ACR1281S ACR1281S Specification V1.01 Advanced Card Systems Ltd.
ACR1281S Revision History Rev Number Date Author V1.00 2010-08-19 Nathan Li/ Kit Au V1.01 2010-12-15 Vincent Zhong/Jessy Wei Advanced Card Systems Ltd.
ACR1281S INDEX Index ....................................................................................................................................................3 Introduction..........................................................................................................................................5 features.................................................................................................................................................5 Terms ...........................
ACR1281S 11. Exclusive Mode Configure ......................................................................................................30 12. Request Command Test...........................................................................................................31 13. Continuous Wake Up Command Sending Test for the PICC Interface ..................................32 14. Read and Update the RC531 Register for the PICC Interface ................................................32 15.
ACR1281S INTRODUCTION The ACR1281S is a dual-interface reader(IFD and PCD) that supports both contact and contactless (PICC) smart cards. FEATURES • • • • • • • • • • • • • • One standard ICC landing type card acceptor. ISO 7816 Parts 1-4 Compliant for Contact Smart Card Interface. Support contact memory cards. ISO 14443 Parts 1-4 Compliant for Contactless Smart Card Interface. A built-in antenna for PICC contactless access applications. The ACR1281 supports the following Tag Types: o MIFARE Classic. E.g.
ACR1281S TERMS • • • • • • • • • • • • • • • • • • • • • • • • • • IFD: Interface Device. A terminal, communication device, or machine to which the integrated circuit(s) card is electrically connected during operation. PCD: Proximity Coupling Device. ISO 14443 Contactless Reader. ICC: Integrated Circuit(s) Card. Refer to a plastic card containing an integrated circuit, which is compatible with ISO 7816. PICC: Proximity Integrated Circuit(s) Card.
ACR1281S QUICK OVERVIEW OF THE ACR1281S READER 1. ACR1281S (with Contact Card Option) 2. ACR1281S (without Contact Card Option) Advanced Card Systems Ltd.
ACR1281S 3. ACR1281S ICC Interface 4. ACR1281S PICC Interface Advanced Card Systems Ltd.
ACR1281S Recommended ICAO E-Passport Placement ICAO E-Passport • In case the E-Passport is not accessible, try to place the E-Passport above the reader by 5~10mm. 5~10mm Advanced Card Systems Ltd.
ACR1281S SYSTEM DESCRIPTION 1. The Reader Block Diagram LED & Buzzer RC531 NFC Interface Chip Built-In Antenna Contactless Interface Carrier = 13.56MHz PICC Contactless Card Advanced Card Systems Ltd.
ACR1281S 2. Communication Flow Chart of ACR1281S Host ACR128U PCSC ICC Interface ACR128U PCSC PICC Interface Serial Interface (CCID liked Format) PCSC Layer T=CL &T=1 Emulation ACR1281S ISO 7816 Part1-4 ICC Interface ISO 14443 Part1-4 PICC Interface Physical Interface ICC And PICC Advanced Card Systems Ltd.
ACR1281S HARDWARE DESCRIPTION 3. USB Interface The ACR1281S is connected to a Host through the RS232 Serial Interface; the max speed is up to 500kbps. Pin 1 2 3 4 Signal VCC RXD TXD GND Function +5V power supply for the reader. The signal from the reader to the host. The signal from the host to the reader. Reference voltage level for power supply 4. LED Indicator The LEDs are used for showing the state of the contact and contactless interfaces.
ACR1281S 5. Buzzer A monotone buzzer is used to show the “Card Insertion” and “Card Removal” events. Events 1. The reader powered up and initialization success. 2. Card Insertion Event (ICC or PICC) 3. Card Removal Event (ICC or PICC) Buzzer Beep Beep Beep 6. ICC Interface (Contact Smart Card) A landing type Smart Card Acceptor is used for providing reliable operations. The minimum life cycle of the acceptor is about 300K times of card insertion and removal. 7.
ACR1281S SERIAL COMMUNICATION PROTOCOL (CCID-LIKED FRAME FORMAT) Communication setting: 9600 bps(Default), 19200 bps, 38400 bps, 57600 bps and 115200 bps,128000bps, 250000bps, 500000bps. Byte format: 8-N-1. The communication protocol between the Host and ACR1281S is very similar to the CCID protocol.
