The ACR3801 Smart Card Reader establishes a uniform interface from the computer to the smart card for a wide variety of cards. By taking care of the card specifics, it liberates the computer software programmer of getting involved with the technical details of the smart card operation, which are in many cases irrelevant to the implementation of a smart card system.
Supports CT-API (through wrapper on top of PC/SC) • Supports Android™ OS 3.1 and above • Compliant with the following standards: FIPS 201 EN60950/IEC 60950 ISO 7816 PC/SC CCID Microsoft WHQL RoHS Page 5 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
3.1. MCU Cards ACR3801 is a PC/SC compliant smart card reader that supports ISO 7816 Class A, B and C (5 V, 3 V, and 1.8 V) smart cards. It also works with MCU cards following either the T=0 and T=1 protocol.
ACR3801 provides a mechanism to protect the inserted card when it is suddenly withdrawn while it is powered up. The power supply to the card and the signal lines between the ACR3801 and the card is immediately deactivated when the card is being removed. However, as a rule to avoid any electrical damage, a card should only be removed from the reader while it is powered down.
5.0. Power Supply ACR3801 requires a voltage of 5 V DC, 100 mA, regulated, power supply. ACR3801 gets the power supply from the computer (through the cable supplied along with each type of reader). 5.1. Status LED The LED indicates the activation status of the smart card interface: Flashing slowly (turns on 200 ms for every 2 seconds) •...
6.0. USB Interface 6.1. Communication Parameters ACR3801 is connected to a computer through USB as specified in the USB Specification 2.0. ACR3801 is working in full speed more, i.e. 12 Mbps. Signal Function VBUS +5 V power supply for the reader...
3. CCID Commands are sent on BULK-OUT endpoint. Each command sent to ACR3801 has an associated ending response. Some commands can also have intermediate responses. 4. CCID Responses are sent on BULK-IN endpoint. All commands sent to ACR3801 have to be sent synchronously (e.g., bMaxCCIDBusySlots is equal to 01h for ACR3801).
Page 11
Automatic ICC clock frequency change according to parameters dwFeatures 00010030h Automatic baud rate change according to frequency and FI,DI parameters TPDU level change with ACR3801 Maximum message length accepted by dwMaxCCIDMessageLength 0000010Fh ACR3801 is 271 bytes bClassGetResponse Insignificant for TPDU level exchanges...
8.0. Commands 8.1. CCID Command Pipe Bulk-OUT Messages ACR3801 shall follow the CCID Bulk-OUT Messages as specified in CCID Section 4. In addition, this specification defines some extended commands for operating additional features. This section lists the CCID Bulk-OUT Messages to be supported by ACR3801.
Size of extra bytes of this message Identifies the slot number for this bSlot command bSeq Sequence number for command abRFU Reserved for future use The response to this message is the RDR_to_PC_SlotStatus message. Page 13 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Size of extra bytes of this message Identifies the slot number for this bSlot command bSeq Sequence number for command abRFU Reserved for future use The response to this message is the RDR_to_PC_SlotStatus message. Page 14 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Data block sent to the CCID. Data is Byte abData sent “as is” to the ICC (TPDU array exchange level). The response to this message is the RDR_to_PC_DataBlock message. Page 15 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Size of extra bytes of this message Identifies the slot number for this BSlot command BSeq Sequence number for command AbRFU Reserved for future use The response to this message is the RDR_to_PC_Parameters message. Page 16 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Size of extra bytes of this message Identifies the slot number for this BSlot command BSeq Sequence number for command AbRFU Reserved for future use The response to this message is the RDR_to_PC_Parameters message. Page 17 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
00h = Stopping the Clock is not allowed bClockStop 01h = Stop with Clock signal Low 02h = Stop with Clock signal High 03h = Stop with Clock either High or Page 18 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 19
03h = Stop with Clock either High or Low bIFSC Size of negotiated IFSC bNadValue Only support NAD = 00h The response to this message is the RDR_to_PC_Parameters message. Page 19 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
8.2. CCID Bulk-IN Messages The Bulk-IN messages are used in response to the Bulk-OUT messages. ACR3801 shall follow the CCID Bulk-IN Messages as specified in CCID Section 4. This section lists the CCID Bulk-IN Messages to be supported by ACR3801.
01h = Clock stopped in state L bClockStatus 02h = Clock stopped in state H 03h = Clock stopped in an unknown state All other values are RFU Page 21 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
8.3. Memory Card Command Set This section contains the Memory Card Command Set for ACR3801. 8.3.1. Recollection Card – 1, 2, 4, 8 and 18 Kbit I2C Card 8.3.1.1. SELECT_CARD_TYPE This command powers down and up the selected card inserted in the card reader and performs a card reset.
Page 24
Length of data to be written to the memory card Byte x Data to be written to the memory card Response Data Format (abData field in the RDR_to_PC_DataBlock) Page 24 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 25
Where: SW1 SW2 = 90 00h if no error Page 25 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
= 04h for 16-byte page write = 05h for 32-byte page write = 06h for 64-byte page write = 07h for 128-byte page write Response Data Format (abData field in the RDR_to_PC_DataBlock) Page 26 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 27
Memory address location of the memory card MEM_L Length of data to be written to the memory card Byte x Data to be written to the memory card Page 27 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 28
Response Data Format (abData field in the RDR_to_PC_DataBlock) Where: SW1 SW2 = 90 00h if no error Page 28 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Response Data Format (abData field in the RDR_to_PC_DataBlock) BYTE 1 … … BYTE N Where: BYTE x Data read from memory card SW1 SW2 = 90 00h if no error Page 29 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 30
“rp” indicate the password to compare r = 0: Write password, r = 1: Read password, p : Password set number, rp = 01 for the secure code. Page 30 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 31
Pseudo-APDU Ch(0) Ch(1) … Ch(7) Where: Ch(0),Ch(1)…Ch(7) Host challenge, 8 bytes Response Data Format (abData field in the RDR_to_PC_DataBlock) Where: SW1 SW2 = 90 00h if no error Page 31 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Length of data to be read from the memory card Response Data Format (abData field in the RDR_to_PC_DataBlock) BYTE 1 … … BYTE N Where: BYTE x Data read from memory card Page 32 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 33
” indicate the password to compare: r = 0 : Write password, r = 1 : Read password, : Password set number. = 0111 for the secure code) Page 33 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 34
VERIFY_AUTHENTICATION Command Format (abData field in the PC_to_RDR_XfrBlock) Pseudo-APDU Q1(0) Q1(1) … Q1(7) Where: Byte Address Memory address location of the memory card Q1(0),Q1(1)…Q1(7) Host challenge, 8 bytes Page 34 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 35
Response Data Format (abData field in the RDR_to_PC_DataBlock) Where: SW1 SW2 = 90 00h if no error Page 35 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Response Data Format (abData field in the RDR_to_PC_DataBlock) BYTE 1 … … BYTE N Where: BYTE x Data read from memory card SW1 SW2 = 90 00h if no error Page 36 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 37
MEM_L = 1 + INT( (number of bits - 1)/8 ) For example, to read 8 protection bits starting from memory 0x0010h, the following pseudo-APDU should be issued: 0xFFh 0xB2h 0x00h 0x10h 0x01h Page 37 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 38
Each byte specified in the command is used in the card to compare the byte stored in a specified address location. If the data match, the corresponding protection bit is irreversibly programmed to ‘0’. Page 38 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk...
Page 39
Command Format (abData field in the PC_to_RDR_XfrBlock) Pseudo-APDU CODE MEM_L Byte 1 Byte 2 Where: CODE Two bytes secret code (PIN) Response Data Format (abData field in the RDR_to_PC_DataBlock) ErrorCnt Page 39 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 40
= Error Counter. FFh indicates successful verification. 00h indicates that the password is locked (or exceeded the maximum number of retries). Other values indicate that current verification has failed. Page 40 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Response Data Format (abData field in the RDR_to_PC_DataBlock) BYTE 1 … … BYTE N Where: BYTE x Data read from memory card SW1 SW2 = 90 00h if no error Page 41 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 42
The arrangement of the protection bits in the PROT bytes is as follows: PROT 1 PROT 2 … Where: Px is the protection bit of BYTE x in the response data Page 42 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 43
Byte values to be compared with the data in the card starting at Byte Address. BYTE 1 is compared with the data at Byte Address; BYTE N is compared with the data at (Byte Address+N-1). Page 43 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 44
This command is used to write the specified data as new secret code in the card. The current secret code must be presented to the card with the PRESENT_CODE command prior to the execution of this command. Page 44 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 45
Command Format (abData field in the PC_to_RDR_XfrBlock) Pseudo-APDU CODE MEM_L Byte Byte Byte Response Data Format (abData field in the RDR_to_PC_DataBlock) Where: SW1 SW2 = 90 00h if no error Page 45 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
LSB first, i.e., the bit at card address 0 is regarded as the LSB of byte 0. Four different WRITE modes are available for this card type, which are distinguished by a flag in the Page 46 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk...
Page 47
SLE 6636 only) BYTE Byte value to be written to the card Response Data Format (abData field in the RDR_to_PC_DataBlock) Where: SW1 SW2 = 90 00h if no error Page 47 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 48
AUTHENTICATE_MEMORY_CARD (SLE 4436, SLE 5536 and SLE 6636) To read a card authentication certificate from a SLE 5536 or SLE 6636 card, the ACR3801 executes the following actions: 1. Select Key 1 or Key 2 in the card as specified in the command.
Page 49
16 bits of authentication data computed by the card. The LSB of BYTE 1 is the first authentication bit read from the card. SW1 SW2 = 90 00h if no error Page 49 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
LSB first, i.e., the bit at card address 0 is regarded as the LSB of byte 0. The byte at the specified card address is not erased prior to the write operation and, hence, memory Page 50 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk...
Page 51
= Memory byte address location of the scratch pad Typical value is 0x02h Response Data Format (abData field in the RDR_to_PC_DataBlock) Where: SW1 SW2 = 90 00h if no error Page 51 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 52
2. Search a '1' bit in the presentation error counter and write the bit to '0'. 3. Erase the presentation error counter. Please note that Memory Error Counter cannot be erased. Page 52 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 53
After SW1SW2 = 0x9000h has been received, read back the Application Area can check if the VERIFY_MEMORY_CODE is correct. If all data in Application Area is erased and is equal to “0xFFh,” the previous verification is successful. Page 53 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
LSB first, i.e., the bit at card address 0 is regarded as the LSB of byte 0. The byte at the specified card address is not erased prior to the write operation and, hence, memory Page 54 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk...
Page 55
Command Format (abData field in the PC_to_RDR_XfrBlock) Pseudo-APDU Byte Address MEM_L Where: Byte Address Memory byte address location of the word to be erased. Response Data Format (abData field in the RDR_to_PC_DataBlock) Page 55 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 56
AT88SC102: Erase Application Zone 2 with EC2 function disabled AT88SC1003: Erase Application Zone 1 AT88SC1003: Erase Application Zone 2 with EC2 function disabled AT88SC1003: Erase Application Zone 3 Page 56 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 57
Length of presentation error counter in bits. The value should be 0x80h always. Byte Address Byte address of the Application Zone Key in the card Byte Address AT88SC101 AT88SC102 AT88SC1003 Page 57 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 58
Note: After SW1SW2 = 0x9000h has been received, read back the Security Code Attempts Counter (SCAC) to check whether the VERIFY_USER_CODE is correct. If SCAC is erased and is equal to “0xFFh,” the previous verification is successful. Page 58 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
Page 59
EC2EN Fuse Issuer Fuse Manufacturer Fuse AT88SC1003 EC2EN Fuse Issuer Fuse Response Data Format (abData field in the RDR_to_PC_DataBlock) Where: SW1 SW2 = 90 00h if no error Page 59 of 62 ACR3801 – Reference Manual info@acs.com.hk www.acs.com.hk Version 2.01...
8.4.1. GET_READER_INFORMATION This command returns relevant information about ACR3801 and the current operating status, such as, the firmware revision number, the maximum data length of a command and response, the supported card types, and whether a card is inserted and powered up or not.
Appendix B. Response Error Codes The following table summarizes the possible error code returned by the ACR3801: Error Code Status SLOTERROR_CMD_ABORTED SLOTERROR_ICC_MUTE SLOTERROR_XFR_PARITY_ERROR SLOTERROR_XFR_OVERRUN SLOTERROR_HW_ERROR SLOTERROR_BAD_ATR_TS SLOTERROR_BAD_ATR_TCK SLOTERROR_ICC_PROTOCOL_NOT_SUPPORTED SLOTERROR_ICC_CLASS_NOT_SUPPORTED SLOTERROR_PROCEDURE_BYTE_CONFLICE SLOTERROR_DEACTIVATED_PROTOCOL SLOTERROR_BUSY_WITH_AUTO_SEQUENCE SLOTERROR_CMD_SLOT_BUSY Table 4: Response Error Codes Page 62 of 62 ACR3801 –...
Need help?
Do you have a question about the ACR3801 and is the answer not in the manual?
Questions and answers