ACR33U-A1 supports the following
features:

Automatic ICC clock frequency change
according to parameters

Automatic baud rate change according

40

dwFeatures

4 000204B0h

to frequency and FI,DI parameters
Automatic PPS made by the CCID

according to the active parameters
Automatic IFSD exchange as first

exchange (T=1 protocol in use)
Short APDU level exchange with CCID

44

48

49

50

52

53

dwMaxCCIDMessageLength

bClassGetResponse

bClassEnvelope

wLCDLayout

bPINSupport

bMaxCCIDBusySlots

4 0000010Fh

1 00h Insignificant for TPDU level exchanges

1 00h Insignificant for TPDU level exchanges

2 0000h No LCD

1 03h With PIN Verification and Modification

1 01h Only 1 slot can be simultaneously busy

Maximum message length accepted by
ACR33U-A1 is 271 bytes

Page 11 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.0. Commands

8.1. CCID Command Pipe Bulk-OUT Messages

ACR33U-A1 shall follow the CCID Bulk-OUT Messages as specified in CCID Section 4. In addition,
this specification defines some extended commands for operating additional features.

This section lists the CCID Bulk-OUT Messages to be supported by ACR33U-A1.

8.1.1. PC_to_RDR_IccPowerOn

Activates the card slot and return ATR from the card.

Offset Field Size Value Description

0

1

2

5

6

7

The response to this command message is the RDR_to_PC_DataBlock response message and the
data returned is the Answer-to-Reset (ATR) data.

bMessageType

dwLength

bSlot

bSeq

bPowerSelect

abRFU

1 62h -

4 00000000h Size of extra bytes of this message

1 00-05h

1 00-FFh Sequence number for command

1 01h

2 - Reserved for future use

Identifies the slot number for this
command

Voltage that is applied to the ICC:
01h – 5 volts

Page 12 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.1.2. PC_to_RDR_IccPowerOff

Deactivates the card slot.

Offset Field Size Value Description

0

1

5

6

7

The response to this message is the RDR_to_PC_SlotStatus message.

bMessageType

dwLength

bSlot

bSeq

abRFU

1 63h -

4 00000000h Size of extra bytes of this message

1 00-05h

1 00-FFh Sequence number for command

3 - Reserved for future use

Identifies the slot number for this
command

Page 13 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.1.3. PC_to_RDR_GetSlotStatus

Gets current status of the slot.

Offset Field Size Value Description

0

1

5

6

7

The response to this message is the RDR_to_PC_SlotStatus message.

bMessageType

dwLength

bSlot

bSeq

abRFU

1 65h -

4 00000000h Size of extra bytes of this message

1 00-05h

1 00-FFh Sequence number for command

3 - Reserved for future use

Identifies the slot number for this
command

Page 14 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.1.4. PC_to_RDR_XfrBlock

Transfers data block to the ICC.

Offset Field Size Value Description

0

1

5

6

7

8

10

The response to this message is the RDR_to_PC_DataBlock message.

bMessageType

dwLength

bSlot

bSeq

bBWI

wLevelParameter

abData

1 6Fh -

4 -

1 00-05h

1 00-FFh Sequence number for command

1 00-FFh

2 0000h RFU (TPDU exchange level)

Byte

array

Size of abData field of this message

Identifies the slot number for this
command

Used to extend the CCIDs Block
Waiting Timeout for this current
transfer. The CCID will timeout the
block after “this number multiplied by
the Block Waiting Time” has expired.

Data block sent to the CCID. Data is

-

sent “as is” to the ICC (TPDU
exchange level).

Page 15 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.1.5. PC_to_RDR_GetParameters

Gets slot parameters.

Offset Field Size Value Description

0

1

5

6

7

The response to this message is the RDR_to_PC_Parameters message.

bMessageType

DwLength

BSlot

BSeq

AbRFU

1 6CH -

4 00000000H Size of extra bytes of this message

1 00-05H

1 00-FFH Sequence number for command

3 - Reserved for future use

Identifies the slot number for this
command

Page 16 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.1.6. PC_to_RDR_SetParameters

Sets slot parameters.

Offset Field Size Value Description

0

1

5

6

7

8

10

The response to this message is the RDR_to_PC_Parameters message.

bMessageType

dwLength

bSlot

bSeq

bProtocolNum

abRFU

abProtocolDataStructure

1 61h -

4 - Size of extra bytes of this message

1 00-05h

1 00-FFh Sequence number for command

1

2 -

Byte

array

00h,

01h

Identifies the slot number for this
command

Specifies what protocol data structure
follows.

00h = Structure for protocol T=0
01h = Structure for protocol T=1
The following values are reserved for

future use:
80h = Structure for 2-wire protocol
81h = Structure for 3-wire protocol
82h = Structure for I2C protocol

Reserved for future use

- Protocol Data Structure

Protocol Data Structure for Protocol T=0 (dwLength=00000005h)

Offset Field Size Value Description

B7-4 – FI – Index into the Table 7 in
ISO/IEC 7816-3:1997 selecting a clock

10

11

12

13

bmFindexDindex

bmTCCKST0

bGuardTimeT0

bWaitingIntegerT0

1 -

1 -

1 00-FFh

1 00-FFh WI for T=0 used to define WWT

rate conversion factor
B3-0 – DI - Index into the Table 8 in
ISO/IEC 7816-3:1997 selecting a baud

rate conversion factor

B0 – 0b, B7-2 – 000000b
B1 – Convention used (b1=0 for direct,

b1=1 for inverse) Note: The CCID
ignores this bit.

Extra guard time between two
characters. Add 0 to 254etu to the
normal guard time of 12etu. FFh is the
same as 00h.

Page 17 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

Offset Field Size Value Description

ICC Clock Stop Support:
00h = Stopping the Clock is not allowed

14

The response to this message is the RDR_to_PC_Parameters message.

Protocol Data Structure for Protocol T=1 (dwLength=00000007h)

Offset Field Size Value Description

10

bClockStop

bmFindexDindex

1 00-03h

1 -

01h = Stop with Clock signal Low
02h = Stop with Clock signal High
03h = Stop with Clock either High or

Low

B7-4 – FI – Index into the Table 7 in
ISO/IEC 7816-3:1997 selecting a
clock rate conversion factor

B3-0 – DI - Index into the Table 8 in
ISO/IEC 7816-3:1997 selecting a

baud rate conversion factor

11

12

13

14

15

16

BmTCCKST1

BGuardTimeT1

BwaitingIntegerT1

bClockStop

bIFSC

bNadValue

B7-2 – 000100b
B0 – Checksum type (b0=0 for LRC,

1 -

1 00-FFh

1 00-9Fh

1 00-03h

1 00-FFh Size of negotiated IFSC

1 00h Only support NAD = 00h

b0=1 for CRC
B1 – Convention used (b1=0 for

direct, b1=1 for inverse) Note: The
CCID ignores this bit.