ACR1281S 8. Bulk-OUT Command 8.1 HOST_to_RDR_IccPowerOn This command is used to activate the ICC and PICC . The ATR will be returned if available in response “RDR_to_HOST_DataBlock” Format (See 2.1). Command Frame Format STX Bulk-OUT Header (0x02) (HOST_to_RDR_IccPowerOn) 1 Byte 10 Bytes HOST_to_RDR_IccPowerOn Format Offset Field Size Value 0 bMessageType 1 62h 1 dwLength 4 00000000h
ACR1281S Example: Power off PICC slot Command: 02 63 00 00 00 00 00 00 00 00 00 63 03 ACK: 02 00 00 03 Response: 02 81 00 00 00 00 00 00 00 81 00 00 03 8.3 HOST_to_RDR_XfrBlock This command is used to exchange APDUs between the Host and ACR1281S. Command Frame Format STX Bulk-OUT Header (0x02) (HOST_to_RDR_XfrBlock) 1 Byte 10 Bytes HOST_to_RDR_XfrBlock Format Offset Field Size 0 bMessageType 1 1 dwLength 4
ACR1281S Offset 0 1 5 6 7 Field bMessageType dwLength bSlot bSeq abRFU Size 1 4 Value 65h 00000000h 1 1 3 00h,01h 00-FFh Description Message-specific data length 00h forPICC interface, 01h for ICC Sequence number for command Reserved for Future Use 8.5 HOST_to_RDR_SetParameters This command is used to change the parameters for contact interface to implement PPS.
ACR1281S 5 6 7 10 bSlot bSeq abRFU abData 1 1 3 Byte array 00h,01h 00-FFh 00h for PICC interface, 01h for ICC 00h for protocol T=0, 01h for T=1. Reserved for Future Use Data block sent to the reader. Example for buzzer on 50ms : Command: 02 6B 06 00 00 00 01 00 00 00 00 E0 00 00 28 01 05 A0 03 ACK: 02 00 00 03 Response: 02 83 06 00 00 00 01 00 02 00 00 E1 00 00 00 01 05 63 03 Advanced Card Systems Ltd.
ACR1281S 9. Bulk-IN Response 9.1 RDR_to_HOST_DataBlock The reader in response to the “HOST_to_RDR_IccPowerOn” and “HOST_to_RDR_XfrBlock” command messages. Response to the “HOST_to_RDR_IccPowerOn”: Response Frame Format STX Bulk-IN Header abData (0x02) (RDR_to_HOST_DataBlock) 1 Byte 10 Bytes N Bytes of ATR (If card is available) RDR_to_HOST_DataBlock Format Offset Field Size Value 0 bMessageType 1 80h 1 4 N 5 dwLength
ACR1281S 9.2 RDR_to_HOST_SlotStatus The reader in response to the “HOST_to_RDR_IccPowerOff” and “HOST_to_RDR_GetSlotStatus” command messages. Response Frame Format STX Bulk-IN Header (0x02) (RDR_to_HOST_SlotStatus) 1 Byte 10 Bytes RDR_to_HOST_SlotStatus Format Offset Field Size 0 bMessageType 1 Value 81h 1 4 00000000h 5 dwLength
ACR1281S 9.4 RDR_to_HOST_Escape The reader in response to “HOST_to_RDR_Escape” command messages. Response Frame Format STX Bulk-IN Header (0x02) (RDR_to_HOST_DataBlock) 1 Byte 10 Bytes RDR_to_HOST_Escape Format Offset Field Size 0 bMessageType 1 Value 83h 1 abData Checksum N Bytes 1 Byte ETX (0x03) 1 Byte Description Indicates that a data block is being sent from the ACR1281S Size of abData field. (N Bytes) 4 N 5 dwLength
ACR1281S RDR_to_PC_NotifySlotChange Format Offset Field Size Value 0 bMessageType 1 50h 1 bmSlotCardState 1 Description Each slot has 2 bits. The least significant bit reports the current state of the slot (0b = no card present, 1b = card present). The most significant bit reports whether the slot has changed state since the last RDR_to_PC_NotifySlotChange message was sent (0b = no change, 1b = change).
ACR1281S 11. Error Handling - ACK Frame: {02 00 00 03}. If the frame sent by the HOST is correctly received by the RDR, a positive status frame = {02 00 00 03} will be sent to the HOST immediately to inform the HOST the frame is correctly received. The HOST has to wait for the response of the command. The RDR will not receive any more frames while the command is being processed.
ACR1281S 12. Protocol Flow Examples 1) Activate a ICC 1. HOST sends a frame 2. RDR sends back a positive status frame immediately HOST RDR 02 62 00 00 00 00 01 00 00 00 00 63 03 02 00 00 03 (positive status frame) .. after some processing delay .. 3. RDR sends back the response of the command 02 80 13 00 00 00 01 00 00 81 00 3B BE 11 00 00 41 01 38 00 00 01 00 00 00 00 00 01 90 00 6F 03 2) Activate a ICC (Incorrect Checksum, HOST ) 1. HOST sends a corrupted frame 2.
ACR1281S 4) Exchange APDU with ICC 1. HOST sends a frame HOST 2. RDR sends back a positive status frame immediately RDR 02 6F 05 00 00 00 01 00 00 00 00 80 84 00 00 08 67 03 02 00 00 03 (positive status frame) .. after some processing delay .. 3. RDR sends back the response of the command :02 80 0A 00 00 00 01 00 00 81 00 C2 FF 2D 23 C5 F6 5C F2 90 00 34 03 APDU Command: 80 84 00 00 08 APDU Response: 22 5C E9 1C A4 5A A4 D6 90 00 5) Insert contact card into the ICC slot HOST 1.
ACR1281S PERIPHERALS CONTROL The reader’s peripherals control is implemented by Escape Command. 1.
ACR1281S Firmware Version (HEX) = 41 43 52 31 32 38 31 53 20 56 31 30 33 Firmware Version (ASCII) = “ACR1281S V103” 3. Enter Firmware Upgrade Mode Command = {FF 00 00 E0 00} Response = {FF 00 00 E1 02 90 00} Example: Command: 02 6B 05 00 00 00 01 00 00 00 00 FF 00 00 E0 00 70 03 ACK: 02 00 00 03 Response: 02 83 07 00 00 00 01 00 00 00 00 FF 00 00 E1 02 90 00 09 03 Hints: After the response display, the reader will enter the firmware upgrade mode that the reader can be upgraded firmware. 4.
ACR1281S 5. Buzzer Control Setting the Buzzer State: APDU Command = {E0 00 00 28 01 “Duration”} Unit = 10mS 00 = Turn off 01 ~ FE = Duration FF = Turn o APDU Response = {E1 00 00 00 01 “Status”} Reading the existing Buzzer State: APDU Command = {E0 00 00 28 00} APDU Response = {E1 00 00 00 01 “Status”} Example for buzzer on 50ms : Command: 02 6B 06 00 00 00 01 00 00 00 00 E0 00 00 28 01 05 A0 03 ACK: 02 00 00 03 Response: 02 83 06 00 00 00 01 00 00 81 00 E0 00 00 00 01 05 E1 03 6.
ACR1281S 7. Automatic PICC Polling Whenever the reader is connected to the PC, the PICC polling function will start the PICC scanning to determine if a PICC is placed on / removed from the built-antenna. We can send a command to disable the PICC polling function. The command is sent through the PCSC Escape command interface. To meet the energy saving requirement, special modes are provided for turning off the antenna field whenever the PICC is inactive, or no PICC is found.
ACR1281S • • • • ISO 14443 Type A PICCs Only = { E0 00 00 20 01 01} ISO 14443 Type B PICCs Only = { E0 00 00 20 01 02 } ISO 14443 Type A and B PICCs = { E0 00 00 20 01 03} #default setting Read the existing status = { E0 00 00 20 00}; Response = {E1 00 00 00 01 “Status”} Hints: 1. It is recommended to specific the PICC types in the application so as to speed up the card detection process. 9.
ACR1281S To speed up the card detection time, we can enable the “Enforce ICC & PICC Exclusive Mode” • Enforce ICC & PICC Exclusive Mode = {E0 00 00 2B 01 “New Mode Configuration”}. #default value 01 00 = Both ICC & PICC interfaces can be activated at the same time. 01 = Either ICC or PICC interface can be activated at any one time.
ACR1281S 13. Continuous Wake Up Command Sending Test for the PICC Interface This command is used for sending WUPA/WUPB by the reader continuously to test antenna field. • • • Command = {E0 00 00 27 02 “Command” “Speed”} Disable Command Sending = { E0 00 00 27 02 00 00} Response = {E1 00 00 00 01 “Status”} Command coding: WUPA = 01 WUPB = 02 Speed coding: 106k bps = 00 212k bps = 01 424k bps = 02 Status: WUPA Sending = 01 WUPB Sending = 02 Hints: 1.
ACR1281S 18.
ACR1281S PICC INTERFACE DESCRIPTION 1. ATR Generation If the reader detects a PICC, an ATR will be sent to the PCSC driver for identifying the PICC. 1.1 ATR format for ISO 14443 Part 3 PICCs. Byte Value Designation (Hex) 0 3B Initial Header 1 8N T0 2 80 TD1 3 01 TD2 80 T1 Tk 3+N 4F 0C RID 4+N SS C0 .. C1 00 00 00 00 UU 4 To RFU TCK Description Higher nibble 8 means: no TA1, TB1, TC1 only TD1 is following.
ACR1281S 1.2 ATR format for ISO 14443 Part 4 PICCs. Byte Value Designation (Hex) 0 3B Initial Header 1 8N T0 2 80 TD1 3 01 TD2 4 to 3+N XX XX XX XX T1 Tk Description Higher nibble 8 means: no TA1, TB1, TC1 only TD1 is following. Lower nibble N is the number of historical bytes (HistByte 0 to HistByte N-1) Higher nibble 8 means: no TA2, TB2, TC2 only TD2 is following. Lower nibble 0 means T = 0 Higher nibble 0 means no TA3, TB3, TC3, TD3 following.
ACR1281S PICC APDU COMMANDS FOR GENERAL PURPOSES 1. Get Data The “Get Data command” will return the serial number or ATS of the “connected PICC”. Table 1.1-1a: Get UID APDU Format (5 Bytes) Command Class INS Get Data FF CA P1 P2 Le 00 01 00 00 (Max Length) Table 2.1-1b: Get UID Response Format (UID + 2 Bytes) if P1 = 0x00 Response Data Out Result UID (LSB) UID (MSB) SW1 SW2 Table 2.1-1c: Get ATS of a ISO 14443 A card (ATS + 2 Bytes) if P1 = 0x01 Response Data Out Result ATS Table 2.
ACR1281S PICC APDU COMMANDS (T=CL EMULATION) FOR MIFARE 1K/4K MEMORY CARDS 2.1 Load Authentication Keys The “Load Authentication Keys command” will load the authentication keys into the reader. The authentication keys are used to authenticate the particular sector of the Mifare 1K/4K Memory Card. Two kinds of authentication key locations are provided, volatile and non-volatile key locations respectively. Table 2.
ACR1281S Examples: // Load a key {FF FF FF FF FF FF} into the non-volatile memory location 0x05. APDU = {FF 82 20 05 06 FF FF FF FF FF FF} // Load a key {FF FF FF FF FF FF} into the volatile memory location 0x20. APDU = {FF 82 00 20 06 FF FF FF FF FF FF} Hints: 1. Basically, the application should know all the keys being used. It is recommended to store all the required keys to the non-volatile memory for security reasons.
ACR1281S 2.2.1 Authentication for MIFARE 1K/4K The “Authentication command” uses the keys stored in the reader to do authentication with the MIFARE 1K/4K card (PICC). Two types of the keys are used for authentication, TYPE_A and TYPE_B respectively. Table 2.2-1a: Load Authentication Keys APDU Format (6 Bytes) #Obsolete Command Class INS P1 P2 P3 Authentication FF 88 00 Block Number Key Type Table 2.
ACR1281S Response Result Data Out SW1 SW2 Table 2.2-1c: Load Authentication Keys Response Codes Results SW1 SW2 Meaning Success 90 00 Error 63 00 The operation is completed successfully. The operation is failed. MIFARE 1K Memory Map. Sectors (Total 16 sectors. Each sector consists of 4 consecutive blocks) Sector 0 Sector 1 .. ..
ACR1281S // To authenticate the Block 0x04 with a {TYPE A, non-volatile, key number 0x05}. // PC/SC V2.01, Obsolete APDU = {FF 88 00 04 60 05}; // To authenticate the Block 0x04 with a {TYPE A, non-volatile, key number 0x05}. // PC/SC V2.07 APDU = {FF 86 00 00 05 01 00 04 60 05} Hints: MIFARE Ultralight does not need to do any authentication. The memory is free to access. Advanced Card Systems Ltd.
ACR1281S 2.3 Read Binary Blocks The “Read Binary Blocks command” is used for retrieving a multiple of “data blocks” from the PICC. The data block/trailer block must be authenticated first before executing the “Read Binary Blocks command”. Table 2.3-1a: Read Binary APDU Format (5 Bytes) Command Class INS P1 Read Binary Blocks FF B0 00 P2 Le Block Number Number of Bytes to Read Block Number (1 Byte): The starting block.
ACR1281S 2.4 Update Binary Blocks The “Update Binary Blocks command” is used for writing a multiple of “data blocks” into the PICC. The data block/trailer block must be authenticated first before executing the “Update Binary Blocks command”. Table 2.3-1a: Update Binary APDU Format (Multiple of 16 + 5 Bytes) Command Class INS P1 P2 Lc Update Binary Blocks FF D6 00 Block Number Number of Bytes to Update Data In Block Data (Multiple of 16 Bytes) Block Number (1 Byte): The starting block to be updated.
ACR1281S 2.5 Value Block Related Commands The data block can be used as value block for implementing value-based applications. 2.5.1 Value Block Operation The “Value Block Operation command” is used for manipulating value-based transactions. E.g. Increment a value of the value block etc. Table 2.5.1-1a: Value Block Operation APDU Format (10 Bytes) Command Class INS P1 P2 Lc Value Block Operation FF D7 00 Block Number 05 Data In VB_OP VB_Value (4 Bytes) {MSB ..
ACR1281S 2.5.2 Read Value Block The “Read Value Block command” is used for retrieving the value from the value block. This command is only valid for value block. Table 2.5.2-1a: Read Value Block APDU Format (5 Bytes) Command Class INS P1 P2 Read Value Block FF B1 00 Le Block Number 00 Block Number (1 Byte): The value block to be accessed. Table 2.5.2-1b: Read Value Block Response Format (4 + 2 Bytes) Response Data Out Result Value {MSB ..
ACR1281S 2.5.3 Restore Value Block The “Restore Value Block command” is used to copy a value from a value block to another value block. Table 2.5.3-1a: Restore Value Block APDU Format (7 Bytes) Command Class INS P1 P2 Lc Data In Value Block Operation FF D7 00 Source Block Number 02 03 Target Block Number Source Block Number (1 Byte): The value of the source value block will be copied to the target value block. Target Block Number (1 Byte): The value block to be restored.
ACR1281S BASIC PROGRAM FLOW FOR CONTACTLESS APPLICATIONS Step 0. Start the application. The reader will do the PICC Polling and scan for tags continuously. Present a PICC tag at the field of the reader. Step 1. Power on the PICC Interface Step 2. Access the PICC by exchanging APDUs. Step 2. Access the PICC by exchanging APDUs. .. Step N. Power off the PICC Interface. Shut down the application. Advanced Card Systems Ltd.
ACR1281S 1. How to access PCSC Compliant Tags (ISO14443-4)? Basically, all ISO 14443-4 complaint cards (PICCs) would understand the ISO 7816-4 APDUs. The ACR1281S Reader just has to communicate with the ISO 14443-4 complaint cards through exchanging ISO 7816-4 APDUs and Responses. ACR1281S will handle the ISO 14443 Parts 1-4 Protocols internally. MIFARE 1K, 4K, MINI and Ultralight tags are supported through the T=CL emulation. Just simply treat the MIFARE tags as standard ISO14443-4 tags.
