1.0. Introduction The ACR122S is a contactless smart card reader/writer used for accessing ISO 14443-4 Type A and B, Mifare, ISO 18092 or NFC, and FeliCa tags using the serial interface. This document will discuss the command set in implementing a smart card application using the ACR122S.
ISO 14443 VCCI RoHS 2.1. Serial Interface The ACR122S is connected to a Host through the RS-232C Serial Interface at 9600 bps, 8-N-1. Signal Function +5 V power supply for the reader (max. 200 mA; normal 100 mA) The signal from the reader to the host...
Loop inductance is approximately 1.6 µH – 2.5 µH. • Operating distance for a different tag is approximately up to 50 mm (depends on the tag). • Only one tag can be accessed at a time. Page 6 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
SAM and peripherals The contactless interface and peripherals are accessed through the use of pseudo-APDUs. The SAM interface is accessed through the use of standard APDUs. Figure 1: ACR122S Communication Flowchart Page 7 of 57 ACR122S – Communication Protocol info@acs.com.hk...
4.0. Serial Interface (CCID-like Frame Format) Note: Communication setting: 9600 bps, 8-N-1. The communication protocol between the host and ACR122S is very similar to the CCID protocol. Command Frame Format APDU Command or STX (02h) Bulk-OUT Header Checksum ETX (03h)
02 62 00 00 00 00 00 01 01 00 00 1. HOST sends a frame [Checksum] 03 2. RDR sends back a positive status frame 02 00 00 03 (positive status frame) immediately Page 9 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
Page 10
The NAK Frame is only used by the HOST to get the last response. {02 00 00 00 00 00 00 00 00 00 00 00 03} // 11 zeros Page 10 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk...
RDR_to_HOST_DataBlock Format Offset Field Size Value Description Indicates that a data block is bMessageType being sent from the ACR122S. dwLength Size of abData field (N Bytes). <LSB .. MSB> Identifies the slot number for Same as Bulk-OUT bSlot this command.
RDR_to_HOST_DataBlock Format Offset Field Size Value Description Indicates that a data block is bMessageType being sent from the ACR122S. dwLength Size of abData field (0 Byte). <LSB .. MSB> Identifies the slot number for this Same as Bulk-OUT bSlot command.
10 Bytes N Bytes (ATR) 1 Byte 1 Byte RDR_to_HOST_DataBlock Format Offset Field Size Value Description Indicates that a data block is bMessageType being sent from the ACR122S. Page 13 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
Page 14
-> 02 80 0A 00 00 00 00 03 00 00 00 E3 51 B0 FC 88 AA 2D 18 90 00 [Checksum] 03 Response = E3 51 B0 FC 88 AA 2D 18; SW1 SW2 = 90 00 Page 14 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk...
6.0. Pseudo-APDUs for contactless interface and peripherals control ACR122S comes with two primitive commands for this purpose. <Class FFh> 6.1. Direct Transmit This command is used to send a pseudo-APDU (Tag Commands), and returns the length of the Response Data.
Page 16
InnoVision Jewel tag. This field is not used. Data Out Tag Response returned by the reader. Direct Transmit Response Format Response Data Out D5 41 Status [DataIn[]] Result SW1 SW2 D5 4B NbTg [TargetData1[]] [TargetData2[]] Page 16 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
Page 17
SW1 SW2. Status Code returned by the reader. Results Meaning Success The operation is completed successfully. Error The operation is failed. Time Out Error The TAG does not response. Page 17 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
The APDU Command should be “FF 00 00 00 09 D4 4A 01 01 00 FF FF 01 00” In which, Direct Transmit APDU = “FF 00 00 00” Length of the Tag Command = “09” Tag Command (InListPassiveTarget 212Kbps) = “D4 4A 01 01” Page 18 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
Page 19
FF 00 00 00 21 D4 40 01 20 08 01 01 05 01 86 04 02 02 01 09 01 01 80 00 00 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA [Checksum] 03 Page 19 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
Page 20
“D5 41 00 1D 07 01 01 05 01 86 04 02 02 00 00 01 00 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 90 00” Page 20 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk...
