ACR38 Reference Manual
Version 1.9 02-2006
Unit 1008, 10th Floor, Hongkong International Trade and Exhibition Centre
1 Trademart Drive, Kowloon Bay, Hong Kong
Tel: +852 2796 7873 Fax: +852 2796 1286 Email: [email protected] Website: www.acs.com.hk
ACR38 Reference Manual
version 1.9 February 2006
Contents
1.
2.
3.
Introduction.............................................................................................................................. 4
Features.................................................................................................................................... 4
Supported card types.............................................................................................................. 5
3.1
3.2
4.
Smart Card Interface ............................................................................................................... 6
4.1
4.2
4.3
4.4
4.5
5.
Communication Parameters ............................................................................................................... 8
Endpoints ............................................................................................................................................ 8
Communication protocol ........................................................................................................ 9
7.1
7.2
7.3
8.
Status LED.......................................................................................................................................... 7
USB Interface ........................................................................................................................... 8
6.1
6.2
7.
Smart Card Power Supply VCC (C1) ................................................................................................. 6
Programming Voltage VPP (C6)......................................................................................................... 6
Card Type Selection ........................................................................................................................... 6
Interface for Microcontroller-based Cards .......................................................................................... 6
Card Tearing Protection...................................................................................................................... 6
Power Supply........................................................................................................................... 7
5.1
6.
Microcontroller-based smart cards (asynchronous interface) ............................................................ 5
Memory-based smart cards (synchronous interface) ......................................................................... 5
Command to ACR38........................................................................................................................... 9
Response from ACR38....................................................................................................................... 9
Card Status Message ....................................................................................................................... 10
Commands ............................................................................................................................. 11
8.1
Control Commands........................................................................................................................... 11
8.1.1
GET_ACR_STAT ...................................................................................................................... 11
8.1.2
SELECT_CARD_TYPE............................................................................................................. 12
8.1.3
SET_OPTION............................................................................................................................ 12
8.1.4
SET_CARD_PPS ...................................................................................................................... 12
8.1.5
SET_READER_PPS ................................................................................................................. 13
8.2
Card Commands............................................................................................................................... 14
8.2.1
MCU-based Card....................................................................................................................... 14
8.2.1.1 RESET_WITH_5_VOLTS_DEFAULT .................................................................................. 14
8.2.1.2 RESET_WITH_SPECIFIC_VOLTAGE ................................................................................. 14
8.2.1.3 POWER_OFF ....................................................................................................................... 15
8.2.1.4 EXCHANGE_TPDU_T0........................................................................................................ 15
8.2.1.5 EXCHANGE_TPDU_T1........................................................................................................ 16
8.2.2
Memory Card – 1,2,4,8,16 kbit I2C card ................................................................................... 16
8.2.2.1 SELECT_CARD_TYPE ........................................................................................................ 16
8.2.2.2 SELECT_PAGE_SIZE .......................................................................................................... 17
8.2.2.3 READ_MEMORY_CARD...................................................................................................... 17
8.2.2.4 WRITE_MEMORY_CARD .................................................................................................... 18
8.2.3
Memory Card – 32,64,128,256,512,1024 kbit I2C card ............................................................ 19
8.2.3.1 SELECT_CARD_TYPE ........................................................................................................ 19
8.2.3.2 SELECT_PAGE_SIZE .......................................................................................................... 19
8.2.3.3 READ_MEMORY_CARD...................................................................................................... 20
8.2.3.4 WRITE_MEMORY_CARD .................................................................................................... 20
8.2.4
Memory Card – ATMEL AT88SC153 ........................................................................................ 21
8.2.4.1 SELECT_CARD_TYPE ........................................................................................................ 21
8.2.4.2 READ_MEMORY_CARD...................................................................................................... 21
8.2.4.3 WRITE_MEMORY_CARD .................................................................................................... 22
8.2.4.4 VERIFTY_PASSWORD........................................................................................................ 22
 Advanced Card Systems Ltd.
Page 2 of 43
ACR38 Reference Manual
version 1.9 February 2006
8.2.4.5 INITIALIZE_AUTHENTICATION........................................................................................... 23
8.2.4.6 VERIFY_AUTHENTICATION ............................................................................................... 23
8.2.5
Memory Card – ATMEL AT88SC1608 ...................................................................................... 24
8.2.5.1 SELECT_CARD_TYPE ........................................................................................................ 24
8.2.5.2 READ_MEMORY_CARD...................................................................................................... 24
8.2.5.3 WRITE_MEMORY_CARD .................................................................................................... 25
8.2.5.4 VERIFTY_PASSWORD........................................................................................................ 25
8.2.5.5 INITIALIZE_AUTHENTICATION........................................................................................... 26
8.2.5.6 VERIFY_AUTHENTICATION ............................................................................................... 26
8.2.6
Memory Card – SLE4418/4428................................................................................................. 27
8.2.6.1 SELECT_CARD_TYPE ........................................................................................................ 27
8.2.6.2 READ_MEMORY_WITH_PROTECT_BIT_CARD ............................................................... 27
8.2.6.3 READ_MEMORY_WITHOUT_PROTECT_BIT_CARD........................................................ 28
8.2.6.4 WRITE_MEMORY_CARD .................................................................................................... 29
8.2.6.5 WRITE_PROTECTION_MEMORY_CARD .......................................................................... 29
8.2.6.6 PRESENT_CODE_MEMORY_CARD (only SLE 4428) ....................................................... 30
8.2.6.7 READ_PRESENTATION_ERROR_COUNTER_MEMORY_CARD (only SLE 4428) ......... 30
8.2.7
Memory Card – SLE4432/4442................................................................................................. 32
8.2.7.1 SELECT_CARD_TYPE ........................................................................................................ 32
8.2.7.2 READ_MEMORY_CARD...................................................................................................... 32
8.2.7.3 WRITE_MEMORY_CARD .................................................................................................... 33
8.2.7.4 WRITE_PROTECTION_MEMORY_CARD .......................................................................... 33
8.2.7.5 PRESENT_CODE_MEMORY_CARD (only SLE 4442) ....................................................... 34
8.2.7.6 READ_PRESENTATION_ERROR_COUNTER_MEMORY_CARD (only SLE 4442) ......... 35
8.2.7.7 CHANGE_CODE_MEMORY_CARD (only SLE 4442)......................................................... 35
8.2.8
Memory Card – SLE4406/4436/5536........................................................................................ 37
8.2.8.1 SELECT_CARD_TYPE ........................................................................................................ 37
8.2.8.2 READ_MEMORY_CARD...................................................................................................... 37
8.2.8.3 WRITE_ONE_BYTE_MEMORY_CARD............................................................................... 38
8.2.8.4 PRESENT_CODE_MEMORY_CARD .................................................................................. 39
8.2.8.5 AUTHENTICATE_MEMORY_CARD (SLE4436 and SLE5536 only) ................................... 40
Appendix A: Supported Card Types .......................................................................................... 41
Appendix B: Response Status Codes ....................................................................................... 42
Appendix C: Technical Specifications....................................................................................... 43
 Advanced Card Systems Ltd.
Page 3 of 43
ACR38 Reference Manual
version 1.9 February 2006
1. Introduction
The ACS Smart Card Reader/Writer ACR38 is an interface for the communication between a computer (for
example, a PC) and a smart card. Different types of smart cards have different commands and different
communication protocols. This prevents in most cases the direct communication between a smart card and
a computer. The ACR38 Reader/Writer establishes a uniform interface from the computer to the smart card
for a wide variety of cards. By taking care of the card specific particulars, it releases the computer software
programmer of getting involved with the technical details of the smart card operation, which are in many
cases not relevant for the implementation of a smart card system.
The ACR38 Smart Card Reader/Writer is connected to the computer through USB interface. The reader
accepts commands from the computer, carries out the specified function at the smart card and returns the
requested data or status information.
NOTE - Although the ACR38 is a true card reader/writer as it can read and write smart cards, the terms card reader or reader will be
used indifferently to refer to the ACR38, for the sake of readability and because these designations are commonly in use for this kind of
devices.
