AMR220-C1 Secure Bluetooth® mPOS Reader communicates with smart devices via Bluetooth® technology. With its compliance to ISO 7816 and ISO 14443, it supports both contact and contactless smart cards. Moreover, it further extends card support and strengthens the mobile reader product line’s salability in the payment industry, with the additional compliance to EMV® Levels 1 & 2,

Mastercard® Contactless (formerly MasterCard PayPass), and Visa® Contactless.

Target customers include micro merchants, mobile merchants (example: catering, food trucks, express delivery companies), and retail merchants.

1.1. Symbols and Abbreviations

Abbreviation Description

AC Application Cryptogram

FFI

CED

CID

CVM

CVR

ATC

BLE

AID

AIP

AOSA

APDU

IAD

IFD

JCB

PAN

Application Identifier

Application Interchange Profile

Available Offline Spending Amount

Application Protocol Data Unit

Application Transaction Counter

Bluetooth

Bluetooth Low Energy

Certification Authority

Customer Exclusive Data

Cryptogram Information Data

Cardholder Verification Method

Card Verification Results

Discretionary Data

Dedicated File

Form Factor Indicator

Firmware

Issuer Application Data

Interface Device

Japan Credit Bureau

Primary Account Number

AMR220-C1 – Reference Manual

Version 1.02

Page 5 of 69 [email protected] www.acs.com.hk

Abbreviation

PBOC

PCD

POS

PSN

RID

QPBOC

TAC

TTQ

TVR

Description

People’s Bank of China specifications

Proximity Coupling Device

Personal Identification Number

Point of Sale

Application PAN Sequence Number

Registered Application Provider Identifier

Quick PBOC (The Chinese counterpart of contact-less EMV)

Terminal Action Code

Terminal Transaction Qualifiers

Terminal Verification Results

Table 1 : Symbols and Abbreviations

AMR220-C1 – Reference Manual

Version 1.02

Page 6 of 69 [email protected] www.acs.com.hk

2.0. Features

• USB Full Speed Interface

• Bluetooth ® Interface

• Plug and Play – CCID support brings utmost mobility

• Smart Card Reader: o Contactless Interface:

 Read/Write speed of up to 848 Kbps

 Built-in antenna for contactless tag access, with reading distance of up to 60 mm

(depending on tag type)

 Supports ISO 14443 Part 4 Type A and B cards, MIFARE ®

NFC (ISO/IEC 18092) tags

, FeliCa, and all 4 types of

 Supports Mastercard ® Contactless and Visa payWave ® compliant cards

 Built-in anti-collision feature (only one tag is accessed at any time)

 NFC Mode Supported:

 Card reader/writer mode o Contact Interface:

 Read/Write speed of up to 600 Kbps

 Supports ISO 7816 Class A, B, and C (5 V, 3 V, 1.8 V) full-sized cards

 Supports microprocessor cards with T=0 or T=1 protocol

 Supports PPS (Protocol and Parameters Selection)

 Features Short Circuit Protection

● Application Programming Interface: o Supports PC/SC o Supports CT-API (through wrapper on top of PC/SC)

● Built-in Peripherals: o LEDs:

 Four User-controllable single-color LED (Green)

 One Charging Status LED (Red)

 One Bluetooth Status LED (Blue) o Buttons:

 Power Switch

 Bluetooth Switch o User-controllable speaker (audio tone indication)

● Supports several cryptographic algorithms (Upon Request) such as AES, DES, and 3DES

● USB Firmware Upgradeability

● Supports Android™ 4.4 and later

● Supports iOS 8.0 and later

● Compliant with the following standards: o EN 60950/IEC 60950

1 Applicable under PC-linked mode

Uses an ACS-defined Android Library

Uses an ACS-defined iOS Library

Page 7 of 69

AMR220-C1 – Reference Manual

Version 1.02 [email protected] www.acs.com.hk

o ISO 7816 o ISO 14443 o ISO 18092 o EMV ® Levels 1 and 2 o Mastercard ® Contactless o Visa payWave ® o Bluetooth ® o PC/SC o CCID o CE o FCC o RoHS 2 o REACH o TELEC (Japan) o Microsoft ® WHQL

AMR220-C1 – Reference Manual

Version 1.02

Page 8 of 69 [email protected] www.acs.com.hk

3.0. Architecture

3.1. Hardware Design

The Cortex M3 grade main processor is used for communication with tablet or PC via BT interface or

USB interface. It also controls the peripherals and ICC communication. The NFC chip acts as a

Transceiver to build an RF channel between contactless tag and the main processor.

Li-Ion Battery

Carrier Freq

= 13.56MHz

Built-in

Antenna

NFC Chip Main

Processor

Bluetooth

Module

Carrier Freq

= 2.4GHz

BLE 4.1

Host with BT

Peripherals

LED, Buzzer, etc

ICC Socket

Host with USB

USB 2.0

Contactless

Tag

Contact Card

Figure 1 : Hardware Architecture

3.1.1. Battery

AMR220-C1 uses a rechargeable Lithium-ion battery, which has the capacity of 450 mAh.

3.1.1.1. Battery Charging

The battery of AMR220-C1 may be charged by connecting it to a power outlet.

3.1.1.2. Battery Life

The battery life is dependent on the usage of the device. Below is an estimate of the battery life depending on the various work conditions:

Mode

Working Mode:

Contact Interface

Working Mode:

Contactless Interface

OFF Mode

Estimated Battery Life

9 days*

7 days*

(1)

2 years

Table 2 : Estimated Battery Lifespan

*Note: Results may vary as it depends on the smart card used.

(1) In Bluetooth mode, 10 operations per day with 1 minute operation run

AMR220-C1 – Reference Manual

Version 1.02

Page 9 of 69 [email protected] www.acs.com.hk

3.1.2. User Interface

3.1.2.1. LED Behaviors

Charging LED

Charging LED On

LED Status Description

Charging

Charging LED Off Fully Charged

Bluetooth LED

LED Status

Slow Blinking (0.5 sec - ON, 4.5 sec - OFF)

Slow Blinking (0.5 sec - ON, 1.5 sec - OFF)

OFF

LED Status

BT LED ON

Description

Paired

Pairing

Bluetooth is Inactive

BT LED Off

EMV Contactless LEDs Behaviors

Note : For more information, refer to EMV Contactless Specification: https://www.emvco.com/wpcontent/uploads/2017/05/Book_A_Architecture_and_General_Rqmts_v2_6_Final_20160422011856105.pdf.

AMR220-C1 – Reference Manual

Version 1.02

Page 10 of 69 [email protected] www.acs.com.hk

3.1.2.2. Switch Behaviors

3.1.2.2.1. Power Switch Behaviors

• To turn on the device, press and hold the power switch for about 1-2 seconds.

• To turn off the device, press and hold the power switch until a beep sound is heard, then release the switch.

3.1.2.2.2. Bluetooth Switch Behaviors

To activate/deactivate Bluetooth paring:

• To activate Bluetooth pairing, press Bluetooth switch once.

• To deactivate Bluetooth pairing, press twice within 2 seconds.

To set device into Firmware Update Mode:

• If the device is turned on, press and hold Bluetooth switch for about 10 seconds.

• If the device is turned off, press Bluetooth switch together with the power switch.

3.1.2.3. Device Reset Pinhole

To reset the device:

• To reset the device, locate the pinhole beside the Bluetooth button, then press the reset button using a pin.

AMR220-C1 – Reference Manual

Version 1.02

Page 11 of 69 [email protected] www.acs.com.hk

3.2. Software Design

3.2.1. USB Interface

By using an MS-CCID driver, only a single slot device may be supported, and only the PICC interface may be used. In order to use both interfaces, the ACS driver is needed. AMR220-C1 USB interface follows CCID protocol with two defined slots; one for ICC interface and one for PICC interface.

Since AMR220-C1 is a CCID device, the host application is fully compatible with PCSC standard.

Note : For more details, please refer to Microsoft MSDN Library or PCSC workgroup.

Some usually used PCSC API will be described in PCSC API .

AMR220-C1 PCSC Application

USB

CCID

Command Dispatch

AMR220-C

ISO7816 1-4 ISO14443 1-4 /

ISO18092

Physical

ICC PICC

Figure 2 : Software Architecture – USB Interface

3.2.2. Bluetooth Interface

The Bluetooth interface of AMR220-C1 follows the BLE 4.1 standard. ACS offers a high level

Android/IOS library to simplify application programming. The BT API is described in Bluetooth

Library .

Below is the BLE architecture for reference.

Figure 3 : Software Architecture – Bluetooth Interface

AMR220-C1 – Reference Manual

Version 1.02

Page 12 of 69 [email protected] www.acs.com.hk

4.0. Host Programming

4.1. PCSC API

This section describes some of the PCSC API for application programming using USB interface. For more details, please refer to Microsoft MSDN Library or PCSC workgroup.

4.1.1. SCardEstablishContext

The SCardEstablishContext function establishes the resource manager context within which database operations are performed.

Refer to: http://msdn.microsoft.com/en-us/library/windows/desktop/aa379479%28v=vs.85%29.aspx

4.1.2. SCardListReaders

The SCardListReaders function provides the list of readers within a set of named reader groups, eliminating duplicates.

The caller supplies a list of reader groups, and receives the list of readers within the named groups.

Unrecognized group names are ignored. This function only returns readers within the named groups that are currently attached to the system and available for use.

Refer to: http://msdn.microsoft.com/en-us/library/windows/desktop/aa379793%28v=vs.85%29.aspx

4.1.3. SCardConnect

The SCardConnect function establishes a connection (using a specific resource manager context) between the calling application and a smart card contained by a specific reader. If no card exists in the specified reader, an error is returned.

Refer to: http://msdn.microsoft.com/en-us/library/windows/desktop/aa379473%28v=vs.85%29.aspx

4.1.4. SCardControl

The SCardControl function gives you direct control of the reader. You can call it any time after a successful call to SCardConnect and before a successful call to SCardDisconnect. The effect on the state of the reader depends on the control code.

Refer to: http://msdn.microsoft.com/en-us/library/windows/desktop/aa379474%28v=vs.85%29.aspx

Note:

Commands from Escape Command

are using this API for sending.

4.1.5. ScardTransmit

The SCardTransmit function sends a service request to the smart card and expects to receive data back from the card.

Refer to: http://msdn.microsoft.com/en-us/library/windows/desktop/aa379804%28v=vs.85%29.aspx

Note: APDU Commands (i.e. the commands sent to connected card in

Pseudo APDUs for

Contactless Interface ) are using this API for sending.

4.1.6. ScardDisconnect

The SCardDisconnect function terminates a connection previously opened between the calling application and a smart card in the target reader.

