ACS ACR33U-A1 User Manual

Page 1
ACR33U-A1
SmartDuo
Smart Card Reader
Reference Manual V1.02
Subject to change without prior notice info@acs.com.hk
www.acs.com.hk
Page 2
Table of Contents
1.0. Introduction ............................................................................................................. 4
1.1. Reference Documents ........................................................................................................... 4
1.2. Symbols and Abbreviations ................................................................................................... 4
2.0. Features ................................................................................................................... 5
3.0. Smart Card Support ................................................................................................ 6
3.1. MCU Cards ............................................................................................................................ 6
3.2. Memory-based Smart Cards.................................................................................................. 6
4.0. Smart Card Interface ............................................................................................... 7
4.1. Smart Card Power Supply VCC (C1) .................................................................................... 7
4.2. Programming Voltage VPP (C6) ............................................................................................ 7
4.3. Card Type Selection .............................................................................................................. 7
4.4. Interface for Microcontroller-based Cards ............................................................................. 7
4.5. Card Tearing Protection ......................................................................................................... 7
5.0. Power Supply ........................................................................................................... 8
5.1. Status LED ............................................................................................................................. 8
6.0. USB Interface ........................................................................................................... 9
6.1. Communication Parameters .................................................................................................. 9
6.2. Endpoints ............................................................................................................................... 9
7.0. Communication Protocol ...................................................................................... 10
8.0. Commands ............................................................................................................. 12
8.1. CCID Command Pipe Bulk-OUT Messages ........................................................................ 12
8.1.1. PC_to_RDR_IccPowerOn ........................................................................................... 12
8.1.2. PC_to_RDR_IccPowerOff ........................................................................................... 13
8.1.3. PC_to_RDR_GetSlotStatus ........................................................................................ 14
8.1.4. PC_to_RDR_XfrBlock ................................................................................................. 15
8.1.5. PC_to_RDR_GetParameters ...................................................................................... 16
8.1.6. PC_to_RDR_SetParameters ...................................................................................... 17
8.1.7. PC_to_RDR_Escape .................................................................................................. 19
8.2. CCID Bulk-IN Messages ...................................................................................................... 21
8.2.1. RDR_to_PC_DataBlock .............................................................................................. 21
8.2.2. RDR_to_PC_SlotStatus .............................................................................................. 21
8.2.3. RDR_to_PC_Parameters ............................................................................................ 22
8.2.4. RDR_to_PC_Escape .................................................................................................. 24
8.3. Memory Card Access via PC_to_RDR_XfrBlock ................................................................ 26
8.3.1. Memory Card – 1, 2, 4, 8, 16 kbit I2C Card ................................................................ 26
8.3.2. Memory Card – 32, 64, 128, 256, 512, 1024 kbit I2C Card ........................................ 29
8.3.3. Memory Card – ATMEL AT88SC153.......................................................................... 32
8.3.4. Memory Card – ATMEL AT88SC1608........................................................................ 36
8.3.5. Memory Card – SLE4418/SLE4428/SLE5518/SLE5528 ............................................ 40
8.3.6. Memory Card – SLE4432/SLE4442/SLE5532/SLE5542 ............................................ 45
8.3.7. Memory Card – SLE4406/SLE4436/SLE5536/SLE6636 ............................................ 50
8.3.8. Memory Card – AT88SC101 / AT88SC102 / AT88SC1003 ....................................... 54
Appendix A. CCID Response Error Codes .................................................................... 60
Page 2 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 3
Tables
Table 1 : Symbols and Abbreviations ..................................................................................................... 4
Table 2 : USB Interface Wiring ............................................................................................................... 9
Table 3 : CCID Response Error Codes ................................................................................................ 60
Page 3 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 4
1.0. Introduction
The ACR33U-A1 SmartDuo PC-linked Smart Card Reader acts as an interface for the communication between a computer and a smart card. Different types of smart cards have different commands and different communication protocols, which, in most cases, prevent direct communication between a smart card and a computer. The ACR33U-A1 SmartDuo Smart Card Reader establishes a uniform interface from the computer to the smart card for a wide variety of cards. By taking care of the card’s particulars, it releases the computer software programmer from being responsible with smart card operations’ technical details, which in many cases, are not relevant to the implementation of a smart card system.
1.1. Reference Documents
The following related documents are available from www.usb.org
Universal Serial Bus Specification 2.0 (also referred to as the USB specification), April 27, 2000
Universal Serial Bus Common Class Specification 1.0, December 16, 1997
Universal Serial Bus Device Class: Smart Card CCID Specification for Integrated Circuit(s)
Cards Interface Devices, Revision 1.1, April 22, 2005
The following related documents can be ordered through www.ansi.org
ISO/IEC 7816-1; Identification Cards – Integrated circuit(s) cards with contacts - Part 1: Physical Characteristics
ISO/IEC 7816-2; Identification Cards – Integrated circuit(s) cards with contacts - Part 2: Dimensions and Locations of the contacts
ISO/IEC 7816-3; Identification Cards – Integrated circuit(s) cards with contacts - Part 3: Electronic signals and transmission protocols
1.2. Symbols and Abbreviations
Abbreviation Description
ATR Answer-to-reset
CCID Chip/Smart Card Interface Device
ICC Integrated Circuit Cards
IFSC Information Field Sized for ICC for protocol T=1
IFSD Information Field Sized for CCID for protocol T=1
NAD Node Address
PPS Protocol and Parameters Selection
RFU Reserved for future use*
TPDU Transport Protocol Data Unit
USB Universal Serial Bus
Table 1: Symbols and Abbreviations
*Note: Must be set to zero unless stated differently.
Page 4 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 5
2.0. Features
USB Full Speed Interface
Plug-and-Play – CCID support brings utmost compatibility
Dual Slots for Full-Sized Smart Cards
Three SAM (Secure Access Module) Card Slots
Smart Card Reader:
o Supports ISO 7816 Class A (5 V) smart cards
o Supports microprocessor cards with T=0 and T=1 protocol
o Supports memory cards
o Supports PPS (Protocol and Parameters Selection)
o Features Short Circuit Protection
User controllable peripherals:
o Tri-Color LED (Green, Red, Blue)
o Buzzer
Application Programming Interface:
o Supports PC/SC
o Supports CT-API (through wrapper on top of PC/SC)
Supports Android™ OS 3.1 and above
Compliant with the following international standards:
o ISO 7816
o CE
o FCC
o VCCI
o PC/SC
o CCID
o Microsoft WHQL
o RoHS
Page 5 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 6
3.0. Smart Card Support
3.1. MCU Cards
The ACR33U-A1 is a PC/SC compliant smart card reader that supports ISO 7816 Class A (5 V) smart card. It also works with MCU cards following either the T=0 and T=1 protocol.
The card ATR indicates the specific operation mode (TA2 present; bit b5 of TA2 must be 0) and when that the particular mode is not supported by the ACR33U-A1; the reader will reset the card to a negotiable mode. If the card cannot be set to negotiable mode, the reader will then reject the card.