2. Features
•
Support ISO-7816 Class A, B and C (5V, 3V, 1.8V) cards
•
Supports CPU-based cards with T=0 and/or T=1 protocol
•
Supports PPS (Protocol and Parameters Selection) with 1,743 – 250,000 bps in reading and writing
smart cards
•
Full speed USB 2.0 interface (12 Mbps) to PC with simple command structure
•
Supports the most common memory-based smart cards
 Advanced Card Systems Ltd.
Page 4 of 43
ACR38 Reference Manual
version 1.9 February 2006
3. Supported card types
The ACR38 can operate MCU cards with T=0 and T=1 protocol in its main card slot.
3.1
Microcontroller-based smart cards (asynchronous interface)
The ACR38 supports EEPROM microcontroller-based cards with internal programming voltage (VPP)
generation and the following programming parameters transmitted in the ATR:
PI1= 0 or 5
I = 25 or 50
The ACR38 performs the Protocol and Parameters Selection (PPS) procedure as specified in ISO7816-3:
1997.
When the card ATR indicates the specific operation mode (TA2 present; bit b5 of TA2 must be 0) and that
particular mode is not supported by the ACR38, the reader will reset the card to set it to negotiable mode. If
the card cannot be set to negotiable mode, the reader will reject the card.
When the card ATR indicates the negotiable mode (TA2 not present) and communication parameters other
than the default parameters, the ACR38 will execute the PPS and try to use the communication parameters
that the card suggested in its ATR. If the card does not accept the PPS, the reader will use the default
parameters (F=372, D=1).
For the meaning of the aforementioned parameters, please refer to ISO7816, part 3.
3.2
•
Memory-based smart cards (synchronous interface)
Cards following the I2Cbus protocol (free memory cards) with maximum 128 bytes page with capability,
including:
Atmel AT24C01/02/04/08/16/32/64/128/256/512/1024
•
Cards with secure memory IC with password and authentication, including:
Atmel AT88SC153, AT88SC1608
•
Cards with intelligent 1k bytes EEPROM with write-protect function, including:
Infineon SLE4418, SLE4428
•
Cards with intelligent 256 bytes EEPROM with write-protect function, including:
Infineon SLE4432, SLE4442
•
Cards with ‘104’ type EEPROM non-reloadable token counter cards, including:
Infineon SLE4406, SLE4436 and SLE5536 (support from firmware 1.10 onwards)
 Advanced Card Systems Ltd.
Page 5 of 43
ACR38 Reference Manual
version 1.9 February 2006
4. Smart Card Interface
The interface between the ACR38 and the inserted smart card follows the specifications of ISO7816-3 with
certain restrictions or enhancements to increase the practical functionality of the ACR38.
4.1
Smart Card Power Supply VCC (C1)
The current consumption of the inserted card must not be higher than 50 mA.
4.2
Programming Voltage VPP (C6)
According to ISO 7816-3, the smart card contact C6 (VPP) supplies the programming voltage to the smart
card. Since all common smart cards in the market are EEPROM based and do not require the provision of
an external programming voltage, the contact C6 (VPP) has been implemented as a normal control signal in
the ACR38. The electrical specifications of this contact are identical to those of the signal RST (at contact
C2).
4.3
Card Type Selection
The controlling PC always has to select the card type through the proper command sent to the ACR38 prior
to activating the inserted card. This includes both the memory cards and MCU-based cards.
For MCU-based cards, the reader allows to select the preferred protocol, T=0 or T=1. However, this
selection is only accepted and carried out by the reader through the PPS when the card inserted in the
reader supports both protocol types. Whenever an MCU-based card supports only one protocol type, T=0 or
T=1, the reader automatically uses that protocol type, regardless of the protocol type selected by the
application.
4.4
Interface for Microcontroller-based Cards
For microcontroller-based smart cards only the contacts C1 (VCC), C2 (RST), C3 (CLK), C5 (GND) and C7
(I/O) are used. A frequency of 4 MHz is applied to the CLK signal (C3).
4.5
Card Tearing Protection
The ACR38 provides a mechanism to protect the inserted card when it is suddenly withdrawn while it is
powered up. The power supply to the card and the signal lines between the ACR38 and the card are
immediately deactivated when the card is being removed. As a general rule, however, to avoid any electrical
damage, a card should only be removed from the reader while it is powered down.
NOTE - The ACR38 does never by itself switch on the power supply to the inserted card. This must explicitly be done by the
controlling computer through the proper command sent to the reader.
 Advanced Card Systems Ltd.
Page 6 of 43
ACR38 Reference Manual
version 1.9 February 2006
5. Power Supply
The ACR38 requires a voltage of 5V DC, 100mA regulated power supply. The ACR38 gets the power supply
from the PC (through the cable supplied along with each type of reader).
5.1
Status LED
Green LED on the front of the reader indicates the activation status of the smart card interface:
Flashing slowly (turns on 200ms for every 2 seconds)
Indicates that the ACR38 is powered up and is in the standby state. Either the smart card has not been
inserted or the smart card has not been powered up (if it is inserted).
Lighting up
Indicates power supply to the smart card is switched on, i.e., the smart card is activated.
Flashing quickly
Indicates that there is communication between the ACR38 and the smart card.
 Advanced Card Systems Ltd.
Page 7 of 43
ACR38 Reference Manual
version 1.9 February 2006
6. USB Interface
The ACR38 is connected to a computer through a USB following the USB standard.
6.1
Communication Parameters
The ACR38 is connected to a computer through USB as specified in the USB Specification 2.0. The ACR38
is working in full speed mode, i.e. 12 Mbps.
USB Interface Wiring
Pin
Signal
Function
1
VBUS
+5V power supply for the reader
2
D-
Differential signal transmits data between ACR30 and PC.
3
D+
Differential signal transmits data between ACR30 and PC.
4
GND
Reference voltage level for power supply
NOTE - In order for the ACR38 to function properly through USB interface, either ACS proprietary device driver or ACS PC/SC
device driver has to be installed. Please refer to the Device Driver Installation Guide for more detail.
6.2
Endpoints
The ACR38 uses the following endpoints to communicate with the host computer:
Control Endpoint
For setup and control purpose
Bulk OUT
For command sent from host to ACR38 (data packet size is 64 bytes)
Bulk IN
For response sent from ACR38 to host (data packet size is 64 bytes)
Interrupt IN
For card status message sent from ACR38 to host (data packet size is 8 bytes)
 Advanced Card Systems Ltd.
Page 8 of 43
ACR38 Reference Manual
version 1.9 February 2006
7. Communication protocol
In the normal operation, the ACR38 acts as a slave device with regards to the communication between a
computer and the reader. The communication is carried out in the form of successive command-response
exchanges. The computer transmits a command to the reader and receives a response from the reader after
the command has been executed. A new command can be transmitted to the ACR38 only after the
response to the previous command has been received.
There are two cases where the reader transmits data without having received a command from the
computer, namely, the Reset Message of the reader and the Card Status Message.
7.1
Command to ACR38
A command consists of six protocol bytes and a variable number of data bytes and has the following
structure:
Byte
1
2
Header
Instruction
01H
3
4
Data Length = N
5 ... N+4 (N>0)
Data
Data Length N
Header
Always 01H to indicate the start of a command.
Instruction
The instruction code of the command to be carried out by the ACR38.
Data Length
Number of subsequent data bytes, and is encoded in 2 bytes. The first byte (MSB) and
second byte (LSB) represent data length N.
Data
Data contents of the command.
For a READ command, for example, the data bytes would specify the start address and the
number of bytes to be read. For a WRITE command, the data bytes would specify the start
address and the data to be written to the card.
The data bytes can represent values to be written to a card and/or command parameters
such as an address, a counter, etc.
Note: Commands are sent from host computer to ACR38 through the BULK OUT endpoint.
7.2
Response from ACR38
The response from the ACR38 to any command depends on whether the command has been received by
the reader without error (e.g., checksum error).