Extra guard time (0 to 254etu
between two characters). If value is
FFh, then guard time is reduced by
1etu.

B7-4 = BWI values 0-9 valid
B3-0 = CWI values 0-Fh valid

ICC Clock Stop Support:
00h = Stopping the Clock is not

allowed
01h = Stop with Clock signal Low
02h = Stop with Clock signal High
03h = Stop with Clock either High or

Low

The response to this message is the RDR_to_PC_Parameters message.

Page 18 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.1.7. PC_to_RDR_Escape

Defines and access extended features.

Offset Field Size Value Description

0

1

5

6

7

10

bMessageType

dwLength

bSlot

bSeq

abRFU

abData

1 6Bh -

4 -

1 00-05h

1 00-FFh Sequence number for command

3 - Reserved for future use

Byte

array

- Data block sent to the CCID

8.1.7.1. LED

Offset Field Size Value Description

10

11

13

15

bcmdCode

wcmdLength

abRFU

abData

1 01h -

2 0001h -

2 - Reserved for future use

00000

1

XYZb

Size of abData field of this message

Identifies the slot number for this
command

00000xxx for 3 LED,
XYZ: 000 => 3 LEDs off
XYZ: 001 => LED1 on, green for 1 Sec
XYZ: 010 => LED2 on, red for 1 Sec
XYZ: 100 => LED3 on, blue for 1 Sec

The response to this command message is the RDR_to_PC_Escape response message.

8.1.7.2. BUZZER

Offset Field Size Value Description

10

11

13

15

The response to this command message is the RDR_to_PC_Escape response message.

bcmdCode

wcmdLength

abRFU

abData

1 08h -

2 0001h -

2 - Reserved for future use

XX for buzzer on or off,

1 XXh

YZ: 5A = buzzer on for 1 Sec
YZ: A5 = buzzer off

Page 19 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.1.7.3. Get Firmware Version

Offset Field Size Value Description

10

11

13

The response to this command message is the RDR_to_PC_Escape response message.

bcmdCode

wcmdLength

abRFU

1 04h -

2 0000h -

2 - Reserved for future use

Page 20 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.2. CCID Bulk-IN Messages

The Bulk-IN messages are used in response to the Bulk-OUT messages. ACR33U-A1 shall follow the
CCID Bulk-IN Messages as specified in CCID Section 4.

This section lists the CCID Bulk-IN Messages to be supported by ACR33U-A1.

Note: The values of bSlot and bSeq are the same as Bulk-OUT message.

8.2.1. RDR_to_PC_DataBlock

This message is sent by ACR33U-A1 in response to the command message:
PC_to_RDR_IccPowerOn and PC_to_RDR_XfrBlock.

Offset Field Size Value Description

0

1

5

6

7

8

9

10

bMessageType

dwLength

bSlot

bSeq

bStatus

bError

bChainParameter

abData

1 80h

4 - Size of extra bytes of this message

1 - Same value as in Bulk-OUT message

1 - Same value as in Bulk-OUT message

1 -

1 -

1 00h RFU (TPDU exchange level)

Byte

array

Indicates that a data block is being
sent from the CCID

Slot status register as defined in CCID
Section 4.2.1

Slot error register as defined in CCID
Section 4.2.1

This field contains the data returned

­by the CCID

8.2.2. RDR_to_PC_SlotStatus

This message is sent by ACR33U-A1 in response to PC_to_RDR_IccPowerOff,
PC_to_RDR_GetSlotStatus.

Offset Field Size Value Description

0

bMessageType

1 81 -

1

5

6

7

8

9

dwLength

bSlot

bSeq

bStatus

bError

bClockStatus

4 00000000h Size of extra bytes of this message

1 -

1 -

1 -

1 -

1 -

Same value as in Bulk-OUT message

Same value as in Bulk-OUT message

Slot status register as defined in CCID
Section 4.2.1

Slot error register as defined in CCID
Section 4.2.1

Value:
00h = Clock running
01h = Clock stopped in state L
02h = Clock stopped in state H
03h = Clock stopped in an unknown state
All other values are RFU

Page 21 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.2.3. RDR_to_PC_Parameters

This message is sent by ACR33U-A1 in response to PC_to_RDR_GetParameters and
PC_to_RDR_SetParameters messages.

Offset Field Size Value Description

0

1

5

6

7

8

9

10

bMessageType

dwLength

bSlot

bSeq

bStatus

bError

bProtocolNum

abProtocolDataSt

ructure

1 82h -

4 - Size of extra bytes of this message

1 - Same value as in Bulk-OUT message

1 - Same value as in Bulk-OUT message

1 -

1 -

1 -

Byte

array

Slot status register as defined in CCID
Section 4.2.1

Slot error register as defined in CCID
Section 4.2.1

Specifies what protocol data structure
follows:

00h = Structure for protocol T=0
01h = Structure for protocol T=1
The following values are reserved for

future use.
80h = Structure for 2-wire protocol
81h = Structure for 3-wire protocol
82h = Structure for I2C protocol

Protocol Data Structure as summarized

­in CCID Section 10.1.6

Protocol Data Structure for Protocol T=0 (bProtocolNum=0, dwLength=00000005h)

Offset Field Size Value Description

B7-4 – FI – Index into the Table 7 in
ISO/IEC 7816-3:1997 selecting a clock

10

11

12

13

bmFindexDindex

bmTCCKST0

bGuardTimeT0

bWaitingIntegerT0

1 -

1

1 00-FFh

1 00-FFh WI for T=0 used to define WWT

00h,

02h

rate conversion factor
B3-0 – DI - Index into the Table 8 in
ISO/IEC 7816-3:1997 selecting a baud

rate conversion factor

For T=0, B0 – 0b, B7-2 – 000000b
B1 – Convention used (b1=0 for direct,

b1=1 for inverse)

Extra guard time between two
characters. Add 0 to 254etu to the
normal guard time of 12etu. FFh is the
same as 00h.