When the card ATR indicates the negotiable mode (TA2 not present) and communication parameters other than the default parameters, the ACR33U-A1 will execute the PPS and try to use the communication parameters that the card suggested in its ATR. If the card does not accept the PPS, the reader will use the default parameters (F=372, D=1).
For the meaning of the aforementioned parameters, please refer to ISO 7816-3.
3.2. Memory-based Smart Cards
The ACR33U-A1 works with several memory-based smart cards such as:
Cards following the I2Cbus protocol (free memory cards) with maximum 128 bytes page with capability, including:
o Atmel: AT24C01/02/04/08/16/32/64/128/256/512/1024
Cards with secure memory IC with password and authentication, including:
o Atmel: AT88SC153 and AT88SC1608
Cards with intelligent 1k bytes EEPROM with write-protect function, including:
o Infineon: SLE4418, SLE4428, SLE5518 and SLE5528
Cards with intelligent 256 bytes EEPROM with write-protect function, including:
o Infineon: SLE4432, SLE4442, SLE5532 and SLE5542
Cards with ‘104’ type EEPROM non-reloadable token counter cards, including:
o Infineon: SLE4406, SLE4436, SLE5536 and SLE6636
Cards with Security Logic with Application Zone(s), including:
o Atmel: AT88SC101, AT88SC102 and AT88SC1003
Note: Memory card is supported in ICC Slot 0 only of ACR33U-A1 SmartDuo Smart Card Reader.
Page 6 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 7
4.0. Smart Card Interface
The interface between the ACR33U-A1 and the inserted smart card follows the specifications of ISO 7816-3 with certain restrictions or enhancements to increase the practical functionality of the ACR33U-A1.
4.1. Smart Card Power Supply VCC (C1)
The current consumption of the inserted card must not be higher than 50 mA.
4.2. Programming Voltage VPP (C6)
According to ISO 7816-3, the smart card contact C6 (VPP) supplies the programming voltage to the smart card. Since all common smart cards in the market are EEPROM-based and do not require the provision of an external programming voltage, the contact C6 (VPP) has been implemented as a normal control signal in the ACR33U-A1. The electrical specifications of this contact are identical to those of the signal RST (at contact C2).
4.3. Card Type Selection
The controlling PC must always select the card type through the proper command sent to the ACR33U-A1 prior to activating the inserted card. This includes both the memory cards and MCU­based cards.
For MCU-based cards the reader allows to select the preferred protocol, T=0 or T=1. However, this selection is only accepted and carried out by the reader through the PPS when the card inserted in the reader supports both protocol types. Whenever an MCU-based card supports only one protocol type, T=0 or T=1, the reader automatically uses that protocol type, regardless of the protocol type selected by the application.
4.4. Interface for Microcontroller-based Cards
For microcontroller-based smart cards only the contacts C1 (VCC), C2 (RST), C3 (CLK), C5 (GND) and C7 (I/O) are used. A frequency of 4 MHz is applied to the CLK signal (C3).
4.5. Card Tearing Protection
The ACR33U-A1 provides a mechanism to protect the inserted card when it is suddenly withdrawn while it is powered up. The power supply to the card and the signal lines between the ACR33U-A1 and the card is immediately deactivated when the card is removed. However, as a rule to avoid any electrical damage, a card should only be removed from the reader while it is powered down.
Note: ACR33U-A1 does not switch on the power supply to the inserted card by itself. This can be done by the controlling computer through the proper command sent to the reader.
Page 7 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 8
5.0. Power Supply
The ACR33U-A1 requires a voltage of 5 V DC, 100 mA, regulated, power supply. The ACR33U-A1 gets the power supply from the computer (through the cable supplied along with each type of reader).
5.1. Status LED
The LED indicates the activation status of the smart card interface:
Flashing slowly (turns on 200 ms every 2 seconds) Indicates ACR33U-A1 is powered up and in the standby state. Either the smart card has not been inserted or the smart card has not been powered up (if it is inserted).
Lighting up Indicates power supply to the smart card is switched on, i.e., the smart card is activated.
Flashing quickly Indicates there are communications between ACR33U-A1 and smart card.
The different LED colors indicate the different states of the ACR33U-A1, where:
Red LED Power status
Green LED Main card slot status (ICC Slot 0)
Blue LED Slave card slot status (ICC Slot 1)
Page 8 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 9
6.0. USB Interface
6.1. Communication Parameters
The ACR33U-A1 is connected to a computer through USB as specified in the USB Specification 2.0. The ACR33U-A1 is working in full speed mode, i.e. 12 Mbps.
Pin Signal Function
1 VBUS +5 V power supply for the reader
2 D- Differential signal transmits data between ACR33U-A1 and PC
3 D+ Differential signal transmits data between ACR33U-A1 and PC
4 GND Reference voltage level for power supply
Table 2: USB Interface Wiring
Note: In order for the ACR33U-A1 to function properly through USB interface, either ACS proprietary device driver or ACS PC/SC device driver has to be installed.
6.2. Endpoints
The ACR33U-A1 uses the following endpoints to communicate with the host computer:
Control Endpoint
Bulk OUT
Bulk IN
Interrupt IN
For setup and control purpose
For command to be sent from host to ACR33U-A1 (data packet size is 64 bytes)
For response to be sent from ACR33U-A1 to host (data packet size is 64 bytes)
For card status message to sent from ACR33U-A1 to host (data packet size is 8 bytes)
Page 9 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 10
7.0. Communication Protocol
ACR33U-A1 shall interface with the host through the USB connection. A specification, namely CCID, has been released within the industry defining such a protocol for the USB chip-card interface devices. CCID covers all the protocols required for operating smart cards.
The configurations and usage of USB endpoints on ACR33U-A1 shall follow CCID Section 3.
An overview is summarized below:
1. Control Commands are sent on control pipe (default pipe). These include class-specific requests and USB standard requests. Commands that are sent on the default pipe report information back to the host on the default pipe.
2. CCID Events are sent on the interrupt pipe.
3. CCID Commands are sent on BULK-OUT endpoint. Each command sent to ACR33U-A1 has an associated ending response. Some commands can also have intermediate responses.
4. CCID Responses are sent on BULK-IN endpoint. All commands sent to ACR33U-A1 have to be sent synchronously (e.g., bMaxCCIDBusySlots is equal to 01h for ACR33U-A1).
The ACR33U-A1 supported CCID features are indicated in its Class Descriptor:
Offset Field Size Value Description
0
1
2
4
5
6
10
14
18
19
23
27
bLength
bDescriptorType
bcdCCID
bMaxSlotIndex
bVoltageSupport
dwProtocols
dwDefaultClock
dwMaximumClock
bNumClockSupported
dwDataRate
dwMaxDataRate
bNumDataRatesSupported
1 36h Size of this descriptor, in bytes
1 21h CCID Functional Descriptor type
2 0100h
1 05h
1 01h ACR33U-A1 can supply 5 V to its slot
4 00000003h
4 00000FA0h Default ICC clock frequency is 4 MHz
4 00000FA0h
1 00h
4 00002A00h Default ICC I/O data rate is 10752 bps
4 00054024h
1 00h
CCID Specification Release Number in Binary-Coded decimal
2 big slots and 3 SAM slots are available on ACR33U-A1
ACR33U-A1 supports T=0 and T=1 protocol
Maximum supported ICC clock frequency is 4 MHz
Does not support manual setting of clock frequency
Maximum supported ICC I/O data rate is 344100 bps
Does not support manual setting of data rates
28
32
36
dwMaxIFSD
dwSynchProtocols
dwMechanical
4 00000FEh
4 00000000h
4 00000000h
Maximum IFSD supported by ACR33U­A1 for protocol T=1 is 254
ACR33U-A1 does not support synchronous card
ACR33U-A1 does not support special mechanical characteristics
Page 10 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 11
Offset Field Size Value Description
ACR33U-A1 supports the following features:
Automatic ICC clock frequency change according to parameters
Automatic baud rate change according
40
dwFeatures
4 000204B0h
to frequency and FI,DI parameters Automatic PPS made by the CCID
according to the active parameters Automatic IFSD exchange as first
exchange (T=1 protocol in use) Short APDU level exchange with CCID
44
48
49
50
52
53
dwMaxCCIDMessageLength
bClassGetResponse
bClassEnvelope
wLCDLayout
bPINSupport
bMaxCCIDBusySlots
4 0000010Fh
1 00h Insignificant for TPDU level exchanges
1 00h Insignificant for TPDU level exchanges
2 0000h No LCD
1 03h With PIN Verification and Modification
1 01h Only 1 slot can be simultaneously busy
Maximum message length accepted by ACR33U-A1 is 271 bytes
Page 11 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 12
8.0. Commands
8.1. CCID Command Pipe Bulk-OUT Messages
ACR33U-A1 shall follow the CCID Bulk-OUT Messages as specified in CCID Section 4. In addition, this specification defines some extended commands for operating additional features.
This section lists the CCID Bulk-OUT Messages to be supported by ACR33U-A1.