The response by the ACR38 to a correctly received command consists of three protocol bytes, two status
bytes and a variable number of data bytes and has the following structure:
Byte
1
2
Header
Status
01H
Header
3
4
Data Length = N
5 ... N+4 (N>0)
Data
Data Length N
Always 01H to indicate the start of the response.
 Advanced Card Systems Ltd.
Page 9 of 43
ACR38 Reference Manual
Status
version 1.9 February 2006
Indicates the command execution status:
00 H
= command successfully executed
Otherwise = error in command data, or command cannot be executed
A table listing the possible values of the status byte and the corresponding meaning is given
in Appendix B.
Data Length
Number of subsequent data bytes, and is encoded in 2 bytes. The first byte (MSB) and
second byte (LSB) represent data length N.
Data
Data contents of the command.
For a READ_DATA command, for example, the data bytes would contain the contents of the
memory addresses read from the card. The data bytes can represent values read from the
card and/or status information.
Note: Responses are sent from ACR38 to the host computer through BULK IN endpoint.
7.3
Card Status Message
When a card is being inserted into the reader or an inserted card is being removed from the reader while the
reader is idle, i.e., not executing a command, the reader transmits a Card Status Message to notify the host
computer of the change in the card insertion status.
The Card Status Messages have the following structure and contents:
Card Status Message for Card Insertion
Byte
1
2
Header
Status
01 H
C1 H
3
4
Data Length
00 H
00 H
3
4
Card Status Message for Card Removal
Byte
1
2
Header
Status
01 H
C0 H
Data Length
00 H
00 H
A card status message is transmitted only once for every card insertion or removal event. The reader does
not expect an acknowledge signal from the computer. After transmitting a status message, the reader waits
for the next command from the computer.
Note: Card status messages are sent from ACR38 to the host computer through INTERRUPT IN endpoint.
 Advanced Card Systems Ltd.
Page 10 of 43
ACR38 Reference Manual
version 1.9 February 2006
8. Commands
The commands executed by the ACR38 can generally be divided into two categories, namely, Control
Commands and Card Commands.
Control Commands control the internal operation of the ACR38. They do not directly affect the card inserted
in the reader and are therefore independent of the selected card type.
Card Commands are directed toward the card inserted in the ACR38. The structure of these commands and
the data transmitted in the commands and responses depend on the selected card type.
8.1
Control Commands
8.1.1 GET_ACR_STAT
This command returns relevant information about the particular ACR38 model and the current operating
status, such as, the firmware revision number, the maximum data length of a command and response, the
supported card types, and whether a card is inserted and powered up.
Command format
Header
Instruction
01 H
01 H
Data length
00 H
00 H
Response data format
Header
Status
Data length
INTERNAL
MAX_C
MAX_R
C_TYPE
C_SEL
C_STAT
LEN
01 H
INTERNAL
10 bytes data for internal use only
MAX_C
The maximum number of command data bytes.
MAX_R
The maximum number of data bytes that can be requested to be transmitted in a response.
C_TYPE
The card types supported by the ACR38. This data field is a bitmap with each bit
representing a particular card type. A bit set to '1' means the corresponding card type is
supported by the reader and can be selected with the SELECT_CARD_TYPE command.
The bit assignment is as follows:
Byte
card type
1
15
14
13
12
2
11
10
9
8
7
6
5
4
3
2
1
0
See Appendix A for the correspondence between these bits and the respective card types.
C_SEL
The currently selected card type as specified in a previous SELECT_CARD_TYPE command.
A value of 00H means that no card type has been selected.
C_STAT
Indicates whether a card is physically inserted in the reader and whether the card is powered
up:
00H: no card inserted
01H: card inserted, not powered up
03H: card powered up
 Advanced Card Systems Ltd.
Page 11 of 43
ACR38 Reference Manual
version 1.9 February 2006
8.1.2 SELECT_CARD_TYPE
This command sets the required card type. The firmware in the ACR38 adjusts the communication protocol
between reader and the inserted card according to the selected card type.
Command format
TYPE
Header
Instruction
01 H
02 H
Data length
Data
LEN
TYPE
00 H
01 H
See Appendix A for the value to be specified in this command for a particular card to be used.
Response data format
Header
Status
Data length
LEN
01 H
8.1.3 SET_OPTION
This command selects the options for the reader.
Command format
Header
01 H
Option
Instruction
07 H
Data length
Data
LEN
Option
00 H
01 H
Bit 4 : Select for EMV mode
Specifies whether the reader is in EMV mode
0 : reader not in EMV mode (default)
1 : reader in EMV mode
Bit 5 : Select for memory card mode
Specifies whether the reader is in memory card mode
0 : reader not in memory card mode (default)
1 : reader in memory card mode
Bit 0, 1, 2, 3, 6 and 7
Reserved
Response data format
Header
Status
Data length
LEN
01 H
8.1.4 SET_CARD_PPS
This command sends PPS Request to the smart card. This command should work in pair with
SET_READER_PPS.
 Advanced Card Systems Ltd.
Page 12 of 43
ACR38 Reference Manual
version 1.9 February 2006
Command format
Header
01 H
LEN
Instruction
0A H
Data length
Data
LEN
PPS
Request
MSB
LSB
Length of PPS request. Typical value is “4”
PPS Request PPS Request to send to the card (Please refer to ISO/IEC 7816-3:1997 Section 7 for
details of PPS request)
A typical PPS request to select T=1 protocol and FD=0x94 (62500 baud at 4MHz) is: 0xFF
0x11 0x94 0x7A
Response data format
Header
Status
Data length
Data
LEN
01 H
…
8.1.5 SET_READER_PPS
This command sends PPS Response to the reader, and asks the reader to switch its protocol and/or speed
to communication with the smart card. This command should work in pair with SET_CARD_PPS.
Command format
Header
01 H
LEN
Instruction
0B H
Data length
Data
LEN
PPS
Response
MSB
LSB
Length of PPS response. Typical value is “4”.
PPS Response PPS Response received from the card (Please refer to ISO/IEC 7816-3:1997 Section 7 for
details of PPS response). After the driver or the application validates the PPS Response, it
should send the PPS Response to the reader. The reader can then switch the protocol
and/or speed.
A typical PPS response should be the same as PPS Request.
Response data format
Header
Status
Data length
LEN
01 H
 Advanced Card Systems Ltd.
Page 13 of 43
ACR38 Reference Manual
8.2
version 1.9 February 2006
Card Commands
The available commands and the parameters specified in the card commands as well as the data
transmitted in the response from the ACR38 depend on the selected card type.
8.2.1 MCU-based Card
8.2.1.1
RESET_WITH_5_VOLTS_DEFAULT
This command powers up the card inserted in the card reader and performs a card reset. If the card is
powered up when the command is being issued, only a reset of the card is carried out. The power supply to
the card is not switched off.
Command format
Header
Instruction
Data length
LEN
01 H
80 H
00 H
00 H
Response data format
Header
Status
Data length
ATR
LEN
01 H
ATR
………
Answer-To-Reset as transmitted by the card according to ISO7816-3.
NOTE - The ATR is only returned in the ACR38 response if the communication protocol of the card is
compatible with the reader, i.e., if the card can be processed by the ACR38. Otherwise, the ACR38 returns
an error status and deactivates the smart card interface.
8.2.1.2
RESET_WITH_SPECIFIC_VOLTAGE
This command powers up the card inserted in the card reader and performs a card reset. If the card is
powered up when the command is being issued, only a reset of the card is carried out. The power supply to
the card is not switched off.
Command format
Header
Instruction
Data length
Data
LEN
01 H
Data
80 H
00 H
01 H
= 00 H for automatic voltage detection
= 01 H for 5-volt card
= 02 H for 3-volt card
= 03 H for 1.8-volt card
 Advanced Card Systems Ltd.
Page 14 of 43
ACR38 Reference Manual
version 1.9 February 2006
Response data format
Header
Status
Data length
ATR
LEN
01 H
ATR
………
Answer-To-Reset as transmitted by the card according to ISO7816-3.
