SCM Microsystems SCL01X Reference Manual

Multiprotocol contactless stationary reader
Table of Contents

Advertisement

Quick Links

SCM Microsystems
Reference Manual – version 2.0
SCL01X
Multiprotocol contactless stationary reader

Advertisement

Table of Contents
loading
Need help?

Need help?

Do you have a question about the SCL01X and is the answer not in the manual?

Questions and answers

Summary of Contents for SCM Microsystems SCL01X

  • Page 1 SCM Microsystems Reference Manual – version 2.0 SCL01X Multiprotocol contactless stationary reader...
  • Page 3 Reference manual SCL01X Multiprotocol Contactless Stationary Reader © SCM Microsystems Oskar-Messter-Strasse, 13 85737 Ismaning Germany Phone +49 89 9595 5000 • Fax +49 89 9595 5555...
  • Page 4 Document history Date Version Description of change 26/10/2010 Initial version Typo corrections Add the Pass_through command description Manual fro both SCL010 and SCL011 products Contact information http://www.scmmicro.com/products-services/smart-card-readers-terminals/contactless-dual- interface-readers.html For sales information, please email sales@scmmicro.com...
  • Page 5: Table Of Contents

    SCL01X key features ....................14 3.3. SCL01X ordering information ..................15 3.4. SCL01X customization options ..................15 3.5. Contactless communication principles and SCL01X usage recommendations ... 16 3.5.1. Power supply......................16 3.5.2. Data exchange ...................... 16 3.5.3. Recommendations ....................17 3.6.
  • Page 6 6.3.1. T=CL Command ....................41 6.3.2. T=CL user command .................... 42 6.4. Set of APDU defined by SCM Microsystems ............... 43 6.4.1. MIFARE DESFire Commands ................43 6.4.2. Commands for communicating with NFC Forum Tags Type 1 ......43 6.4.3.
  • Page 7 7.3.4. Snap-on card holder ..................... 78...
  • Page 8: Legal Information

    1.1. Disclaimers The content published in this document is believed to be accurate. SCM Microsystems does not, however, provide any representation or warranty regarding the accuracy or completeness of its content and regarding the consequences of the use of information contained herein. If this document has the status ―Draft‖, its content is still under internal review and yet to be formally...
  • Page 9: Trademarks

    Open Source Software. If the document contains technical drawings related to SCM Microsystems products, they are provided for documentation purposes only. SCM Microsystems does not grant you any license to its designs.
  • Page 10: Introduction To The Manual

    2. Introduction to the manual 2.1. Objective of the manual This manual provides an overview of the hardware and software features of the SCL01X contactless reader, hereafter referred to as ―SCL01X‖. This manual describes in details interfaces and supported commands available for developers using SCL01X in their applications.
  • Page 11: Definition Of Various Terms And Acronyms

    Distance coverage till ~10 cm. PUPI Pseudo unique PICC identifier Reserved for future use Radio Frequency STCIII Smart card reader controller ASIC from SCM Microsystems Universal Serial Bus Vendor ID Binary notation of a number x, y, z 0,1 (xyz)b 0xYY...
  • Page 12: References

    SCL01X R EFERENCE ANUAL 2.5. References Doc ref in Description Issuer the manual ISO/IEC Identification cards - Integrated circuit(s) cards ISO / IEC 7816-4 with contacts Part 4: Interindustry commands for interchange ISO/IEC 7816-4: 1995 (E) Identification cards — Contactless integrated...
  • Page 13: Conventions

    SCL01X R EFERENCE ANUAL 2.6. Conventions Bits are represented by lower case ‗b‘ where followed by a numbering digit. Bytes are represented by upper case ‗B‘ where followed by a numbering digit. Bit number 5 Bit number 0 Most significant nibble...
  • Page 14: General Information About Scl01X

    ID, payment & public transportation schemes and to interact with NFC-enabled devices. As for all SCM Microsystems products, SCL01X is designed to offer best in class interoperability with various formats of tokens: cards, dongles, watches or NFC mobile phones.
  • Page 15: Scl01X Ordering Information

    Contactless SDK 905266  It is important to note that those accessories are incompatible with each other – i.e. when the snap-on card holder is fitted on the SCL01X, the cradle cannot be used anymore. 3.4. SCL01X customization options Upon request, SCM can customize: ...
  • Page 16: Contactless Communication Principles And Scl01X Usage Recommendations

    NFC mobile phone etc… Communication between SCL01X and user tokens uses magnetic field inductive coupling. The magnetic field is generated by SCL01X has a carrier frequency of 13.56MHz. 3.5.1. Power supply When the user token is put in the magnetic field of the reader, its antenna couples with the reader and an induction current appears in the antenna thus providing power to the integrated circuit.
  • Page 17: Recommendations

    For this reason, SCM Microsystems has implemented in its driver only 1 slot. This means that in the event several user tokens are in the field of the SCL01X, only one will be active. ...
  • Page 18: Applications

    Those user tokens can have several form factors like credit cards, key fobs, NFC mobile phones or USB dongles like SCT3511 that SCM Microsystems markets. SCL01X itself handles the communication protocol but not the application related to the token. The application-specific logic has to be implemented by software developers on the host.
  • Page 19: Scl01X Characteristics

    4. SCL01X characteristics 4.1. SCL01X high level architecture 4.1.1. Block diagram The link between SCL01X and the host to which it is connected is the USB interface providing both the power and the communication channel. EMC filter + text Device controller...
  • Page 20: Quick Reference Data

    Default color Translucent black Drawing with dimensions of the SCL01X and accessories can be found in annex. 4.2.2. LED behavior The LED behavior of the SCL01X is given below. SCL01X states LED Indication (GREEN) After plug-in (Driver is not installed or driver is...
  • Page 21: Other Data

    Operating Up to 95%RH non condensing humidity range Certifications USB, CE, FCC, VCCI, WEEE, RoHS, WHQL, Radio Frequency for Japan, The LED indicates SCL01X detects a user token in its field but it doesn‘t guaranty that communication can actually happen...
  • Page 22: Software Modules

    Windows Vista (32 & 64 bit)  Windows Server 2008 (32 & 64 bit) 5.3. Driver 5.3.1. SCL01X listing SCL01X is listed by PC/SC applications as SCM Microsystems Inc. SCL01X Contactless Reader. 5.3.2. Supported operating systems Operating systems supported by the driver:  Windows 2000 ...
  • Page 23: Pc/Sc 2.0 Compliant Atr

    SCL01X R EFERENCE ANUAL  Mac OS 10.4.11  Mac OS 10.5.6  Mac OS 10.6.4  Debian 5.0 Kernel version 2.6.26 – 32 bit  Debian 5.0 Kernel version 2.6.26 – 64 bit  Ubuntu 10.04 Kernel version 2.6.29 – 32 bit ...
  • Page 24 SCL01X R EFERENCE ANUAL 5.3.3.2. ATR for contactless storage user tokens The ATR of the user token is composed as described in the table below. In order to allow the application to identify the storage card properly, it‘s Standard and Card name describing bytes must be interpreted according to the Part 3 Supplemental Document, maintained by PC/SC.
  • Page 25 SCL01X R EFERENCE ANUAL 5.3.3.3. ATR for an NFC Forum tag type 1 user token (Topaz) Byte# Value Designation Description 0x3B Initial header 0x82 TD1 present. 2 historical bytes in following 0x80 Nibble 8 indicates no TA2, TB2, TC2 and...
  • Page 26 SCL01X R EFERENCE ANUAL 5.3.3.4. ATR for a NFC Forum tag type 3 user token (FeliCa) Byte# Value Designation Description 0x3B Initial header 0x8C present. historical bytes following ATR 0x80 Nibble8 indicates no TA2, TB2, TC2 and TD2 present Nibble 0 means T=0...
  • Page 27 SCL01X R EFERENCE ANUAL 5.3.3.5. ATR for ISO/IEC 14443-4 user tokens The user token exposes its ATS or application information which is mapped to an ATR. The table describes how this mapping is done. Byte# Value Designation Description 0x3B Initial header...
  • Page 28: Firmware

    Firmware 5.4.1. CCID-like transport protocol SCL01X implements a transport protocol that is compliant with USB Device Class: Smart Card CCID Specification for Integrated Circuit(s) Cards Interface Devices Revision 1.10. This paragraph describes the CCID specification features that are implemented and those that are not implemented.
  • Page 29: Automatic Pps

    106kbps. In PC/SC 2.0 compliant driver an escape command has been introduced to force baud rate. The maximum speed supported by SCL01X is 848Kbps by default (with 254 bytes frame size). Using escape messages as explained later in this manual it is possible to change this.
  • Page 30: Commands Description

    SCL01X R EFERENCE ANUAL 6. Commands description 6.1. Generic APDU 6.1.1. Get UID Command 6.1.1.1. Description GET UID will retrieve the UID or SNR or PUPI of the user token. This command can be used for all supported technologies. 6.1.1.2.
  • Page 31 SCL01X R EFERENCE ANUAL 6.1.1.5. Examples ISO14443-4A ISO14443-4B MIFARE 4K MIFARE Ultralight NFC Forum tag type 1 NFC Forum tag type 3...
  • Page 32: Escape Command Apdu

    SCL01X R EFERENCE ANUAL 6.1.2. Escape command APDU 6.1.2.1. Description This command can be used to send escape commands to SCL01X. For description of escape commands please refer to the dedicated chapter in this manual. 6.1.2.2. Format Data in 0xFF...
  • Page 33: Set Of Apdu For Contactless Storage User Tokens

    SCL01X R EFERENCE ANUAL 6.2. Set of APDU for contactless storage user tokens 6.2.1. STORAGE_CARD_CMDS_READ_BINARY 6.2.1.1. Description Using this APDU, application can read a memory block on user tokens based on technologies like MIFARE Classic 1K or 4K (block size 0x10 bytes) or MIFARE Ultra light (block size 0x04 bytes).
  • Page 34 SCL01X R EFERENCE ANUAL 6.2.1.5. Example For a MIFARE Classic 1K card which has the following memory content: To read the seventh block, you have to issue the following command and get the following response:...
  • Page 35: Storage_Card_Cmds_Write_Binary

    SCL01X R EFERENCE ANUAL 6.2.2. STORAGE_CARD_CMDS_WRITE_BINARY 6.2.2.1. Description This APDU writes data to a memory address 6.2.2.2. Format Data in 0xFF 0xD6 Address Address 0xXX Data Where:  P2 indicate the memory block number where data should be written ...
  • Page 36 SCL01X R EFERENCE ANUAL Results into the following memory mapping...
  • Page 37: Storage_Card_Cmds_Load_Keys

    SCL01X R EFERENCE ANUAL 6.2.3. STORAGE_CARD_CMDS_LOAD_KEYS 6.2.3.1. Description Some type of user tokens like MIFARE Classic may require that an authentication happens before any data can be read or written. To perform this authentication, keys need to be loaded in the reader‘s memory using this command.
  • Page 38: Storage_Card_Cmds_Authenticate

    SCL01X R EFERENCE ANUAL 6.2.4. STORAGE_CARD_CMDS_AUTHENTICATE 6.2.4.1. Description This command enables to perform authentication for user tokens based on MIFARE Classic 1K Before this command successfully executed, STORAGE_CARD_CMDS_LOAD_KEY command must have been executed. 6.2.4.2. Format Data in 0xFF 0x86 0x00...
  • Page 39 SCL01X R EFERENCE ANUAL 6.2.4.5. Example For a MIFARE Classic 1K card which has the following memory mapping: Reading sector 0 or sector 1 of this card requires authentication with key A or key B. The following example:  authenticates with key A of sector 0 ...
  • Page 40: Storage_Card_Cmds_Value_Block

    SCL01X R EFERENCE ANUAL 6.2.5. STORAGE_CARD_CMDS_VALUE_BLOCK 6.2.5.1. Description This APDU is used to interact with MIFARE Classic e-purse applications. Please refer to MIFARE Classic documentation available from NXP Semiconductors for further details on MIFARE classic memory mapping and commands. 6.2.5.2.
  • Page 41: Set Of Apdu For Iso/Iec14443-4 User Tokens

    Description SCL01X can transfer directly ISO/IEC7816-4 APDU to the PICC. SCL01X supports user tokens that have both the MIFARE and T=CL partitions. Depending on the APDU sent by the host, the reader switches to the corresponding mode (MIFARE or T=CL) automatically and the command is processed accordingly.
  • Page 42: T=Cl User Command

    SCL01X R EFERENCE ANUAL 6.3.2. T=CL user command Description This command can be used to send raw data to the user token. 6.3.2.1. Format Data 0xFF 0xFE 0x00 0x00 Lraw_data Raw_data 6.3.2.2. Response Data Out PICC response data+ SW1 + SW2 6.3.2.3.
  • Page 43: Set Of Apdu Defined By Scm Microsystems

    SCL01X R EFERENCE ANUAL 6.4. Set of APDU defined by SCM Microsystems 6.4.1. MIFARE DESFire Commands Description This command can be used to send commands to DESFire-based user tokens. For a description of DESFire commands please contact NXP Semiconductors. 6.4.1.1.
  • Page 44 SCL01X R EFERENCE ANUAL Data SW1 SW2 HR0 HR1 UID0 UID1 UID2 UID3 0x90 0x00 Where  HR0 and HR1 are the 2 bytes Header ROM which identify the tag  UID0 through UID3 are the first 3 bytes of the tag‘s UID.
  • Page 45 SCL01X R EFERENCE ANUAL 6.4.2.2. Read All Blocks (RALL) Description The RALL command reads-out the two header ROM bytes and the whole of the static memory blocks 0x0-0xE. Format Data 0xFF 0x52 0x00 0x00 0x00 Response Data SW1 SW2 HR0 HR1 120 bytes (Blocks 0 – E)
  • Page 46 SCL01X R EFERENCE ANUAL 6.4.2.3. Read Byte (READ) Description This command reads a single EEPROM memory byte within the static memory model area of blocks 0x0-0xE. Format Data 0xFF 0x54 0x00 Byte Address 0x00 Where P2 codes the address of the memory byte in the following way:...
  • Page 47 SCL01X R EFERENCE ANUAL 6.4.2.4. Write-Erase Byte (WRITE-E) Description This commands erases and then writes the value of an individual memory byte within the static memory model area of blocks 0x0-0xE. Format Data 0xFF 0x56 0x00 Byte 0x01 1 byte of data to be...
  • Page 48 SCL01X R EFERENCE ANUAL 6.4.2.5. Write-No-Erase Byte (WRITE-NE) Description This command writes a byte value on an individual memory byte within the static memory model area of blocks 0x0-0xE. This command does not erase the value of the targeted byte before writing the new data.
  • Page 49 SCL01X R EFERENCE ANUAL Example For an NFC forum tag type 1 which has the following memory dump The following sequence does  A READ of the byte # 0x03 in block 0x07  A WRITE NO ERASE of the byte # 0x03 in the block =0x07 with value 0x09 ...
  • Page 50 SCL01X R EFERENCE ANUAL 6.4.2.6. Read Segment (RSEG) Description This command reads out a complete segment (or block) of the memory a Topaz tag with dynamic memory model. Please note that this command only function on those specific Topaz tags.
  • Page 51 SCL01X R EFERENCE ANUAL 6.4.2.8. Write-Erase 8 bytes (WRITE-E8) Description This command writes erases a memory block and then writes a value to it. Format Data 0xFF 0x5E 0x00 Block 0x08 8 bytes of data to be Address written P2 – Block Address - b8 - b1 - General block (0x00 – 0xFF)
  • Page 52: Commands For Communicating With Nfc Forum Tags Type 2

    Please refer to NFC Forum tag type 2 specification for definition of the commands to be used 6.4.4. Commands for communication with NFC Forum Tags Type 3 Proprietary APDUs defined for the following FeliCa™ non-secure commands are described in this section. SCL01X does not support FeliCa™ secure commands.  REQC ...
  • Page 53 SCL01X R EFERENCE ANUAL 6.4.4.2. Request Service Description On receiving this command an NFC Forum tag 3 type will respond with the area key version of the specified area and the service key version of the specified service. Format Data...
  • Page 54: Commands For Communicating With Nfc Forum Tags Type 4

    SCL01X R EFERENCE ANUAL 6.4.4.5. Write Description When an NFC Forum tag type 3 receives this command, it writes the records of the specified service. Format Data 0xFF 0x48 Number of Number of 2*(P1 + P2) Service Code List, services...
  • Page 55 SCL01X R EFERENCE ANUAL Data PICC response data Example This command can be used to send commands to a MIFARE Ultralight C The command for generating an 8-byte random number on MIFARE Ultralight C is 0x1A 0x00: Sending the APDU 0xFF 0xEF 0x00 0x00 0x02 0x1A 0x00...
  • Page 56: Escape Commands

    Escape commands can be used by an application to configure SCL01X to function in a mode that is not its default configured mode or to get specific information. To put the SCL01X back into its default mode, either the SCL01X has to be unplugged and plugged again or the application can send again the same escape command.
  • Page 57: Reader_Getcardinfo

    6.4.9. READER_GETCARDINFO This escape command is used to get information about the card placed on the reader. The SCL01X returns an error if no card is placed on it. The input buffer shall contain the escape command code Input buffer 0x11 The output buffer contents are described below.
  • Page 58: Reader_Cntless_Get_Ats_Atqb

    The output buffer contains the ATS bytes or the ATQB bytes depending on the type of PICC placed on the reader. 6.4.13. READER_CNTLESS_GET_TYPE This escape command retrieves the type of the card which SCL01X is configured to poll for. The input buffer shall contain the escape command code Input buffer 0x94...
  • Page 59: Reader_Cntless_Set_Type

    READER_CNTLESS_SET_TYPE This escape command configures the type of cards SCL01X will poll for. Using this command can improve the polling efficiency of SCL01X for applications where only type A or only type B cards are expected. The default is Type A+type B+FeliCa (0x1B).
  • Page 60: Reader_Cntless_Rf_Switch

    6.4.16. READER_CNTLESS_RAW_CFG This escape command switches SCL01X to raw mode. When SCL01X is in raw mode it only polls for one type of contactless card. SCL01X is by default not in this mode and therefore READER_CNTLESS_RAW_XMIT would fail. The input buffer contains 2 bytes...
  • Page 61: Reader_Cntless_Raw_Xmit

    6.4.17. READER_CNTLESS_RAW_XMIT This escape command can only be executed by the firmware once SCL01X is put in raw mode using the READER_CNTLESS_RAW_CFG escape command. This escape command can be used to send commands to smart card when SCL01X is in raw...
  • Page 62: Reader_ Cntless_Disable_Pps

    6.4.18. READER_ CNTLESS_DISABLE_PPS By default SCL01X does automatic PPS – i.e. it switches the RF communication speed to the highest possible supported by the card. This escape command can be used to switch ON/OFF automatic PPS. When automatic PPS is...
  • Page 63: Reader_Cntless_Baudrate

    SCL01X R EFERENCE ANUAL 6.4.20. READER_CNTLESS_BAUDRATE This escape command can be used to get the actual operating baud rate of card-reader communication. The input buffer shall contain the escape message value. Input buffer 0x9E The output buffer shall point to a BYTE buffer with following possible values...
  • Page 64: Reader_Cntless_Force_Baudrate_Pcsc_Rev2

    SCL01X R EFERENCE ANUAL 6.4.21. READER_CNTLESS_FORCE_BAUDRATE_PCSC_REV2 This escape command can be used to force baud rate for Contactless cards. The input buffer is Byte # Value Description 0xAD Escape command code 0x00 Apply the baud rate specified by the card...
  • Page 65: Reader_Getpnpparams

    This escape command is used to retrieve the slot information. The input buffer contains the escape command code Input buffer 0xD9 The output buffer is Byte # Value Description 0x01 Only 1 slot supported on SCL01X 0x00 Slot number 0x01 Contactless slot...
  • Page 66: Reader_Get_Card_Details

    SCL01X R EFERENCE ANUAL 6.4.24. READER_GET_CARD_DETAILS This escape command is used to get details about the PICC placed on the reader. The input buffer contains the escape command code Input buffer 0xDA The output buffer is Byte # Value Description...
  • Page 67: Reader_Is_Scl01X

    MIFARE FeliCa 6.4.25. READER_IS_SCL01x This escape message may be used to check if the connected device is an SCL01x device. The input buffer contains the escape command code Input buffer 0xDB The output buffer shall point to a BYTE buffer with following possible values...
  • Page 68: Reader_Send_Attrib_With_Inf

    SCL01X R EFERENCE ANUAL 6.4.26. READER_SEND_ATTRIB_WITH_INF This Escape command may be used to send application layer bytes to a type B card along with the ATTRIB command in the higher layer INF field. The input buffer is Byte # Value...
  • Page 69: Annexes

    SCL01X R EFERENCE ANUAL 7. Annexes Annex A – Status words table 7.1. Description 0x90 0x00 NO ERROR 0x67 0x00 LENGTH INCORRECT 0x6D 0x00 INVALID INSTRUCTION BYTE 0x6E 0x00 CLASS NOT SUPPORTED 0x6F 0x00 UNKNOWN COMMAND 0x63 0x00 AUTHENTICATION ERROR...
  • Page 70: Annex B - Sample Code Using Escape Commands Through Escape Ioctl

    SCL01X R EFERENCE ANUAL Annex B – Sample code using escape commands 7.2. through Escape IOCTL File Name : T_pupi.H #ifdef __cplusplus extern "C" { #endif #define IOCTL_CCID_ESCAPE SCARD_CTL_CODE (0xDAC) #define CCID_GET_PUPI_STATUS 0xFF9B #define CCID_SET_PUPI_ON 0x019B #define CCID_SET_PUPI_OFF 0x009B #define MINTIMEOUT...
  • Page 71 SCARD_READERSTATE Reader[1]; // please add the name of the used reader here or use SCardListReaders // to find the right reader name char *ReaderName[] = {"SCM Microsystems Inc. SCL01X USB ContactlessReader 0", NULL}; /*************************************************************************************** *****************/ ContextHandle = -1; ret = SCardEstablishContext(SCARD_SCOPE_USER, NULL, NULL, &ContextHandle);...
  • Page 72 SCL01X R EFERENCE ANUAL ret = SCardGetStatusChange( ContextHandle, MINTIMEOUT, Reader, printf ("\nATR: "); for (i=0; i<Reader->cbAtr; i++) printf ("%.2x ",Reader->rgbAtr[i]); printf ("\n----------------------------------------------\n"); /* set actual PUPI status: ON */ printf ("\nenable PUPI "); InBufLen = 2; InWord = CCID_SET_PUPI_ON; ret = SCardControl (CardHandle, IOCTL_CCID_ESCAPE, &InWord,...
  • Page 73 SCL01X R EFERENCE ANUAL printf ("\n Get PUPI status: %lx: %.2x", ret,OutByte); Reader[0].dwCurrentState = SCARD_STATE_UNAWARE; Reader[0].dwEventState = SCARD_STATE_UNAWARE; Reader[0].szReader = ReaderName[0]; ret = SCardGetStatusChange (ContextHandle, MINTIMEOUT, Reader, 1); printf ("\nATR: "); for (i=0; i<Reader->cbAtr; i++) printf ("%.2x ",Reader->rgbAtr[i]); printf ("\n----------------------------------------------\n");...
  • Page 74 SCL01X R EFERENCE ANUAL Reader[0].szReader = ReaderName[0]; ret = SCardGetStatusChange( ContextHandle, MINTIMEOUT, Reader, printf ("\nATR: "); for (i=0; i<Reader->cbAtr; i++) printf ("%.2x ",Reader->rgbAtr[i]); printf ("\n----------------------------------------------\n"); ret = SCardDisconnect(CardHandle, SCARD_RESET_CARD); else printf("\n SCardConnect failed with 0x%.8lX",ret); ret = SCardReleaseContext(ContextHandle); else printf("\n SCardEstablishContext failed with %.8lX",ret);...
  • Page 75: Annex C - Mechanical Drawings

    SCL01X R EFERENCE ANUAL Annex C – Mechanical drawings 7.3. 7.3.1. Top casing...
  • Page 76: Bottom Casing

    SCL01X R EFERENCE ANUAL 7.3.2. Bottom casing...
  • Page 77: Cradle

    SCL01X R EFERENCE ANUAL 7.3.3. Cradle...
  • Page 78 SCL01X R EFERENCE ANUAL 7.3.4. Snap-on card holder...

Table of Contents