Refer to: http://msdn.microsoft.com/en-us/library/windows/desktop/aa379475%28v=vs.85%29.aspx

AMR220-C1 – Reference Manual

Version 1.02

Page 13 of 69 [email protected] www.acs.com.hk

4.1.7. APDU Flow

Start

SCardEstablishContext

SCardListReaders

Reader present?

Yes

SCardConnect

Connection successf ul ?

Yes

SCardTransmit

SCardDisconnect

End

Figure 4 : APDU Flow

AMR220-C1 – Reference Manual

Version 1.02

Page 14 of 69 [email protected] www.acs.com.hk

4.1.8. Escape Command Flow

Start

SCardEstablishContext

SCardListReaders

Reader present?

Yes

SCardConnect

SCardControl

SCardDisconnect

End

Figure 5 : Escape Command Flow

AMR220-C1 – Reference Manual

Version 1.02

Page 15 of 69 [email protected] www.acs.com.hk

4.2. Bluetooth Library

This section describes the ACS BT library for developer use. For more details, please refer to the

Library package documents.

4.2.1. Setting Up BLE

If BLE is supported on the device, enable Bluetooth in order to connect card terminals. To enable

Bluetooth, get the instance of BluetoothAdapter from BluetoothManager. private BluetoothAdapter mBluetoothAdapter;

...

// Initializes Bluetooth adapter. final BluetoothManager bluetoothManager = (BluetoothManager)

getSystemService(Context.BLUETOOTH_SERVICE); mBluetoothAdapter = bluetoothManager.getAdapter();

To check whether Bluetooth is enabled or not, call isEnabled() from BluetoothAdapter. Then, call startActivityForResult() to request user permission to enable Bluetooth. The result will be returned from onActivityResult() implementation.

// Ensures Bluetooth is available on the device and it is enabled. If not,

// displays a dialog requesting user permission to enable Bluetooth. if (mBluetoothAdapter == null || !mBluetoothAdapter.isEnabled()) {

Intent enableBtIntent = new

Intent(BluetoothAdapter.ACTION_REQUEST_ENABLE);

startActivityForResult(enableBtIntent, REQUEST_ENABLE_BT);

}

AMR220-C1 – Reference Manual

Version 1.02

Page 16 of 69 [email protected] www.acs.com.hk

4.2.2. Initializing Java Smart Card I/O API

To use Java Smart Card I/O API with BLE card terminals, call getInstance() from BluetoothSmartCard.

This class is a singleton and takes a Context as a parameter. If this method is called within Activity, they can pass this to the parameter. private BluetoothTerminalManager mManager; private TerminalFactory mFactory;

...

// Get the Bluetooth terminal manager.

mManager = BluetoothSmartCard.getInstance(this).getManager();

if (mManager == null) {

Toast.makeText(this, R.string.error_bluetooth_not_supported,

Toast.LENGTH_SHORT).show();

finish();

return;

}

// Get the terminal factory.

mFactory = BluetoothSmartCard.getInstance(this).getFactory();

if (mFactory == null) {

Toast.makeText(this, R.string.error_bluetooth_provider_not_found,

Toast.LENGTH_SHORT).show();

finish();

return;

}

AMR220-C1 – Reference Manual

Version 1.02

Page 17 of 69 [email protected] www.acs.com.hk

4.2.3. Finding BLE Card Terminals

To find BLE card terminals, use startScan() method from BluetoothTerminalManager. Supply a terminal type and a callback for returning CardTerminal object.

Once the card terminal is found, stopScan() must be called to stop the scanning. This is to avoid the smart device battery from draining quickly, which will affect the operation.

For Android 6.0 or later, developers must request either ACCESS_COARSE_LOCATION or

ACCESS_FINE_LOCATION permission at run-time in order to scan BLE devices. private Handler mHandler; private Button mScanButton; private TerminalAdapter mTerminalAdapter;

...

// Initialize Scan button. mHandler = new Handler(); mScanButton = (Button) findViewById(R.id.activity_main_button_scan); mScanButton.setOnClickListener(new View.OnClickListener() {

@Override

public void onClick(View v) {

// Request access coarse location permission.

if (ContextCompat.checkSelfPermission(MainActivity.this,

Manifest.permission.ACCESS_COARSE_LOCATION)

!= PackageManager.PERMISSION_GRANTED) {

ActivityCompat.requestPermissions(MainActivity.this,

new String[]{Manifest.permission.ACCESS_COARSE_LOCATION},

REQUEST_ACCESS_COARSE_LOCATION);

} else {

mScanButton.setEnabled(false);

mTerminalAdapter.clear();

// Start the scan. mManager.startScan(BluetoothTerminalManager.TERMINAL_TYPE_AMR220_C,

new BluetoothTerminalManager.TerminalScanCallback() {

@Override

public void onScan(final CardTerminal terminal) {

runOnUiThread(new Runnable() {

@Override

public void run() {

mTerminalAdapter.addTerminal(terminal);

}

});

}

});

// Stop the scan.

mHandler.postDelayed(new Runnable() {

@Override

public void run() {

mManager.stopScan();

mScanButton.setEnabled(true);

}

}, SCAN_PERIOD);

}

});

AMR220-C1 – Reference Manual

Version 1.02

Page 18 of 69 [email protected] www.acs.com.hk

The result will be returned from onRequestPermissionsResult(). After the permission is granted, the application can start the scan.

@Override public void onRequestPermissionsResult(int requestCode,

@NonNull String[] permissions,

@NonNull int[] grantResults) {

if (requestCode == REQUEST_ACCESS_COARSE_LOCATION) {

if ((grantResults.length > 0)

&& (grantResults[0] == PackageManager.PERMISSION_GRANTED)) {

mScanButton.setEnabled(false);

mTerminalAdapter.clear();

// Start the scan.

mManager.startScan(BluetoothTerminalManager.TERMINAL_TYPE_AMR220_C,

new BluetoothTerminalManager.TerminalScanCallback() {

@Override

public void onScan(final CardTerminal terminal) {

runOnUiThread(new Runnable() {

@Override

public void run() {

mTerminalAdapter.addTerminal(terminal);

}

});

}

});

// Stop the scan.

mHandler.postDelayed(new Runnable() {

@Override

public void run() {

mManager.stopScan();

mScanButton.setEnabled(true);

}

}, SCAN_PERIOD);

}

} else {

super.onRequestPermissionsResult(requestCode, permissions,

grantResults);

}

4.2.4. Connecting to a Card

To connect a card, call connect() from CardTerminal object to return a Card object. The available protocols are T=0, T=1, T=0 or T=1 and direct.

// Protocol:

// "T=0" - T=0

// "T=1" - T=1

// "*" - T=0 or T=1

// "direct" - Direct mode

try {

Card card = terminal.connect("*");

} catch (CardException e) {

e.printStackTrace();

}

AMR220-C1 – Reference Manual

Version 1.02

Page 19 of 69 [email protected] www.acs.com.hk

4.2.5. Disconnecting from the Card

After using the card, disconnect it by calling disconnect() from the Card object. To reset the card after disconnecting, pass true to the parameter. try {

card.disconnect(false);

} catch (CardException e) {

e.printStackTrace();

}

4.2.6. Transmitting APDUs

If the card is connected successfully, open a channel to transmit APDUs. Call either getBasicChannel() or openLogicalChannel() from Card object. After a CardChannel object is returned, transmit APDUs using transmit(CommandAPDU) or transmit(ByteBuffer, ByteBuffer) from the CardChannel object. byte[] command = { 0x00, (byte) 0x84, 0x00, 0x00, 0x08 };

try {

Card card = terminal.connect("*");

CardChannel channel = card.getBasicChannel();

CommandAPDU commandAPDU = new CommandAPDU(command);

ResponseAPDU responseAPDU = channel.transmit(commandAPDU);

} catch (CardException e) {

e.printStackTrace();

}

4.2.7. Transmitting Control Commands

If the card is connected successfully, call transmitControlCommand() from the Card object to transmit control commands. int controlCode = BluetoothTerminalManager.IOCTL_ESCAPE;

try {

Card card = terminal.connect("direct");

card.transmitControlCommand(controlCode, command);

} catch (CardException e) {

e.printStackTrace();

}

4.2.8. Disconnecting from BLE Card Terminal

The library connects BLE card terminal automatically when calling connect() from the CardTerminal object. To terminate the Bluetooth connection manually, call disconnect() from

BluetoothTerminalManager object. mManager.disconnect(terminal);

AMR220-C1 – Reference Manual

Version 1.02

Page 20 of 69 [email protected] www.acs.com.hk

5.0. Command Set

5.1. API between Tablet and AMR220-C1

Note : This section is only for the developers who will not use the ACS BT Library for the development of their own application. If you are using the ACS BT Library, please ignore this Section.

5.1.1. BT Communication Frame format

There is a defined frame format for communication between AMR220-C1 and the tablet.

The format is defined below:

STX

(0x02)

Data

Len

MSB

Data

Len

LSB

Sequence

Number

Frame

Type

Data Field CheckSum

(N Bytes)

Where :

STX Start of Text, must equal to 0x02

Data Len MSB Length of the Data Field, MSB (1 Byte)

Data Len LSB Length of the Data Field, LSB (1 Byte)

Sequence Number Sequence number for BT Message, increases per message, bit 7 indicates whether it is chaining or not (“1” = chaining package, “0” = end package)

Frame Type Communicate Frame type

Data Frame without Encrypt = 0x00 Encrypted Data Frame = 0x01

ACK Frame = 0x02

Abort Frame = 0x04

NAK Frame = 0x03

INT Frame = 0x05

Inter character timeout Frame = 0xF1

Data Len Error Frame = 0xF3

Checksum Incorrect Frame = 0xF2

Data Field: Message Body (N Bytes), Data Encrypt part

Checksum : XOR {Data Len MSB, Data Len LSB, Sequence Number, Frame Type,

Data Field}

AMR220-C1 – Reference Manual

Version 1.02

Page 21 of 69 [email protected] www.acs.com.hk

Status Reply ：

1. Received, or Chaining Accepted - ACK

Reply format:

0x02 0x00 0x00 Seq 0x02 CS

After the ACK Reply, Response Frame will be followed.