NOTE - The ATR is only returned in the ACR38 response if the communication protocol of the card is
compatible with the reader, i.e., if the card can be processed by the ACR38. Otherwise, the ACR38 returns
an error status and deactivates the smart card interface.
8.2.1.3
POWER_OFF
This command powers off the card inserted in the card reader.
Command format
Header
Instruction
01 H
81 H
Data length
LEN
00 H
00 H
Response data format
Header
Status
Data length
LEN
01 H
8.2.1.4
EXCHANGE_TPDU_T0
To exchange an APDU (Application Protocol Data Unit) command/response pair between the MCU card
inserted in the ACR38 and the host computer.
Command format
Header
Instruction
Data length LEN
MSB
01 H
A0 H
LEN
Length of APDU command data, N
Data
T0 TPDU to be sent to the card
LSB
Data
T0 TPDU
………
Case 1: CLA INS P1 P2
Case 2: CLA INS P1 P2 Le
Case 3: CLA INS P1 P2 Lc Data
Case 4: Not supported. The driver/application should break case 4 command into case 3 +
case 2 commands.
 Advanced Card Systems Ltd.
Page 15 of 43
ACR38 Reference Manual
version 1.9 February 2006
Response data format
Header
Status
Data length
BYTE 1
…
…
BYTE N
SW1
SW2
LEN
01 H
BYTE x
Response data from card (if any).
SW1, SW2 Status code returned by the card.
8.2.1.5
EXCHANGE_TPDU_T1
To exchange an APDU (Application Protocol Data Unit) command/response pair between the MCU card
inserted in the ACR38 and the host computer using T1 protocol.
Command format
Header
01 H
Instruction
A1 H
Data length LEN
Data
MSB
LSB
T1 TPDU Frame
MSB
LSB
………
LEN
Length of APDU command data, N
Data
T1 TPDU frame to be sent to the card. It should include NAD, PCB, LEN, INF and EDC fields.
Please refer to ISO/IEC 7816:3:1997(E) Section 9.4 for detailed information.
Response data format
Header
Status
Data length
BYTE 1
…
…
BYTE N
LEN
01 H
BYTE x
Response T1 Block from card (if any). The response should include NAD, PCB, LEN, INF and
EDC fields. Please refer to ISO/IEC 7816:3:1997(E) Section 9.4 for detailed information.
8.2.2
8.2.2.1
Memory Card – 1,2,4,8,16 kbit I2C card
SELECT_CARD_TYPE
This command powers down and up the selected card inserted in the card reader and performs a card reset.
Notes: This command must be the first command after card insertion!
 Advanced Card Systems Ltd.
Page 16 of 43
ACR38 Reference Manual
version 1.9 February 2006
Command format
Header
Instruction
Data length
Data
LEN
01 H
A0 H
00 H
06 H
CLA
INS
P1
P2
Lc
Card Type
FF H
A4 H
00 H
00 H
01 H
01 H
Response data format
Header
Status
Data length
BYTE 1
…
…
BYTE N
SW1
SW2
LEN
01 H
BYTE x
ATR from card (if any)
SW1, SW2 = 90 H 00 H if no error
8.2.2.2
SELECT_PAGE_SIZE
This command will choose the page size to read the smart card. The default value is 8-byte page write. It will
reset to default value whenever the card is removed or the reader is powered off.
Command format
Header
Instruction
Data length
Data
LEN
01 H
Page size
A0 H
00 H
06 H
CLA
INS
P1
P2
Lc
FF H
01 H
00 H
00 H
01 H
Page size
= 03 H for 8-byte page write
= 04 H for 16-byte page write
= 05 H for 32-byte page write
= 06 H for 64-byte page write
= 07 H for 128-byte page write
Response data format
Header
Status
Data length
SW1
SW2
LEN
01 H
SW1, SW2 = 90 H 00 H if no error
8.2.2.3
READ_MEMORY_CARD
Command format
Header
Instruction
Data length
LEN
Data
CLA
INS
Byte Address
MSB
01 H
 Advanced Card Systems Ltd.
A0 H
00 H
05 H
FF H
MEM_L
LSB
B0 H
Page 17 of 43
ACR38 Reference Manual
version 1.9 February 2006
Byte Address Memory address location of the memory card.
MEM_L
Length of data to be read from the memory card.
Response data format
Header
Status
Data length
BYTE 1
…
…
BYTE N
SW1
SW2
LEN
01 H
BYTE x
Data read from memory card
SW1, SW2 = 90 H 00 H if no error
8.2.2.4
WRITE_MEMORY_CARD
Command format
Header
Instruction
Data length
Data
LEN
MSB
01 H
CLA
INS
LSB
A0 H
Byte Address
MSB
FF H
MEM_L
Byte 1
....
....
Byte n
LSB
D0 H
Byte Address Memory address location of the memory card.
LEN
= 5 + MEM_L
MEM_L
Length of data to be written to the memory card.
Byte x
Data to be written to the memory card.
Response data format
Header
Status
Data length
SW1
SW2
LEN
01 H
SW1, SW2 = 90 H 00 H if no error
 Advanced Card Systems Ltd.
Page 18 of 43
ACR38 Reference Manual
8.2.3
8.2.3.1
version 1.9 February 2006
Memory Card – 32,64,128,256,512,1024 kbit I2C card
SELECT_CARD_TYPE
This command powers down and up the selected card inserted in the card reader and performs a card reset.
Notes: This command must be the first command after card insertion!
Command format
Header
Instruction
Data length
Data
LEN
01 H
A0 H
00 H
06 H
CLA
INS
P1
P2
Lc
Card Type
FF H
A4 H
00 H
00 H
01 H
02 H
Response data format
Header
Status
Data length
BYTE 1
…
…
BYTE N
SW1
SW2
LEN
01 H
BYTE x
ATR from card (if any)
SW1, SW2 = 90 H 00 H if no error
8.2.3.2
SELECT_PAGE_SIZE
This command will choose the page size to read the smart card. The default value is 8-byte page write. It will
reset to default value whenever the card is removed or the reader is powered off.
Command format
Header
Instruction
Data length
LEN
01 H
A0 H
00 H
Data
TPDU to be sent to the card
Page size
= 03 H for 8-byte page write
06 H
Data
CLA
INS
P1
P2
Lc
FF H
01 H
00 H
00 H
01 H
Page size
= 04 H for 16-byte page write
= 05 H for 32-byte page write
= 06 H for 64-byte page write
= 07 H for 128-byte page write
 Advanced Card Systems Ltd.
Page 19 of 43
ACR38 Reference Manual
version 1.9 February 2006
Response data format
Header
Status
Data length
SW1
SW2
LEN
01 H
SW1, SW2 = 90 H 00 H if no error
8.2.3.3
READ_MEMORY_CARD
Command format
Header
Instruction
Data length
Data
LEN
CLA
INS
Byte Address
MSB
01 H
INS
A0 H
00 H
05 H
MEM_L
LSB
FF H
= B0 H for 32,64,128,256,512kbit iic card
= 1011 000* b for 1024kbit iic card, where * is the MSB of the 17 bit addressing
Byte Address Memory address location of the memory card.
MEM_L
Length of data to be read from the memory card.
Response data format
Header
Status
Data length
BYTE 1
…
…
BYTE N
SW1
SW2
LEN
01 H
BYTE x
Data read from memory card
SW1, SW2 = 90 H 00 H if no error
8.2.3.4
WRITE_MEMORY_CARD
Command format
Header
Instruction
Data length
LEN
MSB
01 H
INS
A0 H
Data
CLA
INS
LSB
Byte Address
MSB
MEM_L
Byte 1
....
....
Byte n
LSB
FF H
= D0 H for 32,64,128,256,512kbit iic card
= 1101 000* b for 1024kbit iic card, where * is the MSB of the 17 bit addressing
Byte Address Memory address location of the memory card.
LEN
= 5 + MEM_L
MEM_L
Length of data to be written to the memory card.
Byte x
Data to be written to the memory card.
 Advanced Card Systems Ltd.
