background image

Document Title Here 

Document Title Here 

 

Document Title Here

 

ACR33U-A1 SmartDuo Reference Manual 

Version 1.00

 

Page 50 of 56

 

 

 

[email protected] 

www.acs.com.hk 

8.2.13.2.  READ_MEMORY_CARD 

Command format (abData field in the PC_to_RDR_XfrBlock) 

Pseudo-APDU 

CLA 

INS 

P1 

Byte 

Address 

MEM_L 

FF

 

H

 

B0

 

H

 

00

 

H

 

 

 

Byte Address

  = Memory address location of the memory card. 

MEM_L

 

Length of data to be read from the memory card. 

Response data format (abData field in the RDR_to_PC_DataBlock) 

BYTE 1 

… 

… 

BYTE N 

SW1 

SW2 

 

 

 

 

 

 

BYTE x

 

Data read from memory card 

SW1, SW2

 

90

 

H

 

00

 

H

 if no error 

8.2.13.3.  WRITE_MEMORY_CARD 

To write data to the specified address of the inserted card. The byte is written to the card with LSB 
first, i.e., the bit at card address 0 is regarded as the LSB of byte 0. 

The byte at the specified card address is not erased prior to the write operation and, hence, memory 
bits can only be programmed from '1' to '0'. 

Command format (abData field in the PC_to_RDR_XfrBlock) 

Pseudo-APDU 

CLA 

INS 

P1 

Byte 

Address 

MEM_L  Byte 1  ....  ....  Byte N 

FF

 

H

 

D0

 

H

 

00

 

H

 

 

 

 

 

 

 

Byte Address

  = Memory address location of the memory card. 

MEM_L

 

Length of data to be written to the memory card. 

BYTE

 

Byte value to be written to the card 

Response data format (abData field in the RDR_to_PC_DataBlock) 

SW1 

SW2 

 

 

SW1, SW2

 

90

 

H

 

00

 

H

 if no error 

 

Summary of Contents for ACR33U-A1 Smart Duo

Page 1: ...Subject to change without prior notice info acs com hk www acs com hk Reference Manual ACR33U A1 SmartDuo Smart Card Reader...

Page 2: ...owerOff 11 8 1 3 PC_to_RDR_GetSlotStatus 12 8 1 4 PC_to_RDR_XfrBlock 12 8 1 5 PC_to_RDR_GetParameters 13 8 1 6 PC_to_RDR_ResetParameters 13 8 1 7 PC_to_RDR_SetParameters 14 8 1 8 PC_to_RDR_Escape 16 8...

Page 3: ...have different commands and different communication protocols which in most cases prevent direct communication between a smart card and a computer The ACR33U A1 SmartDuo Smart Card Reader establishes...

Page 4: ...lots Smart card reader o Supports ISO 7816 Class A 5V smart cards o Reads and writes onto all microprocessor cards with T 0 and T 1 protocol o Supports memory cards Atmel AT88SC153 and AT88SC1608 o Su...

Page 5: ...ollowing the I2Cbus protocol free memory cards with maximum 128 bytes page with capability including Atmel AT24C01 02 04 08 16 32 64 128 256 512 1024 Cards with secure memory IC with password and auth...

Page 6: ...Duo prior to activating the inserted card This includes both the memory cards and MCU based cards For MCU based cards the reader allows to select the preferred protocol T 0 or T 1 However this selecti...

Page 7: ...s of the smart card interface Flashing slowly turns on 200 ms every 2 seconds Indicates ACR33U A1 SmartDuo is powered up and in the standby state Either the smart card has not been inserted or the sma...

Page 8: ...d PC 3 D Differential signal transmits data between ACR33U A1 and PC 4 GND Reference voltage level for power supply Table 1 USB Interface Wiring Note In order for the ACR33U A1 SmartDuo to function pr...

Page 9: ...s an associated ending response Some commands can also have intermediate responses 4 CCID Responses are sent on BULK IN endpoint All commands sent to ACR33U A1 SmartDuo have to be sent synchronously i...