ACR1281S Typical sequence may be: - Present the Tag and Connect the PICC Interface - Read / Update the memory of the tag Step 1) Connect the Tag The ATR of the tag is 3B 8C 80 01 50 00 05 70 3B 00 00 00 00 33 81 81 20 In which, The ATQB = 50 00 05 70 3B 00 00 00 00 33 81 81. It is an ISO14443-4 Type B tag. Step 2) Send an APDU, Get Challenge.
ACR1281S For Example: ISO7816-4 APDU // To read 8 bytes from an ISO 14443-4 Type B PICC (ST19XR08E) APDU Command ={80 B2 80 00 08} Class = 0x80 INS = 0xB2 P1 = 0x80 P2 = 0x00 Lc = None Data In = None Le = 0x08 APDU Response: 00 01 02 03 04 05 06 07 90 00 Advanced Card Systems Ltd.
ACR1281S 2. How to access DESFIRE Tags (ISO14443-4)? The DESFIRE supports ISO7816-4 APDU Wrapping and Native modes. Once the DESFire Tag is activated, the first APDU sent to the DESFire Tag will determine the “Command Mode”. If the first APDU is “Native Mode”, the rest of the APDUs must be in “Native Mode” format. Similarly, If the first APDU is “ISO7816-4 APDU Wrapping Mode”, the rest of the APDUs must be in “ISO7816-4 APDU Wrapping Mode” format. Example 1: DESFIRE ISO7816-4 APDU Wrapping.
ACR1281S Example 3: DESFIRE Native Command. // We can send Native DESFire Commands to the reader without ISO7816 wrapping if we find that the Native DESFire Commands are more easier to handle. // To read 8 bytes random number from an ISO 14443-4 Type A PICC (DESFIRE) APDU = {0A 00} Answer: AF 25 9C 65 0C 87 65 1D D7 In which, the first byte “AF” is the status code returned by the DESFire Card. The Data inside the blanket [1DD7] can simply be ignored by the application.
ACR1281S BASIC PROGRAM FLOW FOR CONTACT APPLICATIONS Step 0. Start the application and insert a ICC Card into the ICC Interface. Step 1. Power on the ICC Interface Step 2. Access the ICC by exchanging APDUs. .. Step N. Power off the ICC Interface. Shut down the application. 1.
ACR1281S Command: 02 6F 07 00 00 00 01 00 00 00 00 80 A4 00 00 02 55 55 4F 03 ACK:02 00 00 03 Response: 02 80 02 00 00 00 01 00 00 81 00 91 00 93 03 File name is 55 55 4)Write a date to the file in 3)step Command: 02 6F 0d 00 00 00 01 00 00 00 00 80 d2 00 00 08 01 02 03 04 05 06 07 08 31 03 ACK:02 00 00 03 Response: 02 80 02 00 00 00 01 00 00 81 00 90 00 92 03 5) Read a date from a file Command: 02 6F 05 00 00 00 01 00 00 00 00 80 B2 00 00 08 51 03 ACK:02 00 00 03 Response: 02 80 0A 00 00 00 01 00 00 81 00
ACR1281S ANNEX A Example of XOR: The Checksum byte is one byte in length and is calculated as the exclusive-OR of all the bytes with the Bulk-Header field and information field. E.g.: Command: 02 6F 05 00 00 00 01 00 00 00 00 80 B2 00 00 08 51 03 The Bulk-Header field is 6F 05 00 00 00 01 00 00 00 00, and the information field is 80 B2 00 00 08 and the checksum is 0x51 Advanced Card Systems Ltd.
ACR1281S TECHNICAL SPECIFICATION Universal Serial Bus Interface Power source........................................ From +5V power or USB Speed ................................................... up to 500Kbps Supply Voltage...................................... Regulated 5V DC Supply Current ..................................... 200mA (max); 100mA (normal) Contactless Smart Card Interface Standard ............................................... ISO 14443 A & B Parts 1-4 Protocol .......................
FCC Caution: Any Changes or modifications not expressly approved by the party responsible for compliance could void the user’s authority to operate the equipment. This device complies with part 15 of the FCC Rules. Operation is subject to the following two conditions: (1) This device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation.