0% found this document useful (0 votes)

71 views98 pages

Api Acr1281u C1 1.11

Uploaded by

Anwar Mohamed

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

71 views98 pages

Api Acr1281u C1 1.11

Uploaded by

Anwar Mohamed

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

You are on page 1/ 98

ACR1281U-C1

USB Dual Interface Reader

Application Programming Interface V1.11

Subject to change without prior notice [email protected]

www.acs.com.hk
Revision History
Release Date Revision Description Version Number
2011-08-19 ● Initial Release 1.00
• Added Manual PICC Polling from ACR128
• Removed Buzzer Control OFF: 00
• Removed the following functions:
o Buzzer Status
o Read/Initialize Register Setting
o Read/Update Register
2011-12-21 o All Atmel Memory Card functions 1.01
o Read Interface Status
• Updated Sections 5.3.5 & 5.3.6: Set/Read
Default LED & Buzzer Behaviors
• Updated Sections 5.3.10 & 5.3.11:
Set/Read Automatic PICC Polling
● Updated description for Set/Read Antenna
Field
2012-07-18 • Updated Formatting 1.02
• Updated Formatting
2013-01-23 1.03
• Updated Section 2.0: Features
• Updated Product Photo
• Added FIPS201 in Section 2.0: Features
2013-07-11 • Updated Sections 5.3.5 & 5.3.6: Set/Read 1.04
Default LED & Buzzer Behaviors
• Updated Sections 5.3.10 & 5.3.11:
Set/Read Automatic PICC Polling

Page 2 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Release Date Revision Description Version Number
• Updated formatting
• Added Memory Card - ATMEL AT88SC15
and Memory Card - AT88SC101 /
AT88SC102 / AT88SC1003 in Contact
Smart Card Protocol Section 5.1
• Added Memory Card - ATMEL
AT88SC1608 in Contact Smart Card
Protocol Section 5.1
o Select Card Type
o Read Memory Card
o Write Memory Card
o Verify Password
o Initialize Authentication
2014-01-09 o Verify Authentication 1.05
• Removed the following commands under
Section 5.3
o Set Auto PPS
o Read Auto PPS
o Set Antenna Field
o Read Antenna Field Status
o Set User Extra Guard Time Setting
o Read User Extra Guard Time Setting
o Set “616C” Auto Handle Option Setting
o Read “616C” Auto Handle Option
Setting
• Refresh Interface Status
• Updated Section 5.3.10: Set Automatic
2015-10-14 1.06
PICC Polling
• Updated Section 2.0: Features
• Added Section 5.3.17 Set Auto PPS and
Section 5.3.18 Read Auto PPS
2017-01-18 1.07
• Added Note in Appendix D. Escape
Command Example
• Removed FIPS201 in Section 2.0 Features
• Updated Section 2.0: Features
o Added CAC, PIV, PPS, and extended
2018-03-20 APDU Support for Contact Interface 1.08
o Added Short Circuit Protection Feature
o Added REACH Compliance
• Updated Section 2.0: Features
• Transferred Appendix B: Accessing Mifare
2020-01-31 1.09
DESFire tags to Section 5.2.6
• Added Section 5.3.19: Read Serial Number

Page 3 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Release Date Revision Description Version Number
• Updated Section 5.2.1.1: ATR Format for
ISO 14443 Part 3 PICCs
2020-05-27 • Updated Section 5.2.3: PICC Commands 1.10
(T=CL Emulation) for MIFARE 1K/4K
Memory Cards
2020-07-03 • Updated Section 5.3 Peripherals Control 1.11

Page 4 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Table of Contents
1.0. Introduction ............................................................................................................... 7
2.0. Features ..................................................................................................................... 8
3.0. ACR1281U-C1 Architecture ...................................................................................... 9
3.1. Reader Block Diagram...........................................................................................................9
3.2. Communication between PC/SC driver and ICC, PICC and SAM ......................................10
4.0. Hardware Design ..................................................................................................... 11
4.1. USB......................................................................................................................................11
4.1.1. Communication Parameters .......................................................................................11
4.1.2. Endpoints ....................................................................................................................11
4.2. Contact Smart Card Interface ..............................................................................................11
4.2.1. Smart Card Power Supply VCC (C1) ..........................................................................11
4.2.2. Card Type Selection....................................................................................................11
4.2.3. Interface for Microcontroller-based Cards ..................................................................12
4.3. Contactless Smart Card Interface .......................................................................................12
4.3.1. Carrier Frequency .......................................................................................................12
4.3.2. Card Polling.................................................................................................................12
4.4. User Interface ......................................................................................................................12
4.4.1. Buzzer .........................................................................................................................12
4.4.2. LED .............................................................................................................................12
5.0. Software Design ...................................................................................................... 13
5.1. Contact Smart Card Protocol ...............................................................................................13
5.1.1. Memory Card – 1/2/4/8/16 kilobits I2C Card ...............................................................13
5.1.2. Memory Card – 32/64/128/256/512/1024 kbits I2C Card ...........................................16
5.1.3. Memory Card – ATMEL AT88SC153..........................................................................19
5.1.4. Memory Card – ATMEL AT88SC1608........................................................................23
5.1.5. Memory Card – SLE4418/SLE4428/SLE5518/SLE5528 ............................................27
5.1.6. Memory Card – SLE4432/SLE4442/SLE5532/SLE5542 ............................................32
5.1.7. Memory Card – SLE4406/SLE4436/SLE5536/SLE6636 ............................................38
5.1.8. Memory Card – SLE4404 ...........................................................................................43
5.1.9. Memory Card – AT88SC101/AT88SC102/AT88SC1003 ...........................................47
5.2. Contactless Smart Card Protocol ........................................................................................55
5.2.1. ATR Generation ..........................................................................................................55
5.2.2. Pseudo APDUs for Contactless Interface ...................................................................58
5.2.3. PICC Commands (T=CL Emulation) for MIFARE 1K/4K Memory Cards ...................59
5.2.4. Accessing PC/SC-compliant tags (ISO 14443-4) .......................................................69
5.2.5. Accessing MIFARE DESFire tags (ISO 14443-4).......................................................70
5.3. Peripherals Control ..............................................................................................................72
5.3.1. Get Firmware Version .................................................................................................72
5.3.2. LED Control.................................................................................................................73
5.3.3. LED Status ..................................................................................................................74
5.3.4. Buzzer Control ............................................................................................................75
5.3.5. Set Default LED and Buzzer Behaviors ......................................................................76
5.3.6. Read Default LED and Buzzer Behaviors ...................................................................77
5.3.7. Initialize Card Insertion Counter..................................................................................78
5.3.8. Read Card Insertion Counter ......................................................................................79
5.3.9. Update Card Insertion Counter ...................................................................................80
5.3.10. Set Automatic PICC Polling ........................................................................................81
5.3.11. Read Automatic PICC Polling .....................................................................................83
5.3.12. Manual PICC Polling ...................................................................................................84
5.3.13. Set PICC Operating Parameter ..................................................................................85
5.3.14. Read PICC Operating Parameter ...............................................................................86
5.3.15. Set Exclusive Mode.....................................................................................................87
5.3.16. Read Exclusive Mode .................................................................................................88

Page 5 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.3.17. Set Auto PPS ..............................................................................................................89
5.3.18. Read Auto PPS ...........................................................................................................90
5.3.19. Read Serial Number....................................................................................................91
Appendix A. Basic program flow for contactless applications.................................... 92
Appendix B. Extended APDU Command Example ........................................................ 93
Appendix C. Escape Command Example ...................................................................... 95
Appendix D. Supported Card Types ............................................................................... 96
Appendix E. ACR128 Compatibility ................................................................................ 97

List of Figures
Figure 1 : ACR1281U-C1 Reader Block Diagram .................................................................................. 9
Figure 2 : ACR1281U-C1 Architecture ................................................................................................. 10

List of Tables
Table 1 : USB Interface Wiring ............................................................................................................. 11
Table 2 : Buzzer Event ......................................................................................................................... 12
Table 3 : LED Indicator ......................................................................................................................... 12
Table 4 : Blown Fuse Code Values ...................................................................................................... 53
Table 5 : ISO 14443 Part 3 ATR Format .............................................................................................. 55
Table 6 : ISO 14443 Part 4 ATR Format .............................................................................................. 56
Table 7 : MIFARE 1K Memory Map ...................................................................................................... 62
Table 8 : MIFARE 4K Memory Map ...................................................................................................... 62
Table 9 : MIFARE Ultralight Memory Map ............................................................................................ 63

Page 6 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
1.0. Introduction
The ACR1281U-C1 DualBoost II is the second generation of the ACR128 DualBoost Reader. The
ACR1281U-C1 is a powerful and efficient dual interface smart card reader that can be used to access
ISO 7816 MCU cards, MIFARE® cards and ISO 14443 Type A and B contactless cards. It makes use
of the USB CCID class driver and USB interface to connect to a PC and accept card commands from
the computer application.
The ACR1281U-C1 acts as the intermediary device between the computer and the card. The reader,
which communicates with a contactless tag, MCU card, SAM card, or the device peripherals (LED or
buzzer), will carry out commands issued from the computer. It has three interfaces: the PICC, ICC
and SAM interface, which all follow the PC/SC specifications. The contact interface makes use of the
APDU commands as defined in ISO 7816 specifications. For contact MCU card operations, please
refer to the related card documentation and the PC/SC specifications.
This API document details how the PC/SC APDU commands are implemented for the contactless
interface, contact memory card support and device peripherals of the ACR1281U-C1.

Page 7 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
2.0. Features
• USB Full Speed Interface
• CCID-compliant
• Smart Card Reader:
o Contactless Interface:
▪ Read/Write speed of up to 848 Kbps
▪ Built-in antenna for contactless tag access, with card reading distance of up to 50 mm
(depending on tag type)
▪ Supports ISO 14443 Part 4 Type A and B cards and MIFARE series
▪ Built-in anti-collision feature (only one tag is accessed at any time)
▪ Supports extended APDU (max. 64 KB)
o Contact Interface:
▪ Supports ISO 7816 Class A, B and C (5 V, 3 V and 1.8 V)
▪ Supports CAC (Common Access Card)
▪ Supports PIV (Personal Identity Verification Card)
▪ Supports microprocessor cards with T=0 or T=1 protocol
▪ Supports memory cards
▪ Supports PPS (Protocol and Parameters Selection)
▪ Features Short Circuit Protection
▪ Supports extended APDU (max. 64 KBytes for T=1; max. 512+10 Bytes for T=0)
o SAM Interface:
▪ One SAM Slot
▪ Supports ISO 7816 Class A SAM cards
• Application Programming Interface:
o Supports PC/SC
o Supports CT-API (through wrapper on top of PC/SC)
• Built-in Peripherals:
o Two user-controllable LEDs
o User-controllable buzzer
• USB Firmware Upgradability
• Supports Android™ 3.1 and later1
• Compliant with the following standards:
o ISO 14443
o ISO 7816
o PC/SC
o CCID
o CE
o FCC
o RoHS
o REACH
o Microsoft® WHQL

1
Uses an ACS-defined Android Library

Page 8 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
3.0. ACR1281U-C1 Architecture
3.1. Reader Block Diagram

Figure 1: ACR1281U-C1 Reader Block Diagram

Page 9 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
3.2. Communication between PC/SC driver and ICC, PICC and
SAM
The protocol being used between the ACR1281U-C1 and the PC is CCID. All communications
between ICC, PICC and SAM are PC/SC-compliant.

Figure 2: ACR1281U-C1 Architecture

Page 10 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
4.0. Hardware Design
4.1. USB
The ACR1281U-C1 connects to a computer through USB following the USB standard.

4.1.1. Communication Parameters

The ACR1281U-C1 connects to a computer through USB as specified in the USB Specification 2.0.
The ACR1281U-C1 works in full-speed mode, i.e. 12 Mbps.

Pin Signal Function

1 VBUS +5 V power supply for the reader
2 D- Differential signal transmits data between ACR1281U-C1 and PC
3 D+ Differential signal transmits data between ACR1281U-C1 and PC
4 GND Reference voltage level for power supply

Table 1: USB Interface Wiring

Note: The device driver should be installed for the ACR1281U-C1 to function properly through USB
interface.

4.1.2. Endpoints
The ACR1281U-C1 uses the following endpoints to communicate with the host computer:
Control Endpoint – For setup and control purposes.
Bulk-OUT – For commands to be sent from the host to the ACR1281U-C1 (data packet size is 64
bytes).
Bulk-IN – For response to be sent from the ACR1281U-C1 to the host (data packet size is 64 bytes).
Interrupt-IN – For card status message to be sent from the ACR1281U-C1 to the host (data packet
size is 8 bytes).

4.2. Contact Smart Card Interface

The interface between the ACR1281U-C1 and the inserted smart card follows the specifications of
ISO 7816-3 with certain restrictions or enhancements to increase the practical functionality of the
ACR1281U-C1.

4.2.1. Smart Card Power Supply VCC (C1)

The current consumption of the inserted card must not be higher than 50 mA.

4.2.2. Card Type Selection

Before activating the inserted card, the controlling PC always needs to select the card type through
the proper command sent to the ACR1281U-C1. This includes both memory card and MCU-based
cards.
For MCU-based cards the reader allows for the selection of the preferred protocol, T=0 or T=1.
However, this selection is only accepted and carried out by the reader through the PPS if the card
inserted in the reader supports both protocol types. Whenever an MCU-based card supports only one
protocol type, T=0 or T=1, the reader automatically uses that protocol type, regardless of the protocol
type selected by the application.

Page 11 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
4.2.3. Interface for Microcontroller-based Cards
For microcontroller-based smart cards only the contacts C1 (VCC), C2 (RST), C3 (CLK), C5 (GND)
and C7 (I/O) are used. A frequency of 4.8 MHz is applied to the CLK signal (C3).

4.3. Contactless Smart Card Interface

The interface between the ACR1281U-C1 and the contactless card follows the specifications of ISO
14443 with certain restrictions or enhancements to increase the practical functionality of the
ACR1281U-C1.

4.3.1. Carrier Frequency

The carrier frequency for the ACR1281U-C1 is 13.56 MHz.

4.3.2. Card Polling

The ACR1281U-C1 automatically polls the contactless cards that are within the field. ISO 14443-4
Type A, ISO 14443-4 Type B and MIFARE cards are supported.

4.4. User Interface

4.4.1. Buzzer
A monotone buzzer is used to show the “Card Insertion” and “Card Removal” events.

Events Buzzer
1. The reader is powered up and successfully initialized. Beep
2. Card Insertion Event (ICC or PICC) Beep
3. Card Removal Event (ICC or PICC) Beep

Table 2: Buzzer Event

4.4.2. LED
The LEDs are used for showing the state of the contact and contactless interfaces. The Red LED is
used for showing PICC status and Green LED for ICC.

Red LED Green LED

Reader States
PICC Indicator ICC Indicator
1. No PICC found or PICC is available but
A single pulse per ~ 5 seconds
not activated.
2. PICC is available and activated. ON
3. PICC is operating. Blinking
4. ICC is available and activated. ON
5. ICC is unavailable or inactive. OFF
6. ICC is operating. Blinking

Table 3: LED Indicator

Page 12 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.0. Software Design
5.1. Contact Smart Card Protocol
5.1.1. Memory Card – 1/2/4/8/16 kilobits I2C Card

5.1.1.1. Select card type

This command powers down/up the selected card in the reader, and then performs a card reset after.

Command

Command Class INS P1 P2 Lc Card Type

Select Card Type FFh A4h 00h 00h 01h 01h

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.

5.1.1.2. Select page size

This command chooses the page size to read in the card. The default value is an 8-byte page write. It
resets to the default value whenever the card is removed, or the reader is turned off.

Command

Command Class INS P1 P2 Lc Page Size

Select Page Size FFh 01h 00h 00h 01h

Where:
Page Size (1 byte)
03h = 8-byte page write
04h = 16-byte page write
05h = 32-byte page write
06h = 64-byte page write
07h = 128-byte page write

Page 13 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.

5.1.1.3. Read memory card

This command reads the memory card’s content from a specified address.

Command

Byte Address
Command Class INS MEM_L
MSB LSB
Read Memory Card FFh B0h

Where:
Byte Address (2 bytes)
Memory address location of the memory card
MEM_L (1 byte)
Length of data to be read from the memory card

Response

Response Byte 1 … … Byte N SW1 SW2

Result

Where:
Byte (1…N) Data read from memory card.
SW1 SW2 = 90 00h if the operation was completed successfully.

Page 14 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.1.1.4. Write memory card
This command writes the memory card’s content to a specified address.

Command

Byte Address
Command Class INS MEM_L Byte 1 … … Byte N
MSB LSB

Write Memory Card FFh D0h

Where:
Byte Address (2 bytes)
Memory address location of the memory card
MEM_L (1 byte)
Length of data to be read from the memory card
Byte (1…N) Data to be written to the memory card.

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.

Page 15 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.1.2. Memory Card – 32/64/128/256/512/1024 kbits I2C Card

5.1.2.1. Select card type

This command powers down/up the selected card in the reader, and then performs a card reset after.

Command

Command Class INS P1 P2 Lc Card Type

Select Card Type FFh A4h 00h 00h 01h 02h

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.

5.1.2.2. Select page size

This command chooses the page size to read in the card. The default value is an 8-byte page write. It
resets to the default value whenever the card is removed, or the reader is turned off.

Command

Command Class INS P1 P2 Lc Page Size

Select Page Size FFh 01h 00h 00h 01h

Where:
Page Size (1 byte)
03h = 8-byte page write
04h = 16-byte page write
05h = 32-byte page write
06h = 64-byte page write
07h = 128-byte page write

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.

Page 16 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.1.2.3. Read memory card
This command reads the memory card’s content from a specified address.

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.1.4. Memory Card – ATMEL AT88SC1608
5.1.4.1. Select card type
This command powers down/up the selected card inserted in the card reader and performs a card
reset. It also selects the page size to be a 16-byte page write.

Command

Pseudo-APDU
Command Class INS P1 P2 Lc Card Type
Select Card Type FFh A4h 00h 00h 01h 04h

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.

5.1.4.2. Read memory card

This command reads the memory card’s content from a specified address.

Command

Pseudo-APDU
Command Class INS Zone Address Byte Address MEM_L
Read Memory Card FFh

Where:
INS (1 byte)
For reading user zone, INS = B0h
For reading configuration zone or reading fuse, INS = B1h
Zone Address (1 byte)
= 00000 A10 A9 A8b, where A10 is the MSB of zone address
** don’t care for reading fuse
Byte Address (1 byte)
= A7 A6 A5 A4 A3 A2 A1 A0b is the memory address location of the
memory card
For reading fuse, Byte Address = 1000 0000b
MEM_L (1 byte)
Length of data to be read from the memory card.

Page 23 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Response

Response Byte 1 … … Byte N SW1 SW2

Result

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.

5.1.4.6. Verify authentication

This command verifies the memory card’s authentication.

Command

Pseudo-APDU
Command Class INS P1 P2 Lc Ch (0) Ch (1) … Ch (7)
Verify
FFh 82h 00h 00h 08h
Authentication

Where:
Ch (0…7) (8 bytes)
= Host challenge

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.

Page 26 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.1.5. Memory Card – SLE4418/SLE4428/SLE5518/SLE5528

5.1.5.1. Select card type

This command powers down/up the selected card in the reader, and then performs a card reset after.

Command

Command Class INS P1 P2 Lc Card Type

Select Card Type FFh A4h 00h 00h 01h 05h

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.

5.1.5.2. Read memory card

This command reads the memory card’s content from a specified address.

Command

Byte Address
Command Class INS MEM_L
MSB LSB
Read Memory Card FFh B0h

Response

Response Byte 1 … … Byte N SW1 SW2

Result

Where:
Byte (1…N) Data read from memory card.
SW1 SW2 = 90 00h if the operation was completed successfully.

Page 27 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.1.5.3. Read presentation error counter memory card (for SLE4428 and
SLE5528 only)
This command reads the presentation error counter for the secret code.

Command

Command Class INS P1 P2 MEM_L

Read Presentation Error Counter FFh B1h 00h 00h 03h

Response

Response ErrCnt Dummy 1 Dummy 2 SW1 SW2

Result

Where:
ErrCnt (1 byte)
The value of the presentation error counter
FFh = indicates the verification is correct
00h = indicates the password is locked (exceeding the maximum
number of retries)
Other values indicate the verification failed.
Dummy 1, Dummy 2 (2 bytes)
Dummy data read from the card
SW1 SW2 = 90 00h if the operation was completed successfully.

5.1.5.4. Read protection bit

This command reads the protection bit.

Command

Byte Address
Command Class INS MEM_L
MSB LSB
Read Protection Bit FFh B2h

Where:
MSB Byte Address (1 byte)
The memory address location of the memory card
= 0000 00 A9 A8b
LSB Byte Address (1 byte)
The memory address location of the memory card
= A7 A6 A5 A4 A3 A2 A1 A0b

Page 28 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
MEM_L (1 byte)
Length of protection bits read from the card, in multiples of 8 bits. The
maximum value is 32.
MEM_L = 1 + INT ((number of bits – 1)/8)
For example, to read 8 protection bits starting from memory 0010h,
the following pseudo-APDU should be issued:
FF B1 00 10 01h

Response

Response PROT 1 … … PROT L SW1 SW2

Result

Where:
PROT (1..L) Bytes containing the protection bits.
SW1 SW2 = 90 00h if the operation was completed successfully.

The arrangement of the protection bits in the PROT bytes is as follows:

PROT 1 PROT 2 ….
P8 P7 P6 P5 P4 P3 P2 P1 P16 P15 P14 P13 P12 P11 P10 P9 .. .. .. .. .. .. P18 P17

Where:
Px is the protection bit of byte x in response data:
0 = byte is write protected
1 = byte can be written

5.1.5.5. Write memory card

This command writes the memory card’s content to a specified address.

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.1.6. Memory Card – SLE4432/SLE4442/SLE5532/SLE5542

5.1.6.1. Select card type

This command powers down/up the selected card in the reader, and then performs a card reset after.

Command

Command Class INS P1 P2 Lc Card Type

Select Card Type FFh A4h 00h 00h 01h 06h

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully

5.1.6.2. Read memory card

This command reads the memory card’s content from a specified address.

Command

Command Class INS P1 Byte Address MEM_L

Read Memory Card FFh B0h 00h

Where:
Byte Address (1 byte)
=A7 A6 A5 A4 A3 A2 A1 A0b is the memory address location of the
memory card
MEM_L (1 byte)
Length of data to be read from the memory card

Response

Response Byte 1 … … Byte N PROT1 PROT2 PROT3 PROT4 SW1 SW2

Result

Where:
Byte (1…N) Data read from memory card.
PROT (1…4) Bytes containing the protections bits from protection.
SW1 SW2 = 90 00h if the operation was completed successfully.

Page 32 of 98

5.1.7.1. Select card type

This command powers down/up the selected card in the reader, and then performs a card reset after.

Command

Command Class INS P1 P2 Lc Card Type

Select Card Type FFh A4h 00h 00h 01h 07h

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.

5.1.7.2. Read Memory Card

This command reads the memory card’s content from a specified address.

Command

Command Class INS P1 Byte Address MEM_L

Read Memory Card FFh B0h 00h

Where:
Byte Address (1 byte)
Memory address location of the memory card
MEM_L (1 byte)
Length of data to be read from the memory card

Response

Response Byte 1 … … Byte N SW1 SW2

Result

Where:
Byte (1…N) Data read from memory card.
SW1 SW2 = 90 00h if the operation was completed successfully.

Page 38 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.1.7.3. Write one byte memory card
This command is used to write one byte to the specified address of the inserted card. The byte is
written to the card with LSB first, i.e. the bit card address 0 is regarded as the LSB of byte 0.
Four different write modes are available for this card type, which are distinguished by a flag in the
command data field:
a. Write
The byte value specified in the command is written to the specified address. This command can
be used for writing personalization data and counter values to the card.
b. Write with carry
The byte value specified in the command is written to the specified address and the command is
sent to the card to erase the next lower counter stage. This mode can therefore only be used for
updating the counter value in the card.
c. Write with backup enabled (for SLE4436, SLE5536 and SLE6636 only)
The byte value specified in the command is written to the specified address. This command can
be used for writing personalization data and counter values to the card. Backup bit is enabled to
prevent data loss when card tearing occurs.
d. Write with carry and backup enabled (SLE4436, SLE5536 and SLE6636 only)
The byte value specified in the command is written to the specified address and the command is
sent to the card to erase the next lower counter stage. This mode can therefore only be used for
updating the counter value in the card. Backup bit is enabled to prevent data loss when card
tearing occurs.
With all write modes, the byte at the specified card address is not erased prior to the write operation
and hence, memory bits can only be programmed from ‘1’ to ‘0’.
The backup mode available in the SLE4436 and SLE5536 card can be enabled or disabled in the
write operation.

Command

Command Class INS P1 Byte Address MEM_L Mode Byte

Read Memory Card FFh D0h 00h 02h

Where:
Byte Address (1 byte)
Memory address location of the memory card
Mode (1 byte)
Specifies the write mode and backup option
00h = Write.
01h = Write with carry.
02h = Write with backup enabled (for SLE4436, SLE5536 and
SLE6636 only).
03h = Write with carry and with backup enabled (for SLE4436,
SLE5536 and SLE6636 only).
Byte (1 byte)
Byte value to be written to the card

Page 39 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.

5.1.7.4. Present code memory card

This command submits the secret code to the memory card to enable card personalization mode. The
following actions are executed:
1. Search a ‘1’ bit in the presentation error counter and write bit ‘0’.
2. Present the specified code to the card.

Command

Code
Command Class INS P1 P2 MEM_L
Addr Byte 1 Byte 2 Byte 3
Present Code
FFh 20h 00h 00h 04h 09h
Memory Card

Where:
Addr (1 byte)
Byte address of the presentation counter in the card
Code (3 bytes)
Secret code (PIN)

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.

Page 40 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.1.7.5. Authenticate memory card (for SLE4436, SLE5536 and SLE6636
only)
This command reads the authentication certificate from the card. The following actions are executed:
1. Select Key 1 or Key 2 in the card as specified in the command.
2. Present the challenge data specified in the command to the card.
3. Generate the specified number of CLK pulses for each bit authentication data computed by
the card.
4. Read 16 bits of authentication data from the card.
5. Reset the card to normal operation mode.

The authentication is performed in two steps. The first step is to send the Authentication Certificate to
the card. The second step is to get back two bytes of authentication data calculated by the card.

Step 1: Send authentication certificate to the card.

Command

Code
Command Class INS P1 P2 MEM_L
Key CLK_CNT Byte 1 … Byte 6
Send
Authentication FFh 84h 00h 00h 08h
Certificate

Where:
Key (1 byte)
Key to be used for the computation of the authentication certificate
00h = Key 1 with no cipher block chaining.
01h = Key 2 with no cipher block chaining.
80h = Key 1 with cipher block chaining (for SLL5536 and SLE6636
only).
81h = Key 2 with cipher block chaining (for SLL5536 and SLE6636
only).
CLK_CNT (1 byte)
Number of CLK pulses to be supplied to the card for the computation
of each bit of the authentication certificate. Typical value is 160
clocks (A0h).
Byte (1...6) Card challenge data.

Response

Response SW1 SW2

Result 61h 02h

Page 41 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Step 2: Get the authentication data (Get Response).
Command

Command Class INS P1 P2 MEM_L

Get Authentication Data FFh C0h 00h 00h 02h

Response

Response Cert SW1 SW2

Result

Where:
Cert (2 bytes)
16 bits of authentication data computed by the card. The LSB of Byte
1 is the first authentication bit read from the card.
SW1 SW2 = 90 00h if the operation was completed successfully.

Page 42 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.1.8. Memory Card – SLE4404

5.1.8.1. Select card type

This command powers down/up the selected card in the reader, and then performs a card reset after.

Command

Command Class INS P1 P2 Lc Card Type

Select Card Type FFh A4h 00h 00h 01h 08h

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.

5.1.8.2. Read memory card

This command reads the memory card’s content from a specified address.

Command

Command Class INS P1 Byte Address MEM_L

Read Memory Card FFh B0h 00h

Where:
Byte Address (1 byte)
Memory address location of the memory card
MEM_L (1 byte)
Length of data to be read from the memory card

Response

Response Byte 1 … … Byte N SW1 SW2

Result

Where:
Byte (1…N) Data read from memory card.
SW1 SW2 = 90 00h if the operation was completed successfully.

Page 43 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.1.8.3. Write memory card
This command writes the memory card’s content to a specified address. The byte is written to the
card with LSB first, i.e. the bit at card address 0 is regarded as the LSB of byte 0.
The byte at the specified card address is not erased prior to the write operation and hence, memory
bits can only be programmed from ‘1’ to ‘0’.

Command

Byte
Command Class INS P1 MEM_L Byte 1 … … Byte N
Address
Write Memory Card FFh D0h 00h

Where:
Byte Address (1 byte)
Memory address location of the memory card
MEM_L (1 byte)
Length of data to be written to the memory card
Byte (1…N) Data to be written to the memory card.

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.

5.1.8.4. Erase scratch pad memory card

This command erases the data of the scratch pad memory of the inserted card. All memory bits inside
the scratch pad memory will be programmed to the state of ‘1’.

Command

Command Class INS P1 Byte Address MEM_L

Erase Scratch Pad FFh D2h 00h 00h

Where:
Byte Address (1 byte)
Memory byte address location of the scratch pad. Typical value is
02h.

Page 44 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.

5.1.8.5. Verify user code

This command submits the User Code (2 bytes) to the inserted card. The User Code enables access
to the memory of the card.
The following actions are executed:
1. Present the specified code to the card.
2. Search a ‘1’ bit in the presentation error counter and write the bit ‘0’.
3. Erase the presentation error counter. The Error User Counter can be erased when the
submitted code is correct.

Command

Error Counter Byte Code

Command Class INS MEM_L
LEN Address Byte 1 Byte 2
Verify User Code FFh 20h 04h 08h 02h

Where:
Error Counter LEN (1 byte)
Length of presentation error counter in bits
Byte Address (1 byte)
Byte address of the key in the card
Code (1 byte)
User Code

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.
= 63 00h if there are no more retries left.

Note: After SW1 SW2 = 90 00h has been received, read back the User Error Counter to check
whether the Verify_User_Code is correct. If the User Error Counter is erased and is equal to ‘FFh’, the
previous verification was successful.

Page 45 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.1.8.6. Verify memory code
This command submits memory code (4 bytes) to the inserted card. The memory code is used to
authorize the reloading of the user memory, together with the User Code.
The following actions are executed:
1. Present the specified code to the card.
2. Search a ‘1’ bit in the presentation error counter and write the bit to ‘0’.
3. Erase the presentation error counter.
Note: The Memory Error Counter cannot be erased.

Command

Error Code
Byte
Command Class INS Counter MEM_L
Address
LEN Byte 1 Byte 2 Byte 3 Byte 4

Verify Memory
FFh 20h 40h 28h 04h
Code

Where:
Error Counter LEN (1 byte)
Length of presentation error counter in bits
Byte Address (1 byte)
Byte address of the key in the card
Code (4 bytes)
Memory Code

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.
= 63 00h if there are no more retries left.

Note: After SW1 SW2 = 90 00h has been received, read back the User Error Counter to check
whether the Verify Memory Code is correct. If all data in Application Area is erased and is equal to
‘FFh’, the previous verification was successful.

Page 46 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.1.9. Memory Card – AT88SC101/AT88SC102/AT88SC1003
5.1.9.1. Select card type
This command powers down and up the selected card inserted in the card reader and performs a card
reset.

Command

Pseudo-APDU
Command Class INS P1 P2 Lc Card Type
Select Card Type FFh A4h 00h 00h 01h 09h

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.

5.1.9.2. Read Memory Card

This command reads the memory card’s content from the specified address.

Command

Pseudo-APDU
Command Class INS P1 Byte Address MEM_L
Read Memory Card FFh B0h 00h

Where:
Byte Address (1 byte)
Memory address location of the memory card.
MEM_L (1 byte)
Length of data to be read from the memory card.

Response

Response Byte 1 … … Byte N SW1 SW2

Result

Where:
Byte (1…N) Data read from memory card.
SW1 SW2 = 90 00h if the operation was completed successfully.

Page 47 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.1.9.3. Write Memory Card
This command writes data to the specified address of the inserted card. The byte is written to the card
with LSB first, i.e., the bit at card address 0 is regarded as the LSB of byte 0.
The byte at the specified card address is not erased prior to the write operation and, hence, memory
bits can only be programmed from '1' to '0'.

Command

Pseudo-APDU
Byte
Command Class INS P1 MEM_L Byte 1 … … Byte N
Address
Write Memory
FFh D0h 00h
Card

Where:
Byte Address (1 byte)
Memory address location of the memory card.
MEM_L (1 byte)
Length of data to be written to the memory card
Byte (1…N) Byte value to be written to the card.

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.

5.1.9.4. Erase non-application zone

This command erases the data in non-application zones. The EEPROM memory is organized into 16
bit words. Although erases are performed on single bits the ERASE operation clears an entire word in
the memory. Therefore, performing an Erase on any bit in the word will clear All 16 bits of that word to
the state of ‘1’.
To erase Error Counter or the data in Application Zones, please refer to:
• Erase Application Zone With Erase command as specified
• Erase Application Zone With Write and Erase command as specified
• Verify Security Code commands as specified

Page 48 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Command

Pseudo-APDU
Command Class INS P1 Byte Address MEM_L
Erase Non-Application Zone FFh D2h 00h 00h

Where:
Byte Address (1 byte)
Memory byte address location of the word to be erased.
Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.

5.1.9.5. Erase Application Zone with Erase

This command can be used in the following cases:
• AT88SC101: To erase the data in Application Zone with EC Function Disabled
• AT88SC102: To erase the data in Application Zone 1
• AT88SC102: To erase the data in Application Zone 2 with EC2 Function Disabled
• AT88SC1003: To erase the data in Application Zone 1
• AT88SC1003: To erase the data in Application Zone 2 with EC2 Function Disabled
• AT88SC1003: To erase the data in Application Zone 3
The following actions are executed for this command:
1. Present the specified code to the card.
2. Erase the presentation error counter. The data in corresponding Application Zone can be
erased when the submitted code is correct.

Command

Pseudo-APDU

Error CODE
Byte
Command Class INS Counter MEM_L Byte Byte Byte
Address … …
LEN 1 2 N
Erase
Application
FFh 20h 00h
Zone with
Erase

Where:
Error Counter LEN (1 byte)
= Length of presentation error counter in bits. The value should be
00h always.

Page 49 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Byte Address (1 byte)
= Byte address of the Application Zone Key in the card. Please refer
to the table below for the correct value.
MEM_L (1 byte)
= Length of the Erase Key. Please refer to the table below for the
correct value.
CODE (1…N) = Erase Key

Cases Byte Address LEN

AT88SC101: Erase Application Zone with EC function disabled 96h 04h
AT88SC102: Erase Application Zone 1 56h 06h
AT88SC102: Erase Application Zone 2 with EC2 function disabled 9Ch 04h
AT88SC1003: Erase Application Zone 1 36h 06h
AT88SC1003: Erase Application Zone 2 with EC2 function disabled 5Ch 04h
AT88SC1003: Erase Application Zone 3 C0h 06h

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.

Note: After SW1SW2 = 90 00h been received, read back the data in Application Zone can check
whether the Erase Application Zone with Erase is correct. If all data in Application Zone is erased and
equals to “FFh”, the previous verification was successful.

5.1.9.6. Erase Application Zone with Write and Erase

This command can be used in the following cases:
• AT88SC101: To erase the data in Application Zone with EC Function Enabled
• AT88SC102: To erase the data in Application Zone 2 with EC2 Function Enabled
• AT88SC1003: To erase the data in Application Zone 2 with EC2 Function Enabled

With EC or EC2 Function Enabled (that is, ECEN or EC2EN Fuse is unblown and in “1” state), the
following actions are executed:
1. Present the specified code to the card
2. Search a '1' bit in the presentation error counter and write the bit to '0'
3. Erase the presentation error counter. The data in corresponding Application Zone can be
erased when the submitted code is correct.

Page 50 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Command

Pseudo-APDU

Error CODE
Byte
Command Class INS Counter MEM_L Byte Byte Byte Byte
Address
LEN 1 2 3 4
Erase
Application
Zone with FFh 20h 80h 04h
Write and
Erase

Where:
Error Counter LEN (1 byte)
= Length of presentation error counter in bits. The value should be
80h always.
Byte Address (1 byte)
= Byte address of the Application Zone Key in the card. Please refer
to the table below for the correct value.
CODE (4 bytes)
= Erase Key

Cases Byte Address

AT88SC101 96h
AT88SC102 9Ch
AT88SC1003 5Ch

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.
= 63 00 if there are no more retries left.

Note: After SW1SW2 = 90 00 has been received, read back the data in Application Zone can check
whether the Erase Application Zone with Write and Erase is correct. If all data in Application Zone is
erased and equals to “FFh”, the previous verification was successful.

Page 51 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.1.9.7. Verify Security Code
This command submits the Security Code (2 bytes) to the inserted card. The Security Code enables
the memory access of the card.
The following actions are executed:
1. Present the specified code to the card
2. Search a '1' bit in the presentation error counter and write the bit to '0'
3. Erase the presentation error counter. The Security Code Attempts Counter can be erased
when the submitted code is correct.

Command

Pseudo-APDU

Byte CODE
Command Class INS Error Counter LEN MEM_L
Address Byte 1 Byte 2
Verify
Security FFh 20h 08h 0Ah 02h
Code

Where:
Error Counter LEN (1 byte)
= Length of presentation error counter in bits.
Byte Address (1 byte)
= Byte address of the key in the card.
CODE (2 bytes)
= Security Code
Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.
= 63 00 if there are no more retries left.

Note: After SW1SW2 = 90 00h been received, read back the Security Code Attempts Counter
(SCAC) can check whether the Verify User Code is correct. If SCAC is erased and equals to “FFh”,
the previous verification was successful.

Page 52 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.1.9.8. Blow Fuse
This command blows the fuse of the inserted card. The fuse can be EC_EN Fuse, EC2EN Fuse,
Issuer Fuse or Manufacturer’s Fuse.
Note: Blowing the fuse is an irreversible process.

Command

Pseudo-APDU
CODE
Error Fuse Fuse State State
Byte
Command Class INS Counter MEM_L Bit Bit of of
Address
LEN Addr Addr FUS RST
(High) (Low) Pin Pin
Blown 00h
FFh 05h 00h 00h 04h 01h
Fuse 01h

Where:
Fuse Bit Addr (2 bytes)
= Bit address of the fuse. Please refer to the table below for the
correct value.
State of FUS Pin (1 byte)
= State of the FUS pin. Should be 01h always.
State of RST Pin (1 byte)
= State of the RST pin. Please refer to below table for the correct
value.

Fuse Bit Addr Fuse Bit State of RST

(High) Addr (Low) Pin
Manufacturer Fuse 05h 80h 01h
AT88SC101 EC_EN Fuse 05h C9h 01h
Issuer Fuse 05h E0h 01h
Manufacturer Fuse 05h B0h 01h
AT88SC102 EC2EN Fuse 05h F9h 01h
Issuer Fuse 06h 10h 01h
Manufacturer Fuse 03h F8h 00h
AT88SC1003 EC2EN Fuse 03h FCh 00h
Issuer Fuse 03h E0h 00h

Table 4: Blown Fuse Code Values

Page 53 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h if the operation was completed successfully.
= 63 00 if there are no more retries left.

Page 54 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.2. Contactless Smart Card Protocol
5.2.1. ATR Generation
If the reader detects a PICC, an ATR will be sent to the PC/SC driver for identifying the PICC.

5.2.1.1. ATR Format for ISO 14443 Part 3 PICCs

Byte Value (Hex) Designation Description
Initial
0 3B -
Header
Higher nibble 8 means: no TA1, TB1, TC1
only TD1 is following.
1 8N T0
Lower nibble N is the number of historical
bytes (HistByte 0 to HistByte N-1)
Higher nibble 8 means: no TA2, TB2, TC2
2 80 TD1 only TD2 is following.
Lower nibble 0 means T = 0
Higher nibble 0 means no TA3, TB3, TC3,
3 01 TD2 TD3 following.
Lower nibble 1 means T = 1
Category indicator byte, 80 means A status
80 T1 indicator may be present in an optional
COMPACT-TLV data object
4F Application identifier Presence Indicator
0C Length
4 to
3+N Registered Application Provider Identifier
RID Tk
(RID) # A0 00 00 03 06h
SS Byte for standard
C0.. C1 Bytes for card name
00 00 00 00 RFU RFU # 00 00 00 00h
4+N UU TCK Exclusive-oring of all the bytes T0 to Tk

Table 5: ISO 14443 Part 3 ATR Format

Example:
ATR for MIFARE 1K = {3B 8F 80 01 80 4F 0C A0 00 00 03 06 03 00 01 00 00 00 00 6Ah}

ATR
Initial Card
T0 TD1 TD2 T1 Tk Length RID Standard RFU TCK
Header Name
A0
00
00
00h 00
3Bh 8Fh 80h 01h 80h 4Fh 0Ch 00 03h 6Ah
01h 00
03
00h
06h

Where:
Length (YY) = 0Ch

Page 55 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
RID = A0 00 00 03 06h (PC/SC Workgroup)
Standard (SS) = 03h (ISO 14443A, Part 3)
Card Name (C0 ... C1) [00 01h] (MIFARE 1K)
[00 02h] (MIFARE 4K)
[00 03h] (MIFARE Ultralight)
[00 26h] (MIFARE Mini)
[FF 28h] JCOP 30
FF SAK undefined tags
[00 36h] (MIFARE PLUS SL1_2K)
[00 37h] (MIFARE PLUS SL1_4K)
[00 38h] (MIFARE PLUS SL2_2K) Additional ATR support for
FW532 and above
[00 39h] (MIFARE PLUS SL2_4K)
[00 3Ah] (MIFARE Ultralight C)

5.2.1.2. ATR Format for ISO 14443 Part 4 PICCs

Byte Value (Hex) Designation Description
0 3B Initial Header -
Higher nibble 8 means: no TA1, TB1, TC1 only TD1 is
following.
1 8N T0
Lower nibble N is the number of historical bytes (HistByte 0
to HistByte N-1)
Higher nibble 8 means: no TA2, TB2, TC2 only TD2 is
2 80 TD1 following.
Lower nibble 0 means T = 0
Higher nibble 0 means no TA3, TB3, TC3, TD3 following.
3 01 TD2
Lower nibble 1 means T = 1
XX T1 Historical Bytes:
ISO 14443A:
The historical bytes from ATS response. Refer to the ISO
14443-4 specification.

4 to XX ISO 14443B:
3+N XX Tk Byte1-4 Byte5-7 Byte8
XX Application Protocol Info Higher nibble=MBLI
Data from Byte from from ATTRIB
ATQB ATQB command Lower
nibble (RFU)=0

4+N UU TCK Exclusive-oring of all the bytes T0 to Tk

Table 6: ISO 14443 Part 4 ATR Format

Page 56 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Example 1: Consider the ATR from MIFARE DESFire as follows:
DESFire (ATR) = 3B 81 80 01 80 80h (6 bytes of ATR)
Note: Use the APDU “FF CA 01 00 00h” to distinguish the ISO 14443A-4 and ISO 14443B-4 PICCs
and retrieve the full ATS if available. The ATS is returned for ISO 14443A-3 or ISO 14443B-3/4
PICCs.
APDU Command = FF CA 01 00 00h
APDU Response = 06 75 77 81 02 90 00h
ATS = {06 75 77 81 02 80h}
Example 2: Consider the ATR from EZ-Link as follows:
EZ-Link (ATR) = 3B 88 80 01 1C 2D 94 11 F7 71 85 00 BEh
Application Data of ATQB = 1C 2D 94 11h
Protocol Information of ATQB = F7 71 85h
MBLI of ATTRIB = 00h

Page 57 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.2.2. Pseudo APDUs for Contactless Interface

5.2.2.1. Get data

This command returns the serial number or ATS of the connected PICC.

Command

Command Class INS P1 P2 Le

00h 00h
Get Data FFh CAh 00h
01h (Full Length)

Get UID Response if P1 = 00h

Response UID … … UID SW1 SW2

Result LSB MSB

Get ATS Response if P1 = 01h (for ISO 14443-A cards only)

Response Data Out

Result ATS SW1 SW2

Response Code

Results SW1 SW2 Meaning

Success 90 00h The operation was completed successfully.
End of UID/ATS reached before Le bytes (Le is greater than
Warning 62 82h
UID Length).
Wrong length (wrong number Le: ‘XX’ encodes the exact
Error 6C XX
number) if Le is less than the available UID length.
Error 63 00h The operation failed.
Error 6A 81h Function not supported.

Example 1: To get the serial number of the connected PICC:

UINT8 GET_UID[5] = {FF CA 00 00 00h};
Example 2: To get the ATS of the connected ISO 14443-A PICC:
UINT8 GET_ATS[5] = {FF CA 01 00 00h};

Page 58 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.2.3. PICC Commands (T=CL Emulation) for MIFARE 1K/4K Memory Cards
5.2.3.1. Load authentication keys
This command loads the authentication keys into the reader. The authentication keys are used to
authenticate the specified sector of the MIFARE 1K/4K Memory Card. Two kinds of authentication key
locations are provided, volatile and non-volatile key locations.

Command

Command Class INS P1 P2 Le Data In

Key Key
Load Authentication Keys FFh 82h 06h Key
Structure Number

Where:
Key Structure (1 byte)
00h = Key is loaded into the reader’s volatile memory
20h = Key is loaded into the reader’s non-volatile memory
Other = Reserved.
Key Number (1 byte)
00h – 1Fh = Non-volatile memory for storing keys. The keys are
permanently stored in the reader and will not be erased even if the
reader is disconnected from the PC. It can store up to 32 keys inside
the reader non-volatile memory.
20h (Session Key) = Volatile memory for temporarily storing keys.
The keys will be erased when the reader is disconnected from the
PC. Only one volatile memory is provided. The volatile key can be
used as a session key for different sessions. Default value = FF FF
FF FF FF FFh.
Key (6 bytes)
The key value loaded into the reader.
E.g. {FF FF FF FF FF FFh}

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h means the operation was completed successfully.
= 63 00h means the operation failed.

Page 59 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Example1:
Load a key { FF FF FF FF FF FFh } into the non-volatile memory location 05h.
APDU = {FF 82 20 05 06 FF FF FF FF FF FFh}

Load a key { FF FF FF FF FF FFh } into the volatile memory location 20h.

APDU = {FF 82 00 20 06 FF FF FF FF FF FFh}
Notes:
1. The application should know all the keys being used. It is recommended to store all the
required keys to the non-volatile memory for security reasons. The contents of both volatile
and non-volatile memories are not readable by any application.
2. The content of the volatile memory “Session Key 20h” will remain valid until the reader is
reset or powered-off. The session key is useful for storing any key value that is changing from
time to time. The session key is stored in the “Internal RAM”, while the non-volatile keys are
stored in “EEPROM” that is relatively slower than the “Internal RAM”.
3. It is not recommended to use the “non-volatile key locations 00-1Fh” to store any “temporary
key” that will be changed frequently. The “non-volatile keys” are supposed to be used for
storing any “key value” that will not change frequently. If the ”key value” is supposed to be
changed from time to time, store the “key value” to the “volatile key location 20h” instead.

Page 60 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.2.3.2. Authentication for MIFARE 1K/4K
This command is used to authenticate the MIFARE 1K/4K card (PICC) using the keys stored in the
reader. Two types of authentication keys are used: Type_A and Type_B.

Command

Command Class INS P1 P2 P3 Data In

Authentication
FFh 88h 00h Block Number Key Type Key Number
6 bytes (Obsolete)

Command Class INS P1 P2 Lc Data In

Authentication
FFh 86h 00h 00h 05h Authenticate Data Bytes
10 bytes

Where:
Authenticate Data Bytes (5 bytes)

Byte 1 Byte 2 Byte 3 Byte 4 Byte 5

Version
00h Block Number Key Type Key Number
01h

Where:
Block Number (1 byte)
The memory block to be authenticated.

Note: For MIFARE 1K card, it has a total of 16 sectors and each sector consists of 4
consecutive blocks. For example, Sector 00h consists of Blocks {00h, 01h, 02h and 03h};
Sector 01h consists of Blocks {04h, 05h, 06h and 07h}; the last sector 0Fh consists of Blocks
{3Ch, 3Dh, 3Eh and 3Fh}.
Once the authentication is done successfully, there is no need to do the authentication again
provided that the blocks to be accessed belong to the same sector. Please refer to the
MIFARE 1K/4K specification for more details.

Key Type (1 byte)

60h = Key is used as Key A key for authentication.
61h = Key is used as Key B key for authentication.
Key Number (1 byte)
00h – 1Fh = Non-volatile memory for storing keys. The keys are
permanently stored in the reader and will not be erased even if the
reader is disconnected from the PC. It can store up to 32 keys inside
the reader non-volatile memory.
20h (Session Key) = Volatile memory for temporarily storing keys.
The keys will be erased when the reader is disconnected from the
PC. Only 1 volatile memory is provided. The volatile key can be used
as a session key for different sessions. Default value = FF FF FF FF
FF FFh.

Page 61 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h means the operation was completed successfully.
= 63 00h means the operation failed.

Sectors
Data Blocks
(Total of 16 sectors. Each Trailer Block
(3 blocks, 16 bytes per
sector consists of 4 (1 block, 16 bytes)
block)
consecutive blocks)
Sector 0 00h ~ 02h 03h
Sector 1 04h ~ 06h 07h
..
1 KB
..
Sector 14 38h ~ 0Ah 3Bh
Sector 15 3Ch ~ 3Eh 3Fh

Table 7: MIFARE 1K Memory Map

Sectors
Data Blocks
(Total of 32 sectors. Each Trailer Block
(3 blocks, 16 bytes per
sector consists of 4 (1 block, 16 bytes
block)
consecutive blocks)
Sector 0 00h ~ 02h 03h
Sector 1 04h ~ 06h 07h
... 2 KB
...
Sector 30 78h ~ 7Ah 7Bh
Sector 31 7Ch ~ 7Eh 7Fh

Sectors
Data Blocks
(Total of 32 sectors. Each Trailer Block
(3 blocks, 16 bytes per
sector consists of 4 (1 block, 16 bytes
block)
consecutive blocks)
Sector 32 80h ~ 8Eh 8Fh
Sector 33 90h ~ 9Eh 9Fh
... 2 KB
...
Sector 38 E0h ~ EEh EFh
Sector 39 F0h ~ FEh FFh

Table 8: MIFARE 4K Memory Map

Page 62 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Example 1:
To authenticate Block 04h with the following characteristics: Key A, key number 00h, from PC/SC
V2.01 (Obsolete).
APDU = { FF 88 00 04 60 00h }

Example 2:
Similar to the previous example, to authenticate Block 04h with the following characteristics: Key A,
key number 00h, from PC/SC V2.07.
APDU = { FF 86 00 00 05 01 00 04 60 00h }

Note: MIFARE® Ultralight does not need authentication since it provides free access to the user data
area.

Byte Number 0 1 2 3 Page

Serial Number SN0 SN1 SN2 BCC0 0
Serial Number SN3 SN4 SN5 SN6 1

Internal/Lock BCC1 Internal Lock0 Lock1 2

OTP OPT0 OPT1 OTP2 OTP3 3

Data read/write Data0 Data1 Data2 Data3 4
Data read/write Data4 Data5 Data6 Data7 5
Data read/write Data8 Data9 Data10 Data11 6
512 bits
Data read/write Data12 Data13 Data14 Data15 7
or
Data read/write Data16 Data17 Data18 Data19 8
64 bytes
Data read/write Data20 Data21 Data22 Data23 9
Data read/write Data24 Data25 Data26 Data27 10
Data read/write Data28 Data29 Data30 Data31 11
Data read/write Data32 Data33 Data34 Data35 12
Data read/write Data36 Data37 Data38 Data39 13
Data read/write Data40 Data41 Data42 Data43 14
Data read/write Data44 Data45 Data46 Data47 15

Table 9: MIFARE Ultralight Memory Map

Page 63 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.2.3.3. Read binary blocks
This command retrieves multiple data blocks from the PICC. The data block/trailer must be
authenticated first before executing this command.

Command

Command Class INS P1 P2 Le

Read Binary Blocks FFh B0h 00h Block Number Number of Bytes to Read

Where:
Block Number (1 byte)
Starting Block
Number of Bytes to Read The length of the bytes to be read can be a multiple of 16 bytes
for MIFARE 1K/4K or a multiple of 4 bytes for MIFARE Ultralight
(1 Byte).
Maximum of 16 bytes for MIFARE Ultralight.
Maximum of 48 bytes for MIFARE 1K (Multiple Blocks Mode; 3
consecutive blocks).
Maximum of 240 bytes for MIFARE 4K (Multiple Blocks Mode; 15
consecutive blocks).

Example 1: 10h (16 bytes). Starting block only. (Single Block Mode)
Example 2: 40h (64 bytes). From starting block to starting block +3. (Multiple Blocks Mode)

Note: For security considerations, the Multiple Block Mode is used for accessing data blocks only.
The Trailer Block is not supposed to be accessed in Multiple Blocks Mode. Please use Single Block
Mode to access the Trailer Block.

Response

Response Data Out

Result Data (Multiple of 4 or 16 bytes) SW1 SW2

Where:
SW1 SW2 = 90 00h means the operation was completed successfully.
= 63 00h means the operation failed.

Example 1: Read 16 bytes from the binary block 04h (MIFARE 1K or 4K).
APDU = { FF B0 00 04 10h }

Example 2: Read 240 bytes starting from the binary block 80h (MIFARE 4K). Block 80h to Block 8Eh
(15 blocks).
APDU = { FF B0 00 80 F0 }

Page 64 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.2.3.4. Update binary blocks
This command writes multiple data blocks into the PICC. The data block/trailer block must be
authenticated first before executing this command.

Command

Command Class INS P1 P2 Le Data In

Number of Block Data
Update Block
FFh D6h 00h Bytes to (Multiple of
Binary Blocks Number
Update 16 Bytes)

Where:
Block Number (1 byte)
Starting Block
Block Data Multiple of 16 + 2 Bytes, or 6 Bytes. Data to be written into
the binary blocks.
Number of Bytes to Read The length of the bytes to be read can be a multiple of 16
bytes for MIFARE 1K/4K or a multiple of 4 bytes for MIFARE
Ultralight (1 byte).
Maximum of 16 bytes for MIFARE Ultralight.
Maximum of 48 bytes for MIFARE 1K (Multiple Blocks Mode;
3 consecutive blocks).
Maximum of 240 bytes for MIFARE 4K (Multiple Blocks
Mode; 15 consecutive blocks).
Example 1: 10h (16 bytes). Starting block only. (Single Block Mode)
Example 2: 30h (48 bytes). From starting block to starting block +2. (Multiple Blocks Mode)

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h means the operation was completed successfully.
= 63 00h means the operation failed.

Example 1: Update the binary block 04h of MIFARE 1K/4K with Data {00 01 .. 0Fh}
APDU = { FF D6 00 04 10 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0Fh }

Example 2: Update the binary block 04h of MIFARE Ultralight with Data { 00 01 02 03h }
APDU = {FF D6 00 04 04 00 01 02 03h}

Page 65 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.2.3.5. Value block operation (Increment, Decrement, Store)
This command manipulates value-based transactions (e.g., increment a value block, etc.).

Command

Command Class INS P1 P2 Lc Data In

VB_Value
Value Block Block
FFh D7h 00h 05h VB_OP (4 Bytes)
Operation Number
{MSB…LSB}

Where:
Block Number (1 byte)
Value Block to be manipulated
VB_OP (1 byte)
Value block operation
00h = Store VB_Value into the block. The block will then be
converted to a value block.
01h = Increment the value of the value block by the VB_Value. This
command is only valid for value blocks.
02h = Decrement the value of the value block by the VB_Value. This
command is only valid for value blocks.
VB_Value (4 bytes)
The value used for manipulation. The value is a signed long integer.

Example 1: Decimal - 4 = { FF FF FF FCh }

VB_Value
MSB LSB
FFh FFh FFh FCh

Example 2: Decimal 1 = { 00 00 00 01h }

VB_Value
MSB LSB
00h 00h 00h 01h

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h means the operation is completed successfully.
= 63 00h means the operation failed.

Page 66 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.2.3.6. Read value block
This command retrieves the value from a value block. This command is only valid for value blocks.

Command

Command Class INS P1 P2 Le

Read Value Block FFh B1h 00h Block Number 00h

Where:
Block Number (1 byte)
The value block to be accessed.

Response

Response Data Out

Value
Result SW1 SW2
{MSB … LSB}

Where:
Value (4 bytes)
The value returned from the cards. The value is a signed long
integer.

Example 1: Decimal - 4 = { FF FF FF FCh }

VB_Value
MSB LSB
FFh FFh FFh FCh

Example 2: Decimal 1 = { 00 00 00 01h }

VB_Value
MSB LSB
00h 00h 00h 01h

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h means the operation was completed successfully.
= 63 00h means the operation failed.

Page 67 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.2.3.7. Copy value block
This command copies a value from a value block to another value block.

Command

Command Class INS P1 P2 Lc Data In

Copy Value Source Block Target Block
FFh D7h 00h 02h 03h
Block Number Number

Where:
Source Block Number (1 byte)
Block number where the value will come from and copied to the
target value block.
Target Block Number (1 byte)
Block number where the value from the source block will be copied
to. The source and target value blocks must be in the same sector.

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h means the operation was completed successfully.
= 63 00h means the operation failed.
Example 1: Store a value “1” into block 05h
APDU = {FF D7 00 05 05 00 00 00 00 01h}
Example 2: Read the value block 05h
APDU = {FF B1 00 05 00h}
Example 3: Copy the value from value block 05h to value block 06h
APDU = {FF D7 00 05 02 03 06h}
Example 4: Increment the value block 05h by “5”
APDU = {FF D7 00 05 05 01 00 00 00 05h}

Page 68 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.2.4. Accessing PC/SC-compliant tags (ISO 14443-4)
All ISO 14443-4-compliant cards (PICCs) understand the ISO 7816-4 APDUs. The ACR1281U-C1
reader only needs to communicate with the ISO 14443-4-compliant cards through exchanging ISO
7816-4 APDUs and responses. ACR1281U-C1 will handle the ISO 14443 Parts 1-4 Protocols
internally.
The MIFARE Classic 1K/4K, MIFARE Mini and MIFARE Ultralight tags are supported through the
T=CL emulation. Simply treat the MIFARE tags as standard ISO 14443-4 tags. For more information,
see PICC Commands (T=CL Emulation) for MIFARE 1K/4K Memory Cards.

Command

Command Class INS P1 P2 Lc Data In Le

ISO 7816 Part Length of the Expected Length of the
4 Command Data In Response Data

Response

Response Data Out

Result SW1 SW2

Where:
SW1 SW2 = 90 00h means the operation was completed successfully.
= 63 00h means the operation failed.
Typical sequence may be:
1. Present the tag and connect the PICC interface.
2. Read/Update the memory of the tag.

Step 1: Connect the tag.

The ATR of the tag is 3B 88 80 01 00 00 00 00 33 81 81 00 3Ah
In which,
The Application Data of ATQB = 00 00 00 00h, protocol information of ATQB = 33 81 81h. It is an ISO
14443-4 Type B tag.

Step 2: Send an APDU, Get Challenge.

<< 00 84 00 00 08h
>> 1A F7 F3 1B CD 2B A9 58 [90 00h]
Note: For ISO 14443-4 Type A tags, the ATS can be obtained by using the APDU “FF CA 01 00 00h.”

Example: ISO 7816-4 APDU

To read 8 bytes from an ISO 14443-4 Type B PICC (ST19XR08E)
APDU = { 80 B2 80 00 08h }
Class = 80h; INS = B2h; P1 = 80h; P2 = 00h;
Lc = None; Data In = None; Le = 08h
Answer: 00 01 02 03 04 05 06 07 [$90 00h]

Page 69 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.2.5. Accessing MIFARE DESFire tags (ISO 14443-4)
MIFARE® DESFire supports ISO 7816-4 APDU Wrapping and Native modes. Once the DESFire tag
is activated, the first APDU sent to the DESFire tag will determine the “Command Mode.” If the first
APDU is in “Native Mode,” the rest of the APDUs must also be in “Native Mode” format. Similarly, if
the first APDU is in “ISO 7816-4 APDU Wrapping Mode,” the rest of the APDUs must also be in “ISO
7816-4 APDU Wrapping Mode” format.

Example 1: MIFARE DESFire ISO 7816-4 APDU Wrapping.

To read 8 bytes random number from an ISO 14443-4 Type A PICC (DESFire):
APDU = {90 0A 00 00 01 00 00h}

Class = 90h; INS = 0Ah (DESFire Instruction); P1 = 00h; P2 = 00h

Lc = 01h; Data In = 00h; Le = 00h (Le = 00h for maximum length)

Answer: 7B 18 92 9D 9A 25 05 21h [$91AFh]

Note: Status Code {91 AFh} is defined in MIFARE DESFire specification. Please refer to MIFARE
DESFire specification for more details.

Example 2: MIFARE DESFire Frame Level Chaining (ISO 7816 wrapping mode)
In this example, the application has to do the “Frame Level Chaining”.
To get the version of the DESFire card:

Step 1: Send an APDU {90 60 00 00 00h} to get the first frame. INS=60h
Answer: 04 01 01 00 02 18 05 91 AFh [$91AFh]

Step 2: Send an APDU {90 AF 00 00 00h} to get the second frame. INS=AFh
Answer: 04 01 01 00 06 18 05 91 AFh [$91AFh]

Step 3: Send an APDU {90 AF 00 00 00h} to get the last frame. INS=AFh
Answer: 04 52 5A 19 B2 1B 80 8E 36 54 4D 40 26 04 91 00h [$9100h]

Example 3: MIFARE DESFire Native Command.

You can send Native DESFire Commands to the reader without ISO 7816 wrapping if we find that the
Native DESFire Commands are easier to handle.

To read 8 bytes random number from an ISO 14443-4 Type A PICC (DESFire):
APDU = {0A 00h}
Answer: AF 25 9C 65 0C 87 65 1D D7h [$1DD7h]

In which, the first byte “AF” is the status code returned by the MIFARE DESFire card.
The Data inside the blanket [$1DD7h] can simply be ignored by the application.

Page 70 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Example 4: MIFARE DESFire Frame Level Chaining (Native Mode)
In this example, the application has to do the “Frame Level Chaining”.
To get the version of the DESFire card:

Step 1: Send an APDU {60h} to get the first frame. INS=60h

Answer: AF 04 01 01 00 02 18 05h [$1805h]

Step 2: Send an APDU {AFh} to get the second frame. INS=AFh

Answer: AF 04 01 01 00 06 18 05h [$1805h]

Step 3: Send an APDU {AFh} to get the last frame. INS=AFh

Answer: 00 04 52 5A 19 B2 1B 80 8E 36 54 4D 40 26 04h [$2604h]

Note: In MIFARE DESFire Native Mode, the status code [90 00h] will not be added to the response if
the response length is greater than 1. If the response length is less than 2, the status code [90 00h]
will be added in order to meet the requirement of PC/SC. The minimum response length is 2.

Page 71 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.3. Peripherals Control
The reader’s peripherals control commands are implemented by using PC_to_RDR_Escape.
Note: The driver will add the Class, INS and P1 automatically.

5.3.1. Get Firmware Version

This command gets the reader’s firmware version.

Get Firmware Version Format (5 bytes)

Command Class INS P1 P2 Lc

Get Firmware Version E0h 00h 00h 18h 00h

Get Firmware Version Response Format

Response Class INS P1 P2 Le Data Out

Number of Bytes Firmware
Result E1h 00h 00h 00h
to be Received Version

Example:
Response = E1 00 00 00 0F 41 43 52 31 32 38 31 55 5F 56 35 30 33 2E 31
Firmware Version (HEX) = 41 43 52 31 32 38 31 55 5F 56 35 30 33 2E 31
Firmware Version (ASCII) = “ACR1281U_V503.1”

Page 72 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.3.2. LED Control
This command controls the LED output.

LED Control Format (6 bytes)

Command Class INS P1 P2 Lc Data In

LED Control E0h 00h 00h 29h 01h LED Status

Where:
LED Status (1 byte)

LED Status Description Description

1 = ON
Bit 0 Red LED
0 = OFF
1 = ON
Bit 1 Green LED
0 = OFF
Bit 2 – 7 RFU RFU

LED Control Response Format (6 bytes)

Response Class INS P1 P2 Le Data Out

Result E1h 00h 00h 00h 01h LED Status

Page 73 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.3.3. LED Status
This command checks the existing LED status.

LED Status Format (5 bytes)

Command Class INS P1 P2 Lc

LED Status E0h 00h 00h 29h 00h

LED Status Response Format (6 bytes)

Response Class INS P1 P2 Le Data Out

Result E1h 00h 00h 00h 01h LED Status

Where:
LED Status (1 byte)

LED Status Description Description

1 = ON
Bit 0 Red LED
0 = OFF
1 = ON
Bit 1 Green LED
0 = OFF
Bit 2 – 7 RFU RFU

Page 74 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.3.4. Buzzer Control
This command controls the buzzer output.

Buzzer Control Format (6 bytes)

Command Class INS P1 P2 Lc Data In

Buzzer Control E0h 00h 00h 28h 01h Buzzer ON Duration

Where:
Buzzer ON Duration (1 byte)
00h = OFF
01 – FFh = Duration (unit: 10 ms)

Buzzer Control Response Format (6 bytes)

Response Class INS P1 P2 Le Data Out

Result E1h 00h 00h 00h 01h 00h

Page 75 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.3.5. Set Default LED and Buzzer Behaviors
This command sets the default behavior of the LEDs and buzzer.

Set LED and Buzzer Behaviors Format (6 bytes)

Command Class INS P1 P2 Lc Data In

Set Default LED and Buzzer
E0h 00h 00h 21h 01h Default Behaviors
Behaviors

Where:
Default Behaviors (1 byte)

LED Status Description Description

To show the activations status of the ICC

interface.
Bit 0 ICC Activation Status LED
1 = Enable
0 = Disable

To show the PICC polling status.

Bit 1 PICC Polling Status LED 1 = Enable
0 = Disable
Bit 2 RFU RFU
Bit 3 RFU RFU
To make a beep whenever a card insertion
or removal event is detected (for both ICC
Card Insertion and Removal and PICC).
Bit 4
Events Buzzer
1 = Enable
0 = Disable
To make a beep when the contactless chip
Contactless Chip Reset is reset.
Bit 5
Indication Buzzer 1 = Enable
0 = Disable
To make a beep when the exclusive mode
Exclusive Mode Status Buzzer. is activated.
Bit 6 Either ICC or PICC Interface
1 = Enable
can be activated
0 = Disable
To make the LED blink whenever the card
Bit 7 Card Operation Blinking LED
(PICC or ICC) is being accessed.

Note: Default value of Behaviors = FBh.

Set LED and Buzzer Behaviors Response Format (6 bytes)

Response Class INS P1 P2 Le Data Out

Result E1h 00h 00h 00h 01h Default Behaviors

Page 76 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.3.6. Read Default LED and Buzzer Behaviors
This command reads the current default behaviors of LEDs and buzzer.

Read LED and Buzzer Behaviors Format (5 bytes)

Command Class INS P1 P2 Lc

Read Default LED and Buzzer Behaviors E0h 00h 00h 21h 00h

Read LED and Buzzer Behaviors Response Format (6 bytes)

Response Class INS P1 P2 Le Data Out

Result E1h 00h 00h 00h 01h Default Behaviors

Where:

Default Behaviors (1 byte)

LED Status Description Description

To show the activations status of the
N ICC interface.
Bit 0 ICC Activation Status LED
1 = Enable
0 = Disable
To show the PICC polling status.
Bit 1 PICC Polling Status LED 1 = Enable
0 = Disable
Bit 2 RFU RFU
Bit 3 RFU RFU
To make a beep whenever a card
insertion or removal event is detected
Card Insertion and Removal (for both ICC and PICC).
Bit 4
Events Buzzer
1 = Enable
0 = Disable
To make a beep when the contactless
Contactless Chip Reset Indication chip is reset.
Bit 5
Buzzer 1 = Enable
0 = Disable
To make a beep when the exclusive
Exclusive Mode Status Buzzer. mode is activated.
Bit 6 Either ICC or PICC Interface can
1 = Enable
be activated
0 = Disable
To make the LED blink whenever the
Bit 7 Card Operation Blinking LED
card (PICC or ICC) is being accessed.
Note: Default value of Behaviors = FBh.

Page 77 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.3.7. Initialize Card Insertion Counter
This command initializes the cards insertion/detection counter.

Initialize Card Insertion Counter Format (9 bytes)

Command Class INS P1 P2 Lc Data In

Initialize Card ICC Cnt ICC Cnt PICC Cnt PICC Cnt
E0h 00h 00h 09h 04h
Insertion Counter (LSB) (MSB) (LSB) (MSB)

Where:
ICC Cnt (LSB) (1 byte)
ICC Insertion Counter (LSB)
ICC Cnt (MSB) (1 byte)
ICC Insertion Counter (MSB)
PICC Cnt (LSB) (1 byte)
PICC Insertion Counter (LSB)
PICC Cnt (MSB) (1 byte)
PICC Insertion Counter (MSB)

Initialize Card Insertion Counter Response Format (5 bytes)

Response Class INS P1 P2 Le

Result E1h 00h 00h 00h 00h

Page 78 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.3.8. Read Card Insertion Counter
This command checks the cards insertion/detection counter value.

Read Card Insertion Counter Format (5 bytes)

Command Class INS P1 P2 Lc

Read Card Insertion Counter E0h 00h 00h 09h 00h

Read Card Insertion Counter Response Format (9 bytes)

Response Class INS P1 P2 Le Data Out

ICC Cnt ICC Cnt PICC Cnt PICC Cnt
Result E1h 00h 00h 00h 04h
(LSB) (MSB) (LSB) (MSB)

Page 79 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.3.9. Update Card Insertion Counter
This command updates the cards insertion/detection counter value.

Update Card Insertion Counter Format (5 bytes)

Command Class INS P1 P2 Lc

Update Card Insertion Counter E0h 00h 00h 0Ah 00h

Update Card Insertion Counter Response Format (9 bytes)

Response Class INS P1 P2 Le Data Out

ICC Cnt ICC Cnt PICC Cnt PICC Cnt
Result E1h 00h 00h 00h 04h
(LSB) (MSB) (LSB) (MSB)

Page 80 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.3.10. Set Automatic PICC Polling
This command sets the reader’s polling mode.
Whenever the reader is connected to the computer, the PICC polling function will start the PICC
scanning to determine if a PICC is placed on/removed from the built-in antenna.
You can send a command to disable the PICC polling function by sending a command through the
PC/SC Escape Command interface. To meet the energy saving requirement, special modes are
provided for turning off the antenna field whenever the PICC is inactive, or no PICC is found. The
reader will consume less current in power saving mode.

Set Automatic PICC Polling Format (6 bytes)

Command Class INS P1 P2 Lc Data In

Set Automatic PICC Polling E0h 00h 00h 23h 01h Polling Setting

Where:
Polling Setting (1 byte)

Polling
Description Description
Setting
1 = Enable
Bit 0 Auto PICC Polling
0 = Disable
1 = Enable
Bit 1 Turn off Antenna Field if no PICC found
0 = Disable
1 = Enable
Bit 2 Turn off Antenna Field if the PICC is inactive
0 = Disable
Bit 3 RFU RFU
Bit 5 – Bit 4:
0 – 0 = 250 ms
Bit 5 – 4 PICC Polling Interval for PICC 0 – 1 = 500 ms
1 – 0 = 1000 ms
1 – 1 = 2500 ms
Bit 6 RFU RFU
1 = Enable
Bit 7 Enforce ISO 14443A Part 4
0 = Disable

Note: Default value of Behaviors = 8Fh.

Set Automatic PICC Polling Response Format (6 bytes)

Response Class INS P1 P2 Le Data Out

Result E1h 00h 00h 00h 01h Polling Setting

Page 81 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Notes:
1. It is recommended to enable the option “Turn off Antenna Field is the PICC is inactive,” so
that the “Inactive PICC” will not be exposed to the field all the time to prevent the PICC from
warming up.
2. The longer the PICC Poll Interval, the more efficient it is for energy saving. However, the
response time of PICC Polling will become longer. The Idle Current Consumption in Power
Saving Mode is about 60 mA, while the Idle Current Consumption in Non-Power Saving mode
is about 130 mA. Idle Current Consumption = PICC is not activated.
3. The reader will activate the ISO 14443A-4 mode of the “ISO 14443A-4 compliant PICC”
automatically. Type B PICC will not be affected by this option.
4. The JCOP30 card comes with two modes: ISO 14443A-3 (MIFARE 1K) and ISO 14443A-4
modes. The application has to decide which mode should be selected once the PICC is
activated.

Page 82 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.3.11. Read Automatic PICC Polling
This command checks the current automatic PICC polling.

Read Automatic PICC Polling Format (5 bytes)

Command Class INS P1 P2 Lc

Read Automatic PICC Polling E0h 00h 00h 23h 00h

Read Automatic PICC Polling Response Format (6 bytes)

Response Class INS P1 P2 Le Data Out

Result E1h 00h 00h 00h 01h Polling Setting

Where:
Polling Setting (1 byte)

Page 83 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.3.12. Manual PICC Polling
This command determines if any PICC is within the detection range of the reader. This command can
be used if the automatic PICC polling function is disabled.

Manual PICC Polling Format (6 bytes)

Command Class INS P1 P2 Lc Data In

Manual PICC Polling E0h 00h 00h 22h 01h 0Ah

Manual PICC Polling Response Format (6 bytes)

Response Class INS P1 P2 Le Data Out

Result E1h 00h 00h 00h 01h Status

Where:
Status (1 byte)
00h = PICC is detected
FFh = No PICC is detected

Page 84 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.3.13. Set PICC Operating Parameter
The command sets the PICC operating parameter.

Set PICC Operating Parameter Format (6 bytes)

Command Class INS P1 P2 Lc Data In

Set PICC Operating
E0h 00h 00h 20h 01h Operating Parameter
Parameter

Where:
Operating Parameter (1 Byte)

Operating
Parameter Description Option
Parameter
1 = Detect
Bit 0 ISO 14443 Type A The tag types to be 0 = Skip
detected during PICC
Polling 1 = Detect
Bit 1 ISO 14443 Type B
0 = Skip
Bit 2 – 7 RFU RFU RFU

Note: Default value of Behaviors = 03h.

Set PICC Operating Parameter Response Format (6 bytes)

Response Class INS P1 P2 Le Data Out

Result E1h 00h 00h 00h 01h Operating Parameter

Page 85 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.3.14. Read PICC Operating Parameter
This command checks the current PICC operating parameter.

Read PICC Operating Parameter Format (5 bytes)

Command Class INS P1 P2 Lc

Read PICC Operating Parameter E0h 00h 00h 20h 00h

Read PICC Operating Parameter Response Format (6 bytes)

Response Class INS P1 P2 Le Data Out

Result E1h 00h 00h 00h 01h Operating Parameter

Where:
Operating Parameter (1 byte)

Operating
Parameter Description Option
Parameter
1 = Detect
Bit 0 ISO 14443 Type A The tag types to be 0 = Skip
detected during
PICC Polling 1 = Detect
Bit 1 ISO 14443 Type B
0 = Skip
Bit 2 – 7 RFU RFU RFU

Page 86 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.3.15. Set Exclusive Mode
This command sets the reader in to/out from exclusive mode.

Set Exclusive Mode Format (6 bytes)

Command Class INS P1 P2 Lc Data In

Set Exclusive Mode E0h 00h 00h 2Bh 01h Mode Configuration

Where:
Mode Configuration (1 byte)
00h = Share Mode: ICC and PICC interfaces can work at the same
time.
01h = Exclusive Mode: PICC is disabled when Auto Polling and
Antenna Power Off when ICC is inserted (Default).

Set Exclusive Mode Response Format (6 bytes)

Response Class INS P1 P2 Le Data Out

Mode Current Mode
Result E1h 00h 00h 00h 02h
Configuration Configuration

Page 87 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.3.16. Read Exclusive Mode
This command checks the current exclusive mode setting.

Read Exclusive Mode Format (5 bytes)

Command Class INS P1 P2 Lc

Read Exclusive Mode E0h 00h 00h 2Bh 00h

Read Exclusive Mode Response Format (6 bytes)

Response Class INS P1 P2 Le Data Out

Mode Current Mode
Result E1h 00h 00h 00h 02h
Configuration Configuration

Page 88 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.3.17. Set Auto PPS
Whenever a PICC is recognized, the reader will try to change the communication speed between the
PCD and PICC as defined by the maximum connection speed. If the card does not support the
proposed connection speed, the reader will try to connect the card with a slower speed setting.

Set Auto PPS Format (6 bytes)

Command Class INS P1 P2 Lc Data In

Set Auto PPS E0h 00h 00h 24h 01h Max Speed

Where:
Max Speed (1 byte)
00h = 106 Kbps; default setting, equal to No Auto PPS
01h = 212 Kbps
02h = 424 Kbps
03h = 848 Kbps

Set Auto PPS Response Format (6 bytes)

Response Class INS P1 P2 Le Data Out

Max Current
Result E1h 00h 00h 00h 02h
Speed Speed

Notes:
1. Normally, the application should know the maximum connection speed of the PICCs being
used. The environment also affects the maximum achievable speed. The reader just uses the
proposed communication speed to talk with the PICC. The PICC will become inaccessible if
the PICC or environment does not meet the requirement of the proposed communication
speed.
2. If the higher speed setting affects the performance of the reader, please switch back to a
lower speed setting.

Page 89 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.3.18. Read Auto PPS
This command checks the current auto PPS setting.

Read Auto PPS Format (5 bytes)

Command Class INS P1 P2 Lc

Read Auto PPS E0h 00h 00h 24h 00h

Read Auto PPS Response Format (6 bytes)

Response Class INS P1 P2 Le Data Out

Max Current
Result E1h 00h 00h 00h 02h
Speed Speed

Where:
Max Speed Maximum Speed (1 byte)
Current Speed Current Speed (1 byte)
00h = 106 Kbps; default setting, equal to No Auto PPS
01h = 212 Kbps
02h = 424 Kbps
03h = 848 Kbps

Page 90 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
5.3.19. Read Serial Number
This command reads the reader serial number.
Note: This is applicable only to firmware version 533.00 and above.

Read the Serial Number Format (5 bytes)

Command Class INS P1 P2 Lc

Read Serial Number E0h 00h 00h 33h 00h

Read the Serial Number Response Format

Response Class INS P1 P2 Le Data Out

Serial Number
Result E1 00h 00h 00h Len
(N bytes)

Page 91 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Appendix A. Basic program flow for contactless
applications

Step 0: Start the application. The reader will do the PICC polling and scan for tags continuously. Once
the tag is found and detected, the corresponding ATR will be sent to the computer.

Step 1: Connect the ACR1281U PICC Interface with T=1 protocol.

Step 2: Access the PICC by exchanging APDUs.

Step N: Disconnect the ACR1281U PICC Interface. Shut down the application.

Page 92 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Appendix B. Extended APDU Command Example
Card: ACOS7 (supports Extended APDU, echo response)
Write CMD: 80 D2 00 00 XX XX XXh
CLA = 80h
INS = D2h
P1 = 00h
P2 = 00h
Data Len = XX XX XXh

Example 1: APDU length = 263 bytes

APDU Command:
80D20000000100000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F
202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F40414243444546
4748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6
D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F90919293
9495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B
8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9D
ADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFD
FEFFh

Example 2: APDU length = 775 bytes

APDU Command:
80D20000000300000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F
202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F40414243444546
4748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6
D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F90919293
9495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B
8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9D
ADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFD
FEFF000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F2021222324
25262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B
4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F70717
2737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F9091929394959697989
99A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBC
BDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDE
DFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF0001020
30405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292
A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F50
5152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F7071727374757677

Page 93 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
78797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9
E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1
C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3
E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFFh

Response:
000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F20212223242526
2728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4
D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F70717273
7475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A
9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDB
EBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE
0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF00010203040
5060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2
C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152
535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F70717273747576777879
7A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA
0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3
C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5
E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF000102030405060708090A
0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303
132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F50515253545556575
8595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E
7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A
5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C
8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EA
EBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF9000h

Page 94 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Appendix C. Escape Command Example
Example: Get firmware version (using PCSCDirectCommand.exe).
Step 1: Plug in the ACR1281 Reader to the computer.

Step 2: Open the PCSCDirectCommand.exe.

Step 3: Connect the reader in Direct mode. The ATR will be displayed (if a card is present) or “No
ATR retrieved (ATRLen = 0)” will be displayed (if no card).

Step 4: Enter Command: “2079”

Enter Data: “18 00” (APDU for Get Firmware Version)
Press Enter to send to reader, and then check the response.

Note: PCSCDirectCommand.exe is not available in the Software Development Kit (SDK). Please
contact ACS for more information.

Page 95 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Appendix D. Supported Card Types
The following table summarizes the card type returned by GET_READER_INFORMATION
corresponding to the respective card type.

Card Type Code Card Type

00h Auto-select T=0 or T=1 communication protocol
01h I2C memory card (1k, 2k, 4k, 8k and 16k bits)
02h I2C memory card (32k, 64k, 128k, 256k, 512k and 1024k bits)
03h RFU
04h RFU
05h Infineon SLE4418 and SLE4428
06h Infineon SLE4432 and SLE4442
07h Infineon SLE4406, SLE4436 and SLE5536
08h Infineon SLE4404
09h RFU

Page 96 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Appendix E. ACR128 Compatibility
Below is the list of ACR128 functions that are implemented differently or not supported by the
ACR1281U-C1.

Functions ACR128 ACR1281U-C1

1. Change the default
FWI and Transmit
1F 03 [Data: 3 bytes] Not supported.
Frame Size of the
activated PICC.

2. Transceiver Setting 20 04 06 [Data: 3 bytes] Not supported.

3. PICC Setting 2A 0C [Data: 12 bytes] Not supported.

4. PICC T=CL Data

Exchange Error 2C 02 [Data:1 byte] Not supported.
Handling

5. Read Register 19 01 [Reg. No.] Not supported.

6. Update Register 1A 02 [Reg. No.] [Value] Not supported.

7. PICC Polling for

20 02 [Data: 1 byte] FF 20 01 [Data: 1 byte]
Specific Types

28 01 [Duration]
28 01 [Duration]
Duration:
8. Buzzer Control
00 = Turn Off Duration:
01 – FE = Duration x 10 ms 01 – FF = Duration × 10 ms
FF = Turn On

Page 97 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk
Functions ACR128 ACR1281U-C1
Set: 21 01 [Data: 1 byte] Set: 21 01 [Data: 1 byte]
Read: 21 00 Read: 21 00

Data: Data:
Bit 0 = ICC Activation Status Bit 0 = ICC Activation Status

Bit 1 = PICC Polling Status LED Bit 1 = PICC Polling Status

LED
Bit 2 = PICC Activation Status
Buzzer Bit 2 = RFU

9. Set/Read Default LED Bit 3 = PICC PPS Status Buzzer Bit 3 = RFU
and Buzzer Behaviors

Bit 4 = Card Insertion and Bit 4 = Card Insertion and

Removal Events Buzzer Removal Events Buzzer

Bit 5 = Contactless Chip Reset Bit 5 = Contactless Chip Reset

Indication Buzzer Indication Buzzer

Bit 6 = Exclusive Mode Status Bit 6 = Exclusive Mode Status

Buzzer Buzzer

Bit 7 = Card Operation Blinking Bit 7 = Card Operation Blinking

LED LED
Set: 23 01 [Data: 1 byte] Set: 23 01 [Data: 1 byte]
Read: 23 00 Read: 23 00

Data: Data:
Bit 0 = Auto PICC Polling Bit 0 = Auto PICC Polling

Bit 1 = Turn off Antenna Field if no Bit 1 = Turn off Antenna Field if
PICC is found no PICC is found

Bit 2 = Turn off Antenna Field if Bit 2 = Turn off Antenna Field if
10. Set/Read Automatic
the PICC is inactive the PICC is inactive
PICC Polling

Bit 3 = Activate the PICC when Bit 3 = RFU

detected
Bit 4..5 = PICC Poll Interval for
Bit 4..5 = PICC Poll Interval for PICC
PICC
Bit 6 = RFU
Bit 6 = Test Mode
Bit 7 = Enforce ISO 14443A
Bit 7 = Enforce ISO 14443A Part 4 Part 4

MIFARE, MIFARE Classic, MIFARE DESFire, MIFARE Mini and MIFARE Ultralight are registered trademarks of NXP B.V. and are used under license.
Windows and Windows Vista are registered trademarks of Microsoft Corporation in the United States and/or other countries.

Page 98 of 98

www.acs.com
ACR1281U-C1 – Application Programming Interface [email protected]
.hk
Version 1.11 www.acs.com.hk

Api Acr1252u 1.17
No ratings yet
Api Acr1252u 1.17
109 pages
API ACR128 v1.9 PDF
No ratings yet
API ACR128 v1.9 PDF
42 pages
ACR1222L NFC Reader API Guide
No ratings yet
ACR1222L NFC Reader API Guide
63 pages
Api Acr1222l 1.04
No ratings yet
Api Acr1222l 1.04
61 pages
Ref Acr1552u Series 1.05
No ratings yet
Ref Acr1552u Series 1.05
95 pages
ACR122 Installation and Testing
No ratings yet
ACR122 Installation and Testing
6 pages
Referencia Acr
No ratings yet
Referencia Acr
105 pages
ACR1281S1-C8 API Documentation
No ratings yet
ACR1281S1-C8 API Documentation
50 pages
Api Acr1283l 1.03
No ratings yet
Api Acr1283l 1.03
95 pages
ACR1281S-C1 API Documentation V1.01
No ratings yet
ACR1281S-C1 API Documentation V1.01
22 pages
TSP Acr1281s C1 1.06
No ratings yet
TSP Acr1281s C1 1.06
7 pages
Api Acr122u 2.04
No ratings yet
Api Acr122u 2.04
49 pages
TSP Acr1283l 1.05
No ratings yet
TSP Acr1283l 1.05
8 pages
Api Acr122u 2.02
No ratings yet
Api Acr122u 2.02
47 pages
Application Programming ACR122U
No ratings yet
Application Programming ACR122U
47 pages
Ref Acr1281u C2 1.02
No ratings yet
Ref Acr1281u C2 1.02
17 pages
PSG Acr120
No ratings yet
PSG Acr120
1 page
Api Acr1252u A1 1.07
No ratings yet
Api Acr1252u A1 1.07
80 pages
CMP Acr122s 2.02
No ratings yet
CMP Acr122s 2.02
57 pages
TSP Acr1281 C8 1.00
No ratings yet
TSP Acr1281 C8 1.00
7 pages
Acr122U NFC Reader: Application Programming Interface
No ratings yet
Acr122U NFC Reader: Application Programming Interface
34 pages
Contactless Smart Card Reader
No ratings yet
Contactless Smart Card Reader
30 pages
TSP Acr1281u Npa v2.00
No ratings yet
TSP Acr1281u Npa v2.00
6 pages
ACR120 Contactless Reader/Writer: Communication Protocol
No ratings yet
ACR120 Contactless Reader/Writer: Communication Protocol
38 pages
TSP ACR120v2
No ratings yet
TSP ACR120v2
7 pages
Api Acr1252u 1.09
No ratings yet
Api Acr1252u 1.09
80 pages
ACR122U SDK User Manual - v2.0
No ratings yet
ACR122U SDK User Manual - v2.0
20 pages
API Acr122
No ratings yet
API Acr122
27 pages
Ppe Acr1281s C1 1.02
No ratings yet
Ppe Acr1281s C1 1.02
13 pages
ACR1252U: NFC Forum Certified Reader
No ratings yet
ACR1252U: NFC Forum Certified Reader
7 pages
PLT-07592 - AC-01 V2 User Guide
No ratings yet
PLT-07592 - AC-01 V2 User Guide
78 pages
Mifare Application Programming Guide For Desfire Rev
No ratings yet
Mifare Application Programming Guide For Desfire Rev
44 pages
TSP Acr89u A2 1.04
No ratings yet
TSP Acr89u A2 1.04
9 pages
JINMUYU USB HID Keyboard Simulator IC Card Reader General Technical Manual
No ratings yet
JINMUYU USB HID Keyboard Simulator IC Card Reader General Technical Manual
15 pages
Tsp-Acr122s-2.05 Datasheet
No ratings yet
Tsp-Acr122s-2.05 Datasheet
7 pages
Acr122U NFC Reader: Technical Specifications
No ratings yet
Acr122U NFC Reader: Technical Specifications
6 pages
ACR38U-I1: Smart Card Reader
No ratings yet
ACR38U-I1: Smart Card Reader
7 pages
Interoperability Specification For Iccs and Personal Computer Systems
No ratings yet
Interoperability Specification For Iccs and Personal Computer Systems
8 pages
ACR1255U-J1 Secure Bluetooth NFC Reader: Technical Specifications V1.08
No ratings yet
ACR1255U-J1 Secure Bluetooth NFC Reader: Technical Specifications V1.08
7 pages
PIC18F2450/4450 Data Sheet
No ratings yet
PIC18F2450/4450 Data Sheet
320 pages
Pic18f45k80 PDF
No ratings yet
Pic18f45k80 PDF
628 pages
Read Me
No ratings yet
Read Me
7 pages
PIC18F4885
No ratings yet
PIC18F4885
482 pages
Pci 1751
No ratings yet
Pci 1751
35 pages
TSP Acr38u A4 2.03
No ratings yet
TSP Acr38u A4 2.03
8 pages
SDK ACR122U Users-Manual
No ratings yet
SDK ACR122U Users-Manual
18 pages
MCS9835CV-BA: PCI To Dual UART & Parallel Port
No ratings yet
MCS9835CV-BA: PCI To Dual UART & Parallel Port
28 pages
Ppe Acr1283l 1.01
No ratings yet
Ppe Acr1283l 1.01
12 pages
Manual PocketMate - 0
No ratings yet
Manual PocketMate - 0
7 pages
LC Hikcentral Access Control V2.2.1 6609
No ratings yet
LC Hikcentral Access Control V2.2.1 6609
12 pages
SCard Reader Series Technica Manual V1.10
No ratings yet
SCard Reader Series Technica Manual V1.10
33 pages
PIC18F2585/2680/4585/4680 Data Sheet
No ratings yet
PIC18F2585/2680/4585/4680 Data Sheet
18 pages
Libro para Descargar PDF
No ratings yet
Libro para Descargar PDF
127 pages
Flyer bR301 BLE C45
No ratings yet
Flyer bR301 BLE C45
2 pages
Mastercard Rules
No ratings yet
Mastercard Rules
443 pages
Lexical Analysis: Programming Languages Translators
No ratings yet
Lexical Analysis: Programming Languages Translators
21 pages
Blade RF
No ratings yet
Blade RF
14 pages
Install Open VPN On Ubuntu
No ratings yet
Install Open VPN On Ubuntu
11 pages
C++ Library for Network Packet Manipulation
No ratings yet
C++ Library for Network Packet Manipulation
3 pages
Edit-2
No ratings yet
Edit-2
14 pages
System x3650 M2 Problem Determination and Service Guide
100% (1)
System x3650 M2 Problem Determination and Service Guide
234 pages
Important Notes of 9th Class Computer Science Chapter 4
No ratings yet
Important Notes of 9th Class Computer Science Chapter 4
9 pages
Raspberry Pi Overview & Features
No ratings yet
Raspberry Pi Overview & Features
22 pages
Past Papers
No ratings yet
Past Papers
6 pages
Chapter #1 Concepts of Computer Programming
No ratings yet
Chapter #1 Concepts of Computer Programming
35 pages
Mamba Stack: Esc:Mamba F50 Pro Fc:Mamba Basic App F722 Mk1
No ratings yet
Mamba Stack: Esc:Mamba F50 Pro Fc:Mamba Basic App F722 Mk1
3 pages
Cerberus® PRO: 252-Point and 504-Point Addressable Fire Alarm Control Panel
No ratings yet
Cerberus® PRO: 252-Point and 504-Point Addressable Fire Alarm Control Panel
6 pages
PLC For MTE
No ratings yet
PLC For MTE
9 pages
"Mobile Computing": Malineni Lakshmaiah Engineering College
No ratings yet
"Mobile Computing": Malineni Lakshmaiah Engineering College
12 pages
Flowcheck
No ratings yet
Flowcheck
34 pages
OmniCom Help
No ratings yet
OmniCom Help
523 pages
Computer Hardware & Software Notes-3
No ratings yet
Computer Hardware & Software Notes-3
47 pages
Lab Manual 8051
50% (2)
Lab Manual 8051
40 pages
Tesiraforté® Avb Ci Fixed I/O DSP: Data Sheet
No ratings yet
Tesiraforté® Avb Ci Fixed I/O DSP: Data Sheet
2 pages
Module 1 Notes-1
100% (1)
Module 1 Notes-1
21 pages
5thsem BCA PHP LAB Programs
No ratings yet
5thsem BCA PHP LAB Programs
1 page
ScanMate I1120
No ratings yet
ScanMate I1120
2 pages
CC Unit 3
No ratings yet
CC Unit 3
28 pages
Linux Process Management Guide
No ratings yet
Linux Process Management Guide
18 pages
Ruby Programming Cheat Sheet
100% (5)
Ruby Programming Cheat Sheet
8 pages
Alwin International Public School: AISSCE 2023 - 2024
No ratings yet
Alwin International Public School: AISSCE 2023 - 2024
30 pages
FFT Implementation With Hardware Reuse
No ratings yet
FFT Implementation With Hardware Reuse
5 pages
HP-15C & Intel 8087: Math Simplified
No ratings yet
HP-15C & Intel 8087: Math Simplified
49 pages
Modbus TCP Training Overview
No ratings yet
Modbus TCP Training Overview
45 pages
01 Become A PostgreSQL DBA Understanding The Architecture
No ratings yet
01 Become A PostgreSQL DBA Understanding The Architecture
10 pages
Unit 4
No ratings yet
Unit 4
35 pages
Obdpro Obd To Rs232 Interpreter
100% (1)
Obdpro Obd To Rs232 Interpreter
20 pages
Python UNIT1 Notes
No ratings yet
Python UNIT1 Notes
30 pages
1 - PPT Module-1
No ratings yet
1 - PPT Module-1
38 pages