Page 10: ...4 00020 4B0h ACR33U A1 supports the following features Automatic ICC clock frequency change according to parameters Automatic baud rate change according to frequency and FI DI parameters Automatic PP...

Page 11: ...bMessageType 1 62h 1 dwLength 4 00000 000h Size of extra bytes of this message 2 bSlot 1 00 05h Identifies the slot number for this command 5 bSeq 1 00 FFh Sequence number for command 6 bPowerSelect 1...

Page 12: ...the RDR_to_PC_SlotStatus message 8 1 4 PC_to_RDR_XfrBlock Transfer data block to the ICC Offset Field Size Value Description 0 bMessageType 1 6Fh 1 dwLength 4 Size of abData field of this message 5 b...

Page 13: ...number for this command 6 BSeq 1 00 FFh Sequence number for command 7 AbRFU 3 Reserved for future use The response to this message is the RDR_to_PC_Parameters message 8 1 6 PC_to_RDR_ResetParameters R...

Page 14: ...served for future use 80h Structure for 2 wire protocol 81h Structure for 3 wire protocol 82h Structure for I2C protocol 8 abRFU 2 Reserved for future use 10 abProtocolDataSt ructure Byte array Protoc...

Page 15: ...lock rate conversion factor B3 0 DI Index into the table 8 in ISO IEC 7816 3 1997 selecting a baud rate conversion factor 11 BmTCCKST1 1 B7 2 000100b B0 Checksum type b0 0 for LRC b0 1 for CRC B1 Conv...

Page 16: ...f abData field of this message 5 bSlot 1 00 05h Identifies the slot number for this command 6 bSeq 1 00 FFh Sequence number for command 7 abRFU 3 Reserved for future use 10 abData Byte array Data bloc...

Page 17: ...10 bcmdCode 1 08h 11 wcmdLength 2 0001h 13 abRFU 2 Reserved for future use 15 abData 1 XXh XXh for buzzer on or off YZ 5A buzzer on for 1 Sec conform to will s version YZ A5 buzzer off Get Firmware V...

Page 18: ...ates that a data block is being sent from the CCID 1 dwLength 4 Size of extra bytes of this message 5 bSlot 1 Same value as in Bulk OUT message 6 bSeq 1 Same value as in Bulk OUT message 7 bStatus 1 S...

Page 19: ...rameters and PC_to_RDR_SetParameters messages Offset Field Size Value Description 0 bMessageType 1 82h 1 dwLength 4 Size of extra bytes of this message 5 bSlot 1 Same value as in Bulk OUT message 6 bS...

Page 20: ...B3 0 DI Index into the table 8 in ISO IEC 7816 3 1997 selecting a baud rate conversion factor 11 bmTCCKST0 1 00h 02h For T 0 B0 0b B7 2 000000b B1 Convention used b1 0 for direct b1 1 for inverse 12...

Page 21: ...997 selecting a baud rate conversion factor 11 BmTCCKST1 1 10h 11h 12h 13h For T 1 B7 2 000100b B0 Checksum type b0 0 for LRC b0 1 for CRC B1 Convention used b1 0 for direct b1 1 for inverse 12 BGuard...

Page 22: ...ard 8 2 5 1 SELECT_CARD_TYPE This command powers down and up the selected card inserted in the card reader and performs a card reset NOTE This command can only be used after the logical smart card rea...

Page 23: ...field in the PC_to_RDR_XfrBlock Pseudo APDU CLA INS P1 P2 Lc Page size FF H 01 H 00 H 00 H 01 H Page size 03 H for 8 byte page write 04 H for 16 byte page write 05 H for 32 byte page write 06 H for 6...

Page 24: ...from memory card SW1 SW2 90 H 00 H if no error 8 2 5 4 WRITE_MEMORY_CARD Command format abData field in the PC_to_RDR_XfrBlock Pseudo APDU CLA INS Byte Address MEM_L Byte 1 Byte n MSB LSB FF H D0 H B...