8.1.1. PC_to_RDR_IccPowerOn

Activates the card slot and return ATR from the card.
Offset Field Size Value Description
0
1
2
5
6
7
The response to this command message is the RDR_to_PC_DataBlock response message and the data returned is the Answer-to-Reset (ATR) data.
bMessageType
dwLength
bSlot
bSeq
bPowerSelect
abRFU
1 62h -
4 00000000h Size of extra bytes of this message
1 00-05h
1 00-FFh Sequence number for command
1 01h
2 - Reserved for future use
Identifies the slot number for this command
Voltage that is applied to the ICC: 01h – 5 volts
Page 12 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 13

8.1.2. PC_to_RDR_IccPowerOff

Deactivates the card slot.
Offset Field Size Value Description
0
1
5
6
7
The response to this message is the RDR_to_PC_SlotStatus message.
bMessageType
dwLength
bSlot
bSeq
abRFU
1 63h -
4 00000000h Size of extra bytes of this message
1 00-05h
1 00-FFh Sequence number for command
3 - Reserved for future use
Identifies the slot number for this command
Page 13 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 14

8.1.3. PC_to_RDR_GetSlotStatus

Gets current status of the slot.
Offset Field Size Value Description
0
1
5
6
7
The response to this message is the RDR_to_PC_SlotStatus message.
bMessageType
dwLength
bSlot
bSeq
abRFU
1 65h -
4 00000000h Size of extra bytes of this message
1 00-05h
1 00-FFh Sequence number for command
3 - Reserved for future use
Identifies the slot number for this command
Page 14 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 15

8.1.4. PC_to_RDR_XfrBlock

Transfers data block to the ICC.
Offset Field Size Value Description
0
1
5
6
7
8
10
The response to this message is the RDR_to_PC_DataBlock message.
bMessageType
dwLength
bSlot
bSeq
bBWI
wLevelParameter
abData
1 6Fh -
4 -
1 00-05h
1 00-FFh Sequence number for command
1 00-FFh
2 0000h RFU (TPDU exchange level)
Byte
array
Size of abData field of this message
Identifies the slot number for this command
Used to extend the CCIDs Block Waiting Timeout for this current transfer. The CCID will timeout the block after “this number multiplied by the Block Waiting Time” has expired.
Data block sent to the CCID. Data is
-
sent “as is” to the ICC (TPDU exchange level).
Page 15 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 16

8.1.5. PC_to_RDR_GetParameters

Gets slot parameters.
Offset Field Size Value Description
0
1
5
6
7
The response to this message is the RDR_to_PC_Parameters message.
bMessageType
DwLength
BSlot
BSeq
AbRFU
1 6CH -
4 00000000H Size of extra bytes of this message
1 00-05H
1 00-FFH Sequence number for command
3 - Reserved for future use
Identifies the slot number for this command
Page 16 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 17

8.1.6. PC_to_RDR_SetParameters

Sets slot parameters.
Offset Field Size Value Description
0
1
5
6
7
8
10
The response to this message is the RDR_to_PC_Parameters message.
bMessageType
dwLength
bSlot
bSeq
bProtocolNum
abRFU
abProtocolDataStructure
1 61h -
4 - Size of extra bytes of this message
1 00-05h
1 00-FFh Sequence number for command
1
2 -
Byte
array
00h,
01h
Identifies the slot number for this command
Specifies what protocol data structure follows.
00h = Structure for protocol T=0 01h = Structure for protocol T=1 The following values are reserved for
future use: 80h = Structure for 2-wire protocol 81h = Structure for 3-wire protocol 82h = Structure for I2C protocol
Reserved for future use
- Protocol Data Structure
Protocol Data Structure for Protocol T=0 (dwLength=00000005h)
Offset Field Size Value Description
B7-4 – FI – Index into the Table 7 in ISO/IEC 7816-3:1997 selecting a clock
10
11
12
13
bmFindexDindex
bmTCCKST0
bGuardTimeT0
bWaitingIntegerT0
1 -
1 -
1 00-FFh
1 00-FFh WI for T=0 used to define WWT
rate conversion factor B3-0 – DI - Index into the Table 8 in ISO/IEC 7816-3:1997 selecting a baud
rate conversion factor
B0 – 0b, B7-2 – 000000b B1 – Convention used (b1=0 for direct,
b1=1 for inverse) Note: The CCID ignores this bit.
Extra guard time between two characters. Add 0 to 254etu to the normal guard time of 12etu. FFh is the same as 00h.
Page 17 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 18
Offset Field Size Value Description
ICC Clock Stop Support: 00h = Stopping the Clock is not allowed
14
The response to this message is the RDR_to_PC_Parameters message.
Protocol Data Structure for Protocol T=1 (dwLength=00000007h)
Offset Field Size Value Description
10
bClockStop
bmFindexDindex
1 00-03h
1 -
01h = Stop with Clock signal Low 02h = Stop with Clock signal High 03h = Stop with Clock either High or
Low
B7-4 – FI – Index into the Table 7 in ISO/IEC 7816-3:1997 selecting a clock rate conversion factor
B3-0 – DI - Index into the Table 8 in ISO/IEC 7816-3:1997 selecting a
baud rate conversion factor
11
12
13
14
15
16
BmTCCKST1
BGuardTimeT1
BwaitingIntegerT1
bClockStop
bIFSC
bNadValue
B7-2 – 000100b B0 – Checksum type (b0=0 for LRC,
1 -
1 00-FFh
1 00-9Fh
1 00-03h
1 00-FFh Size of negotiated IFSC
1 00h Only support NAD = 00h
b0=1 for CRC B1 – Convention used (b1=0 for
direct, b1=1 for inverse) Note: The CCID ignores this bit.
Extra guard time (0 to 254etu between two characters). If value is FFh, then guard time is reduced by 1etu.
B7-4 = BWI values 0-9 valid B3-0 = CWI values 0-Fh valid
ICC Clock Stop Support: 00h = Stopping the Clock is not
allowed 01h = Stop with Clock signal Low 02h = Stop with Clock signal High 03h = Stop with Clock either High or
Low
The response to this message is the RDR_to_PC_Parameters message.
Page 18 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 19

8.1.7. PC_to_RDR_Escape

Defines and access extended features.
Offset Field Size Value Description
0
1
5
6
7
10
bMessageType
dwLength
bSlot
bSeq
abRFU
abData
1 6Bh -
4 -
1 00-05h
1 00-FFh Sequence number for command
3 - Reserved for future use
Byte
array
- Data block sent to the CCID
8.1.7.1. LED
Offset Field Size Value Description
10
11
13
15
bcmdCode
wcmdLength
abRFU
abData
1 01h -
2 0001h -
2 - Reserved for future use
00000
1
XYZb
Size of abData field of this message
Identifies the slot number for this command
00000xxx for 3 LED, XYZ: 000 => 3 LEDs off XYZ: 001 => LED1 on, green for 1 Sec XYZ: 010 => LED2 on, red for 1 Sec XYZ: 100 => LED3 on, blue for 1 Sec
The response to this command message is the RDR_to_PC_Escape response message.
8.1.7.2. BUZZER
Offset Field Size Value Description
10
11
13
15
The response to this command message is the RDR_to_PC_Escape response message.
bcmdCode
wcmdLength
abRFU
abData
1 08h -
2 0001h -
2 - Reserved for future use
XX for buzzer on or off,
1 XXh
YZ: 5A = buzzer on for 1 Sec YZ: A5 = buzzer off
Page 19 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 20
8.1.7.3. Get Firmware Version
Offset Field Size Value Description
10
11
13
The response to this command message is the RDR_to_PC_Escape response message.
bcmdCode
wcmdLength
abRFU
1 04h -
2 0000h -
2 - Reserved for future use
Page 20 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 21
8.2. CCID Bulk-IN Messages
The Bulk-IN messages are used in response to the Bulk-OUT messages. ACR33U-A1 shall follow the CCID Bulk-IN Messages as specified in CCID Section 4.
This section lists the CCID Bulk-IN Messages to be supported by ACR33U-A1.
Note: The values of bSlot and bSeq are the same as Bulk-OUT message.

8.2.1. RDR_to_PC_DataBlock

This message is sent by ACR33U-A1 in response to the command message: PC_to_RDR_IccPowerOn and PC_to_RDR_XfrBlock.
Offset Field Size Value Description
0
1
5
6
7
8
9
10
bMessageType
dwLength
bSlot
bSeq
bStatus
bError
bChainParameter
abData
1 80h
4 - Size of extra bytes of this message
1 - Same value as in Bulk-OUT message
1 - Same value as in Bulk-OUT message
1 -
1 -
1 00h RFU (TPDU exchange level)
Byte
array
Indicates that a data block is being sent from the CCID
Slot status register as defined in CCID Section 4.2.1
Slot error register as defined in CCID Section 4.2.1
This field contains the data returned
­by the CCID

8.2.2. RDR_to_PC_SlotStatus

This message is sent by ACR33U-A1 in response to PC_to_RDR_IccPowerOff, PC_to_RDR_GetSlotStatus.
Offset Field Size Value Description
0
bMessageType
1 81 -
1
5
6
7
8
9
dwLength
bSlot
bSeq
bStatus
bError
bClockStatus
4 00000000h Size of extra bytes of this message
1 -
1 -
1 -
1 -
1 -
Same value as in Bulk-OUT message
Same value as in Bulk-OUT message
Slot status register as defined in CCID Section 4.2.1
Slot error register as defined in CCID Section 4.2.1
Value: 00h = Clock running 01h = Clock stopped in state L 02h = Clock stopped in state H 03h = Clock stopped in an unknown state All other values are RFU
Page 21 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 22

8.2.3. RDR_to_PC_Parameters

This message is sent by ACR33U-A1 in response to PC_to_RDR_GetParameters and PC_to_RDR_SetParameters messages.
Offset Field Size Value Description
0
1
5
6
7
8
9
10
bMessageType
dwLength
bSlot
bSeq
bStatus
bError
bProtocolNum
abProtocolDataSt
ructure
1 82h -
4 - Size of extra bytes of this message
1 - Same value as in Bulk-OUT message
1 - Same value as in Bulk-OUT message
1 -
1 -
1 -
Byte
array
Slot status register as defined in CCID Section 4.2.1
Slot error register as defined in CCID Section 4.2.1
Specifies what protocol data structure follows:
00h = Structure for protocol T=0 01h = Structure for protocol T=1 The following values are reserved for
future use. 80h = Structure for 2-wire protocol 81h = Structure for 3-wire protocol 82h = Structure for I2C protocol
Protocol Data Structure as summarized
­in CCID Section 10.1.6
Protocol Data Structure for Protocol T=0 (bProtocolNum=0, dwLength=00000005h)
Offset Field Size Value Description
B7-4 – FI – Index into the Table 7 in ISO/IEC 7816-3:1997 selecting a clock
10
11
12
13
bmFindexDindex
bmTCCKST0
bGuardTimeT0
bWaitingIntegerT0
1 -
1
1 00-FFh
1 00-FFh WI for T=0 used to define WWT
00h,
02h
rate conversion factor B3-0 – DI - Index into the Table 8 in ISO/IEC 7816-3:1997 selecting a baud
rate conversion factor
For T=0, B0 – 0b, B7-2 – 000000b B1 – Convention used (b1=0 for direct,
b1=1 for inverse)
Extra guard time between two characters. Add 0 to 254etu to the normal guard time of 12etu. FFh is the same as 00h.
Page 22 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 23
Offset Field Size Value Description
ICC Clock Stop Support: 00h = Stopping the Clock is not allowed
14
Protocol Data Structure for Protocol T=1 (bProtocolNum=1, dwLength=00000007h)
Offset Field Size Value Description
10
bClockStop
bmFindexDindex
1 00-03h
1
01h = Stop with Clock signal Low 02h = Stop with Clock signal High 03h = Stop with Clock either High or
Low
B7-4 – FI – Index into the Table 7 in ISO/IEC 7816-3:1997 selecting a clock rate conversion factor
B3-0 – DI - Index into the Table 8 in ISO/IEC 7816-3:1997 selecting a baud
rate conversion factor
11
12
13
14
15
16
BmTCCKST1
BGuardTimeT1
BwaitingIntegerT1
bClockStop
bIFSC
bNadValue
10h,
1
1 00-FFh
1 00-9Fh
1 00-03h
1 00-FFh Size of negotiated IFSC
1 00h Only support NAD = 00h
11h, 12h,
13h
For T-1, B7-2 – 000100b B0 – Checksum type (b0=0 for LRC,
b0=1 for CRC B1 – Convention used (b1=0 for direct,
b1=1 for inverse)
Extra guard time (0 to 254etu between two characters). If value is FFh, then guard time is reduced by 1h.
B7-4 = BW I B3-0 = CWI
ICC Clock Stop Support: 00h = Stopping the Clock is not allowed 01h = Stop with Clock signal Low 02h = Stop with Clock signal High 03h = Stop with Clock either High or
Low
Page 23 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 24

8.2.4. RDR_to_PC_Escape

This message is sent by ACR33U-A1 in response to PC_to_RDR_Escape messages.
Offset Field Size Value Description
0
1
5
6
7
8
9
10
bMessageType
dwLength
bSlot
bSeq
bStatus
bError
bRFU
abData
1 83h -
4 -
1 - Same value as in Bulk-OUT message
1 - Same value as in Bulk-OUT message
1 -
1 -
1 00h RFU (TPDU exchange level)
Byte
array
Size of abData field of this message
Slot status register as defined in CCID Section 4.2.1
Slot error register as defined in CCID Section 4.2.1
This field contains the data returned
­by the CCID
8.2.4.1. LED
This message is sent by ACR33U-A1 in response to PC_to_RDR_Escape LED messages.
Offset Field Size Value Description
10
11
bcmdCode
wcmdLength
1 81 -
2 0000 -
XXh for SW2:
13
abStatus
2 00XX
00h: Success 01h: Bad parameter
8.2.4.2. BUZZER
This message is sent by ACR33U-A1 in response to PC_to_RDR_Escape Buzzer messages.
Offset Field Size Value Description
10
11
13
bcmdCode
wcmdLength
abStatus
1 88h -
2 0000h -
XXh:
2 00XXh
00h: Success 01h: Bad parameter
8.2.4.3. Get Firmware Version
This message is sent by ACR33U-A1 in response to PC_to_RDR_Escape Get Firmware Version messages.
Offset Field Size Value Description
Page 24 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 25
Offset Field Size Value Description
10
11
13
15
bcmdCode
wcmdLength
abStatus
abData
1 84h -
2 0004h -
XXh:
2 00XXh
0x41h 0x43h 0x52h 0x33h 0x33h 0x2Dh
13
0x41h 0x31h
0x20h 0xXXh 0xXXh 0xXXh 0xXXh
00h: Success 0h: Bad parameter
XX XX XX XX: Firmware Version
Page 25 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 26
8.3. Memory Card Access via PC_to_RDR_XfrBlock
Memory cards can be accessed via PC_to_RDR_XfrBlock command. All memory card functions are mapped into pseudo-APDUs.

8.3.1. Memory Card – 1, 2, 4, 8, 16 kbit I2C Card

8.3.1.1. SELECT_CARD_TYPE
This command powers down and up the selected card inserted in the card reader and performs a card reset.
Note: This command can only be used after the logical smart card reader communication has been established using the SCardConnect( ) API. For details of SCardConnect( ) API, please refer to PC/SC specifications.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Card Type
FFh A4h 00h 00h 01h 01h
Response data format (abData field in the RDR_to_PC_DataBlock
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
)
8.3.1.2. SELECT_PAGE_SIZE
This command will choose the page size to read the smart card. The default value is 8-byte page write. It will reset to default value whenever the card is removed or the reader is powered down.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Page size
FFh 01h 00h 00h 01h
Where:
Page size = 03h for 8-byte page write
= 04h for 16-byte page write
= 05h for 32-byte page write
= 06h for 64-byte page write
= 07h for 128-byte page write
Page 26 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 27
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.1.3. READ_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS
FFh B0h
Where:
Byte Address: Memory address location of the memory card
MEM_L: Length of data to be read from the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
BYTE 1 … … BYTE N SW1 SW2
Where:
BYTE x: Data read from memory card
SW1, SW2 = 90 00h if no error
Byte Address
MEM_L
MSB LSB
8.3.1.4. WRITE_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS
FFh D0h
Where:
Byte Address: Memory address location of the memory card
MEM_L: Length of data to be written to the memory card
Byte x: Data to be written to the memory card
Byte Address
MEM_L Byte 1 …. .... Byte n
MSB LSB
Page 27 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 28
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
Page 28 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 29

8.3.2. Memory Card – 32, 64, 128, 256, 512, 1024 kbit I2C Card

8.3.2.1. SELECT_CARD_TYPE
This command powers down and up the selected card inserted in the card reader and performs a card reset.
Note: This command can only be used after the logical smart card reader communication has been established using the SCardConnect( ) API. For details of SCardConnect( ) API, please refer to PC/SC specifications.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Card Type
FFh A4h 00h 00h 01h 02h
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.2.2. SELECT_PAGE_SIZE
This command will choose the page size to read the smart card. The default value is 8-byte page write. It will reset to default value whenever the card is removed or the reader is powered off.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Page size
FFh 01h 00h 00h 01h
Where:
Data: TPDU to be sent to the card
Page size = 03h for 8-byte page write
= 04h for 16-byte page write
= 05h for 32-byte page write
= 06h for 64-byte page write
= 07h for 128-byte page write
Page 29 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 30
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.2.3. READ_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS
FFh
Where:
INS = B0h for 32, 64,128, 256, 512 kbit iic card
= 1011 000*b for 1024 kbit iic card, where * is the MSB of the 17 bit addressing
Byte Address: Memory address location of the memory card
MEM_L: Length of data to be read from the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
BYTE 1 … … BYTE N SW1 SW2
Where:
BYTE x: Data read from memory card
SW1, SW2 = 90 00h if no error
Byte Address
MEM_L
MSB LSB
8.3.2.4. WRITE_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS
FFh
Where:
INS = D0h for 32, 64, 128, 256, 512 kbit iic card
Byte Address: Memory address location of the memory card
MEM_L: Length of data to be written to the memory card
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
Byte Address
MEM_L Byte 1 …. .... Byte n
MSB LSB
= 1101 000*b for 1024 kbit iic card, where * is the MSB of the 17 bit addressing
Page 30 of 60
www.acs.com.hk
Page 31
Byte x: Data to be written to the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
Page 31 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 32

8.3.3. Memory Card – ATMEL AT88SC153

8.3.3.1. SELECT_CARD_TYPE
This command powers down and up the selected card inserted in the card reader and performs a card reset. It will also select the page size to be 8-byte page write.
Note: This command can only be used after the logical smart card reader communication has been established using the SCardConnect( ) API. For details of ScardConnect( ) API, please refer to PC/SC specifications.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Card Type
FFh A4h 00h 00h 01h 03h
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.3.2. READ_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 Byte Address MEM_L
FFh 00h
Where:
INS = B0h for reading zone 00b
= B1h for reading zone 01b
= B2h for reading zone 10b
= B3h for reading zone 11b
= B4h for reading fuse
Byte Address: Memory address location of the memory card
MEM_L: Length of data to be read from the memory card
Page 32 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 33
Response data format (abData field in the RDR_to_PC_DataBlock)
BYTE 1 … … BYTE N SW1 SW2
Where:
BYTE x: Data read from memory card
SW1, SW2 = 90 00h if no error
8.3.3.3. WRITE_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 Bye Address MEM_L Byte 1 .... .... Byte n
FFh 00h
Where:
INS = D0h for writing zone 00b
= D1h for writing zone 01b
= D2h for writing zone 10b
= D3h for writing zone 11b
= D4h for writing fuse
Byte Address: Memory address location of the memory card
MEM_L: Length of data to be written to the memory card
MEM_D: Data to be written to the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.3.4. VERIFY_PASSWORD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Pw(0) Pw(1) Pw(2)
FFh 20h 00h 03h
Where:
Pw(0),Pw(1),Pw(2): Passwords to be sent to memory card
Page 33 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 34
P2 = 0000 00rpb
where the two bits “rp” indicate the password to compare
r = 0: Write password,
r = 1: Read password,
p = Password set number,
rp = 01 for the secure code
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1
90h
Where:
SW1 = 90h
SW2 (ErrorCnt) = Error Counter. FFh indicates the verification is correct. 00h indicates the
SW2
ErrorCnt
password is locked (exceeded the maximum number of retries). Other values indicate the current verification has failed.
8.3.3.5. INITIALIZE_AUTHENTICATION
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Q(0) Q(1) … Q(7)
FFh 84h 00h 00h 08h
Where:
Q(0),Q(1)…Q(7): Host random number, 8 bytes
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.3.6. VERIFY_AUTHENTICATION
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Ch(0) Ch(1) … Ch(7)
FFh 82h 00h 00h 08h
Page 34 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 35
Where:
Ch(0),Ch(1)…Ch(7): Host challenge, 8 bytes
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
Page 35 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 36

8.3.4. Memory Card – ATMEL AT88SC1608

8.3.4.1. SELECT_CARD_TYPE
This command powers down and up the selected card inserted in the card reader and performs a card reset. It will also select the page size to be 16-byte page write.
Note: This command can only be used after the logical smart card reader communication has been established using the SCardConnect( ) API. For details of SCardConnect( ) API, please refer to PC/SC specifications.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Card Type
FFh A4h 00h 00h 01h 04h
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.4.2. READ_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS Zone Address Byte Address MEM_L
FFh
Where:
INS = B0h for reading user zone
= B1h for reading configuration zone or reading fuse
Zone Address = 0000 0A
= don’t care for reading fuse
Byte Address = A
MEM_L: Length of data to be read from the memory card
7A6A5A4 A3A2A1A0
= 1000 0000b for reading fuse
b, where A10 is the MSB of zone address
10A9A8
b is the memory address location of the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
BYTE 1 … … BYTE N SW1 SW2
Page 36 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 37
Where:
BYTE x : Data read from memory card
SW1, SW2 = 90 00h if no error
8.3.4.3. WRITE_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS Zone Address Byte Address MEM_L Byte 1 .... .... Byte n
FFh
Where:
INS = D0h for writing user zone
= D1h for writing configuration zone or writing fuse
Zone Address = 0000 0A
b, where A10 is the MSB of zone address
10A9A8
= don’t care for writing fuse
Byte Address = A
= 1000 0000
7A6A5A4 A3A2A1A0
for writing fuse
b
b is the memory address location of the memory card
MEM_L: Length of data to be written to the memory card
Byte x: Data to be written to the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.4.4. VERIFY_PASSWORD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Data
FFh 20h 00h 00h 04h RP Pw(0) Pw(1) Pw(2)
Where:
Pw(0),Pw(1),Pw(2): Passwords to be sent to memory card
RP = 0000 rp
where the four bits “rp
2p1p0
b
” indicate the password to compare:
2p1p0
r = 0: Write password,
r = 1: Read password,
Page 37 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 38
p2p1p0: Password set number
(rp
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1
90h
Where:
SW1 = 90h
SW2 (ErrorCnt) = Error Counter. FFh indicates the verification is correct. 00h indicates the
SW2
ErrorCnt
password is locked (exceeded the maximum number of retries). Other values indicate the current verification has failed.
= 0111 for the secure code)
2p1p0
8.3.4.5. INITIALIZE_AUTHENTICATION
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Q(0) Q(1) … Q(7)
FFh 84h 00h 00h 08h
Where:
Byte Address: Memory address location of the memory card
Q(0),Q(1)…Q(7): Host random number, 8 bytes
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.4.6. VERIFY_AUTHENTICATION
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Q1(0) Q1(1) Q1(7)
FFh 82h 00h 00h 08h
Where:
Byte Address: Memory address location of the memory card
Q1(0),Q1(1)…Q1(7): Host challenge, 8 bytes
Page 38 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 39
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
Page 39 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 40

8.3.5. Memory Card – SLE4418/SLE4428/SLE5518/SLE5528

8.3.5.1. SELECT_CARD_TYPE
This command powers down and up the selected card inserted in the card reader and performs a card reset.
Note: This command can only be used after the logical smart card reader communication has been established using the SCardConnect( ) API. For details of SCardConnect( ) API, please refer to PC/SC specifications.
Command format (abData field in the PC_to_RDR_XfrBlock)
CLA INS P1 P2 Lc Card Type
FFh A4h 00h 00h 01h 05h
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Pseudo-APDU
Where:
SW1, SW2 = 90 00h
if no error
8.3.5.2. READ_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS
FFh B0h
Where:
MSB Byte Address = 0000 00A
LSB Byte Address = A
MEM_L: Length of data to be read from the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
Byte Address
MSB LSB
card
MEM_L
b is the memory address location of the memory card
9A8
7A6A5A4 A3A2A1A0
b is the memory address location of the memory
BYTE 1 … … BYTE N SW1 SW2
Where:
BYTE x : Data read from memory card
SW1, SW2 = 90 00h if no error
Page 40 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 41
8.3.5.3. READ_PRESENTATION_ERROR_COUNTER_MEMORY_CARD (only SLE4428 and SLE5528)
To read the presentation error counter for the secret code.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 MEM_L
FFh B1h 00h 00h 03h
Response data format (abData field in the RDR_to_PC_DataBlock)
ERRCNT DUMMY 1 DUMMY 2 SW1 SW2
Where:
ERRCNT: The value of the presentation error counter. FFh indicates the last verification is
correct. 00h indicates the password is locked (exceeded the maximum number of retries). Other values indicate the last verification has failed.
DUMMY: Two bytes dummy data read from the card.
SW1, SW2 = 90 00h if no error
8.3.5.4. READ_PROTECTION_BIT
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS
FFh B2h
Where:
MSB Byte Address = 0000 00A
LSB Byte Address = A
MEM_L: Length of protection bits to be read from the card, in multiples of 8
For example, to read eight protection bits starting from memory 0x0010h, the following pseudo­APDU should be issued:
Byte Address
MSB LSB
card.
bits. Maximum value is 32
MEM_L = 1 + INT( (number of bits-1)/8 )
MEM_L
b is the memory address location of the memory card.
9A8
7A6A5A4 A3A2A1A0
b is the memory address location of the memory
0xFFh 0xB1h 0x00h 0x10h 0x01h
Response data format (abData field in the RDR_to_PC_DataBlock)
PROT 1 … … PROT L SW1 SW2
Page 41 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 42
Where:
PROT y: Bytes containing the protection bits
SW1,SW2 = 90 00h if no error
The arrangement of the protection bits in the PROT bytes is as follows:
PROT 1 PROT 2 ….
P8 P7 P6 P5 P4 P3 P2 P1 P16 P15 P14 P13 P12 P11 P10 P9 .. .. .. .. .. .. P18 P 17
Where:
Px is the protection bit of BYTE x in the response data
‘0’ byte is write protected
‘1’ byte can be written
8.3.5.5. WRITE_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS
MEM_L Byte 1 .... .... Byte N
MSB LSB
FFh D0h
Where:
Byte Address
MSB Byte Address = 0000 00A
LSB Byte Address = A
7A6A5A4
b is the memory address location of the memory card
9A8
A3A2A1A0b is the memory address location of the memory
card
MEM_L: Length of data to be written to the memory card
Byte x: Data to be written to the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.5.6. WRITE_PROTECTION_MEMORY_CARD
Each of the bytes specified in the command is internally in the card compared with the byte stored at the specified address and if the data match, the corresponding protection bit is irreversibly programmed to ‘0’.
Page 42 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 43
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS
MEM_L Byte 1 .... .... Byte N
MSB LSB
FFh D1h
Where:
Byte Address
MSB Byte Address = 0000 00A
LSB Byte Address = A
7A6A5A4 A3A2A1A0
b is the memory address location of the memory card
9A8
b is the memory address location of the memory
card
MEM_L: Length of data to be written to the memory card
Byte x: Byte values to be compared with the data in the card starting at Byte Address.
BYTE 1 is compared with the data at Byte Address; BYTE N is compared with the data at (Byte Address+N-1).
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.5.7. PRESENT_CODE_MEMORY_CARD (only SLE 4428 and SLE5528)
To submit the secret code to the memory card to enable the write operation with the SLE4428 and SLE5528 card, the following actions are executed:
Search a ‘1’ bit in the presentation error counter and write the bit to ‘0’
Present the specified code to the card
Try to erase the presentation error counter
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 MEM_L
FFh 20h 00h 00h 02h
Where:
CODE: Two bytes secret code (PIN)
CODE
Byte 1 Byte 2
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1
SW2
ErrorCnt
90h
Page 43 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 44
Where:
SW1 = 90h
SW2 (ErrorCnt) = Error Counter. FFh indicates the verification is correct. 00h indicates
the password is locked (exceeded the maximum number of retries). Other values indicate the current verification has failed.
Page 44 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 45

8.3.6. Memory Card – SLE4432/SLE4442/SLE5532/SLE5542

8.3.6.1. SELECT_CARD_TYPE
This command powers down and up the selected card inserted in the card reader and performs a card reset.
Note: This command can only be used after the logical smart card reader communication has been established using the SCardConnect( ) API. For details of SCardConnect( ) API, please refer to PC/SC specifications.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Card Type
FFh A4h 00h 00h 01h 06h
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.6.2. READ_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 Byte Address MEM_L
FFh B0h 00h
Where:
Byte Address = A
MEM_L: Length of data to be read from the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
BYTE 1 … … BYTE N SW1 SW2
7A6A5A4 A3A2A1A0
b is the memory address location of the memory card
Where:
BYTE x: Data read from memory card
SW1, SW2 = 90 00h if no error
Page 45 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 46
8.3.6.3. READ_PRESENTATION_ERROR_COUNTER_MEMORY_CARD (only SLE4442 and SLE5542)
To read the presentation error counter for the secret code.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 MEM_L
FFh B1h 00h 00h 04h
Response data format (abData field in the RDR_to_PC_DataBlock)
ERRCNT DUMMY 1 DUMMY 2 DUMMY 3 SW1 SW2
Where:
ERRCNT: The value of the presentation error counter. 07h indicates the last verification is
correct. 00h indicates the password is locked (exceeded the maximum number of retries). Other values indicate the last verification has failed.
DUMMY: Three bytes dummy data read from the card.
SW1, SW2 = 90 00h if no error
8.3.6.4. READ_PROTECTION_BITS
To read the protection bits for the first 32 bytes.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 MEM_L
FFh B2h 00h 00h 04h
Response data format (abData field in the RDR_to_PC_DataBlock)
PROT 1 PROT 2 PROT3 PROT 4 SW1 SW2
Where:
PROT y: Bytes containing the protection bits from protection memory
SW1, SW2 = 90 00h if no error
The arrangement of the protection bits in the PROT bytes is as follows:
PROT 1 PROT 2
P8 P7 P6 P5 P4 P3 P2 P1 P16 P15 P14 P13 P12 P 11 P10 P9 .. .. .. .. .. .. P18 P17
Page 46 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 47
Where:
Px is the protection bit of BYTE x in the response data
‘0’ byte is write protected
‘1’ byte can be written
8.3.6.5. WRITE_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 Byte Address MEM_L Byte 1 .... .... Byte N
FFh D0h 00h
Where:
Byte Address = A
7A6A5A4 A3A2A1A0
b is the memory address location of the memory card
MEM_L: Length of data to be written to the memory card
Byte x: Data to be written to the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.6.6. WRITE_PROTECTION_MEMORY_CARD
Each of the bytes specified in the command is internally in the card compared with the byte stored at the specified address and if the data match, the corresponding protection bit is irreversibly programmed to ‘0’.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 Byte Address MEM_L Byte 1 .... .... Byte N
FFh D1h 00h
Where:
Byte Address = 000A
A3A2A1A0b (00 to 1F) is the protection memory address location of
4
the memory card
MEM_L: Length of data to be written to the memory card
Byte x: Byte values to be compared with the data in the card starting at Byte
Address. BYTE 1 is compared with the data at Byte Address; BYTE N is compared with the data at (Byte Address+N-1).
Page 47 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 48
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.6.7. PRESENT_CODE_MEMORY_CARD (only SLE 4442 and SLE5542)
To submit the secret code to the memory card to enable the write operation with the SLE4442 and SLE5542 card, the following actions are executed:
Search a ‘1’ bit in the presentation error counter and write the bit to ‘0’
Present the specified code to the card
Try to erase the presentation error counter
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 MEM_L
FFh 20h 00h 00h 03h
Where:
CODE: Three bytes secret code (PIN)
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1
90h
Where:
SW1 = 90h
SW2 (ErrorCnt) = Error Counter. 07h indicates the verification is correct. 00h indicates the
SW2
ErrorCnt
password is locked (exceeded the maximum number of retries). Other values indicate the current verification has failed.
Byte 1 Byte 2 Byte 3
CODE
8.3.6.8. CHANGE_CODE_MEMORY_CARD (only SLE 4442 and SLE5542)
To write the specified data as new secret code in the card.
The current secret code must be presented to the card with the PRESENT_CODE command prior to the execution of this command.
Page 48 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 49
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 MEM_L
Byte 1 Byte 2 Byte 3
FFh D2h 00h 01h 03h
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
CODE
Page 49 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 50

8.3.7. Memory Card – SLE4406/SLE4436/SLE5536/SLE6636

8.3.7.1. SELECT_CARD_TYPE
This command powers down and up the selected card inserted in the card reader and performs a card reset.
Note: This command can only be used after the logical smart card reader communication has been established using the SCardConnect( ) API. For details of SCardConnect( ) API, please refer to PC/SC specifications.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Card Type
FFh A4h 00h 00h 01h 07h
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.7.2. READ_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 Byte Address MEM_L
FFh B0h 00h
Where:
Byte Address = Memory address location of the memory card
MEM_L: Length of data to be read from the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
BYTE 1 … … BYTE N SW1 SW2
Where:
BYTE x: Data read from memory card
SW1, SW2 = 90 00h if no error
Page 50 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 51
8.3.7.3. WRITE_ONE_BYTE_MEMORY_CARD
To write one byte to the specified address of the inserted card. The byte is written to the card with LSB first, i.e., the bit at card address 0 is regarded as the LSB of byte 0.
Four different WRITE modes are available for this card type, which are distinguished by a flag in the command data field:
1. Write
The byte value specified in the command is written to the specified address. This command can be used for writing personalization data and counter values to the card.
2. Write with carry
The byte value specified in the command is written to the specified address and the command is sent to the card to erase the next lower counter stage. This write mode can therefore only be used for updating the counter value in the card.
3. Write with backup enabled (SLE4436, SLE5536 and SLE6636 only)
The byte value specified in the command is written to the specified address. This command can be used for writing personalization data and counter values to the card. Backup bit is enabled to prevent data loss when card tearing occurs.
4. Write with carry and backup enabled (SLE4436, SLE5536 and SLE6636 only)
The byte value specified in the command is written to the specified address and the command is sent to the card to erase the next lower counter stage. This write mode can therefore only be used for updating the counter value in the card. Backup bit is enabled to prevent data loss when card tearing occurs.
With all write modes, the byte at the specified card address is not erased prior to the write operation and hence, memory bits can only be programmed from '1' to '0'.
The backup mode available in the SLE4436 and SLE5536 card can be enabled or disabled in the write operation.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 Byte Address MEM_L MODE BYTE
FFh D0h 00h 02h
Where:
Byte Address = Memory address location of the memory card
MODE: Specifies the write mode and backup option
00h: write
01h: write with carry
02h: write with backup enabled (SLE4436, SLE5536 and SLE6636 only)
03h: write with carry and with backup enabled (SLE4436, SLE5536 and
SLE6636 only)
BYTE: Byte value to be written to the card
Page 51 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 52
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.7.4. PRESENT_CODE_MEMORY_CARD
To submit the secret code to the memory card to enable the card personalization mode, the following actions are executed:
1. Search a '1' bit in the presentation counter and write the bit to '0'.
2. Present the specified code to the card.
The ACR33U-A1 does not try to erase the presentation counter after the code submission. This must be done by the application software through a separate 'Write with carry' command.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 MEM_L
ADDR Byte 1 Byte 2 Byte 3
FFh 20h 00h 00h 04h 09h
Where:
ADDR: Byte address of the presentation counter in the card
CODE: Three bytes secret code (PIN)
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
CODE
8.3.7.5. AUTHENTICATE_MEMORY_CARD (SLE4436, SLE5536 and SLE6636 only)
To read a card authentication certificate from a SLE5536 or SLE6636 card, the following actions are executed by the ACR33U-A1:
1. Select Key 1 or Key 2 in the card as specified in the command.
2. Present the challenge data specified in the command to the card.
3. Generate the specified number of CLK pulses for each bit of authentication data computed by the card.
4. Read 16 bits of authentication data from the card.
5. Reset the card to normal operation mode.
Page 52 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 53
The authentication has to be performed in two steps. The first step is to send the Authentication Certificate to the card. The second step is to get back two bytes of authentication data calculated by the card.
Step 1: Send Authentication Certificate to the Card.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2
FFh 84h 00h 00h 08h
Where:
KEY: Key to be used for the computation of the authentication certificate:
CLK_CNT: Number of CLK pulses to be supplied to the card for the computation of each
BYTE 1...6: Card challenge data
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
61h 02h
Where:
MEM_L CODE
KEY CLK_CNT Byte1 Byte 2 …… Byte 5 Byte 6
00h: key 1 with no cipher block chaining
01h: key 2 with no cipher block chaining
80h: key 1 with cipher block chaining (SLE5536 and SLE6636 only)
81h: key 2 with cipher block chaining (SLE5536 and SLE6636 only)
bit of the authentication certificate. Typical value is 160 clocks (A0h)
SW1, SW2 = 61 02h if no error, meaning two bytes of authentication data are ready. The
authentication data can be retrieved by “Get_Response” command.
Step 2: Get back the Authentication Data (Get_Response).
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 MEM_L
FFh C0h 00h 00h 02h
Response data format (abData field in the RDR_to_PC_DataBlock)
CERT SW1 SW2
Where:
CERT: 16 bits of authentication data computed by the card. The LSB of BYTE 1 is the
first authentication bit read from the card.
SW1, SW2 = 90 00h if no error
Page 53 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 54

8.3.8. Memory Card – AT88SC101 / AT88SC102 / AT88SC1003

8.3.8.1. SELECT_CARD_TYPE
This command powers down and up the selected card inserted in the card reader and performs a card reset.
Note: This command can only be used after the logical smart card reader communication has been established using the SCardConnect( ) API. For details of SCardConnect( ) API, please refer to PC/SC specifications.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Card Type
FFh A4h 00h 00h 01h 09h
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.8.2. READ_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 Byte Address MEM_L
FFh B0h 00h
Where:
Byte Address = Memory address location of the memory card
MEM_L: Length of data to be read from the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
BYTE 1 … … BYTE N SW1 SW2
Where:
BYTE x: Data read from memory card
SW1, SW2 = 90 00h if no error
Page 54 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 55
8.3.8.3. WRITE_MEMORY_CARD
To write data to the specified address of the inserted card. The byte is written to the card with LSB first, e.g., the bit at card address 0 is regarded as the LSB of byte 0.
The byte at the specified card address is not erased prior to the write operation and hence, memory bits can only be programmed from '1' to '0'.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 Byte Address MEM_L Byte 1 .... .... Byte N
FFh D0h 00h
Where:
Byte Address = Memory address location of the memory card
MEM_L: Length of data to be written to the memory card
BYTE: Byte value to be written to the card
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.8.4. ERASE_NON_APPLICATION_ZONE
To erase the data in Non-Application Zones. The EEPROM memory is organized into 16 bit words. Although erases are performed on single bits the ERASE operation clears an entire word in the memory. Therefore, performing an ERASE on any bit in the word will clear ALL 16 bits of that word to the state of ‘1’.
To erase Error Counter or the data in Application Zones, please refer to:
ERASE_APPLICATION_ZONE_WITH_ERASE command as specified in Section 8.3.8.5
ERASE_APPLICATION_ZONE_WITH_WRITE_AND_ERASE command as specified in
Section 8.3.8.6
VERIFY_SECURITY_CODE
commands as specified in Section 8.3.8.7
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 Byte Address MEM_L
FFh D2h 00h 00h
Where:
Byte Address = Memory byte address location of the word to be erased
Page 55 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 56
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.8.5. ERASE_APPLICATION_ZONE_WITH_ERASE
This command can be used in the following cases:
AT88SC101: To erase the data in Application Zone with EC Function Disabled
AT88SC102: To erase the data in Application Zone 1
AT88SC102: To erase the data in Application Zone 2 with EC2 Function Disabled
AT88SC1003: To erase the data in Application Zone 1
AT88SC1003: To erase the data in Application Zone 2 with EC2 Function Disabled
AT88SC1003: To erase the data in Application Zone 3
The following actions are executed for this command:
Present the specified code to the card
Erase the presentation error counter. The data in corresponding Application Zone can be
erased when the submitted code is correct.
Command format (abData field in the PC_to_RDR_XfrBlock
Pseudo-APDU
CLA INS
FFh 20h 00h
Where:
Error Counter LEN: Length of presentation error counter in bits. The value should be
Byte Address: Byte address of the Application Zone Key in the card. Please refer to
AT88SC101: Erase Application Zone with EC function disabled 96h 04h
Error Counter
LEN
0x00h always.
the table below for the correct value.
Byte
Address
Byte Address LEN
MEM_L
)
Byte 1 Byte
2
CODE
……. ……
Byte
N
AT88SC102: Erase Application Zone 1 56h 06h
AT88SC102: Erase Application Zone 2 with EC2 function disabled 9Ch 04h
AT88SC1003: Erase Application Zone 1 36h 06h
AT88SC1003: Erase Application Zone 2 with EC2 function disabled 5Ch 04h
AT88SC1003: Erase Application Zone 3 C0h 06h
Where:
MEM_L: Length of the Erase Key. Please refer to the table below for the
Page 56 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 57
correct value
CODE: N bytes of Erase Key
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
Note: After SW1SW2 = 0x9000h has been received, read back the data in Application Zone can check whether the ERASE_APPLICATION_ZONE_WITH_ERASE is correct. If all data in Application Zone is erased and equals to “0xFFh”, the previous verification is success.
8.3.8.6. ERASE_APPLICATION_ZONE_WITH_WRITE_AND_ERASE
This command can be used in the following cases:
AT88SC101: To erase the data in Application Zone with EC Function Enabled
AT88SC102: To erase the data in Application Zone 2 with EC2 Function Enabled
AT88SC1003: To erase the data in Application Zone 2 with EC2 Function Enabled
With EC or EC2 Function Enabled (that is, ECEN or EC2EN Fuse is undamaged and in “1” state), the following actions are executed:
Present the specified code to the card
Search a '1' bit in the presentation error counter and write the bit to '0'
Erase the presentation error counter. The data in corresponding Application Zone can be
erased when the submitted code is correct.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CODE
CLA INS Error Counter LEN Byte Address MEM_L
FFh 20h 80h 04h
Where:
Error Counter LEN: Length of presentation error counter in bits. The value should be
0x80h always.
Byte Address: Byte address of the Application Zone Key in the card.
Byte 1 Byte 2 Byte 3 Byte 4
Byte Address
AT88SC101 96h
AT88SC102 9Ch
AT88SC1003 5Ch
CODE: 4 bytes Erase Key
Page 57 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 58
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
= 63 00h if there is no more retry chance
Note: After SW1SW2 = 0x9000h has been received, read back the data in Application Zone can check whether the ERASE_APPLICATION_ZONE_WITH_ERASE is correct. If all data in Application Zone is erased and equals to “0xFFh,” the previous verification is success.
8.3.8.7. VERIFY_SECURITY_CODE
To submit Security Code (2 bytes) to the inserted card. Security Code is to enable the memory access of the card.
The following actions are executed:
Present the specified code to the card
Search a '1' bit in the presentation error counter and write the bit to '0'
Erase the presentation error counter. The Security Code Attempts Counter can be erased
when the submitted code is correct.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS Error Counter LEN Byte Address MEM_L
FFh 20h 08h 0Ah 02h
Where:
Error Counter LEN: Length of presentation error counter in bits
Byte Address: Byte address of the key in the card
CODE: 2 bytes Security Code
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
CODE
Byte 1 Byte 2
Where”
SW1, SW2 = 90 00h if no error
= 63 00h if there is no more retry chance
Note: After SW1SW2 = 0x9000h has been received, read back the Security Code Attempts Counter (SCAC) can check whether the VERIFY_USER_CODE is correct. If SCAC is erased and equals to “0xFFh,” the previous verification is success.
Page 58 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 59
8.3.8.8. BLOWN_FUSE
To blow the fuse of the inserted card. The fuse can be EC_EN Fuse, EC2EN Fuse, Issuer Fuse or Manufacturer’s Fuse.
Note: Blowing of the Fuse is an irreversible process.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
Addr
(Low)
CODE
State of
FUS
Pin
State of RST
Pin
Error
CLA INS
FFh 05h 00h 00h 04h 01h 00h or 01h
Where:
Fuse Bit Addr (2 bytes): Bit address of the fuse. Please refer to the table below for the
State of FUS Pin: State of the FUS pin. Should always be 0x01h.
State of RST Pin: State of the RST pin. Please refer to below table for the correct
AT88SC101
AT88SC102
Counter
LEN
Byte
Address
Manufacturer
Fuse
EC_EN Fuse 05h C9h 01h
Issuer Fuse 05h E0h 01h
Manufacturer
Fuse
EC2EN Fuse 05h F9h 01h
MEM_L
correct value.
value.
Fuse Bit Addr
Fuse Bit
Addr
(High)
(High)
05h 80h 01h
05h B0h 01h
Fuse Bit
Fuse Bit Addr
(Low)
State of
RST Pin
Issuer Fuse 06h 10h 01h
Manufacturer
Fuse
AT88SC1003
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
EC2EN Fuse 03h FCh 00h
Issuer Fuse 03h E0h 00h
03h F8h 00h
Page 59 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 60

Appendix A. CCID Response Error Codes

The following table summarizes the possible error code returned by the ACR33U-A1:
Error Code Status
FFh SLOTERROR_CMD_ABORTED
FEh SLOTERROR_ICC_MUTE
FDh SLOTERROR_XFR_PARITY_ERROR
FCh SLOTERROR_XFR_OVERRUN
FBh SLOTERROR_HW_ERROR
F8h SLOTERROR_BAD_ATR_TS
F7h SLOTERROR_BAD_ATR_TCK
F6h SLOTERROR_ICC_PROTOCOL_NOT_SUPPORTED
F5h SLOTERROR_ICC_CLASS_NOT_SUPPORTED
F4h SLOTERROR_PROCEDURE_BYTE_CONFLICE
F3h SLOTERROR_DEACTIVATED_PROTOCOL
F2h SLOTERROR_BUSY_WITH_AUTO_SEQUENCE
E0h SLOTERROR_CMD_SLOT_BUSY
Table 3: CCID Response Error Codes
Page 60 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Loading...