Page 20 of 43
ACR38 Reference Manual
version 1.9 February 2006
Response data format
Header
Status
Data length
SW1
SW2
LEN
01 H
SW1, SW2 = 90 H 00 H if no error
8.2.4 Memory Card – ATMEL AT88SC153
8.2.4.1
SELECT_CARD_TYPE
This command powers down and up the selected card inserted in the card reader and performs a card reset.
It will also select the page size to be 8-byte page write.
Notes: This command must be the first command after card insertion!
Command format
Header
Instruction
01 H
A0 H
Data length
Data
LEN
00 H
06 H
CLA
INS
P1
P2
Lc
Card Type
FF H
A4 H
00 H
00 H
01 H
03 H
BYTE 2
BYTE 3
BYTE 4
CLA
INS
Response data format
Header
Status
Data length
BYTE 1
SW1
SW2
Byte
Address
MEM_L
LEN
01 H
BYTE x
ATR from card
SW1, SW2 = 90 H 00 H if no error
8.2.4.2
READ_MEMORY_CARD
Command format
Header
Instruction
Data length
LEN
01 H
INS
A0 H
00 H
05 H
Data
FF H
P1
00 H
= B0 H for reading zone 00 b
= B1 H for reading zone 01 b
= B2 H for reading zone 10 b
= B3 H for reading zone 11 b
= B4 H for reading fuse
Byte Address Memory address location of the memory card.
MEM_L
Length of data to be read from the memory card.
 Advanced Card Systems Ltd.
Page 21 of 43
ACR38 Reference Manual
version 1.9 February 2006
Response data format
Header
Status
Data length
BYTE 1
…
…
BYTE N
SW1
SW2
LEN
01 H
BYTE x
Data read from memory card
SW1, SW2 = 90 H 00 H if no error
8.2.4.3
WRITE_MEMORY_CARD
Command format
Header
Instruction
Data length
Data
LEN
MSB
01 H
INS
CLA
INS
P1
Bye
Address
MEM_L
Byte 1
....
....
Byte n
LSB
A0 H
FF H
00 H
= D0 H for writing zone 00 b
= D1 H for writing zone 01 b
= D2 H for writing zone 10 b
= D3 H for writing zone 11 b
= D4 H for writing fuse
Byte Address Memory address location of the memory card.
LEN
= 5 + MEM_L
MEM_L
Length of data to be written to the memory card.
MEM_D
Data to be written to the memory card.
Response data format
Header
Status
Data length
SW1
SW2
LEN
01 H
SW1, SW2 = 90 H 00 H if no error
8.2.4.4
VERIFTY_PASSWORD
Command format
Header
Instruction
Data length
LEN
01 H
A0 H
00 H
08 H
Data
CLA
INS
P1
FF H
20 H
00 H
Pw(0),Pw(1),Pw(2)
Passwords to be sent to memory card.
P2
= 0000 00rp b
 Advanced Card Systems Ltd.
P2
Lc
Pw(0)
Pw(1)
Pw(2)
03 H
Page 22 of 43
ACR38 Reference Manual
version 1.9 February 2006
where the two bits “rp” indicate the password to compare
r = 0 : Write password,
r = 1: Read password,
p: Password set number,
rp = 01 for the secure code.
Response data format
Header
Status
Data length
SW1
SW2
LEN
01 H
SW1, SW2 = 90 H 00 H if no error
8.2.4.5
INITIALIZE_AUTHENTICATION
Command format
Header
Instruction
01 H
A0 H
Data length
Data
LEN
Q(0),Q(1)…Q(7)
00 H
0D H
CLA
INS
P1
P2
Lc
FF H
84 H
00 H
00 H
08 H
Q(0)
Q(1)
…
Q(7)
Ch(0) Ch(1)
…
Ch(7)
Host random number, 8 bytes.
Response data format
Header
Status
Data length
SW1
SW2
LEN
01 H
SW1, SW2 = 90 H 00 H if no error
8.2.4.6
VERIFY_AUTHENTICATION
Command format
Header
Instruction
01 H
A0 H
Data length
Data
LEN
Ch(0),Ch(1)…Ch(7)
00 H
0D H
CLA
INS
P1
P2
Lc
FF H
82 H
00 H
00 H
08 H
Host challenge, 8 bytes.
Response data format
Header
Status
Data length
SW1
SW2
LEN
01 H
SW1, SW2 = 90 H 00 H if no error
 Advanced Card Systems Ltd.
Page 23 of 43
ACR38 Reference Manual
version 1.9 February 2006
8.2.5 Memory Card – ATMEL AT88SC1608
8.2.5.1
SELECT_CARD_TYPE
This command powers down and up the selected card inserted in the card reader and performs a card reset.
It will also select the page size to be 16-byte page write.
Notes: This command must be the first command after card insertion!
Command format
Header
Instruction
01 H
A0 H
Data length
Data
LEN
00 H
06 H
CLA
INS
P1
P2
Lc
Card Type
FF H
A4 H
00 H
00 H
01 H
04 H
Response data format
Header
Status
Data length
BYTE 1
BYTE 2
BYTE 3
CLA
INS
BYTE 4
SW1
SW2
Byte
Address
MEM_L
LEN
01 H
BYTE x
ATR from card
SW1, SW2 = 90 H 00 H if no error
8.2.5.2
READ_MEMORY_CARD
Command format
Header
Instruction
Data length
LEN
01 H
INS
A0 H
00 H
05 H
Data
Zone
Address
FF H
= B0 H for reading user zone
= B1 H for reading configuration zone or reading fuse
Zone Address = 0000 0A10A9A8 b, where A10 is the MSB of zone address
= don’t care for reading fuse
Byte Address = A7A6A5A4 A3A2A1A0 b is the memory address location of the memory card.
= 1000 0000 b for reading fuse
MEM_L
Length of data to be read from the memory card.
 Advanced Card Systems Ltd.
Page 24 of 43
ACR38 Reference Manual
version 1.9 February 2006
Response data format
Header
Status
Data length
BYTE 1
…
…
BYTE N
SW1
SW2
LEN
01 H
BYTE x
Data read from memory card
SW1, SW2 = 90 H 00 H if no error
8.2.5.3
WRITE_MEMORY_CARD
Command format
Header
Instruction
Data length
Data
LEN
MSB
01 H
INS
CLA
INS
Zone
Address
Byte
Address
MEM_L
Byte 1
....
....
Byte n
LSB
A0 H
FF H
= D0 H for writing user zone
= D1 H for writing configuration zone or writing fuse
Zone Address = 0000 0A10A9A8 b, where A10 is the MSB of zone address
= don’t care for writing fuse
Byte Address = A7A6A5A4 A3A2A1A0 b is the memory address location of the memory card.
= 1000 0000 b for writing fuse
LEN
= 5 + MEM_L
MEM_L
Length of data to be written to the memory card.
Byte x
Data to be written to the memory card.
Response data format
Header
Status
Data length
SW1
SW2
LEN
01 H
SW1, SW2 = 90 H 00 H if no error
8.2.5.4
VERIFTY_PASSWORD
Command format
Header
Instruction
Data length
LEN
01 H
Pw(0),Pw(1),Pw(2)
A0 H
00 H
09 H
Data
CLA
INS
P1
P2
Lc
FF H
20 H
00 H
00 H
04 H
Data
RP
Pw(0)
Pw(1) Pw(2)
Passwords to be sent to memory card.
 Advanced Card Systems Ltd.
Page 25 of 43
ACR38 Reference Manual
RP
version 1.9 February 2006
= 0000 rp2p1p0 b
where the four bits “rp2p1p0” indicate the password to compare:
r = 0: Write password,
r = 1: Read password,
p2p1p0: Password set number.
(rp2p1p0 = 0111 for the secure code).
Response data format
Header
Status
Data length
ErrorCnt
SW1
SW2
LEN
01 H
00 H
03 H
ErrorCnt
= Error Counter, FFH if the verification is correct
SW1, SW2 = 90 H 00 H if no error
8.2.5.5
INITIALIZE_AUTHENTICATION
Command format
Header
Instruction
Data length
Data
LEN
01 H
A0 H
00 H
0D H
CLA
INS
P1
P2
Lc
FF H
84 H
00 H
00 H
08 H
Byte Address
Memory address location of the memory card.