2. Receiving failure - Negative Acknowledgment - NAK

Reply format:

0x02 0x00 0x00 Seq 0x03 CS

3. Inter character timeout - the timeout value between each byte (for example 5ms)

Reply format:

0x02 0x00 0x00 Seq 0xF1 CS

4. Checksum checking - Checksum is incorrect

Reply format:

0x02 0x00 0x00 Seq 0xF2 CS

5. Data Length Error - Data length is over the maximum limit

Reply format:

0x02 0x00 0x00 Seq 0xF3 CS

5.1.2. Data Field Format – Command

This section defines the data field content format on the command frame

INS

(1 Byte)

Counter

(1 Byte)

Data Field

Command

Payload Length (2 bytes)

Command Payload

(N Bytes)

(1 Byte)

Where:

INS Command Header (1 byte)

The command header for specific the command feature

Counter Counter for protection against replay attack (1 byte)

Increment per command, for protection against replay attack

Command Payload Length Length of the Command Payload (2 bytes)

Command Payload Message on the command (N bytes)

CS Checksum, XOR {INS, Counter, Command Payload Length,

Command Payload}

AMR220-C1 – Reference Manual

Version 1.02

Page 22 of 69 [email protected] www.acs.com.hk

5.1.3. Data Field Format – Response

This section defines the data field content format on the response frame

RSP

(1 Byte)

Counter

(1 Byte)

Data Field

Response

Payload Length

(2 bytes)

Response Payload

(N Bytes)

Byte)

Where:

RSP Response Header (1 byte)

The response header for specific the command header

Counter Counter for protection against replay attack (1 byte)

Increment per Response

Response Payload Length Length of the Response Payload (2 bytes)

Response Payload Message on the Response (N bytes)

CS Checksum, XOR {INS, Counter, Response Payload Length,

Response Payload}

AMR220-C1 – Reference Manual

Version 1.02

Page 23 of 69 [email protected] www.acs.com.hk

5.1.4. BT Commands and Responses

5.1.4.1. Commands (From Smart Device to AMR220-C1)

Command Name Description

SPH_to_RDR_EmvExchangeData Exchanges data between smart device and EMV L2 kernel

SPH_to_RDR_PcdPowerOn

SPH_to_RDR_PcdPowerOff

SPH_to_RDR_PcdExAPDU

SPH_to_RDR_IccPowerOn

Asks AMR220-C1 to poll PCD tag within the period defined

Asks AMR220-C1 to deselect the activated PCD tag

Asks AMR220-C1 to exchange APDU with the activated PCD tag

Note : SPH_to_RDR_PcdPowerOn must be completed first.

Asks AMR220-C1 to activate ICC/SAM card

SPH_to_RDR_IccPowerOff

SPH_to_RDR_IccExAPDU

Asks AMR220-C1 to power off the activated ICC/SAM card

Asks AMR220-C1 to exchange APDU with the activated ICC/SAM card

Note : SPH_to_RDR_IccPowerOn must be completed first.

SPH_to_RDR_IccSetParameter Asks AMR220-C1 to do PPS with the activated ICC/SAM card

Note : SPH_to_RDR_IccPowerOn must be completed first.

SPH_to_RDR_ExEscape Asks AMR220-C1 to exchange Escape

Command to control/configure peripherals

Table 3 : BT Commands From Smart Device to AMR220-C1

INS

0x44

0x80

0x81

0x82

0xA0

0xA1

0xA2

0xA3

0xC0

AMR220-C1 – Reference Manual

Version 1.02

Page 24 of 69 [email protected] www.acs.com.hk

5.1.4.1.1. SPH_to_RDR_PcdPowerOn

This command asks AMR220-C1 to poll PCD tag within the period defined.

Offset Field

0 INS

Counter

Command Payload

Length

Size

Value

0x80

0x0006

Description

Command Header

Command Counter

Length of the Command Payload

4 Command Payload 6

Byte 1 – Card Type

Bit 0 = 0 – Disable Type A Polling

1 – Enable Type A polling

Bit 1 = 0 – Disable Type B Polling

1 – Enable Type B polling

Bit 2 = 0 – Disable FeliCa212 Polling

1 – Enable FeliCa212 polling

Bit 3 = 0 – Disable FeliCa424 Polling

1 – Enable FeliCa424 polling

Bit 4-6 = RFU

Bit 7 = 0 – No RATS send

1 – RATS Send Automatically

Byte 2 – Polling Retry

Byte 3 – 6 – Polling interval

Interval between each polling

(unit: 1ms)

10 CS 1 XOR for the above field

The response to this message is RDR_to_SPH_PcdPowerOnRsp

AMR220-C1 – Reference Manual

Version 1.02

Page 25 of 69 [email protected] www.acs.com.hk

5.1.4.1.2. SPH_to_RDR_PcdPowerOff

This command asks AMR220-C1 to deselect the activated PCD tag.

Offset Field

0 INS

Counter

Command Payload

Length

Size Value

1 0x81

2 0x0000

Description

Command Header

Command Counter

Length of the Command

Payload

4 Command Payload 0 -

4 CS 1 XOR for the above field

The response to this message is RDR_to_SPH_PcdPowerOffRsp

5.1.4.1.3. SPH_to_RDR_PcdExAPDU

This command asks AMR220-C1 to exchange APDU with the activated PCD tag.

Note : SPH_to_RDR_PcdPowerOn must be completed first.

Offset Field

0 INS

Counter

Command Payload

Length

Size Value

1 0x82

2 N

Description

Command Header

Command Counter

Length of the Command

Payload

4 Command Payload N APDU to activated PCD tag

N+4 CS 1 XOR for the above field

The response to this message is RDR_to_SPH_PcdExAPDURsp

AMR220-C1 – Reference Manual

Version 1.02

Page 26 of 69 [email protected] www.acs.com.hk

5.1.4.1.4. SPH_to_RDR_IccPowerOn

This command asks AMR220-C1 to activate the ICC/SAM card.

Offset Field

0 INS

Counter

Command Payload

Length

Size Value

1 0xA0

2 0x0001

Description

Command Header

Command Counter

Length of the Command

Payload

4 Command Payload 1

ICC Slot select

0x01 = ICC Slot

5 CS 1 XOR for the above field

The response to this message is RDR_to_SPH_IccPowerOnRsp

5.1.4.1.5. SPH_to_RDR_IccPowerOff

This command asks AMR220-C1 to power off the activated ICC/SAM card.

Offset Field

0 INS

Counter

Command Payload

Length

Size Value

1 0xA1

2 0x0001

Description

Command Header

Command Counter

Length of the Command

Payload

4 Command Payload 1

ICC Slot select

0x01 = ICC Slot

5 CS 1 XOR for the above field

The response to this message is RDR_to_SPH_IccPowerOffRsp

AMR220-C1 – Reference Manual

Version 1.02

Page 27 of 69 [email protected] www.acs.com.hk

5.1.4.1.6. SPH_to_RDR_IccExAPDU

This command asks AMR220-C1 to exchange APDU with the activated ICC/SAM card.

Note : SPH_to_RDR_IccPowerOn must be completed first.

Offset Field

0 INS

Counter

Command Payload

Length

Size Value

1 0xA2

2 N

Description

Command Header

Command Counter

Length of the Command Payload

4 Command Payload N

Byte 1 - ICC Slot select

0x01 = ICC Slot

Byte 2 - … - APDU

APDU to activated ICC card

XOR for the above field N+4 CS 1

The response to this message is RDR_to_SPH_IccExAPDURsp

5.1.4.1.7. SPH_to_RDR_IccSetParameter

This command asks AMR220-C1 to do PPS with the activated ICC/SAM card.

Note : SPH_to_RDR_IccPowerOn must be completed first.

Offset Field

0 INS

Counter

Command Payload

Length

Size

Value

0xA3

Description

Command Header

Command Counter

Length of the Command Payload

4 Command Payload 5

Byte 1 - ICC Slot select

0x01 = ICC Slot

Byte 2 - 5 - PPS

XOR for the above field 9 CS 1

The response to this message is RDR_to_SPH_IccSetParameterRsp.

AMR220-C1 – Reference Manual

Version 1.02

Page 28 of 69 [email protected] www.acs.com.hk

5.1.4.1.8. SPH_to_RDR_ExEscape

This command asks AMR220-C1 to exchange Escape command to control/configure the peripherals.

Offset Field

0 INS

Counter

Command Payload

Length

Size Value

1 0xC0

2 5

Description

Command Header

Command Counter

Length of the Command Payload

4 Command Payload N Escape command

N+4 CS 1 XOR for the above field

The response to this message is RDR_to_SPH_ExEscapeRsp

AMR220-C1 – Reference Manual

Version 1.02

Page 29 of 69 [email protected] www.acs.com.hk

5.1.4.2. Responses (From AMR220-C1 to Smart Device)

Response Name Description

RDR_to_SPH_EmvExchangeData

RDR_to_SPH_PcdPowerOnRsp

RDR_to_SPH_PcdPowerOffRsp

RDR_to_SPH_PcdExAPDURsp

Response for SPH_to_RDR_EmvExchangeData

Response for SPH_to_RDR_PcdPowerOn

Response for SPH_to_RDR_PcdPowerOff

Response for SPH_to_RDR_PcdExAPDU

RDR_to_SPH_IccPowerOnRsp

RDR_to_SPH_IccPowerOffRsp

Response for SPH_to_RDR_IccPowerOn

Response for SPH_to_RDR_IccPowerOff

RDR_to_SPH_IccExAPDURsp Response for SPH_to_RDR_IccExAPDU

RDR_to_SPH_IccSetParameterRsp Response for SPH_to_RDR_IccSetParameter

RDR_to_SPH_ExEscapeRsp Response for SPH_to_RDR_ExEscape

Table 4 : BT Responses From AMR220-C1 to Smart Device

5.1.4.2.1. RDR_to_SPH_PcdPowerOnRsp

This command is a response to SPH_to_RDR_PcdPowerOn.

Offset Field Size Value Description

RSP

Counter

Response Payload

Length

0x90

Response Header

Response Counter

Length of the Response Payload

0x92

0xB0

0xB1

0xB2

INS

0x54

0x90

0x91

0xB3

0xD0

N+4

Response Payload

Byte 1 – Error Code

0x00 = No Error

Other = ref to Error Code table

Byte 2 - … - Card ATR

XOR for the above field

AMR220-C1 – Reference Manual

Version 1.02

Page 30 of 69 [email protected] www.acs.com.hk

5.1.4.2.2. RDR_to_SPH_PcdPowerOffRsp

This command is a response to SPH_to_RDR_PcdPowerOff.

Offset Field

0 RSP

Counter

Response Payload

Length

Size Value

1 0x91

Description

Response Header

Response Counter

0x0001 Length of the Response Payload

4 Response Payload 1

0x00 = No Error

Other = ref to Error Code table

5 CS 1 XOR for the above field

5.1.4.2.3. RDR_to_SPH_PcdExAPDURsp

This command is a response to RDR_to_SPH_PcdExAPDURsp.

Offset Field

0 RSP

Size Value

1 0x92

Description

Response Header

1 1 Response Counter

Counter

Response Payload

Length

2 N Length of the Response Payload

N+4

Response Payload

Byte 1 – Error Code

0x00 = No Error

Other = ref to Error Code table

Byte 2 - … - APDU Response

XOR for the above field

AMR220-C1 – Reference Manual

Version 1.02

Page 31 of 69 [email protected] www.acs.com.hk

5.1.4.2.4. RDR_to_SPH_IccPowerOnRsp

This code is a response to SPH_to_RDR_IccPowerOn.