Page 25: ...alue as in Bulk OUT message 6 bSeq 1 Same value as in Bulk OUT message 7 bStatus 1 Slot status register as defined in CCID section 4 2 1 8 bError 1 Slot error register as defined in CCID section 4 2 1...

Page 26: ...512 1024 kbit I2C card 8 2 7 1 SELECT_CARD_TYPE This command powers down and up the selected card inserted in the card reader and performs a card reset Note This command can only be used after the lo...

Page 27: ...H 01 H 00 H 00 H 01 H Data TPDU to be sent to the card Page size 03 H for 8 byte page write 04 H for 16 byte page write 05 H for 32 byte page write 06 H for 64 byte page write 07 H for 128 byte page...

Page 28: ...RITE_MEMORY_CARD Command format abData field in the PC_to_RDR_XfrBlock Pseudo APDU CLA INS Byte Address MEM_L Byte 1 Byte n MSB LSB FF H INS D0 H for 32 64 128 256 512kbit iic card 1101 000 b for 1024...

Page 29: ...the SCardConnect API For details of ScardConnect API please refer to PC SC specifications Command format abData field in the PC_to_RDR_XfrBlock Pseudo APDU CLA INS P1 P2 Lc Card Type FF H A4 H 00 H 0...

Page 30: ...EMORY_CARD Command format abData field in the PC_to_RDR_XfrBlock Pseudo APDU CLA INS P1 Bye Address MEM_L Byte 1 Byte n FF H 00 H INS D0 H for writing zone 00 b D1 H for writing zone 01 b D2 H for wri...

Page 31: ...0 Pw 1 Pw 2 Passwords to be sent to memory card P2 0000 00rp b where the two bits rp indicate the password to compare r 0 Write password r 1 Read password p Password set number rp 01 for the secure c...

Page 32: ...Lc Q 0 Q 1 Q 7 FF H 84 H 00 H 00 H 08 H Q 0 Q 1 Q 7 Host random number 8 bytes Response data format abData field in the RDR_to_PC_DataBlock SW1 SW2 SW1 SW2 90 H 00 H if no error 8 2 8 6 VERIFY_AUTHENT...

Page 33: ...I please refer to PC SC specifications Command format abData field in the PC_to_RDR_XfrBlock Pseudo APDU CLA INS P1 P2 Lc Card Type FF H A4 H 00 H 00 H 01 H 04 H Response data format abData field in t...

Page 34: ...DR_XfrBlock Pseudo APDU CLA INS Zone Address Byte Address MEM_L Byte 1 Byte n FF H INS D0 H for writing user zone D1 H for writing configuration zone or writing fuse Zone Address 0000 0A10A9A8 b where...

Page 35: ...0 Write password r 1 Read password p2p1p0 Password set number rp2p1p0 0111 for the secure code Response data format abData field in the RDR_to_PC_DataBlock SW1 SW2 ErrorCnt 90 H SW1 90 H SW2 ErrorCnt...

Page 36: ...sponse data format abData field in the RDR_to_PC_DataBlock SW1 SW2 SW1 SW2 90 H 00 H if no error 8 2 10 Memory Card SLE4418 SLE4428 SLE5518 SLE5528 8 2 10 1 SELECT_CARD_TYPE This command powers down a...

Page 37: ...DR_to_PC_DataBlock BYTE 1 BYTE N SW1 SW2 BYTE x Data read from memory card SW1 SW2 90 H 00 H if no error 8 2 10 3 READ_PRESENTATION_ERROR_COUNTER_MEMORY_CARD only SLE4428 and SLE5528 To read the prese...

Page 38: ...ngth of protection bits to be read from the card in multiples of 8 bits Maximum value is 32 MEM_L 1 INT number of bits 1 8 For example to read eight protection bits starting from memory 0x0010 the fol...

Page 39: ...aBlock SW1 SW2 SW1 SW2 90 H 00 H if no error 8 2 10 6 WRITE_PROTECTION_MEMORY_CARD Each of the bytes specified in the command is internally in the card compared with the byte stored at the specified a...