Page 22 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

Offset Field Size Value Description

ICC Clock Stop Support:
00h = Stopping the Clock is not allowed

14

Protocol Data Structure for Protocol T=1 (bProtocolNum=1, dwLength=00000007h)

Offset Field Size Value Description

10

bClockStop

bmFindexDindex

1 00-03h

1

01h = Stop with Clock signal Low
02h = Stop with Clock signal High
03h = Stop with Clock either High or

Low

B7-4 – FI – Index into the Table 7 in
ISO/IEC 7816-3:1997 selecting a clock
rate conversion factor

B3-0 – DI - Index into the Table 8 in
ISO/IEC 7816-3:1997 selecting a baud

rate conversion factor

11

12

13

14

15

16

BmTCCKST1

BGuardTimeT1

BwaitingIntegerT1

bClockStop

bIFSC

bNadValue

10h,

1

1 00-FFh

1 00-9Fh

1 00-03h

1 00-FFh Size of negotiated IFSC

1 00h Only support NAD = 00h

11h,
12h,

13h

For T-1, B7-2 – 000100b
B0 – Checksum type (b0=0 for LRC,

b0=1 for CRC
B1 – Convention used (b1=0 for direct,

b1=1 for inverse)

Extra guard time (0 to 254etu between
two characters). If value is FFh, then
guard time is reduced by 1h.

B7-4 = BW I
B3-0 = CWI

ICC Clock Stop Support:
00h = Stopping the Clock is not allowed
01h = Stop with Clock signal Low
02h = Stop with Clock signal High
03h = Stop with Clock either High or

Low

Page 23 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.2.4. RDR_to_PC_Escape

This message is sent by ACR33U-A1 in response to PC_to_RDR_Escape messages.

Offset Field Size Value Description

0

1

5

6

7

8

9

10

bMessageType

dwLength

bSlot

bSeq

bStatus

bError

bRFU

abData

1 83h -

4 -

1 - Same value as in Bulk-OUT message

1 - Same value as in Bulk-OUT message

1 -

1 -

1 00h RFU (TPDU exchange level)

Byte

array

Size of abData field of this message

Slot status register as defined in CCID
Section 4.2.1

Slot error register as defined in CCID
Section 4.2.1

This field contains the data returned

­by the CCID

8.2.4.1. LED

This message is sent by ACR33U-A1 in response to PC_to_RDR_Escape LED messages.

Offset Field Size Value Description

10

11

bcmdCode

wcmdLength

1 81 -

2 0000 -

XXh for SW2:

13

abStatus

2 00XX

00h: Success
01h: Bad parameter

8.2.4.2. BUZZER

This message is sent by ACR33U-A1 in response to PC_to_RDR_Escape Buzzer messages.

Offset Field Size Value Description

10

11

13

bcmdCode

wcmdLength

abStatus

1 88h -

2 0000h -

XXh:

2 00XXh

00h: Success
01h: Bad parameter

8.2.4.3. Get Firmware Version

This message is sent by ACR33U-A1 in response to PC_to_RDR_Escape Get Firmware Version
messages.

Offset Field Size Value Description

Page 24 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

Offset Field Size Value Description

10

11

13

15

bcmdCode

wcmdLength

abStatus

abData

1 84h -

2 0004h -

XXh:

2 00XXh

0x41h
0x43h
0x52h
0x33h
0x33h
0x2Dh

13

0x41h
0x31h

0x20h
0xXXh
0xXXh
0xXXh
0xXXh

00h: Success
0h: Bad parameter

XX XX XX XX: Firmware Version

Page 25 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.3. Memory Card Access via PC_to_RDR_XfrBlock

Memory cards can be accessed via PC_to_RDR_XfrBlock command. All memory card functions are
mapped into pseudo-APDUs.

8.3.1. Memory Card – 1, 2, 4, 8, 16 kbit I2C Card

8.3.1.1. SELECT_CARD_TYPE

This command powers down and up the selected card inserted in the card reader and performs a card
reset.

Note: This command can only be used after the logical smart card reader communication has been
established using the SCardConnect( ) API. For details of SCardConnect( ) API, please refer to
PC/SC specifications.

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 Lc Card Type

FFh A4h 00h 00h 01h 01h

Response data format (abData field in the RDR_to_PC_DataBlock

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

)

8.3.1.2. SELECT_PAGE_SIZE

This command will choose the page size to read the smart card. The default value is 8-byte page
write. It will reset to default value whenever the card is removed or the reader is powered down.

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 Lc Page size

FFh 01h 00h 00h 01h

Where:

Page size = 03h for 8-byte page write

= 04h for 16-byte page write

= 05h for 32-byte page write

= 06h for 64-byte page write

= 07h for 128-byte page write

Page 26 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

8.3.1.3. READ_MEMORY_CARD

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS

FFh B0h

Where:

Byte Address: Memory address location of the memory card

MEM_L: Length of data to be read from the memory card

Response data format (abData field in the RDR_to_PC_DataBlock)

BYTE 1 … … BYTE N SW1 SW2

Where:

BYTE x: Data read from memory card

SW1, SW2 = 90 00h if no error

Byte Address

MEM_L

MSB LSB

8.3.1.4. WRITE_MEMORY_CARD

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS

FFh D0h

Where:

Byte Address: Memory address location of the memory card

MEM_L: Length of data to be written to the memory card

Byte x: Data to be written to the memory card

Byte Address

MEM_L Byte 1 …. .... Byte n

MSB LSB

Page 27 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

Page 28 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.3.2. Memory Card – 32, 64, 128, 256, 512, 1024 kbit I2C Card

8.3.2.1. SELECT_CARD_TYPE

This command powers down and up the selected card inserted in the card reader and performs a card
reset.

Note: This command can only be used after the logical smart card reader communication has been
established using the SCardConnect( ) API. For details of SCardConnect( ) API, please refer to
PC/SC specifications.

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 Lc Card Type

FFh A4h 00h 00h 01h 02h

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

8.3.2.2. SELECT_PAGE_SIZE

This command will choose the page size to read the smart card. The default value is 8-byte page
write. It will reset to default value whenever the card is removed or the reader is powered off.