Offset Field

0 RSP

Counter

Response Payload

Length

Size Value

1 0xB0

2 N

Response Payload

Description

Response Header

Response Counter

Length of the Response Payload

4 Response Payload N

N+4 CS 1

5.1.4.2.5. RDR_to_SPH_IccPowerOffRsp

This command is a response to SPH_to_RDR_IccPowerOff.

Byte 1 - ICC Slot select

0x01 = ICC Slot

Byte 2 – Error Code

0x00 = No Error

Other = ref to Error Code table

Byte 3 - … - Card ATR

XOR for the above field

Offset Field

0 RSP

Counter

Response Payload

Length

Size Value

1 0xB1

2 0x0002

Description

Response Header

Response Counter

Length of the Response Payload

Byte 1 - ICC Slot select

0x01 = ICC Slot

Byte 2 – Error Code

0x00 = No Error

Other = ref to Error Code Table

XOR for the above field

AMR220-C1 – Reference Manual

Version 1.02

Page 32 of 69 [email protected] www.acs.com.hk

5.1.4.2.6. RDR_to_SPH_IccExAPDURsp

This command is a response to SPH_to_RDR_IccExAPDU.

Offset Field

0 RSP

Counter

Response Payload

Length

Size Value

1 0xB2

2 N

Description

Response Header

Response Counter

Length of the Response Payload

4 Response Payload N

Byte 1 - ICC Slot select

0x01 = ICC Slot

Byte 2 – Error Code

0x00 = No Error

Other = ref to Error Code table

Byte 3 - … - APDU Response

XOR for the above field N+4 CS 1

5.1.4.2.7. RDR_to_SPH_IccSetParameterRsp

This command is a response to SPH_to_RDR_IccSetParameter.

Offset Field

0 RSP

Counter

Response Payload

Length

Size Value

1 0xB3

2 N

Description

Response Header

Response Counter

Length of the Response Payload

N+4

Response Payload

Byte 1 - ICC Slot select

0x01 = ICC Slot

Byte 2 – Error Code

0x00 = No Error

Other = ref to Error Code table

Byte 3 - … - PPS Response

XOR for the above field

AMR220-C1 – Reference Manual

Version 1.02

Page 33 of 69 [email protected] www.acs.com.hk

5.1.4.2.8. RDR_to_SPH_ExEscapeRsp

This command is a response to SPH_to_RDR_ExEscape.

Offset Field

0 RSP

Counter

Response Payload

Length

Size Value

1 0xD0

2 N

Description

Response Header

Response Counter

Length of the Response Payload

4 Response Payload

N+4 CS

Escape Command Response

XOR for the above field

AMR220-C1 – Reference Manual

Version 1.02

Page 34 of 69 [email protected] www.acs.com.hk

5.2. Contactless Smart Card Protocol

5.2.1. ATR Generation

The ATR for PICC interface followed PCSC Specification

Note : For more information, refer to http://pcscworkgroup.com/Download/Specifications/pcsc3_v2.01.09.pdf.

5.2.1.1. ATR format for ISO 14443 Part 3 PICCs.

Byte

Value

(Hex)

0x3B

Designation

Initial

0x8N

0x80

TD1

Description

Higher Nibble “8” means:

• TA1, TB1, and TC1 Absent, TD1 available

Lower Nibble “N” means:

• the number of historical bytes

Higher Nibble “8” means:

• TA2, TB2 and TC2 Absent, TD2 available

Lower nibble “0” means:

• Support Protocol T = 0

3+N

4+N

0x01

0x80

0x4F

0x0C

RID

C0 .. C1

0x00 0x00

TD2

…

RFU

TCK

Higher nibble “0” means:

• TA3, TB3, TC3 and TD3 Absent

Lower nibble “1” means:

• Support Protocol T = 1

Category indicator byte

“80 means” A status indicator may be present in an optional COMPACT-TLV data object

Application identifier Presence Indicator

Length

Registered Application Provider Identifier (RID)

Equal to “0xA0 0x00 0x00 0x03 0x06”

Byte for Standard

Bytes for Card Name

RFU

Exclusive-or of all the bytes T0 to Tk

E.g. ATR for Mifare 1K = {0x3B 0x8F 0x80 0x01 0x80 0x4F 0x0C 0xA0 0x00 0x00 0x03 0x06 0x03

0x00 0x01 0x00 0x00 0x00 0x00 0x6A}

Length (YY) = 0x0C

RID = {0xA0 0x00 0x00 0x03 0x06} (PC/SC Workgroup)

Standard (SS) = 0x03 (ISO14443A, Part 3)

Card Name (C0 .. C1) = {0x00 0x01} (Mifare 1K)

AMR220-C1 – Reference Manual

Version 1.02

Page 35 of 69 [email protected] www.acs.com.hk

Standard (SS)

0x03: ISO14443A, Part 3

Card Name (C0 .. C1)

0x11: FeliCa

0x00 0x01: Mifare 1K

0x00 0x02: Mifare 4K

0x00 0x03: Mifare Ultralight 0x00 0x39: Mifare Plus SL2_4K

0x00 0x26: Mifare Mini

0x00 0x30: Topaz

0x00 0x3B: FeliCa

0x00 0x38: Mifare Plus SL2_2K

0xFF [SAK]: undefined tags

5.2.1.2. ATR format for ISO 14443 Part 4 PICCs.

Byte

Value

(Hex)

Designation

0 0x3B Initial

1 0x8N T0

4 to

3 + N

0x80

0x01

TD1

TD2

…

Description

Higher Nibble “8” means:

• TA1, TB1 and TC1 Absent, TD1 available

Lower Nibble “N” means:

• the number of historical bytes

Higher Nibble “8” means:

• TA2, TB2 and TC2 Absent,TD2 available

Lower Nibble “0” means:

• Support Protocol T = 0

Higher Nibble “0” means:

• TA3, TB3, TC3, TD3 Absent

Lower Nibble “1” means:

• Support Protocol T = 1

Historical Bytes:

ISO14443A:

The historical bytes from ATS response.

Refer to the ISO14443-4 specification.

ISO14443B:

Byte1-4

Application

Data from

ATQB

Byte5-7

Protocol

Info Byte from ATQB

Byte8

Higher Nibble =

MBLI from ATTRIB command

Lower Nibble (RFU)

= 0

4+N UU TCK Exclusive-oring of all the bytes T0 to Tk

E.g. 1. ATR for Desfire = {0x3B 0x81 0x80 0x01 0x80 0x80} // 6 bytes of ATR

Note : Use the APDU “0xFF 0xCA 0x01 0x00 0x00” to distinguish the ISO14443A-4 and ISO14443B-4

PICCs, and retrieve the full ATS if available. ISO14443A-3 and ISO14443B-3/4 PICCs do have ATS returned.

AMR220-C1 – Reference Manual

Version 1.02

Page 36 of 69 [email protected] www.acs.com.hk

APDU Command = 0xFF 0xCA 0x01 0x00 0x00

APDU Response = 0x06 0x75 0x77 0x81 0x02 0x80 0x90 0x00

ATS = { 0x06 75 77 81 02 80 }

E.g. 2. ATR for EZ-link = {0x3B 0x88 0x80 0x01 0x1C 0x2D 0x94 0x11 0xF7 0x71 0x85 0x00 0xBE}

Application Data of ATQB = 0x1C 0x2D 0x94 0x11

Protocol Information of ATQB = 0xF7 0x71 0x85

MBLI of ATTRIB = 0x00

5.2.2. Pseudo APDUs for Contactless Interface

5.2.2.1. Get Data Command

The Get Data command retrieves information about the inserted command depending on the inserted card. It can be used for kind of contactless cards.

Get Data Command Format (5 Bytes)

Command

Get Data

Class

0xFF

INS

0xCA

0x00

0x01

If P1 = 0x00, UID Response Format (UID + 2 bytes)

Response Data Out

Result

UID

(LSB)

… …

UID

(MSB)

0x00

SW1

0x00

SW2

If P1 = 0x01, ATS of a ISO 14443 A card Response Format (ATS + 2 bytes)

Response Data Out

Result ATS SW1

Response Codes

Results

Success

Warning

Error

SW1

0x90

0x62

0x6C

0x63

0x6A

SW2

0x00

0x82

0x00

0x81

Meaning

SW2

The operation is completed successfully.

End of UID/ATS reached before Le bytes

(Le is greater than UID Length).

Wrong length (wrong number Le: ‘XX’ encodes the exact number) if Le is less than the available UID length.

The operation failed.

The function is not supported

AMR220-C1 – Reference Manual

Version 1.02

Page 37 of 69 [email protected] www.acs.com.hk

5.2.2.2. PCSC 2.0 part 3 (version 2.02 or above) Related APDU

PCSC2.0 part 3 commands are used to transparently pass data from an application to a contactless tag, return the received data transparently to the application, and perform protocol switch simultaneously.

5.2.2.2.1. Command and Response APDU Format

Command Format:

CLA

0xFF

INS

0xC2

0x00

P2 Lc Data In

Function DataLen Data[DataLen]

Functions 1 Byte

0x00 = Manage Session

0x01 = Transparent Exchange

0x02 = Switch Protocol

Other = RFU

Response Format:

Data Out

Data Field BER-TLV encoded

SW1 SW2

Every command returns SW1 and SW2 together with the response data field (if available). SW1 SW2 is according to ISO 7816. SW1 SW2 from the following C0 data object should also be used.

The C0 data element format:

Tag Length (1btye) SW2

0xC0 0x03 Error Status

Error Status Description

Error Status

XX SW1 SW2

Description

XX = number of the bad data object in the APDU

00 = general error of APDU

01 = error in the 1 st

02 = error in the 2 nd data object

data object

0x00 0x90 0x00 No error occurred

XX 0x62 0x82 Data object XX warning, requested information not available

XX 0x63 0x00

XX 0x63 0x01

XX 0x6A 0x81

No information

Execution stopped due to failure in other data object

Data object XX not supported

AMR220-C1 – Reference Manual

Version 1.02

Page 38 of 69 [email protected] www.acs.com.hk

Error Status

XX 0x67 0x00

XX 0x6A 0x80

XX 0x64 0x00

Description

Data object XX with unexpected length

Data object XX with unexpected vale

Data Object XX execution error (no response from IFD)

XX 0x64 0x01

XX 0x6F 0x00

Data Object XX execution error (no response from ICC)

Data object XX failed, no precise diagnosis

The first value byte indicates the number of the erroneous data object XX and the last two bytes indicate the explanation of the error. Further SW1 SW2 values, according to ISO 7816, are allowed.

If there are more than one data object in the C-APDU field and one data object failed, IFD can process the following data objects if they do not depend on the failed data objects.

5.2.2.2.2. Manage Session Command

Manage Session Commands are used to manage the transparent session, including starting a transparent session, ending a transparent session, managing the operation environment, and managing the capabilities of the IFD within the transparent session.