Page 21
The USER APDU Command should be “00 84 00 00 08” The Composed APDU Command should be “FF 00 00 00 08 D4 40 01 00 84 00 00 08” Page 21 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk...
Get Firmware Version Response Format (10 Bytes) Response Data Out Result Firmware Version Example: Response = 41 43 52 31 32 32 53 31 30 30 (Hex) = ACR122S100 (ASCII) Page 22 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
01h = The buzzer will turn on during the T1 Duration. 02h = The buzzer will turn on during the T2 Duration. 03h = The buzzer will turn on during the T1 and T2 Duration. Page 23 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
Page 24
Response = “90 03”. RED and Green LEDs are ON, To turn off both RED and Green LEDs, APDU = “FF 00 40 0C 04 00 00 00 00” Page 24 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
Page 25
1 Hz = 1000 ms Time Interval = 500 ms ON + 500 ms OFF T1 Duration = 2000 ms = 14h T2 Duration = 0 ms = 00h Number of repetition = 01h Link to Buzzer = 01h Page 25 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
Page 26
// Assume both the Red and Green LEDs are initially OFF. // // Both Initial Red and Green Blinking States are ON // // The buzzer will turn on during both the T1 and T2 duration// Page 26 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
Page 27
// Assume both Red and Green LEDs are initially OFF. // // The Initial Red Blinking State is ON; The Initial Green Blinking States is OFF // // The buzzer will turn on during the T1 duration// Page 27 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
APDU = “FF 00 40 D0 04 05 05 03 01” Response = “90 00” 6.5. Topaz512 and Jewel96 Note: This section only applies to ACR122S with firmware version 1.03. This command is used to Write-with-erase (8 Bytes), Write-no-erase (8 Bytes), Read (8 Bytes) and Read Segment.
Page 29
D5 09 05 01 23 45 67 89 AB CD EF 90 00 [Checksum] 03 The APDU Response is “D5 09 05 01 23 45 67 89 AB CD EF 90 00” Page 29 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
Page 30
Response returned by the contactless chip = “D5 09 05 FF FF FF FF FF FF FF FF 90 00” Write Tag Address = “05” Write Tag 8Bytes Data = “FF FF FF FF FF FF FF FF” Status Code returned by the reader = “90 00” Page 30 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
Page 31
The APDU Command should be “FF 00 00 00 0D D4 40 01 10 00 00 00 00 00 00 00 00 00” In which, Direct Transmit APDU = “FF 00 00 00” Page 31 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47” Status Code returned by the reader = “90 00” If Status Code returned by the reader = “63 00” that mean this operation is not complete. Page 34 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
Step 3. Transfer the prior calculated value of Block HOST -> 02 6F 0A 00 00 00 00 01 00 00 00 HOST -> FF 00 00 00 05 D4 40 [Checksum] 03 Page 39 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
Page 40
101 (dec). The Adr “05 FA 05 FA” tells us the value is copied from Block 05. Note: Please refer to the Mifare specification for more detailed information. Page 40 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
Note: Once the authentication is done, all the data blocks of the same sector are free to access. For example, once the data block 04h is successfully authenticated (Sector 1), the data blocks 04h ~ 07h are free to access. Page 41 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 Note: 4 consecutive Pages will be retrieved. Pages 4, 5, 6 and 7 will be retrieved. Each data page consists of 4 bytes. Page 42 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
Page 43
-> 02 80 05 00 00 00 00 01 01 00 00 -> D5 45 [00] 90 00 [Checksum] 03 Note: Please refer to the Mifare Ultralight specification for more detailed information. Page 43 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
ISO/IEC 14443-3B only: the ID of the card does not match, meaning that the expected card has been exchanged with another one. ISO/IEC 14443-3B only: the card previously activated has disappeared. Page 56 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
Page 57
Error Code Error Mismatch between the NFCID3 initiator and the NFCID3 target in DEP 212/424 kbps passive. An over-current event has been detected. NAD missing in DEP frame. Page 57 of 57 ACR122S – Communication Protocol info@acs.com.hk www.acs.com.hk Version 2.01...
Need help?
Do you have a question about the ACR122S and is the answer not in the manual?
Questions and answers