Q(0),Q(1)…Q(7)
Host random number, 8 bytes.
Q(0)
Q(1)
…
Q(7)
Q1(0) Q1(1)
…
Q1(7)
Response data format
Header
Status
Data length
SW1
SW2
LEN
01 H
SW1, SW2 = 90 H 00 H if no error
8.2.5.6
VERIFY_AUTHENTICATION
Command format
Header
Instruction
Data length
LEN
01 H
A0 H
00 H
0D H
Data
CLA
INS
P1
P2
Lc
FF H
82 H
00 H
00 H
08 H
Byte Address Memory address location of the memory card.
Q1(0),Q1(1)…Q1(7)
Host challenge, 8 bytes.
 Advanced Card Systems Ltd.
Page 26 of 43
ACR38 Reference Manual
version 1.9 February 2006
Response data format
Header
Status
Data length
SW1
SW2
LEN
01 H
SW1, SW2 = 90 H 00 H if no error
8.2.6
8.2.6.1
Memory Card – SLE4418/4428
SELECT_CARD_TYPE
This command powers down and up the selected card inserted in the card reader and performs a card reset.
Notes: This command must be the first command after card insertion!
Command format
Header
Instruction
Data length
Data
LEN
01 H
A0 H
00 H
06 H
CLA
INS
P1
P2
Lc
Card Type
FF H
A4 H
00 H
00 H
01 H
05 H
Response data format
Header
Status
Data length
BYTE 1
BYTE 2
BYTE 3
BYTE 4
SW1
SW2
LEN
01 H
BYTE x
ATR from card
SW1,SW2
= 90 H 00 H if no error
8.2.6.2
READ_MEMORY_WITH_PROTECT_BIT_CARD
Command format
Header
Instruction
Data length
LEN
Data
CLA
INS
Byte Address
MSB
01 H
A0 H
00 H
05 H
FF H
MEM_L
LSB
B0 H
MSB Byte Address
= 0000 00A9A8 b is the memory address location of the memory card.
LSB Byte Address
= A7A6A5A4 A3A2A1A0 b is the memory address location of the memory card.
MEM_L
Length of data to be read from the memory card. (Max. allowable size is EC H.)
 Advanced Card Systems Ltd.
Page 27 of 43
ACR38 Reference Manual
version 1.9 February 2006
Response data format
Header
Status
Data length
BYTE 1
…
…
BYTE N
PROT 1
…
…
PROT L
SW1
SW2
LEN
01 H
BYTE x
Data read from memory card
PROT y
Bytes containing the protection bits of the data bytes read
SW1,SW2
= 90 H 00 H if no error
The number L of protection bytes returned in the response is determined by the number N of data bytes
read from the card as follows:
L = 1 + INT(N/8)
The arrangement of the protection bits in the PROT bytes is as follows:
PROT 1
P8
P7
P6
P5
P4
PROT 2
P3
P2
P1
P16
P15
P14
P13
P12
…
P11
P10
P9
..
..
..
..
..
..
P18
P17
Px is the protection bit of BYTE x in the response data
‘0’ byte is write protected
‘1’ byte can be written
8.2.6.3
READ_MEMORY_WITHOUT_PROTECT_BIT_CARD
Command format
Header
Instruction
Data length
LEN
Data
CLA
INS
Byte Address
MSB
01 H
A0 H
00 H
05 H
FF H
MEM_L
LSB
B2 H
MSB Byte Address
= 0000 00A9A8 b is the memory address location of the memory card.
LSB Byte Address
= A7A6A5A4 A3A2A1A0 b is the memory address location of the memory card.
MEM_L
Length of data to be read from the memory card.
Response data format
Header
Status
Data length
BYTE 1
…
…
BYTE N
SW1
SW2
LEN
01 H
BYTE x
Data read from memory card
SW1, SW2 = 90 H 00 H if no error
 Advanced Card Systems Ltd.
Page 28 of 43
ACR38 Reference Manual
8.2.6.4
version 1.9 February 2006
WRITE_MEMORY_CARD
Command format
Header
Instruction
Data length
Data
LEN
MSB
01 H
CLA
INS
Byte Address
LSB
A0 H
MSB
FF H
MEM_L
Byte 1
....
....
Byte N
LSB
D0 H
MSB Byte Address
= 0000 00A9A8 b is the memory address location of the memory card.
LSB Byte Address
= A7A6A5A4 A3A2A1A0 b is the memory address location of the memory card.
LEN
= 5 + MEM_L
MEM_L
Length of data to be written to the memory card.
Byte x
Data to be written to the memory card.
Response data format
Header
Status
Data length
SW1
SW2
LEN
01 H
SW1, SW2 = 90 H 00 H if no error
8.2.6.5
WRITE_PROTECTION_MEMORY_CARD
Each of the bytes specified in the command is internally in the card compared with the byte stored at the
specified address and if the data matches, the corresponding protection bit is irreversibly programmed to ‘0’.
Command format
Header
Instruction
Data length
LEN
MSB
01 H
Data
CLA
INS
LSB
A0 H
Byte Address
MSB
FF H
MEM_L
Byte 1
....
....
Byte N
LSB
D1 H
MSB Byte Address
= 0000 00A9A8 b is the memory address location of the memory card.
LSB Byte Address
= A7A6A5A4 A3A2A1A0 b is the memory address location of the memory card.
LEN
= 5 + MEM_L
MEM_L
Length of data to be written to the memory card.
Byte x
Byte values to be compared with the data in the card starting at Byte Address. BYTE 1 is
compared with the data at Byte Address; BYTE N is compared with the data at (Byte
Address+N-1).
 Advanced Card Systems Ltd.
Page 29 of 43
ACR38 Reference Manual
version 1.9 February 2006
Response data format
Header
Status
Data length
SW1
SW2
LEN
01 H
SW1, SW2 = 90 H 00 H if no error
8.2.6.6
PRESENT_CODE_MEMORY_CARD (only SLE 4428)
To submit the secret code to the memory card to enable the write operation with the SLE4428 card. The
following actions are executed:
-
search a ‘1’ bit in the presentation error counter and write the bit to ‘0’
-
present the specified code to the card
-
try to erase the presentation error counter
Command format
Header
Instruction
Data length
Data
LEN
01 H
CODE
A0 H
CLA
MSB
LSB
00 H
07 H
INS
P1
P2
MEM_L
CODE
Byte 1
FF H
20 H
00 H
00 H
Byte 2
02 H
Two bytes secret code (PIN)
Response data format
Header
Status
Data length
ERRCNT
LEN
CODE
Byte 1
SW1
SW2
Byte 2
01 H
ERRCNT
The value of the presentation error counter after the code presentation.
CODE
The two bytes secret code read from the card.
SW1, SW2 = 90 H 00 H if no error
If the correct code has been presented to the card, the value of ERRCNT is FF H and the value of CODE is
identical to the code data specified in the command.
8.2.6.7
READ_PRESENTATION_ERROR_COUNTER_MEMORY_CARD (only SLE 4428)
To read the presentation error counter for the secret code.
Command format
Header
Instruction
Data length
LEN
01 H
 Advanced Card Systems Ltd.
A0 H
MSB
LSB
00 H
05 H
Data
CLA
INS
P1
P2
MEM_L
FF H
B1 H
00 H
00 H
00 H
Page 30 of 43
ACR38 Reference Manual
version 1.9 February 2006
Response data format
Header
Status
Data length
ERRCNT
DUMMY 1
DUMMY 2
SW1
SW2
LEN
01 H
ERRCNT
The value of the presentation error counter.
DUMMY
Two bytes dummy data read from the card.
SW1, SW2 = 90 H 00 H if no error
 Advanced Card Systems Ltd.
Page 31 of 43
ACR38 Reference Manual
8.2.7
8.2.7.1
version 1.9 February 2006
Memory Card – SLE4432/4442
SELECT_CARD_TYPE
This command powers down and up the selected card inserted in the card reader and performs a card reset.
Notes: This command must be the first command after card insertion!
Command format
Header
Instruction
Data length
Data
LEN
01 H
A0 H
00 H
06 H
CLA
INS
P1
P2
Lc
Card Type
FF H
A4 H
00 H
00 H
01 H
06 H
Response data format
Header
Status
Data length
BYTE 1
BYTE 2
BYTE 3
BYTE 4
CLA
INS
P1
FF H
B0 H
00 H
SW1
SW2
Byte
Address
MEM_L
LEN
01 H
BYTE x
ATR from card
SW1, SW2 = 90 H 00 H if no error
8.2.7.2
READ_MEMORY_CARD
Command format
Header
Instruction
Data length
LEN
01 H
A0 H
00 H
05 H
Data
Byte Address = A7A6A5A4 A3A2A1A0 b is the memory address location of the memory card.
MEM_L
Length of data to be read from the memory card.
 Advanced Card Systems Ltd.
Page 32 of 43
ACR38 Reference Manual
version 1.9 February 2006
Response data format
Header
Status
Data length
BYTE 1
…
…
BYTE N
PROT 1
PROT 2
PROT3
PROT 4
SW1
SW2
LEN
01 H
BYTE x
Data read from memory card
PROT y
Bytes containing the protection bits from protection memory
SW1, SW2 = 90 H 00 H if no error
The arrangement of the protection bits in the PROT bytes is as follows:
PROT 1
P8
P7
P6
P5
P4
…
PROT 2
P3
P2
P1
P16
P15
P14
P13
P12
P11
P10
P9
..
..
..
..
..
..
P18
P17
Px is the protection bit of BYTE x in the response data
‘0’ byte is write protected
‘1’ byte can be written
8.2.7.3
WRITE_MEMORY_CARD
Command format
Header
Instruction
Data length
Data
LEN
MSB
01 H
CLA
INS
P1
FF H
D0 H
00 H
Byte
Address
MEM_L
Byte 1
....
....
Byte N
LSB
A0 H
Byte Address = A7A6A5A4 A3A2A1A0 b is the memory address location of the memory card.
LEN
= 5 + MEM_L
MEM_L
Length of data to be written to the memory card.
Byte x
Data to be written to the memory card.
Response data format
Header
Status
Data length
SW1
SW2
LEN
01 H
SW1, SW2 = 90 H 00 H if no error
8.2.7.4
WRITE_PROTECTION_MEMORY_CARD
Each of the bytes specified in the command is internally in the card compared with the byte stored at the
specified address and if the data matches, the corresponding protection bit is irreversibly programmed to ‘0’.
 Advanced Card Systems Ltd.
Page 33 of 43
ACR38 Reference Manual
version 1.9 February 2006
Command format
Header
Instruction
Data length
Data
LEN
MSB
01 H
CLA
INS
P1
FF H
D1 H
00 H
Byte
Address
MEM_L
Byte 1
....
....
Byte N
LSB
A0 H
Byte Address = 000A4 A3A2A1A0 b (00 H to 1F H) is the protection memory address location of the memory
card.
LEN
= 5 + MEM_L
MEM_L
Length of data to be written to the memory card.
Byte x
Byte values to be compared with the data in the card starting at Byte Address. BYTE 1 is
compared with the data at Byte Address; BYTE N is compared with the data at (Byte
Address+N-1).
Response data format
Header
Status
Data length
SW1
SW2
LEN
01 H
SW1, SW2 = 90 H 00 H if no error
8.2.7.5
PRESENT_CODE_MEMORY_CARD (only SLE 4442)
To submit the secret code to the memory card to enable the write operation with the SLE4442 card. The
following actions are executed:
-
search a ‘1’ bit in the presentation error counter and write the bit to ‘0’
-
present the specified code to the card
-
try to erase the presentation error counter
Command format
Header
Instruction
Data length
LEN
01 H
CODE
A0 H
Data
CLA
MSB
LSB
00 H
08 H
INS
P1
P2
MEM_L
CODE
Byte 1
FF H
20 H
00 H
00 H
Byte 2
Byte 3
03 H
Three bytes secret code (PIN)
 Advanced Card Systems Ltd.
Page 34 of 43
ACR38 Reference Manual
version 1.9 February 2006
Response data format
Header
Status
Data length
ERRCNT
CODE
LEN
Byte 1
SW1
Byte 2
SW2
Byte 3
01 H
ERRCNT
The value of the presentation error counter after the code presentation.
CODE
The three bytes secret code read from the card.
SW1, SW2 = 90 H 00 H if no error
If the correct code has been presented to the card, the value of ERRCNT is 07 H and the value of CODE is
identical to the code data specified in the command.
8.2.7.6
READ_PRESENTATION_ERROR_COUNTER_MEMORY_CARD (only SLE 4442)
To read the presentation error counter for the secret code.
Command format
Header
Instruction
Data length
Data
LEN
01 H
A0 H
MSB
LSB
00 H
08 H
CLA
INS
P1
P2
MEM_L
FF H
B1 H
00 H
00 H
00 H
Response data format
Header
Status
Data length
ERRCNT
DUMMY 1
DUMMY 2
DUMMY 3
SW1
SW2
LEN
01 H
ERRCNT
The value of the presentation error counter.
DUMMY
Three bytes dummy data read from the card.
SW1, SW2 = 90 H 00 H if no error
8.2.7.7
CHANGE_CODE_MEMORY_CARD (only SLE 4442)
To write the specified data as new secret code in the card.
The current secret code must have been presented to the card with the PRESENT_CODE command prior to
the execution of this command!
Command format
Header
Instruction
Data length
LEN
01 H
A0 H
 Advanced Card Systems Ltd.
Data
CLA
MSB
LSB
00 H
08 H
INS
P1
P2
MEM_L
CODE
Byte 1
FF H
D2 H
00 H
01 H
Byte 2
Byte 3
03 H
Page 35 of 43
ACR38 Reference Manual
version 1.9 February 2006
Response data format
Header
Status
Data length
SW1
SW2
LEN
01 H
SW1, SW2 = 90 H 00 H if no error
 Advanced Card Systems Ltd.
Page 36 of 43
ACR38 Reference Manual
8.2.8
version 1.9 February 2006
Memory Card – SLE4406/4436/5536
Only ACR38 reader with firmware v1.10 onwards can support this memory card type SLE4406/4436/5536.
8.2.8.1
SELECT_CARD_TYPE
This command powers down and up the selected card inserted in the card reader and performs a card reset.
Notes: This command must be the first command after card insertion!
Command format
Header
Instruction
Data length
Data
LEN
01 H
A0 H
00 H
06 H
CLA
INS
P1
P2
Lc
Card Type
FF H
A4 H
00 H
00 H
01 H
07 H
Response data format
Header
Status
Data length
BYTE 1
BYTE 2
BYTE 3
BYTE 4
CLA
INS
P1
FF H
B0 H
00 H
SW1
SW2
Byte
Address
MEM_L
LEN
01 H
BYTE x
ATR from card
SW1, SW2 = 90 H 00 H if no error
8.2.8.2
READ_MEMORY_CARD
Command format
Header
Instruction
Data length
LEN
01 H
A0 H
00 H
05 H
Data
Byte Address = Memory address location of the memory card.
MEM_L
Length of data to be read from the memory card.
 Advanced Card Systems Ltd.
Page 37 of 43
ACR38 Reference Manual
version 1.9 February 2006
Response data format
Header
Status
Data length
BYTE 1
…
…
BYTE N
SW1
SW2
LEN
01 H
BYTE x
Data read from memory card
SW1, SW2 = 90 H 00 H if no error
8.2.8.3
WRITE_ONE_BYTE_MEMORY_CARD
To write one byte to the specified address of the inserted card. The byte is written to the card with LSB first,
i.e., the bit at card address 0 is regarded as the LSB of byte 0.