Manage Session Command

Command

ManageSession

Class

0xFF

INS

0xC2

0x00

DataLen

Data In

DataObject

(N bytes)

Where:

Data Object (1 Byte)

Tag

0x80

Data Object

Version data Object

0x81

0x82

0x83

0x84

0x5F46

0xFF6D

0xFF6E

Start Transparent Session

End Transparent Session

Turn Off RF Field

Turn On RF Field

Timer

Get Parameter

Set Parameter

AMR220-C1 – Reference Manual

Version 1.02

Page 39 of 69 [email protected] www.acs.com.hk

Manage Session Response Data Object

Tag Data Object

0xC0 Generic Error status

0x80

0xFF6D

Version data object

IFD parameter data object

5.2.2.2.2.1. Start Session Data Object

This command starts a transparent session. Auto-polling is disabled from start to end of the session.

Start Session Data Object

Tag Length (1btye) Value

0x81 0x00 -

5.2.2.2.2.2. End Session Data Object

This command ends the transparent session. Auto-polling will be reset.

End Session Data Object

Tag

0x82

Length (1btye)

0x00

Value

5.2.2.2.2.3. Version Data Object

This command returns the version number of the IFD handler.

Version Data Object

Tag Length (1btye)

0x80 0x03

Value

Major Minor Build

5.2.2.2.2.4. Turn Off the RF Data Object

This command turns off the antenna field.

Turn off the RF field Data Object

Tag Length (1btye)

0x83 0x00

Value

AMR220-C1 – Reference Manual

Version 1.02

Page 40 of 69 [email protected] www.acs.com.hk

5.2.2.2.2.5. Turn On the RF Data Object

This command turns on the antenna field.

Turn on the RF field Data Object

Tag Length (1btye) Value

0x84 0x00 -

5.2.2.2.2.6. Timer Data Object

This command creates a 32-bit timer data object (unit of 1us).

For example, if there is timer data object with 5000us between RF turn off data object and RF turn on data object, the reader will turn off the RF field at about 5000us and then turn it on again.

Timer Data Object

Tag Length (1btye)

0x5F46 0x04

Value

Timer (4bytes)

5.2.2.2.2.7. Get Parameter Data Object

This command get different parameters from the IFD.

Get Parameter Data Object

Tag Length (1btye)

0xFF6D Var

Tag

Value

Len Value

TLV_Objects

TLV_Objects:

Parameters Requested Tag Length

Frame size for IFD integer (FSDI)

Frame size for ICC integer (FSCI)

Frame waiting time integer (FWTI)

Max. Communication Speed supported by the IFD

Communication Speed of the ICC

Modulation Index

PCB for ISO/IEC14443

CID for ISO/IEC14443

NAD for ISO/IEC14443

0x05

0x06

0x07

0x08

0x09

0x01

0x02

0x03

0x04

0x00

AMR220-C1 – Reference Manual

Version 1.02

Page 41 of 69 [email protected] www.acs.com.hk

Parameters Requested Tag Length

0x00 Param 1 – 4 for for ISO/IEC14443 type B

5.2.2.2.2.8. Set Parameter Data Object

Set different parameters from the IFD.

Set Parameter Data Object

Tag Length (1btye)

Tag

Value

Len Value

0xFF6E Var TLV_Objects

TLV_Objects:

0x0A

Parameters Requested Tag Length

Frame size for IFD integer (FSDI)

Frame size for ICC integer (FSCI)

Frame waiting time integer (FWTI)

Max. Communication Speed supported by the IFD

Communication Speed of the PICC

Modulation Index

PCB for ISO/IEC14443

CID for ISO/IEC14443

NAD for ISO/IEC14443

Param 1 – 4 for for ISO/IEC14443 type B

0x05

0x06

0x07

0x08

0x01

0x02

0x03

0x04

0x09

0x0A

0x01

0x04

5.2.2.2.3. Transparent Exchange Command

Transparent Exchange Commands are used to transmit and receive any bit or bytes from ICC.

Transparent Exchange Command

Command

TranspEx

Class

0xFF

INS

0xC2

0x00

0x01

DataLen

Data In

DataObject

(N bytes)

AMR220-C1 – Reference Manual

Version 1.02

Page 42 of 69 [email protected] www.acs.com.hk

Where:

Data Object (1 Byte)

Tag

0x90

Data Object

Transmission and Reception Flag

0x91

0x92

Transmission Bit Framing

Reception Bit Framing

0x93

0x94

0x95

0xFF6D

Transmit

Receive

Transceive – Transmit and Receive

Get Parameter

0xFF6E Set Parameter

Transparent Exchange Response Data Object

Tag Data Object

0xC0 Generic Error status

0x92

0x96

0x97

0xFF6D

Number of valid bits in the last byte of received data

Response Status

ICC response

IFD parameter data object

5.2.2.2.3.1. Transmission and Reception Flag Data Object

Defines the framing and RF parameters for the following transmission.

Transmission and Reception Flag Data Object

Tag

0x90

Length (1btye)

0x02 bit

Value

Description

0 – append CRC in the transmit data

1 – do not append CRC in the transmit data

0 – discard CRC from the received data

1 – do not discard CRC from the received data (i.e. no CRC checking)

0 – insert parity in the transmit data

1 – do not insert parity

0 – expect parity in received date

1 – do not expect parity (i.e. no parity checking)

AMR220-C1 – Reference Manual

Version 1.02

Page 43 of 69 [email protected] www.acs.com.hk

Tag Length (1btye) bit

Value

Description

0 – append protocol prologue in the transmit data or discard from the response

1 – do not append or discard protocol prologue if any (e.g. PCB,

CID, NAD)

5-15 RFU

5.2.2.2.3.2. Transmission bit Framing Data Object

Defines the number of valid bits of the last byte of data in the transmit or transceive.

Transmission bit Framing Data Object

Tag

0x91

Length (1btye)

0x01 bit

Value

Description

0-2 Number of valid bits of the last byte (0 means all bits are valid)

3-7 RFU

Transmission bit framing data object shall be together with “transmit” or “transceive” data object only.

If this data object is absent, it means all bits are valid.

5.2.2.2.3.3. Reception bit Framing Data Object

For the command APDU, this data object is used to define the number of expected valid bits of the last byte of data received.

For the response APDU, this data object is used to mention the number of valid bits in the last byte of received data.

Reception bit Framing Data Object

Tag

0x92

Length (1btye)

0x01 bit

Value

Description

0-2 Number of valid bits of the last byte (0 means all bits are valid)

3-7 RFU

If this data object is absent, it means all bits are valid.

AMR220-C1 – Reference Manual

Version 1.02

Page 44 of 69 [email protected] www.acs.com.hk

5.2.2.2.3.4. Transmit Data Object

To transmit the data from IFD to the ICC, no response is expected from the ICC after transmission is completed.

Transmit Data Object

Tag Length (1btye)

0x93 DataLen

Value

Data (N bytes)

5.2.2.2.3.5. Receive Data Object

To force the reader into receiving mode within the time, which is given in the following timer object.

Receive Data Object

Tag Length (1btye)

0x94 0x00

Value

5.2.2.2.3.6. Transceive Data Object

This is for transmitting and receiving data from the ICC. After transmission is complete, the reader will wait until the time which is given in timer data object.

If no timer data object is defined in the data field, then the reader will wait for the time given in the Set parameter FWTI data object.

If no FWTI is set, then the reader will wait about 302us

Transceive Data Object

Tag Length (1btye) Value

0x95 DataLen Data (N Bytes)

5.2.2.2.3.7. Response Status Data Object

This notifies about the received data status inside the response.

Response Status Data Object

Tag Length (1btye)

0x96 0x02

Bit

Value

Byte 0

Description

0 – CRC is OK or no checked

1 – CRC check fail

0 – no collision

1 – collision detected

Byte 1

If collision is detected, these bytes will tell the collision position. Otherwise,

“00h” will be shown

AMR220-C1 – Reference Manual

Version 1.02

Page 45 of 69 [email protected] www.acs.com.hk

Tag Length (1btye)

Bit

Value

Byte 0

Description

0 – no parity error

1 – parity error detected

0 – no framing error

1 – framing error detected

4 - 7 RFU

Byte 1

5.2.2.2.3.8. Response Data Object

Notifies about the received data inside the response.

Response Data Object

Tag Length (1btye)

0x97 DataLen

Value

ReplyData (N Byte)

5.2.2.2.4. Switch Protocol Command

Used for specific protocol and different layers of the standard within the transparent session.

Switch Protocol Command

Command

SwProtocol

Class

0xFF

INS

0xC2

0x00

0x02

DataLen

Data In

DataObject

(N bytes)

Where:

Data Object (1 Byte)

Tag

0x8F

Data Object

Switch Protocol Data Object

0xFF6D

0xFF6E

Get Parameter

Set Parameter

Switch Protocol Response Data Object

Tag

0xC0

Data Object

Generic Error status

0xFF6D IFD parameter data object

AMR220-C1 – Reference Manual

Version 1.02

Page 46 of 69 [email protected] www.acs.com.hk

5.2.2.2.4.1. Switch Protocol Data Object

Used for specific protocol and different layers of the standard

Switch Protocol Data Object

Tag Length (1btye)

Byte 0

0x8F 0x02

Value

Byte 1

0x00 – ISO/IEC14443 Type A

0x01 – ISO/IEC14443 Type B

0x03 – FeliCa

Other – RFU

0x00 – if no layer separation

0x02 – Switch to Layer 2

0x03 – Switch or activate to layer 3

0x04 – activate to layer 4

Other - RFU

5.2.2.2.5. PCSC 2.0 part 3 Example

Step 1. Start Transparent Session

Command: 0xFF 0xC2 0x00 0x00 0x02 0x81 0x00

Response: 0xC0 0x03 0x00 0x90 0x00 0x90 0x00

Step 2. Antenna Field On

Command: 0xFF 0xC2 0x00 0x00 0x02 0x84 0x00

Response: 0xC0 0x03 0x00 0x90 0x00 0x90 0x00

AMR220-C1 – Reference Manual

Version 1.02

Page 47 of 69 [email protected] www.acs.com.hk

Step 3. ISO14443-4A Active

Command: 0xFF 0xC2 0x00 0x02 0x04 0x8F 0x02 0x00 0x04

Response: 0xC0 0x03 0x01 0x64 0x01 0x90 0x00 (if no card present)

0xC0 0x03 0x00 0x90 0x00 0x5F 0x51 [ATR] 0x90 0x00

Step 4. Set the PCB to 0x0A and enable the CRC, parity and protocol prologue in the transmit data

Command: 0xFF 0xC2 0x00 0x01 0x0A 0x90 0x02 0x00 0x00 0xFF 0x6E 0x03 0x07 0x01

0x0A

Response: 0xC0 0x03 0x00 0x90 0x00 0x90 0x00

Step 5. Send the APDU “ 0x80 0xB2 0x00 0x00 0x08 ” to card and get response

Command: 0xFF 0xC2 0x00 0x01 0x0E 0x5F 0x46 0x04 0x40 0x42 0x0F 0x00 0x95 0x05

0x80 0xB2 0x00 0x00 0x08

Response: 0xC0 0x03 0x00 0x90 0x00 0x92 0x01 0x00 0x96 0x02 0x00 0x00 0x97 0x0C

[Card Response] 0x90 0x00

AMR220-C1 – Reference Manual

Version 1.02

Page 48 of 69 [email protected] www.acs.com.hk

Step 6. End Transparent Session

Command: 0xFF 0xC2 0x00 0x00 0x02 0x82 0x00

Response: 0xC0 0x03 0x00 0x90 0x00 0x90 0x00

AMR220-C1 – Reference Manual

Version 1.02

Page 49 of 69 [email protected] www.acs.com.hk

5.2.2.3. PICC Commands (T=CL Emulation) for Mifare 1K/4K MEMORY Cards

5.2.2.3.1. Load Authentication Keys

The “Load Authentication Keys” command loads the authentication keys into the reader. The authentication keys are used to authenticate the particular sector of the Mifare 1K/4K Memory Card.

Only volatile key location is available for AMR220-C1.

Load Authentication Keys APDU Format (11 Bytes)

Command

Load

Authentication

Keys

Class

0xFF

INS

0x82

Key

Structure

Key

Number

0x06

Data In

Key

(6 bytes)

Key Structure (1 Byte):

0x00 = Key is loaded into the reader volatile memory.

Key Number (1 Byte):

0x00 ~ 0x01 = Volatile memory for storing a temporally key. The key disappears once the reader is disconnected from the PC. Two volatile keys are provided. The volatile key can be used as a session key for different sessions.

Default Value = {0xFF 0xFF 0xFF 0xFF 0xFF 0xFF}

Key (6 Bytes):

The key value loaded into the reader. E.g. {0xFF 0xFF 0xFF 0xFF 0xFF 0xFF}

Load Authentication Keys Response Format (2 bytes)

Response

Result

Data Out

SW1 SW2

Load Authentication Keys Response Codes

Results SW1 SW2

Success 0x90 0x00

Meaning

The operation is completed successfully.

Error 0x63 0x00 The operation failed.

Example:

// Load a key { 0xFF 0xFF 0xFF 0xFF 0xFF FF } into the volatile memory location 0x00.

APDU = {0xFF 0x82 0x00 0x00 0x06 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF }

AMR220-C1 – Reference Manual

Version 1.02

Page 50 of 69 [email protected] www.acs.com.hk

5.2.2.3.2. Authentication for MIFARE 1K/4K

The “Authentication command” uses the keys stored in the reader to do authentication with the

MIFARE 1K/4K card. Two types of authentication keys are used: TYPE_A and TYPE_B.

Authentication APDU Format #1 (6 Bytes)

Command Class INS P1 P2 P3 Data In

Authentication 0xFF 0x88 0x00

Authentication APDU Format #2 (10 Bytes)

Command Class INS

Authentication 0xFF 0x86

0x00

Authenticate Data Bytes (5 Byte):

Byte1 Byte 2 Byte 3 Byte 4 Byte 5

Block

Number

0x00

Key Type

0x05

Key Number

Data In

Authenticate Data

Bytes

Version

0x01

0x00 Block

Number

Key

Type

Key

Number

Block Number (1 Byte):

The memory block to be authenticated

For Mifare 1K Card, it has totally 16 sectors and each sector consists of 4 consecutive blocks. E.g.

Sector 0x00 consists of Blocks {0x00, 0x01, 0x02 and 0x03}

Sector 0x01 consists of Blocks {0x04, 0x05, 0x06 and 0x07} the last sector 0x0F consists of Blocks {0x3C, 0x3D, 0x3E and 0x3F}

Once the authentication is done successfully, there is no need to do the authentication again, provided that the blocks to be accessed are belonging to the same sector. Please refer to the

Mifare 1K/4K specification for more details.

Note : Once the block is authenticated successfully, all the blocks belonging to the same sector are accessible.

Key Type (1 Byte):

0x60 = Key is used as a TYPE A key for authentication.

0x61 = Key is used as a TYPE B key for authentication.

Key Number (1 Byte):

0x00 ~ 0x01 = Volatile memory for storing keys. The keys disappear when the reader is disconnected from the PC. Two volatile keys are provided. The volatile key can be used as a session key for different sessions.

AMR220-C1 – Reference Manual

Version 1.02

Page 51 of 69 [email protected] www.acs.com.hk

Load Authentication Keys Response Format (2 bytes)

Response

Result

Data Out

SW1 SW2

Load Authentication Keys Response Codes

Results SW1 SW2

Success 0x90 0x00

Meaning

The operation is completed successfully.

Error 0x63 0x00 The operation failed.

MIFARE 1K Memory Map

Sectors

(Total 16 sectors)

(Each sector consists of 4 consecutive blocks)

Sector 0

Sector 1

…

Sector 14

Sector 15

MIFARE 4K Memory Map

Sectors

(Total 32 sectors)

(Each sector consists of 4 consecutive blocks)

Sector 0

Sector 1

…

Sector 30

Sector 31

Data Blocks

(3 blocks, 16 bytes per block)

0x00 ~ 0x02

0x04 ~ 0x06

…

0x38 ~ 0x0A

0x3C ~ 0x3E

Data Blocks

(3 blocks, 16 bytes per block)

0x00 ~ 0x02

0x04 ~ 0x06

…

0x78 ~ 0x7A

0x7C ~ 0x7E

Trailer Block

(1 block, 16 bytes)

0x03

0x07

…

0x3B

0x3F

Trailer Block

(1 block, 16 bytes)

0x03

0x07

…

0x7B

0x7F

Bytes

AMR220-C1 – Reference Manual

Version 1.02

Page 52 of 69 [email protected] www.acs.com.hk

Sectors

(Total 8 sectors)

(Each sector consists of 16 consecutive blocks)

Sector 32

Sector 33

…

Sector 38

Sector 39

Data Blocks

(15 blocks, 16 bytes per block)

0x80 ~ 0x8E

0x90 ~ 0x9E

…

0xE0 ~ 0xEE

0xF0 ~ 0xFE

Examples:

// to authenticate the Block 0x04 with a {TYPE A, key number 0x00 }

// PC/SC V2.01, Obsolete

APDU = {0xFF 0x88 0x00 0x04 0x60 0x00 };

Trailer Block

(1 block, 16 bytes)

0x8F

0x9F

…

0xEF

0xFF

// to authenticate the Block 0x04 with a {TYPE A, key number 0x00 }

// PC/SC V2.07

APDU = {0xFF 0x86 0x00 0x00 0x05 0x01 0x00 0x04 0x60 0x00 }

Note : MIFARE Ultralight does not need to do any authentication. The memory is free to access.

MIFARE Ultralight Memory Map

Byte Number

Serial Number

Internal / Lock

OTP

Data read/write

SN0

SN3

BCC1

OPT0

Data0

Data4

Data8

Data12

Data16

Data20

Data24

Data28

Data32

Data36

Data40

Data44

SN1

SN4

Internal

OPT1

Data1

Data5

Data9

Data13

Data17

Data21

Data25

Data29

Data33

Data37

Data41

Data45

SN2

SN5

Lock0

OTP2

Data2

Data6

Data10

Data14

Data18

Data22

Data26

Data30

Data34

Data38

Data42

Data46

BCC0

SN6

Lock1

OTP3

Data3

Data7

Data11

Data15

Data19

Data23

Data27

Data31

Data35

Data39

Data43

Data47

Page

64 bytes

Bytes

AMR220-C1 – Reference Manual

Version 1.02

Page 53 of 69 [email protected] www.acs.com.hk

5.2.2.3.3. Read Binary Blocks

The “Read Binary Blocks command” is used for retrieving multiple “data blocks” from the Mifare. The data block/trailer block must be authenticated first before executing the “Read Binary Blocks command”.

Read Binary APDU Format (5 Bytes)

Command Class INS P1 P2 Le

Read Binary

Blocks

0xFF 0xB0 0x00 Block

Number

Block Number (1 Byte):

The starting block

Number of Bytes to Read (1 Byte):

Multiply of 16 bytes for MIFARE 1K/4K or multiply of 4 bytes for MIFARE Ultralight

• Maximum 16 bytes for MIFARE Ultralight.

• Maximum 48 bytes for MIFARE 1K. (Multiple Blocks Mode; 3 consecutive blocks)

• Maximum 240 bytes for MIFARE 4K. (Multiple Blocks Mode; 15 consecutive blocks)

E.g.1: 0x10 (16 bytes) -> Read the starting block only. (Single Block Mode)

E.g.2: 0x40 (64 bytes) -> Read from the starting block to starting block + 3. (Multiple Blocks Mode)

Note : For safety reasons, the Multiple Block Mode is used for accessing Data Blocks only. The Trailer

Block is not supposed to be accessed in Multiple Blocks Mode. Please use Single Block Mode to access the Trailer Block.

Read Binary Block Response Format (Multiply of 4/16 + 2 bytes)

Response Data Out

Number of Bytes to Read

Result Data (Multiply of 4/16 Bytes) SW1 SW2

Read Binary Block Response Codes

Results

Success

Error

SW1

0x90

0x63

SW2

0x00

Meaning

The operation is completed successfully.

The operation failed.

Examples:

// Read 16 bytes from the binary block 0x04 (MIFARE 1K or 4K)

APDU = {0xFF 0xB0 0x00 0x04 0x10}

// Read 240 bytes starting from the binary block 0x80 (MIFARE 4K)

AMR220-C1 – Reference Manual

Version 1.02

Page 54 of 69 [email protected] www.acs.com.hk

// Block 0x80 to Block 0x8E (15 blocks)

APDU = {0xFF 0xB0 0x00 0x80 0xF0}

5.2.2.3.4. Update Binary Blocks

The “Update Binary Blocks command” is used for writing a multiple of “data blocks” into the Mifare.

The data block/trailer block must be authenticated first before executing the “Update Binary Blocks command”.

Update Binary APDU Format (Multiple of 16 + 5 Bytes)

Command

Update Binary

Blocks

Class

0xFF

INS

0xD6

0x00

Block

Number

Number of Bytes to Update

Data In

Block Data

(Multiple of 16

Bytes)

Block Number (1 Byte):

The starting block to be updated.

Number of Bytes to Update (1 Byte):

• Multiply of 16 bytes for MIFARE 1K/4K or 4 bytes for MIFARE Ultralight.

• Maximum 48 bytes for MIFARE 1K. (Multiple Blocks Mode; 3 consecutive blocks)

• Maximum 240 bytes for MIFARE 4K. (Multiple Blocks Mode; 15 consecutive blocks)

E.g.1: 0x10 (16 bytes) -> Write the starting block only. (Single Block Mode)

E.g.2: 0x30 (48 bytes) -> Write from the starting block to starting block + 2. (Multiple Blocks Mode)

Note : For safety reasons, the Multiple Block Mode is used for accessing Data Blocks only. The Trailer

Block is not supposed to be accessed in Multiple Blocks Mode. Please use Single Block Mode to access the Trailer Block.

Block Data (Multiply of 16 + 2 bytes, or 6 bytes):

The data to be written into the binary block/blocks.

Update Binary Block Response Codes (2 bytes)

Results

Success

SW1

0x90

SW2

0x00

Meaning

The operation is completed successfully.

Error 0x63 0x00 The operation failed.

Examples:

// Update the binary block 0x04 of MIFARE 1K/4K with Data {0x00 0x01 .. 0x0F}

APDU = {0xFF 0xD6 0x00 0x04 0x10 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A

0x0B 0x0C 0x0D 0x0E 0x0F}

AMR220-C1 – Reference Manual

Version 1.02

Page 55 of 69 [email protected] www.acs.com.hk

// Update the binary block 0x04 of MIFARE Ultralight with Data {0x00 0x01 0x02 0x03}

APDU = {0xFF 0xD6 0x00 0x04 0x04 0x00 0x01 0x02 0x03}

5.2.2.3.5. Value Block Operation (INC, DEC, STORE)

The “Value Block Operation” command is used for manipulating value-based transactions e.g. increment a value of the value block etc.

Value Block Operation APDU Format (10 Bytes)

Command Class INS P1 P2 Lc Data In

Value Block

Operation

0xFF 0xD7 0x00 Block

Number

0x05 VB_OP VB_Value

(4 Bytes)

{MSB ... LSB}

Block Number (1 Byte):

The value block to be manipulated

VB_OP (1 Byte):

0x00 = Store the VB_Value into the block. The block will then be converted to a value block.

0x01 = Increment the value of the value block by the VB_Value. This command is only valid for value block.

0x02 = Decrement the value of the value block by the VB_Value. This command is only valid for value block.

VB_Value (4 Bytes):

The value used for value manipulation. The value is a signed long integer (4 bytes).

E.g. 1: Decimal “–4” = {0xFF, 0xFF, 0xFF, 0xFC}

MSB

0xFF 0xFF

VB_Value

0xFF

E.g. 2: Decimal “1” = {0x00, 0x00, 0x00, 0x01}

MSB

0x00 0x00

VB_Value

0x00

LSB

0xFC

LSB

0x01

AMR220-C1 – Reference Manual

Version 1.02

Page 56 of 69 [email protected] www.acs.com.hk

Value Block Operation Response Format (2 bytes)

Response

Result

Data Out

SW1 SW2

Value Block Operation Response Codes

Results SW1 SW2

Success

Error

0x90

0x63

0x00

Meaning

The operation is completed successfully.

The operation failed.

5.2.2.3.6. Read Value Block

The “Read Value Block” command is used for retrieving the value from the value block. This command is only valid for value block.

Read Value Block APDU Format (5 Bytes)

Command Class INS P1 P2 Le

Read Value

Block

Block Number (1 Byte):

The value block to be accessed.

Read Value Block Response Format (4 + 2 bytes)

Response

Result

0xFF 0xB1

Value

0x00

{MSB .. LSB}

Block

Number

Data Out

0x04

SW1

Value (4 Bytes):

The value returned from the card. The value is a signed long integer (4 bytes).

E.g. 1: Decimal “–4” = {0xFF, 0xFF, 0xFF, 0xFC}

Value

MSB LSB

0xFF 0xFF 0xFF 0xFC

SW2

AMR220-C1 – Reference Manual

Version 1.02

Page 57 of 69 [email protected] www.acs.com.hk

E.g. 2: Decimal “1” = {0x00, 0x00, 0x00, 0x01}

Value

MSB

0x00 0x00 0x00

Read Value Block Response Codes

Results SW1 SW2

Success

Error

0x90

0x63

0x00

LSB

0x01

Meaning

The operation is completed successfully.

The operation failed.

5.2.2.3.7. Copy Value Block

The “Copy Value Block” command is used to copy a value from a value block to another value block.

Copy Value Block APDU Format (7 Bytes)

Command Class INS P1 P2 Lc Data In

Copy Value

Block

0xFF 0xD7 0x00 Source

Block

Number

0x02 0x03 Target

Block

Number

Source Block Number (1 Byte):

The value of the source value block will be copied to the target value block.

Target Block Number (1 Byte):

The value block to be restored. The source and target value blocks must be in the same sector.

Copy Value Block Response Format (2 bytes)

Response

Result

Data Out

SW1 SW2

Copy Value Block Response Codes

Results

Success

Error

SW1

0x90

0x63

SW2

0x00

Meaning

The operation is completed successfully.

The operation failed.

AMR220-C1 – Reference Manual

Version 1.02

Page 58 of 69 [email protected] www.acs.com.hk

5.2.2.4. Access PCSC Compliant Tags (ISO14443-4)

Basically, all ISO14443-4 complaint cards (PICCs) understands the ISO 7816-4 APDUs. The

AMR220-C1 just has to communicate with the ISO 14443-4 complaint cards through exchanging ISO

7816-4 APDUs and responses. AMR220-C1 will handle the ISO 14443 Parts 1-4 Protocols internally.

MIFARE 1K, 4K, MINI and Ultralight tags are supported through the T=CL emulation. Just simply treat the MIFARE tags as standard ISO14443-4 tags.

For more information, please refer to PICC Commands (T=CL Emulation) for Mifare 1K/4K

MEMORY Cards .

ISO 7816-4 APDU Format

Command Class INS P1 P2 Lc Data In Le

ISO 7816-4

Command

ISO 7816-4 Response Format (Data + 2 bytes)

Response

Result Response Data

Data Out

Common ISO 7816-4 Response Codes

SW1

Length of the

Data In

SW2

Expected length of the

Response Data

Results

Success

SW1

0x90

SW2

0x00

Meaning

The operation is completed successfully.

Error 0x63 0x00 The operation failed.

Typical sequence may be:

• Present the Tag and Connect

• Read / Update the memory of the tag

Operation Example:

Step 1. Connect the Tag

The ATR of the tag is 0x3B 0x88 0x80 0x01 0x00 0x00 0x00 0x00 0x33 0x81 0x81 0x00

0x3A

In which it is an ISO14443-4 Type B tag with,

The Application Data of ATQB = 0x00 0x00 0x00 0x00

Protocol information of ATQB = 0x33 0x81 0x81

Step 2. Send an APDU, e.g. Get Challenge

CMD: 0x00 0x84 0x00 0x00 0x08

RSP: 0x1A 0xF7 0xF3 0x1B 0xCD 0x2B 0xA9 0x58 [0x90 0x00]

Note : For ISO14443-4 Type A tags, the ATS can be obtained by using the APDU “0xFF

0xCA 0x01 0x00 0x00”

AMR220-C1 – Reference Manual

Version 1.02

Page 59 of 69 [email protected] www.acs.com.hk

5.2.2.5. Access FeliCa Tags

For FeliCa Access, the command is different with PCSC Compliant Tags and Mifare. The Command is follow FeliCa Spec with header added, the following is the format.

FeliCa Command Format

Command

FeliCa

Command

Class

0xFF

INS

0x00

Length of the Data

Data In

FeliCa Command

(start with Length

Byte)

Felica Command:

Please Ref to Felica Card specification

Examples: e.g.1 Polling Command

= {0x06, 0x00 , 0xFF, 0xFF , 0x00, 0x00}

In which

0x00 = Polling Command Code

0xFF 0xFF = System Code e.g.2 Read Without Encryption Command

= {0x10 0x06 0x01 0x01 0x06 0x01 0xCB 0x09 0x57 0x03 0x01 0x09 0x01 0x01 0x80 0x00 }

In which

0x06 = Read Without Encryption Command Code

0x01 0x01 0x06 0x01 0xCB 0x09 0x57 0x03 = Felica IDm (depend on card)

0x09 0x01= Service Code

0x80 0x00 = Block

FeliCa Response Format (Data + 2 bytes)

Response

Result

Response Codes

Data Out

Response Data SW1 SW2

Results

Success

Error

SW1

0x90

0x67

0x64

SW2

0x00

0x01

Meaning

The operation is completed successfully.

Length error

The operation failed.

AMR220-C1 – Reference Manual

Version 1.02

Page 60 of 69 [email protected] www.acs.com.hk

Operation Example:

Step 1. Connect the FeliCa

The ATR = 0x3B 0x8F 0x80 0x01 0x80 0x4F 0x0C 0xA0 0x00 0x00 0x03 0x06 0x11

0x00 0x3B 0x00 0x00 0x00 0x00 0x42

In which 11 00 3B = FeliCa

Step 2. Read FeliCa IDM

CMD = 0xFF 0xCA 0x00 0x00 0x00

RSP = [IDM (8bytes)] 0x90 0x00 e.g. the FeliCa IDM = 0x01 0x01 0x06 0x01 0xCB 0x09 0x57 0x03

Step 3. FeliCa Command Access (Example to use Read without Encryption Command)

CMD = 0xFF 0x00 0x00 0x00 0x10 0x10 0x06 0x01 0x01 0x06 0x01 0xCB 0x09 0x57

0x03 0x01 0x09 0x01 0x01 0x80 0x00

In which

Felica Command = 0x10 0x06 0x01 0x01 0x06 0x01 0xCB 0x09 0x57 0x03 0x01

0x09 0x01 0x01 0x80 0x00

Felica IDm = 0x01 0x01 0x06 0x01 0xCB 0x09 0x57 0x03

RSP = 0x1D 0x07 0x01 0x01 0x06 0x01 0xCB 0x09 0x57 0x03 0x00 0x00 0x01 0x00

0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

0x00 0x90 0x00

In which

Response Code = 0x07

Felica IDm = 0x01 0x01 0x06 0x01 0xCB 0x09 0x57 0x03

Status Flag = 0x00 0x00

Block Data = 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

0x00 0x00 0x00

AMR220-C1 – Reference Manual

Version 1.02

Page 61 of 69 [email protected] www.acs.com.hk

5.3. Escape Command

The Escape command is used to control the peripherals or special operation.

The commands are sent through SPH_to_RDR_ExEscape or PCSC SCardControl with dwControlCode = SCARD_CTL_CODE(3500).