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 Lc Page size

FFh 01h 00h 00h 01h

Where:

Data: TPDU to be sent to the card

Page size = 03h for 8-byte page write

= 04h for 16-byte page write

= 05h for 32-byte page write

= 06h for 64-byte page write

= 07h for 128-byte page write

Page 29 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

8.3.2.3. READ_MEMORY_CARD

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS

FFh

Where:

INS = B0h for 32, 64,128, 256, 512 kbit iic card

= 1011 000*b for 1024 kbit iic card, where * is the MSB of the 17 bit addressing

Byte Address: Memory address location of the memory card

MEM_L: Length of data to be read from the memory card

Response data format (abData field in the RDR_to_PC_DataBlock)

BYTE 1 … … BYTE N SW1 SW2

Where:

BYTE x: Data read from memory card

SW1, SW2 = 90 00h if no error

Byte Address

MEM_L

MSB LSB

8.3.2.4. WRITE_MEMORY_CARD

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS

FFh

Where:

INS = D0h for 32, 64, 128, 256, 512 kbit iic card

Byte Address: Memory address location of the memory card

MEM_L: Length of data to be written to the memory card

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

Byte Address

MEM_L Byte 1 …. .... Byte n

MSB LSB

= 1101 000*b for 1024 kbit iic card, where * is the MSB of the 17 bit addressing

Page 30 of 60

www.acs.com.hk

Byte x: Data to be written to the memory card

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

Page 31 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.3.3. Memory Card – ATMEL AT88SC153

8.3.3.1. SELECT_CARD_TYPE

This command powers down and up the selected card inserted in the card reader and performs a card
reset. It will also select the page size to be 8-byte page write.

Note: This command can only be used after the logical smart card reader communication has been
established using the SCardConnect( ) API. For details of ScardConnect( ) API, please refer to PC/SC
specifications.

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 Lc Card Type

FFh A4h 00h 00h 01h 03h

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

8.3.3.2. READ_MEMORY_CARD

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 Byte Address MEM_L

FFh 00h

Where:

INS = B0h for reading zone 00b

= B1h for reading zone 01b

= B2h for reading zone 10b

= B3h for reading zone 11b

= B4h for reading fuse

Byte Address: Memory address location of the memory card

MEM_L: Length of data to be read from the memory card

Page 32 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

Response data format (abData field in the RDR_to_PC_DataBlock)

BYTE 1 … … BYTE N SW1 SW2

Where:

BYTE x: Data read from memory card

SW1, SW2 = 90 00h if no error

8.3.3.3. WRITE_MEMORY_CARD

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 Bye Address MEM_L Byte 1 .... .... Byte n

FFh 00h

Where:

INS = D0h for writing zone 00b

= D1h for writing zone 01b

= D2h for writing zone 10b

= D3h for writing zone 11b

= D4h for writing fuse

Byte Address: Memory address location of the memory card

MEM_L: Length of data to be written to the memory card

MEM_D: Data to be written to the memory card

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

8.3.3.4. VERIFY_PASSWORD

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 Lc Pw(0) Pw(1) Pw(2)

FFh 20h 00h 03h

Where:

Pw(0),Pw(1),Pw(2): Passwords to be sent to memory card

Page 33 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

P2 = 0000 00rpb

where the two bits “rp” indicate the password to compare

r = 0: Write password,

r = 1: Read password,

p = Password set number,

rp = 01 for the secure code

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1

90h

Where:

SW1 = 90h

SW2 (ErrorCnt) = Error Counter. FFh indicates the verification is correct. 00h indicates the

SW2

ErrorCnt

password is locked (exceeded the maximum number of retries). Other
values indicate the current verification has failed.

8.3.3.5. INITIALIZE_AUTHENTICATION

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 Lc Q(0) Q(1) … Q(7)

FFh 84h 00h 00h 08h

Where:

Q(0),Q(1)…Q(7): Host random number, 8 bytes

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

8.3.3.6. VERIFY_AUTHENTICATION

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 Lc Ch(0) Ch(1) … Ch(7)

FFh 82h 00h 00h 08h

Page 34 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

Where:

Ch(0),Ch(1)…Ch(7): Host challenge, 8 bytes

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

Page 35 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.3.4. Memory Card – ATMEL AT88SC1608

8.3.4.1. SELECT_CARD_TYPE

This command powers down and up the selected card inserted in the card reader and performs a card
reset. It will also select the page size to be 16-byte page write.

Note: This command can only be used after the logical smart card reader communication has been
established using the SCardConnect( ) API. For details of SCardConnect( ) API, please refer to
PC/SC specifications.

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 Lc Card Type

FFh A4h 00h 00h 01h 04h

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

8.3.4.2. READ_MEMORY_CARD

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS Zone Address Byte Address MEM_L

FFh

Where:

INS = B0h for reading user zone

= B1h for reading configuration zone or reading fuse

Zone Address = 0000 0A

= don’t care for reading fuse

Byte Address = A

MEM_L: Length of data to be read from the memory card

7A6A5A4 A3A2A1A0

= 1000 0000b for reading fuse

b, where A10 is the MSB of zone address

10A9A8

b is the memory address location of the memory card

Response data format (abData field in the RDR_to_PC_DataBlock)

BYTE 1 … … BYTE N SW1 SW2

Page 36 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

Where:

BYTE x : Data read from memory card

SW1, SW2 = 90 00h if no error

8.3.4.3. WRITE_MEMORY_CARD

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS Zone Address Byte Address MEM_L Byte 1 .... .... Byte n

FFh

Where:

INS = D0h for writing user zone

= D1h for writing configuration zone or writing fuse

Zone Address = 0000 0A

b, where A10 is the MSB of zone address

10A9A8

= don’t care for writing fuse

Byte Address = A

= 1000 0000

7A6A5A4 A3A2A1A0

for writing fuse

b

b is the memory address location of the memory card

MEM_L: Length of data to be written to the memory card

Byte x: Data to be written to the memory card

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

8.3.4.4. VERIFY_PASSWORD

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 Lc Data

FFh 20h 00h 00h 04h RP Pw(0) Pw(1) Pw(2)

Where:

Pw(0),Pw(1),Pw(2): Passwords to be sent to memory card

RP = 0000 rp

where the four bits “rp

2p1p0

b

” indicate the password to compare:

2p1p0

r = 0: Write password,

r = 1: Read password,

Page 37 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

p2p1p0: Password set number

(rp

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1

90h

Where:

SW1 = 90h

SW2 (ErrorCnt) = Error Counter. FFh indicates the verification is correct. 00h indicates the

SW2

ErrorCnt

password is locked (exceeded the maximum number of retries). Other
values indicate the current verification has failed.

= 0111 for the secure code)

2p1p0

8.3.4.5. INITIALIZE_AUTHENTICATION

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 Lc Q(0) Q(1) … Q(7)

FFh 84h 00h 00h 08h

Where:

Byte Address: Memory address location of the memory card

Q(0),Q(1)…Q(7): Host random number, 8 bytes

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

8.3.4.6. VERIFY_AUTHENTICATION

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 Lc Q1(0) Q1(1) … Q1(7)

FFh 82h 00h 00h 08h

Where:

Byte Address: Memory address location of the memory card

Q1(0),Q1(1)…Q1(7): Host challenge, 8 bytes

Page 38 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

Page 39 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.3.5. Memory Card – SLE4418/SLE4428/SLE5518/SLE5528

8.3.5.1. SELECT_CARD_TYPE

This command powers down and up the selected card inserted in the card reader and performs a card
reset.

Note: This command can only be used after the logical smart card reader communication has been
established using the SCardConnect( ) API. For details of SCardConnect( ) API, please refer to
PC/SC specifications.

Command format (abData field in the PC_to_RDR_XfrBlock)

CLA INS P1 P2 Lc Card Type

FFh A4h 00h 00h 01h 05h

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Pseudo-APDU

Where:

SW1, SW2 = 90 00h

if no error

8.3.5.2. READ_MEMORY_CARD

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS

FFh B0h

Where:

MSB Byte Address = 0000 00A

LSB Byte Address = A

MEM_L: Length of data to be read from the memory card

Response data format (abData field in the RDR_to_PC_DataBlock)

Byte Address

MSB LSB

card

MEM_L

b is the memory address location of the memory card

9A8

7A6A5A4 A3A2A1A0

b is the memory address location of the memory

BYTE 1 … … BYTE N SW1 SW2

Where:

BYTE x : Data read from memory card

SW1, SW2 = 90 00h if no error

Page 40 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.3.5.3. READ_PRESENTATION_ERROR_COUNTER_MEMORY_CARD (only
SLE4428 and SLE5528)

To read the presentation error counter for the secret code.

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 MEM_L

FFh B1h 00h 00h 03h

Response data format (abData field in the RDR_to_PC_DataBlock)

ERRCNT DUMMY 1 DUMMY 2 SW1 SW2

Where:

ERRCNT: The value of the presentation error counter. FFh indicates the last verification is

correct. 00h indicates the password is locked (exceeded the maximum number of
retries). Other values indicate the last verification has failed.

DUMMY: Two bytes dummy data read from the card.

SW1, SW2 = 90 00h if no error

8.3.5.4. READ_PROTECTION_BIT

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS

FFh B2h

Where:

MSB Byte Address = 0000 00A

LSB Byte Address = A

MEM_L: Length of protection bits to be read from the card, in multiples of 8

For example, to read eight protection bits starting from memory 0x0010h, the following pseudo­APDU should be issued:

Byte Address

MSB LSB

card.

bits. Maximum value is 32

MEM_L = 1 + INT( (number of bits-1)/8 )

MEM_L

b is the memory address location of the memory card.

9A8

7A6A5A4 A3A2A1A0

b is the memory address location of the memory

0xFFh 0xB1h 0x00h 0x10h 0x01h

Response data format (abData field in the RDR_to_PC_DataBlock)

PROT 1 … … PROT L SW1 SW2

Page 41 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

Where:

PROT y: Bytes containing the protection bits

SW1,SW2 = 90 00h if no error

The arrangement of the protection bits in the PROT bytes is as follows:

PROT 1 PROT 2 ….

P8 P7 P6 P5 P4 P3 P2 P1 P16 P15 P14 P13 P12 P11 P10 P9 .. .. .. .. .. .. P18 P 17

Where:

Px is the protection bit of BYTE x in the response data

‘0’ byte is write protected

‘1’ byte can be written

8.3.5.5. WRITE_MEMORY_CARD

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS

MEM_L Byte 1 .... .... Byte N

MSB LSB

FFh D0h

Where:

Byte Address

MSB Byte Address = 0000 00A

LSB Byte Address = A

7A6A5A4

b is the memory address location of the memory card

9A8

A3A2A1A0b is the memory address location of the memory

card

MEM_L: Length of data to be written to the memory card

Byte x: Data to be written to the memory card

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

8.3.5.6. WRITE_PROTECTION_MEMORY_CARD

Each of the bytes specified in the command is internally in the card compared with the byte stored at
the specified address and if the data match, the corresponding protection bit is irreversibly
programmed to ‘0’.

Page 42 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS

MEM_L Byte 1 .... .... Byte N

MSB LSB

FFh D1h

Where:

Byte Address

MSB Byte Address = 0000 00A

LSB Byte Address = A

7A6A5A4 A3A2A1A0

b is the memory address location of the memory card

9A8

b is the memory address location of the memory

card

MEM_L: Length of data to be written to the memory card

Byte x: Byte values to be compared with the data in the card starting at Byte Address.

BYTE 1 is compared with the data at Byte Address; BYTE N is compared with the
data at (Byte Address+N-1).

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

8.3.5.7. PRESENT_CODE_MEMORY_CARD (only SLE 4428 and SLE5528)

To submit the secret code to the memory card to enable the write operation with the SLE4428 and
SLE5528 card, the following actions are executed:

• Search a ‘1’ bit in the presentation error counter and write the bit to ‘0’

• Present the specified code to the card

• Try to erase the presentation error counter

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 MEM_L

FFh 20h 00h 00h 02h

Where:

CODE: Two bytes secret code (PIN)

CODE

Byte 1 Byte 2

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1

SW2

ErrorCnt

90h

Page 43 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

Where:

SW1 = 90h

SW2 (ErrorCnt) = Error Counter. FFh indicates the verification is correct. 00h indicates

the password is locked (exceeded the maximum number of retries).
Other values indicate the current verification has failed.

Page 44 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.3.6. Memory Card – SLE4432/SLE4442/SLE5532/SLE5542

8.3.6.1. SELECT_CARD_TYPE

This command powers down and up the selected card inserted in the card reader and performs a card
reset.

Note: This command can only be used after the logical smart card reader communication has been
established using the SCardConnect( ) API. For details of SCardConnect( ) API, please refer to
PC/SC specifications.

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 Lc Card Type

FFh A4h 00h 00h 01h 06h

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

8.3.6.2. READ_MEMORY_CARD

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 Byte Address MEM_L

FFh B0h 00h

Where:

Byte Address = A

MEM_L: Length of data to be read from the memory card

Response data format (abData field in the RDR_to_PC_DataBlock)

BYTE 1 … … BYTE N SW1 SW2

7A6A5A4 A3A2A1A0

b is the memory address location of the memory card

Where:

BYTE x: Data read from memory card

SW1, SW2 = 90 00h if no error

Page 45 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.3.6.3. READ_PRESENTATION_ERROR_COUNTER_MEMORY_CARD (only SLE4442 and SLE5542)

To read the presentation error counter for the secret code.

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 MEM_L

FFh B1h 00h 00h 04h

Response data format (abData field in the RDR_to_PC_DataBlock)

ERRCNT DUMMY 1 DUMMY 2 DUMMY 3 SW1 SW2

Where:

ERRCNT: The value of the presentation error counter. 07h indicates the last verification is

correct. 00h indicates the password is locked (exceeded the maximum number of
retries). Other values indicate the last verification has failed.

DUMMY: Three bytes dummy data read from the card.

SW1, SW2 = 90 00h if no error

8.3.6.4. READ_PROTECTION_BITS

To read the protection bits for the first 32 bytes.

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 MEM_L

FFh B2h 00h 00h 04h

Response data format (abData field in the RDR_to_PC_DataBlock)

PROT 1 PROT 2 PROT3 PROT 4 SW1 SW2

Where:

PROT y: Bytes containing the protection bits from protection memory

SW1, SW2 = 90 00h if no error

The arrangement of the protection bits in the PROT bytes is as follows:

PROT 1 PROT 2 …

P8 P7 P6 P5 P4 P3 P2 P1 P16 P15 P14 P13 P12 P 11 P10 P9 .. .. .. .. .. .. P18 P17

Page 46 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

Where:

Px is the protection bit of BYTE x in the response data

‘0’ byte is write protected

‘1’ byte can be written

8.3.6.5. WRITE_MEMORY_CARD

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 Byte Address MEM_L Byte 1 .... .... Byte N

FFh D0h 00h

Where:

Byte Address = A

7A6A5A4 A3A2A1A0

b is the memory address location of the memory card

MEM_L: Length of data to be written to the memory card

Byte x: Data to be written to the memory card

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

8.3.6.6. WRITE_PROTECTION_MEMORY_CARD

Each of the bytes specified in the command is internally in the card compared with the byte stored at
the specified address and if the data match, the corresponding protection bit is irreversibly
programmed to ‘0’.

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 Byte Address MEM_L Byte 1 .... .... Byte N

FFh D1h 00h

Where:

Byte Address = 000A

A3A2A1A0b (00 to 1F) is the protection memory address location of

4

the memory card

MEM_L: Length of data to be written to the memory card

Byte x: Byte values to be compared with the data in the card starting at Byte

Address. BYTE 1 is compared with the data at Byte Address; BYTE N is
compared with the data at (Byte Address+N-1).

Page 47 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

8.3.6.7. PRESENT_CODE_MEMORY_CARD (only SLE 4442 and SLE5542)

To submit the secret code to the memory card to enable the write operation with the SLE4442 and
SLE5542 card, the following actions are executed:

• Search a ‘1’ bit in the presentation error counter and write the bit to ‘0’

• Present the specified code to the card

• Try to erase the presentation error counter

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 MEM_L

FFh 20h 00h 00h 03h

Where:

CODE: Three bytes secret code (PIN)

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1

90h

Where:

SW1 = 90h

SW2 (ErrorCnt) = Error Counter. 07h indicates the verification is correct. 00h indicates the

SW2

ErrorCnt

password is locked (exceeded the maximum number of retries). Other
values indicate the current verification has failed.

Byte 1 Byte 2 Byte 3

CODE

8.3.6.8. CHANGE_CODE_MEMORY_CARD (only SLE 4442 and SLE5542)

To write the specified data as new secret code in the card.

The current secret code must be presented to the card with the PRESENT_CODE command prior to
the execution of this command.

Page 48 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 MEM_L

Byte 1 Byte 2 Byte 3

FFh D2h 00h 01h 03h

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

CODE

Page 49 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.3.7. Memory Card – SLE4406/SLE4436/SLE5536/SLE6636

8.3.7.1. SELECT_CARD_TYPE

This command powers down and up the selected card inserted in the card reader and performs a card
reset.

Note: This command can only be used after the logical smart card reader communication has been
established using the SCardConnect( ) API. For details of SCardConnect( ) API, please refer to
PC/SC specifications.

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 Lc Card Type

FFh A4h 00h 00h 01h 07h

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

8.3.7.2. READ_MEMORY_CARD

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 Byte Address MEM_L

FFh B0h 00h

Where:

Byte Address = Memory address location of the memory card

MEM_L: Length of data to be read from the memory card

Response data format (abData field in the RDR_to_PC_DataBlock)

BYTE 1 … … BYTE N SW1 SW2

Where:

BYTE x: Data read from memory card

SW1, SW2 = 90 00h if no error

Page 50 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.3.7.3. WRITE_ONE_BYTE_MEMORY_CARD

To write one byte to the specified address of the inserted card. The byte is written to the card with
LSB first, i.e., the bit at card address 0 is regarded as the LSB of byte 0.

Four different WRITE modes are available for this card type, which are distinguished by a flag in the
command data field:

1. Write

The byte value specified in the command is written to the specified address. This command can
be used for writing personalization data and counter values to the card.

2. Write with carry

The byte value specified in the command is written to the specified address and the command is
sent to the card to erase the next lower counter stage. This write mode can therefore only be
used for updating the counter value in the card.

3. Write with backup enabled (SLE4436, SLE5536 and SLE6636 only)

The byte value specified in the command is written to the specified address. This command can
be used for writing personalization data and counter values to the card. Backup bit is enabled to
prevent data loss when card tearing occurs.

4. Write with carry and backup enabled (SLE4436, SLE5536 and SLE6636 only)

The byte value specified in the command is written to the specified address and the command is
sent to the card to erase the next lower counter stage. This write mode can therefore only be
used for updating the counter value in the card. Backup bit is enabled to prevent data loss when
card tearing occurs.

With all write modes, the byte at the specified card address is not erased prior to the write operation
and hence, memory bits can only be programmed from '1' to '0'.

The backup mode available in the SLE4436 and SLE5536 card can be enabled or disabled in the
write operation.

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 Byte Address MEM_L MODE BYTE

FFh D0h 00h 02h

Where:

Byte Address = Memory address location of the memory card

MODE: Specifies the write mode and backup option

00h: write

01h: write with carry

02h: write with backup enabled (SLE4436, SLE5536 and SLE6636 only)

03h: write with carry and with backup enabled (SLE4436, SLE5536 and

SLE6636 only)

BYTE: Byte value to be written to the card

Page 51 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

8.3.7.4. PRESENT_CODE_MEMORY_CARD

To submit the secret code to the memory card to enable the card personalization mode, the following
actions are executed:

1. Search a '1' bit in the presentation counter and write the bit to '0'.

2. Present the specified code to the card.

The ACR33U-A1 does not try to erase the presentation counter after the code submission. This must
be done by the application software through a separate 'Write with carry' command.

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 MEM_L

ADDR Byte 1 Byte 2 Byte 3

FFh 20h 00h 00h 04h 09h

Where:

ADDR: Byte address of the presentation counter in the card

CODE: Three bytes secret code (PIN)

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

CODE

8.3.7.5. AUTHENTICATE_MEMORY_CARD (SLE4436, SLE5536 and SLE6636 only)

To read a card authentication certificate from a SLE5536 or SLE6636 card, the following actions are
executed by the ACR33U-A1:

1. Select Key 1 or Key 2 in the card as specified in the command.

2. Present the challenge data specified in the command to the card.

3. Generate the specified number of CLK pulses for each bit of authentication data computed by
the card.

4. Read 16 bits of authentication data from the card.

5. Reset the card to normal operation mode.

Page 52 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

The authentication has to be performed in two steps. The first step is to send the Authentication
Certificate to the card. The second step is to get back two bytes of authentication data calculated by
the card.

Step 1: Send Authentication Certificate to the Card.

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2

FFh 84h 00h 00h 08h

Where:

KEY: Key to be used for the computation of the authentication certificate:

CLK_CNT: Number of CLK pulses to be supplied to the card for the computation of each

BYTE 1...6: Card challenge data

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

61h 02h

Where:

MEM_L CODE

KEY CLK_CNT Byte1 Byte 2 …… Byte 5 Byte 6

00h: key 1 with no cipher block chaining

01h: key 2 with no cipher block chaining

80h: key 1 with cipher block chaining (SLE5536 and SLE6636 only)

81h: key 2 with cipher block chaining (SLE5536 and SLE6636 only)

bit of the authentication certificate. Typical value is 160 clocks (A0h)

SW1, SW2 = 61 02h if no error, meaning two bytes of authentication data are ready. The

authentication data can be retrieved by “Get_Response” command.

Step 2: Get back the Authentication Data (Get_Response).

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 MEM_L

FFh C0h 00h 00h 02h

Response data format (abData field in the RDR_to_PC_DataBlock)

CERT SW1 SW2

Where:

CERT: 16 bits of authentication data computed by the card. The LSB of BYTE 1 is the

first authentication bit read from the card.

SW1, SW2 = 90 00h if no error

Page 53 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.3.8. Memory Card – AT88SC101 / AT88SC102 / AT88SC1003

8.3.8.1. SELECT_CARD_TYPE

This command powers down and up the selected card inserted in the card reader and performs a card
reset.

Note: This command can only be used after the logical smart card reader communication has been
established using the SCardConnect( ) API. For details of SCardConnect( ) API, please refer to
PC/SC specifications.

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 P2 Lc Card Type

FFh A4h 00h 00h 01h 09h

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

8.3.8.2. READ_MEMORY_CARD

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 Byte Address MEM_L

FFh B0h 00h

Where:

Byte Address = Memory address location of the memory card

MEM_L: Length of data to be read from the memory card

Response data format (abData field in the RDR_to_PC_DataBlock)

BYTE 1 … … BYTE N SW1 SW2

Where:

BYTE x: Data read from memory card

SW1, SW2 = 90 00h if no error

Page 54 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.3.8.3. WRITE_MEMORY_CARD

To write data to the specified address of the inserted card. The byte is written to the card with LSB
first, e.g., the bit at card address 0 is regarded as the LSB of byte 0.

The byte at the specified card address is not erased prior to the write operation and hence, memory
bits can only be programmed from '1' to '0'.

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 Byte Address MEM_L Byte 1 .... .... Byte N

FFh D0h 00h

Where:

Byte Address = Memory address location of the memory card

MEM_L: Length of data to be written to the memory card

BYTE: Byte value to be written to the card

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

8.3.8.4. ERASE_NON_APPLICATION_ZONE

To erase the data in Non-Application Zones. The EEPROM memory is organized into 16 bit words.
Although erases are performed on single bits the ERASE operation clears an entire word in the
memory. Therefore, performing an ERASE on any bit in the word will clear ALL 16 bits of that word to
the state of ‘1’.

To erase Error Counter or the data in Application Zones, please refer to:

• ERASE_APPLICATION_ZONE_WITH_ERASE command as specified in Section 8.3.8.5

• ERASE_APPLICATION_ZONE_WITH_WRITE_AND_ERASE command as specified in

Section 8.3.8.6

• VERIFY_SECURITY_CODE

commands as specified in Section 8.3.8.7

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS P1 Byte Address MEM_L

FFh D2h 00h 00h

Where:

Byte Address = Memory byte address location of the word to be erased

Page 55 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

8.3.8.5. ERASE_APPLICATION_ZONE_WITH_ERASE

This command can be used in the following cases:

• AT88SC101: To erase the data in Application Zone with EC Function Disabled

• AT88SC102: To erase the data in Application Zone 1

• AT88SC102: To erase the data in Application Zone 2 with EC2 Function Disabled

• AT88SC1003: To erase the data in Application Zone 1

• AT88SC1003: To erase the data in Application Zone 2 with EC2 Function Disabled

• AT88SC1003: To erase the data in Application Zone 3

The following actions are executed for this command:

• Present the specified code to the card

• Erase the presentation error counter. The data in corresponding Application Zone can be

erased when the submitted code is correct.

Command format (abData field in the PC_to_RDR_XfrBlock

Pseudo-APDU

CLA INS

FFh 20h 00h

Where:

Error Counter LEN: Length of presentation error counter in bits. The value should be

Byte Address: Byte address of the Application Zone Key in the card. Please refer to

AT88SC101: Erase Application Zone with EC function disabled 96h 04h

Error Counter

LEN

0x00h always.

the table below for the correct value.

Byte

Address

Byte Address LEN

MEM_L

)

Byte 1 Byte

2

CODE

……. ……

Byte

N

AT88SC102: Erase Application Zone 1 56h 06h

AT88SC102: Erase Application Zone 2 with EC2 function disabled 9Ch 04h

AT88SC1003: Erase Application Zone 1 36h 06h

AT88SC1003: Erase Application Zone 2 with EC2 function disabled 5Ch 04h

AT88SC1003: Erase Application Zone 3 C0h 06h

Where:

MEM_L: Length of the Erase Key. Please refer to the table below for the

Page 56 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

correct value

CODE: N bytes of Erase Key

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

Note: After SW1SW2 = 0x9000h has been received, read back the data in Application Zone can
check whether the ERASE_APPLICATION_ZONE_WITH_ERASE is correct. If all data in
Application Zone is erased and equals to “0xFFh”, the previous verification is success.

8.3.8.6. ERASE_APPLICATION_ZONE_WITH_WRITE_AND_ERASE

This command can be used in the following cases:

• AT88SC101: To erase the data in Application Zone with EC Function Enabled

• AT88SC102: To erase the data in Application Zone 2 with EC2 Function Enabled

• AT88SC1003: To erase the data in Application Zone 2 with EC2 Function Enabled

With EC or EC2 Function Enabled (that is, ECEN or EC2EN Fuse is undamaged and in “1” state), the
following actions are executed:

• Present the specified code to the card

• Search a '1' bit in the presentation error counter and write the bit to '0'

• Erase the presentation error counter. The data in corresponding Application Zone can be

erased when the submitted code is correct.

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CODE

CLA INS Error Counter LEN Byte Address MEM_L

FFh 20h 80h 04h

Where:

Error Counter LEN: Length of presentation error counter in bits. The value should be

0x80h always.

Byte Address: Byte address of the Application Zone Key in the card.

Byte 1 Byte 2 Byte 3 Byte 4

Byte Address

AT88SC101 96h

AT88SC102 9Ch

AT88SC1003 5Ch

CODE: 4 bytes Erase Key

Page 57 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

= 63 00h if there is no more retry chance

Note: After SW1SW2 = 0x9000h has been received, read back the data in Application Zone can
check whether the ERASE_APPLICATION_ZONE_WITH_ERASE is correct. If all data in
Application Zone is erased and equals to “0xFFh,” the previous verification is success.

8.3.8.7. VERIFY_SECURITY_CODE

To submit Security Code (2 bytes) to the inserted card. Security Code is to enable the memory access
of the card.

The following actions are executed:

• Present the specified code to the card

• Search a '1' bit in the presentation error counter and write the bit to '0'

• Erase the presentation error counter. The Security Code Attempts Counter can be erased

when the submitted code is correct.

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

CLA INS Error Counter LEN Byte Address MEM_L

FFh 20h 08h 0Ah 02h

Where:

Error Counter LEN: Length of presentation error counter in bits

Byte Address: Byte address of the key in the card

CODE: 2 bytes Security Code

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

CODE

Byte 1 Byte 2

Where”

SW1, SW2 = 90 00h if no error

= 63 00h if there is no more retry chance

Note: After SW1SW2 = 0x9000h has been received, read back the Security Code Attempts
Counter (SCAC) can check whether the VERIFY_USER_CODE is correct. If SCAC is erased and
equals to “0xFFh,” the previous verification is success.

Page 58 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

8.3.8.8. BLOWN_FUSE

To blow the fuse of the inserted card. The fuse can be EC_EN Fuse, EC2EN Fuse, Issuer Fuse or
Manufacturer’s Fuse.

Note: Blowing of the Fuse is an irreversible process.

Command format (abData field in the PC_to_RDR_XfrBlock)

Pseudo-APDU

Addr

(Low)

CODE

State of

FUS

Pin

State of RST

Pin

Error

CLA INS

FFh 05h 00h 00h 04h 01h 00h or 01h

Where:

Fuse Bit Addr (2 bytes): Bit address of the fuse. Please refer to the table below for the

State of FUS Pin: State of the FUS pin. Should always be 0x01h.

State of RST Pin: State of the RST pin. Please refer to below table for the correct

AT88SC101

AT88SC102

Counter

LEN

Byte

Address

Manufacturer

Fuse

EC_EN Fuse 05h C9h 01h

Issuer Fuse 05h E0h 01h

Manufacturer

Fuse

EC2EN Fuse 05h F9h 01h

MEM_L

correct value.

value.

Fuse Bit Addr

Fuse Bit

Addr

(High)

(High)

05h 80h 01h

05h B0h 01h

Fuse Bit

Fuse Bit Addr

(Low)

State of

RST Pin

Issuer Fuse 06h 10h 01h

Manufacturer

Fuse

AT88SC1003

Response data format (abData field in the RDR_to_PC_DataBlock)

SW1 SW2

Where:

SW1, SW2 = 90 00h if no error

EC2EN Fuse 03h FCh 00h

Issuer Fuse 03h E0h 00h

03h F8h 00h

Page 59 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk

Appendix A. CCID Response Error Codes

The following table summarizes the possible error code returned by the ACR33U-A1:

Error Code Status

FFh SLOTERROR_CMD_ABORTED

FEh SLOTERROR_ICC_MUTE

FDh SLOTERROR_XFR_PARITY_ERROR

FCh SLOTERROR_XFR_OVERRUN

FBh SLOTERROR_HW_ERROR

F8h SLOTERROR_BAD_ATR_TS

F7h SLOTERROR_BAD_ATR_TCK

F6h SLOTERROR_ICC_PROTOCOL_NOT_SUPPORTED

F5h SLOTERROR_ICC_CLASS_NOT_SUPPORTED

F4h SLOTERROR_PROCEDURE_BYTE_CONFLICE

F3h SLOTERROR_DEACTIVATED_PROTOCOL

F2h SLOTERROR_BUSY_WITH_AUTO_SEQUENCE

E0h SLOTERROR_CMD_SLOT_BUSY

Table 3: CCID Response Error Codes

Page 60 of 60

ACR33U-A1 – Reference Manual [e-mail]

Version 1.02

www.acs.com.hk