Four different WRITE modes are available for this card type, which are distinguished by a flag in the
command data field:
a)
Write
The byte value specified in the command is written to the specified address. This command can be
used for writing personalization data and counter values to the card.
b)
Write with carry
The byte value specified in the command is written to the specified address and the command is
sent to the card to erase the next lower counter stage. This write mode can therefore only be used
for updating the counter value in the card.
c)
Write with backup enabled (SLE4436 and SLE5536 only)
The byte value specified in the command is written to the specified address. This command can be
used for writing personalization data and counter values to the card. Backup bit is enabled to
prevent data loss when card tearing occurs.
d)
Write with carry and backup enabled (SLE4436 and SLE5536 only)
The byte value specified in the command is written to the specified address and the command is
sent to the card to erase the next lower counter stage. This write mode can therefore only be used
for updating the counter value in the card. Backup bit is enabled to prevent data loss when card
tearing occurs.
With all write modes, the byte at the specified card address is not erased prior to the write operation and,
hence, memory bits can only be programmed from '1' to '0'.
The backup mode available in the SLE4436 and SLE5536 card can be enabled or disabled in the write
operation.
 Advanced Card Systems Ltd.
Page 38 of 43
ACR38 Reference Manual
version 1.9 February 2006
Command format
Header
Instruction
Data length
Data
LEN
MSB
01 H
CLA
INS
P1
Byte
Address
FF H
D0 H
00 H
MEM_L
MODE
BYTE
LSB
A0 H
02 H
Byte Address = Memory address location of the memory card.
LEN
= 5 + MEM_L
MODE
Specifies the write mode and backup option
00H : write
01H : write with carry
02H : write with backup enabled (SLE4436 and SLE5536 only)
03H : write with carry and with backup enabled (SLE4436 and SLE5536 only)
BYTE
Byte value to be written to the card
Response data format
Header
Status
Data length
SW1
SW2
LEN
01 H
SW1, SW2 = 90 H 00 H if no error
8.2.8.4
PRESENT_CODE_MEMORY_CARD
To submit the secret code to the memory card to enable the card personalization mode. The following
actions are executed:
-
search a '1' bit in the presentation counter and write the bit to '0'
-
present the specified code to the card
The ACR38 does not try to erase the presentation counter after the code submission! This must be done by
the application software through a separate 'Write with carry' command.
Command format
Header
Instruction
Data length
01 H
ADDR
CODE
A0 H
Data
CLA
LEN
MSB
LSB
00 H
08 H
INS
P1
P2
MEM_L
CODE
ADDR
FF H
20 H
00 H
00 H
Byte 1
Byte 2
Byte 3
04 H
Byte address of the presentation counter in the card
Three bytes secret code (PIN)
 Advanced Card Systems Ltd.
Page 39 of 43
ACR38 Reference Manual
version 1.9 February 2006
Response data format
Header
Status
Data length
SW1
SW2
LEN
01 H
SW1, SW2 = 90 H 00 H if no error
8.2.8.5
AUTHENTICATE_MEMORY_CARD (SLE4436 and SLE5536 only)
To read a card authentication certificate from a SLE5536 card. The following actions are executed by the
ACR38:
o select Key 1 or Key 2 in the card as specified in the command
o present the challenge data specified in the command to the card
o generate the specified number of CLK pulses for each bit of authentication data computed by
the card
o read 16 bits of authentication data from the card
o reset the card to normal operation mode
The ACR38 returns the 16 bits of authentication data calculated by the card in the response.
Command format
Header
Instruction
Data length
01 H
A0 H
Data
CLA
LEN
MSB
LSB
00 H
08 H
INS
P1
P2
MEM_L
CODE
KEY
FF H
84 H
00 H
00 H
CLK_CNT
Byte1
Byte 2
……
Byte 5
Byte 6
08 H
KEY
Key to be used for the computation of the authentication certificate:
00H : key 1 with no cipher block chaining
01H : key 2 with no cipher block chaining
80H : key 1 with cipher block chaining (SLE5536 only)
81H : key 2 with cipher block chaining (SLE5536 only)
CLK_CNT Number of CLK pulses to be supplied to the card for the computation of each bit of the
authentication certificate.
BYTE 1...6 Card challenge data
Response data format
Header
Status
Data length
CERT
SW1
SW2
LEN
01 H
CERT
16 bits of authentication data computed by the card. The LSB of BYTE 1 is the first
authentication bit read from the card.
SW1, SW2 = 90 H 00 H if no error
 Advanced Card Systems Ltd.
Page 40 of 43
ACR38 Reference Manual
version 1.9 February 2006
Appendix A: Supported Card Types
The following table summarizes which values must be specified in the SET_CARD_TYPE command for a
particular card type to be used, and how the bits in the response to the GET_ACR_STAT command
correspond with the respective card types.
Cyber-mouse card type code
Card Type
00H
Auto-select T=0 or T=1 communication protocol
01H
I2C memory card (1k, 2k, 4k, 8k and 16k bits)
02H
I2C memory card (32k, 64k, 128k, 256k, 512k and 1024k bits)
03H
Atmel AT88SC153 secure memory card
04H
Atmel AT88SC1608 secure memory card
05H
Infineon SLE4418 and SLE4428
06H
Infineon SLE4432 and SLE4442
07H
Infineon SLE4406, SLE4436 and SLE5536
0CH
MCU-based cards with T=0 communication protocol
0DH
MCU-based cards with T=1 communication protocol
 Advanced Card Systems Ltd.
Page 41 of 43
ACR38 Reference Manual
version 1.9 February 2006
Appendix B: Response Status Codes
The following table summarizes the possible status code returned by the ACR38:
Status Code
Status
00
OK – command successfully executed
F4
SLOTERROT_PROCEDURE_BYTE_CONFLICT
F6
SLOTERROR_BAD_LENGTH
F7
SLOTERROR_BAD_FIDI
F8
SLOTERROR_BAD_ATR_TS
F9
SLOTERROR_ICC_NOT_POWERED_UP
FA
SLOTERROR_ICC_NOT_INSERTED
FB
SLOTERROR_HW_ERROR
FC
SLOTERROR_XFE_OVERRUN
FD
SLOTERROR_XFE_PARITY_ERROR
FE
SLOTERROR_ICC_MUTE
FF
SLOTERROR_CMD_ABORTED
 Advanced Card Systems Ltd.
Page 42 of 43
ACR38 Reference Manual
version 1.9 February 2006
Appendix C: Technical Specifications
19.0
96.5
73.0
Device
ACR38 Smart Card Reader/Writer
Universal Serial Bus Interface
Type................................................USB full speed, four lines: +5V, GND, D+ and DPower source ..................................From USB
Speed .............................................12 Mbps
Smart Card Interface
Standard .........................................ISO-7816 Class A, B and C (5V, 3V, 1.8V), T=0 and T=1
Supply current.................................max. 50mA
Smart card read / write speed .........1,743 – 250,000 bps
Short circuit protection ...................+5V / GND on all pins
The presence of the smart card power supply voltage is indicated through a green LED on the
reader
CLK frequency ................................4 MHz
Card connector ...............................Contact
Card insertion cycles.......................min. 100,000
(Optional) SAM Card Interface
Card connector ...............................Landing
Location ..........................................Under the removable dark lid
Physical Specifications
Dimensions .....................................73.0mm (L) x 96.5mm (W) x 19.0mm (H)
Color ...............................................Silver
Weight.............................................95g (± 5g allowance for cable) - Spaceship casing
Cable length, cord, connector .........1.5 meters, Fixed (non-detachable), USB A
Operating Conditions
Temperature ...................................0 - 50° C
Humidity..........................................40% - 80%
Standard/Certifications
EMV Level 1, ISO-7816, PC/SC, CE, FCC, USB Full Speed, Microsoft WHQL 2K, XP
OS
Windows 98, ME, NT, 2K, XP
OEM
OEM-Logo possible, customer-specific colors, casing, and card connector
 Advanced Card Systems Ltd.
Page 43 of 43
Was this manual useful for you? yes no
Thank you for your participation!

* Your assessment is very important for improving the work of artificial intelligence, which forms the content of this project

Download PDF

advertisement