5.3.1. Get Firmware Version

The “Get Firmware Version” command is used to get the AMR220-C1’s firmware message

Get Firmware Version Format (5 Bytes)

Command

Get Firmware

Version

Class

0xE0

INS

0x00

0x18

0x00

Get Firmware Version Response Format (5 Bytes + Firmware Message Length)

Response

Result

Class

0xE1

INS

0x00

Number of

Bytes to

Received

Data Out

Firmware Version e.g. Response = 0xE1 0x00 0x00 0x00 0x10 0x41 0x4D 0x4D 0x32 0x32 0x30 0x43 0x5F 0x31 0x2E

0x30 0x30 0x2E 0x30 0x30 0x00

Firmware Version (HEX) = 0x41 0x4D 0x4D 0x32 0x32 0x30 0x43 0x5F 0x31 0x2E 0x30 0x30 0x2E

0x30 0x30

Firmware Version (ASCII) = “AMM220C_1.01.01”

AMR220-C1 – Reference Manual

Version 1.02

Page 62 of 69 [email protected] www.acs.com.hk

5.3.2. Shut Down Time Configure

The “Shut Down Time Configure” command is used to get/set the Shut Down time for AMR220-C1

To set Shut Down Time Configure Command Format (6 Bytes)

Command

Shut Down

Time Configure

Class

0xE0

INS

0x00

0x48

0x01

To get Shut Down Time Configure Command Format (5 Bytes)

Command

Shut Down

Time Configure

Class

0xE0

INS

0x00

0x48

0x00

Shut Down Time Configure Response Format (6 Bytes)

Response Class INS P1 P2

Result 0xE1 0x00 0x00 0x00

0x01

Data In

Shut Down

Time

Data Out

Shut Down

Time

Shut Down Time (1 Byte): Units in second

0x00 = No Shut Down

Default = 0x78 (120 sec)

5.3.3. Antenna Control

The “Antenna Control” command is used to control the Antenna Field

Note : The antenna field will be affected by Auto Polling.

Antenna Control Command Format (6 Bytes)

Command

Antenna

Control

Class

0xE0

INS

0x00

0x41

0x01

Data In

0x00 – Antenna Off

0x01 – Antenna On

Antenna Control Response Format (6 Bytes)

Response

Result

Class

0xE1

INS

0x00

0x01

Data Out

0x00 – Antenna Off

0x01 – Antenna On

AMR220-C1 – Reference Manual

Version 1.02

Page 63 of 69 [email protected] www.acs.com.hk

5.3.4. Automatic PICC Polling Parameter

The “Automatic PICC Polling Parameter” command is used to set the reader’s polling mode when

USB used for communication

Whenever the AMR220-C1 is connected to the PC, the PICC polling function will start the PICC scanning to determine if a PICC is placed on / removed from the built-antenna.

We can send a command to disable the PICC polling function. To meet the energy saving requirement, special modes are provided for turning off the antenna field whenever the PICC is inactive, or no PICC is found. The reader will consume less current in power saving mode.

Notes :

1. The Auto Polling feature is for USB mode ONLY.

2. The setting will be set to default once AMR220-C1 is reset.

To set Automatic PICC Polling Parameter Command Format (6 Bytes)

Command

Automatic PICC Polling

Parameter

Class INS P1 P2 Lc Data In

0xE0 0x00 0x00 0x23 0x01 Polling Setting or

To get Automatic PICC Polling Parameter Command Format (5 Bytes)

Command

Automatic PICC Polling

Parameter

Class INS P1 P2 Lc

0xE0 0x00 0x00 0x23 0x00

Automatic PICC Polling Parameter Response Format (6 Bytes)

Response

Result

Class

0xE1

INS

0x00

0x01

Data Out

Polling Setting

AMR220-C1 – Reference Manual

Version 1.02

Page 64 of 69 [email protected] www.acs.com.hk

Polling Setting (1 Byte):

Polling Setting

Bit 0

Bit 1

Bit 2

Bit 3

Bit 5 ... 4

Bit 6

Bit 7

Description

Auto PICC Polling

Description

1 = Enable; 0 =Disable

Turn off Antenna Field if no PICC found 1 = Enable; 0 =Disable

Turn off Antenna Field if the PICC is inactive. 1 = Enable; 0 =Disable

RFU

PICC Poll Interval for PICC

RFU

Enforce ISO14443A Part 4

<0 – 0> = 250 ms

<0 – 1> = 500 ms

<1 – 0> = 1000 ms

<1 – 1> = 2500 ms

1= Enable; 0= Disable.

*Default value of Polling Setting Parameter = 0x8B

Notes :

1. It is recommended to enable the option “Turn Off Antenna Field if the PICC is inactive”, so that the Inactive PICC will not be exposed to the field all the time so as to prevent the PICC from warming up.

2. The longer the PICC Poll Interval, the more energy may be efficiently saved. However, the response time of PICC Polling will become longer.

3. The reader will activate the ISO14443A-4 mode of the “ISO14443A-4 compliant PICC” automatically. Type B PICC will not be affected by this option.

4. The JCOP30 card comes with two modes: ISO14443A-3 (MIFARE 1K) and ISO14443A-4 modes. The application has to decide which mode should be selected once the PICC is activated.

AMR220-C1 – Reference Manual

Version 1.02

Page 65 of 69 [email protected] www.acs.com.hk

5.3.5. PICC Polling Detect Card Type

The “PICC Polling Detect Card Type” command is used to set the Automatic Polling’s Detect Card

Type.

Notes :

1. The Auto Polling feature is for USB mode ONLY.

2. The setting will be set to default once AMR220-C1 is reset.

To set PICC Polling Detect Card Type Command Format (6 Bytes)

Command Class INS P1 P2 Lc Data In

PICC Polling

Select Card

Type

0xE0 0x00 0x00 0x20 0x01

To get PICC Polling Detect Card Type Command Format (5 Bytes)

Command

PICC Polling

Select Card

Type

Class

0xE0

INS

0x00

0x20

0x00

Card Type

PICC Polling Detect Card Type Response Format (6 Bytes)

Response

Result

Card Type (1 Byte):

Card Type Parameter

Bit0

Bit1

Bit2

Bit3

Class

0xE1

ISO14443 Type A

ISO14443 Type B

Felica 212kbps

Felica 424kbps

INS

0x00

Bit4 - 7 RFU

*Default value of Card Type = 0x0F

0x00

0x01

Data Out

Card Type

Description Option

1 = Detect

0 = Skip

The tag types to be detected during

PICC Polling.

1 = Detect

0 = Skip

1 = Detect

0 = Skip

RFU

1 = Detect

0 = Skip

RFU

AMR220-C1 – Reference Manual

Version 1.02

Page 66 of 69 [email protected] www.acs.com.hk

5.3.6. Buzzer Control

The “Buzzer Control” command is used to control the buzzer sound output.

Buzzer Control Format #1 (6 Bytes)

Command

Buzzer Control

Class

0xE0

INS

0x00

0x28

0x01

Data In

Buzzer on

Duration

Buzzer on Duration (1 Byte):

0x00 = Turn OFF

0x01 to 0xFF = Duration (unit: 10ms) with Freq = 1500Hz

Buzzer Control Format #2 (8 Bytes)

Command

Buzzer

Control

Class

0xE0

INS

0x00

0x28

0x03 Buzzer on

Duration

Data In

Buzzer off

Duration

Repeat

Count

Buzzer on Duration (1 Byte):

0x00 = Turn OFF

0x01 to 0xFF = Turn ON Duration (unit: 10ms) with Freq = 1500Hz

Buzzer off Duration (1 Byte):

Repeat Count (1 Byte):

Number of Turn ON and Turn OFF pattern repeat

0x00 = Turn ON with Freq = 1500Hz

0x01 to 0xFF = Turn OFF Duration (unit: 10ms)

Buzzer Control Format #3 (12 bytes)

Command Class INS P1 P2 Lc Data In

Buzzer off

Duration

Repeat

Count

Frequency

(MSB … LSB)

Buzzer

Control

0xE0 0x00 0x00 0x28 0x07 Buzzer on

Duration

Buzzer on Duration (1 Byte):

0x00 = Turn OFF

0x01 to 0xFF = Turn ON Duration (unit: 10ms)

Buzzer off Duration (1 Byte):

0x00 = Turn ON

0x01 to 0xFF = Turn OFF Duration (unit: 10ms)

AMR220-C1 – Reference Manual

Version 1.02

Page 67 of 69 [email protected] www.acs.com.hk

Repeat Count (1 Byte):

Number of Turn ON and Turn OFF pattern repeat

Frequency (4Bytes):

Frequency for the buzzer output

Frequency = 1500 -> 1500Hz

Frequency = 750 -> 750Hz

Frequency = other value -> RFU

Buzzer Control Response Format (6 Bytes)

Response

Result

Class

0xE1

INS

0x00

0x01

5.3.7. LEDs Control

The “LEDs Control” command is used to control the LEDs Output.

To set LEDs Control Command Format (6 Bytes)

Data Out

0x00

Command

Buzzer Control

Class

0xE0

INS

0x00

To get LEDs Control Command Format (5Bytes)

Command

Buzzer

Control

Class

0xE0

INS

0x00

P1 P2

0x00 0x29

0x29

0x00

0x01

LEDs Control Response Format (6 Bytes)

Response

Result

Class

0xE1

INS

0x00

LED Status (1 Byte):

Polling Setting

Bit 0 Green 1 LED

0x00

Description

0x00

Bit 1

Bit 2

Bit 3

Bit 4 ... 7

Green 2 LED

Green 3 LED

Green 4 LED

RFU

0x01

Data In

LED Status

Data Out

LED Status

Description

1 = ON; 0 = OFF

RFU

AMR220-C1 – Reference Manual

Version 1.02

Page 68 of 69 [email protected] www.acs.com.hk

The Bluetooth ® word, mark and logos ar e registered trademarks owned by Bluetooth SIG, Inc. and any use of such mar ks by Advanced Car d Systems Ltd. is under license. Other trademarks and trade names are those of their respective owners.

EMV is a registered trademark or trademark of EMVCo LLC in the United States and other countries.

Mastercard is a registered trademark of Mastercard International Incorporated.

Microsoft and Windows are registered trademarks of Microsoft Corporation in the United States and/or other countries.

MIFARE, MIFARE Classic, MIFARE DESFire, MIFARE Ultralight and MIFARE Plus are registered trademarks of NXP B.V. and are used under license.

Visa payWave is a registered trademark of Visa International Service Association.

Page 69 of 69

AMR220-C1 – Reference Manual

Version 1.02 [email protected] www.acs.com.hk

Hej! Jeg er en AI-chatbot, der er specielt trænet til at hjælpe dig med ACS AMR220-C1 Reference Manual. Jeg har grundigt gennemgået dokumentet og kan hjælpe dig med at finde den nøjagtige information, du har brug for, eller forklare indholdet på en klar og simpel måde. Uanset om du leder efter vejledning om specifikke funktioner, fejlfindingstrin eller generel brug, er du velkommen til at stille dine spørgsmål. Jo flere detaljer du giver om dine bekymringer eller behov, jo mere præcist og effektivt kan jeg hjælpe dig!