Page 40: ...actions are executed Search a 1 bit in the presentation error counter and write the bit to 0 Present the specified code to the card Try to erase the presentation error counter Command format abData f...

Page 41: ...onnect API please refer to PC SC specifications Command format abData field in the PC_to_RDR_XfrBlock Pseudo APDU CLA INS P1 P2 Lc Card Type FF H A4 H 00 H 00 H 01 H 06 H Response data format abData f...

Page 42: ...W2 ERRCNT The value of the presentation error counter 07 H indicates the last verification is correct 00 H indicates the password is locked exceeded the maximum number of retries Other values indicate...

Page 43: ...the memory card Byte x Data to be written to the memory card Response data format abData field in the RDR_to_PC_DataBlock SW1 SW2 SW1 SW2 90 H 00 H if no error 8 2 11 6 WRITE_PROTECTION_MEMORY_CARD E...

Page 44: ...tions are executed Search a 1 bit in the presentation error counter and write the bit to 0 Present the specified code to the card Try to erase the presentation error counter Command format abData fiel...

Page 45: ...H 00 H 01 H 03 H Response data format abData field in the RDR_to_PC_DataBlock SW1 SW2 SW1 SW2 90 H 00 H if no error 8 2 12 Memory Card SLE4406 SLE4436 SLE5536 SLE6636 8 2 12 1 SELECT_CARD_TYPE This c...

Page 46: ...d counter values to the card b Write with carry The byte value specified in the command is written to the specified address and the command is sent to the card to erase the next lower counter stage Th...

Page 47: ...he card Response data format abData field in the RDR_to_PC_DataBlock SW1 SW2 SW1 SW2 90 H 00 H if no error 8 2 12 4 PRESENT_CODE_MEMORY_CARD To submit the secret code to the memory card to enable the...

Page 48: ...he card Reset the card to normal operation mode The authentication has to be performed in two steps The first step is to send the Authentication Certificate to the card The second step is to get back...

Page 49: ...to_PC_DataBlock CERT SW1 SW2 CERT 16 bits of authentication data computed by the card The LSB of BYTE 1 is the first authentication bit read from the card SW1 SW2 90 H 00 H if no error 8 2 13 Memory C...

Page 50: ...00 H if no error 8 2 13 3 WRITE_MEMORY_CARD To write data to the specified address of the inserted card The byte is written to the card with LSB first i e the bit at card address 0 is regarded as the...

Page 51: ...13 7 Command format abData field in the PC_to_RDR_XfrBlock Pseudo APDU CLA INS P1 Byte Address MEM_L FF H D2 H 00 H 00 H Byte Address Memory byte address location of the word to be erased Response da...

Page 52: ...table below for the correct value CODE N bytes of Erase Key Byte Address LEN AT88SC101 Erase Application Zone with EC function disabled 96 H 04 H AT88SC102 Erase Application Zone 1 56 H 06 H AT88SC102...

Page 53: ...the presentation error counter The data in corresponding Application Zone can be erased when the submitted code is correct Command format abData field in the PC_to_RDR_XfrBlock Pseudo APDU CLA INS Err...

Page 54: ...ter can be erased when the submitted code is correct Command format abData field in the PC_to_RDR_XfrBlock Pseudo APDU CLA INS Error Counter LEN Byte Addre ss MEM_ L CODE Byt e 1 Byte 2 FF H 20 H 08 H...

Page 55: ...05 H 00 H 00 H 04 H 01 H 00 H or 01 H Fuse Bit Addr 2 bytes Bit address of the fuse Please refer to the table below for the correct value State of FUS Pin State of the FUS pin Should be 0x01 always S...

Page 56: ...turned by the ACR33U A1 SmartDuo Error Code Status FFh SLOTERROR_CMD_ABORTED FEh SLOTERROR_ICC_MUTE FDh SLOTERROR_XFR_PARITY_ERROR FCh SLOTERROR_XFR_OVERRUN FBh SLOTERROR_HW_ERROR F8h SLOTERROR_BAD_AT...

Reviews: