Home

RFID COMMANDS MANUAL

1. Length Status DATA CUSTEM response length 00 communication interrupted 01 bad CRC 02 success 03 bad parameters data read Length 1 byte Commands Manual 127 HF ASK commands 06 36 Devices Name Description CLASS ADD all printer models with ASK module WRITE SR Family Write and verify bytes at a given address This function handles the chip regardless the blocks organization DATA IN Om ss awo w omo Address of the first writing 2 bytes LSB MSB SR176 0 to 31 00 00 to 1F 00 SR512 family O to 63 00 00 to 3F 00 or 1020 to 1023 FC 03 to FF 03 SR4K family O to 511 00 00 to FF 01 or 1020 to 1023 FC 03 to FF 03 Note ADD must be multiple of block size Number of bytes to write SR176 1 to 32 01 to 20 SR512 family 1 to 64 01 to 40 SR4K family 1 to 240 01 to FO Note NB must be multiple of block size Data to write NB bytes CLASS INS DATAQUT 06 Length Status 36 Length Status DATA x response length 00 communication interrupted 01 bad CRC 02 success 03 bad parameters 8x Security activated i e data written data read 82 Security activated good CRC data read back Length 1 byte 128 Commands Manual CUST 2M HF ASK commands 3 7 10 MIFARE Class N 10 The MIFARE Class is based on the 14443 type A contactless protocol it allows communicating and managing
2. 00 07 Devices all printer models with ASK module Name Write Config Eeprom Description Writes in the EEPROM configuration CLASS INS DATAIN 00 Index 01 02 03 04 05 07 Index Value Value serial RS232 TTL RS485 baud rate divider 1382400 BAUDRATE Not relevant for GEN5xx kept for compatibility with other products Not relevant for GEN5xx kept for compatibility with other products Value default SAM Number Field off CTx turn on the field before CTx command and turn off the field during Value 1 ms after CTx command 0x00 and OxFF disable field management on CTx 06 Auto Led management enabled if Value 1 Leds are managed by firmware red power on orange field on green reader card communication 07 08 09 0A 0B 0C 0D 0E 10 11 12 13 14 15 16 17 Not significant on GEN5xx Host communication frame padding module 62 byte padding if Value 62 15014443 4 number of retries Delay between retries ms default RX RF speed at reset 00 106 01 212 02 424 03 847 kb s default RX RF speed at reset 00 106 01 212 02 424 03 847 kb s SAM reset at coupler reset O no reset AUX Pin signal 0F High baud rate 15014443 A gain 00 20 01 24 02 31 03 35 dB Last Slot switch test 1 yes CAM other no SAM Strict 150 14443 3B timeout 1 strict check other no strict check same as GEN3XX Strict 150
3. Transfer into the memory of the TAG the DATA d0 dn of length n CRC 1 CRC 0 After the sequence of the datas 2 bytes of CRC are on CRC not disable tO t1 show the high word of the dubleword value of received timeout t2 t3 shows the low word of the dubleword value of received timeout d0 dn indicate the data to transmit Return Status d0 dl bytes number of the data to receive d dl data received Commands Manual 15 HF CUSTOM commands 1F 61 Devices Name Format Description Notes Default Reference Example 1F 62 Devices Name Format Description Notes Default Reference Example 16 Commands Manual all printer models with RFID reader writer Mifare Anticollision Mf1K Mf4K MfUL ASCII US S Hex 1F 61 Decimal 31 97 Return Status 4 bytes contained the UID all printer models with RFID reader writer Mifare Authentication keys EEPROM Mf1K Mf4K ASCII US b t sS u0 u3 b Hex 1F 62 t s u0 u3 b Decimal 31 98 t s u0 u3 b Authentication with t type key contained in the sector s of the EEPROM of PCD b block of TAG with UID u0 u3 t Type of key t 41 Authentication with A type key t 42 Authentication with B type key 0 lt s lt 15 number of sector containing the key used for authentication O lt b lt 63 number of block to authenticate u0 u3 4 bytes containing the UID of TAG to authenticate Return s
4. o Length Length 1 byte 01 for this command Type 1 byte 0D type of the command to know information about the chip Returned response CLASS INS DATAOUT AAA ee ss Length ID chip Chip Version 4 bytes 1 byte Length 1 byte 06 for this Response Status 1 byte idem previous Status ID chip 4 bytes on GEN5XX it should be the fixed value 0x80 0x80 0x80 0x80 Chip version 1 byte on GEN5XX it should be the fixed value 0x80 136 Commands Manual CUST 2M HF ASK commands 1 WRITE Internal Register Length Type Register Address Value 1 byte 1 byte Length 1 byte 03 for this command Type 1 byte 0E type of the command to write new value at the specified register address Register Address 1 byte specified register address Value 1 byte new value to write Returned response Length Status Length 1 byte 01 for this Response Status 1 byte idem previous Status 0F Chip WRITE Error J READ Internal Register DATA IN Length Type Register Address 1 byte Length 1 byte 02 for this command Type 1 byte 0F type of the command to read value at the specified register address Register Address 1 byte specified register address Returned response DATA OUT OOOO Length Status Value Length 1 byte 02 for this Response Status 1 byte idem previous Status 12 Chip READ Error Value 1 byte data read in the register K Load Speed RF limitation CLASS INS
5. o ACCES 00 ACCES access mode 00 other RFU values SID SID SID 00 for usually selected EF NREC recording number LNG length of data to read CLASS INS DATAOUT s2 s meND s DATA REND execution report DATA data read n bytes CUST 2M Commands Manual 63 HF ASK commands 02 02 Devices all printer models with ASK module Name CHANGE PIN GTML Description Records PIN value contained in the MF A SelectFile of the MF should be carried out before being able to change the PIN This command can t be used during a session CLASS INS DATAIN 02 soz 04 RFU 1 OLDPIN 4 _ NEWPIN 4 RFU For future use OLDPIN old PIN NEWPIN new PIN CLASS INS DATAOUT s2 soz REND 5 REND execution report 02 0B Devices all printer models with ASK module Name VERIFY PIN GTML Description Presentation of PIN with counting of number of incorrect presentations A SelectFile of the MF should be carried out before being able to check PIN CLASS INS DATAIN 08 MODE 00 consultation of counter of incorrect presentations 01 presentation of PIN 02 presentation of PIN in transparent mode for contact communication PIN PIN 4 bytes CLASS INS _ DATAOUT so s RED REND execution report 64 Commands Manual CUSTE2M HF ASK commands 02 03 Devices all printer models with ASK module Name DECREASE GTML Description Decreases the value contained in a counter fil
6. CMD Type of Command LOCK 00 UNLOCK 01 CLASS INS DATAOUT sos 16 REND S REND execution report CUST 2M Commands Manual 105 HF ASK commands 05 0D Devices all printer models with ASK module Name PURCHASE Description Purchase with PME Remark maintained for compatibility with the CD97 CLASS INS DATAIN 05 0D ACHAT 1 JPAID AFF 6 ACHAT Type of purchase 00 purchase transaction 01 purchase transaction with display according to type of purchase JPAID 7 1st bytes of new recording in payments journal Amount Date Time Equipment Type NB the Amount field 2 bytes has to be specified in negative value e If extended purchase transaction with display AFF 6 bytes of display cf display file CLASS INS DATAOUT sos son REND REND execution report Remark in an uninitialized card note that you must do First a Null Purchase Ex 05 OE 01 0B 00 05 OD 00 00 00 00 00 00 00 02 See CD97 specification 106 Commands Manual CUST 2M HF ASK commands 05 0E Devices all printer models with ASK module Name GET ELECTRONIC PURSE STATUS Description Informs on PME status and prepares purchase or loading or a purchase cancellation Remark maintained for compatibility with the CD97 CLASS C Ns DATAIN 0E TYPE 1 NKEY 7 RUF 1 TYPE type of transaction to do 00 loading transaction 01 purchase transaction 02 purchase cancellation NKEY Key Numbe
7. E 0x2CA5 0x3D2C 0x4993 0x581A 0x6A81 0x7B08 0x7470 0x65F9 0x5762 0x46EB E9B1 0xDB2A 0xCAA3 0xBE1C 0xAF 95 0x9D0E 0x8C87 E OxE8B9 0xF930 0xCBAB 0xDA22 OxAE9D 0xBF14 0x8D8F 0x9C06 0x5572 0x44FB 0x7660 0x67E9 0x1356 0x02DF 0x3044 0x21CD 0xD93A 0xC8B3 0xFA28 0xEBA1 0x9F1E 0x8E97 0xBC0C 0xAD85 0x45F3 0x547A 0x66E1 0x7768 0x03D7 0x125 0x3674 0x27FD 0x1566 0x04 E 0x20C5 0x314C 0xC9BB 0xD832 0x 0xFC18 0xED91 0xDFOA 0xCE83 0x26F5 0x377C 0x05E7 0x146 OxAABD 0xBB34 0x89AF 0x9826 0xEC99 0xFD10 0xCF8B 0xDE02 0x1776 0x06FF 0x3464 0x25ED 0x5152 0x40DB 0x7240 0x63C9 0x9B3 0x07F7 0x167 E 0x24 OxCD9B 0xDC12 OXEF 89 0xFF0O0 3 2 5 1 CRC format EAA9 0xFB20 0x8F9F 0x9E16 0xAC8D 0xBD04 EF 0x7050 0x61D9 0x5342 0x42CB 0xBA3C 0xABB5 0x992E 0x88A7 E 0x60D1 0x7158 0x43C3 0x524A E Ox8AB7 0xB82C 0xA9A5 OxDD1A 0xCC93 0xFE08 0xEF81 E5 0x356C 0x41D3 0x505A 0x62C1 0x7348 0x8BBF 0x9A36 0xA8AD 0xB924 The frames only have a CRC if they are not reduced to a single byte pure command The first byte after the End of frame byte is the lower part of CRC LSB The last byte in the frame is the upper part of the CRC MSB 28 Commands Manual CUST M HF ASK commands 3 2 6 Frame length Normal mode EXT bit 0 in CMD or STA byte The maximum number of bytes transmitted w
8. FE error detected by communication controller FD reception buffer overflow FC timeout delay expired before end of reception FB CRC error length of DATA data made up of Length of the response from the card 1 The response from the card 48 Commands Manual CUSTE2M HF ASK commands 01 22 Devices all printer models with ASK module Name Send to antenna extended Description Sends the data to the chosen transparent mode either ISOA ISOB cards understanding class 5 commands and MV5000 cass ms oman JO n 2 LNGLOW 1 LNGHIGH 1 DATA 9 LNG LOW and LNG HIGH length of DATA LNG LOW 256 LNG HIGH DATA The frame to transmit to the card CLASS INS DATAOUT 12 STATUS 1 LNG LOW 1 LNG HIGH 1 DATA x STATUS communication status 01 data received 00 resp 03 no data received in timeout delay in Innovatron or ISOA protocol resp ISOB protocol 06 invalid CID 08 ICC fails to answer correctly FF data coding error FE error detected by communication controller FD reception buffer overflow FC timeout delay expired before end of reception FB CRC error LNG LOW and LNG HIGH length of DATA LNG LOW 256 LNG HIGH DATA the response from the card CUST 2M Commands Manual 49 HF ASK commands 01 13 Devices all printer models with ASK module Name Reset SAM Description Executes hardware initialization of a security module Re
9. KIF 1 KVC 1 ACCES access mode SID SID SID 00 for usually selected EF NREC recording number LNG length of data to read LID LID used in STAMPED mode NKEY KIF SAM key number to use or KIF of the Key used in STAMPED mode 00 KVC 00 if NKEY passed in the previous parameter or KVC of the Key used in STAMPED mode CLASS INS _ DATAOUT sos so mEmD baa CS REND execution report DATA data read n bytes 98 Commands Manual CUSTE2M HF ASK commands 05 08 Devices all printer models with ASK module Name SELECT FILE Description Description Explicit selection of current EF or DF This command sends back the file description data CLASS INS DATAIN 05 08 CNTR 1 LNG 1 PATH x CNTR Selection check 00 MF 02 EF in the current DF identifier bytes 2 to n 08 bytes 1 to n path from MF excluded LNG length of identifier or of path PATH identifier or path NB The command 05 08 00 00 is not supported by CD97 card CLASS INS __ DATAOUT o5 08 REND 3 FCI x REND execution report FCI FCI 05 09 Devices all printer models with ASK module Name STATUS Description ditto SELECT FILE but without selecting a file not available on any card GLASS ms DATAN 09 CNTR Selection check 00 MF 02 EF in the current DF identifier bytes 2 to n 08 bytes 1 to n path from MF excluded LNG length of identifier or of path PATH ide
10. Ox0X no PIN presentation error 0x1X one PIN presentation error 0x3X two PIN presentation error 0x7X PIN blocked Remark 1 For detection of several 15014443 cards if multi detection is activated for the ISO card the card response are appended several times in the response data field Remark 2 For each new detection of ISO A or B by the EnterHuntPhase commands the data for cards previously found are lost so it is not possible to communicate with both type A and type B cards in the same time Remark 3 By default the EnterHuntPhase command sends WAKE UP requests So if multi detection is wished the selection of the REQ request must be previously done thanks to the 01_17_SetEHPparameters Remark 4 In case of short EnterHuntPhase mode 0 if a ticket or a card in protocol ISOB INNOVATRON or Con tact Mode has been found once it could not be seen a second time just after having been found because the reader memorizes the serial number as if the byte forget in the long EnterhuntPhase had been set to 0 If the user wants to see the card again the forgetting of the serial number must be forced thanks to the 01_0E command Note Recognition of the type of card or ticket e g GTML or CD97 is the responsibility of application which then sends the commands to the card according to the appropriate class GEN5XX accepts GEN4XX and GEN3XX format of commands to maintain compatibility 44 Commands Manual CUSTE2M HF ASK commands
11. REND execution report RESULT result of incoming outgoing orders during the session The format is as follows 1 byte function number following bytes same format as for a function execution outside session apart from report 3 first bytes 03 12 Devices all printer models with ASK module Name CLOSE SECURED SESSION CD97 Description Closure of certification session CLASS INS DATAIN No associated input data CLASS INS _ DATAOUT s2 REND execution report v8 m Z U 90 Commands Manual CUST M HF ASK commands 03 15 Devices all printer models with ASK module Name SELECT ISO APPLICATION Description Select application using Select File ISO command CLASS DATA IN 03 15 SelectOption i LNG 1 Select Option 00 first application or select by name if LNG lt gt 0 01 select last application LNG should be 0 02 select next application LNG should be 0 03 select previoust application LNG should be 0 LNG length of data 0 if Select Option lt gt 0 otherwise lt 16 DATA application name LNG bytes CLASS INS DATAOUT sos s2 Rewo Fao REND execution report FCI FCI CUSTE2M Commands Manual 91 HF ASK commands 3 7 5 Certificate Class N 04 04 04 Devices all printer models with ASK module Name CheckCertificate CTx Description Certificate check CLASS INS DATAIN KeyType Param LNG BUFFER x NB Certificate x KeyType
12. Read CTS loba Read command success saiia Data read 55 44 77 77 LKILLLLLLLLLLLLLLLL LLL LLL E gt gt gt gt gt gt A AA AAA gt gt gt Message 80 08 06 03 Oa 02 aa bb 55 44 00 95 a7 Description Type command Sens Host gt CSC incida Command Update CTS sabaoweenss NB 0a sacada Data read cc cc cc cc cc cc CC CC CC CC Timing 0 s 25 ms Response 01 06 06 03 03 02 aa bb 00 16 03 Description Type command Sens CSC gt Host pinar Function class class CTS Lisa Response Update CTS cdi Update command success T Data read aa bb lt lt lt ccc SC SCC LI CUST 2M Commands Manual 181 HF ASK commands Message 80 04 06 02 0a 04 00 35 Oc Description Type command Sens Host gt CSC sachets Command Read CTS aagi NB 04 Fenu Timing 0 s 20 ms Response 01 08 06 02 05 02 aa bb 77 77 00 73 7a Description Type command Sens CSC gt Host PE Function class class CTS ias Response Read CTS cedo Read command success dani Data read aa bb 77 77 lt lt lt cc SS SCC E AAA A AAA AAA gt gt gt gt gt gt AAA AAA AAA AA gt gt 3 8 2 Variable class mapping for GTML card class 5 function APPEND_RECORD command in session mode cial CSC found reset ASK CSC Message 80 02 01 01 00 50 3f Description Type command Sens Host gt CSC Paananen Function class system class PEE Command CSC version ee Timing 0s 15 ms Response 014101 01 43 53 43 20 30 32 2e 30 38 20 3c 70 6
13. 01 04 Devices all printer models with ASK module Name End Tag Communication Description Ends communication with the badge or the ticket in ISO and Innovatron protocols and allows configuring the end of the transaction with the card CLASS INS DATAIN so DNX 1 DNX This byte is bit mapped BitO xxxx xxx0 does not send disconnection order but deselects the CIDs in ISO protocol BitO xxxx xxx1 sends disconnection order And for the Innovatron protocol more options are available Bit1 xxxx xx1x keeps the field ON during 60 ms after having sent or not the disconnection order Bit2 xxxx x1xx switches OFF the field during 10ms and then switches it ON properly Bit3 xxxx 1xxx forgets the last card found Bits7 4 are Reserved for Future Use In Innovatron protocol if all the options are selected their associated functionalities will be performed in the same order as the parametered bits from bit 0 to bit 7 Thus if the user sends 01 04 OF the coupler will Send a disconnection order Wait for 60 ms after having received the acknowledgement of the disconnection order Switches off the field Switches on the field Erases the Serial Number of the last card treated CLASS INS DATAQUT sor s ACK 00 disconnection acquitted 01 disconnection not acquitted or input byte 00 CUST 2M Commands Manual 45 HF ASK commands 01 05 Devices all printer models with ASK module Name Get Commu
14. 2 bytes Serial number in 4 bytes In mode 0 short EnterHuntPhase Manufacturer code Product code 2 bytes Embedder code Application code 2 bytes Serial number in reverse order 4 bytes System and Invalidation bits 2 bytes SRI recognized Status 1 byte 00 communication interrupted 01 bad CRC 0F success 80 collision Chip type 1 byte 00 SR176 01 SR512 02 SR4K UID 64 bit 8 byte UID from LSB to MSB UIDO UID1 UID7 e 1507816 Contact mode answer to reset whose length depends on the different kinds of cards Motorola cards MV5000 cards The DAD byte 1 Byte The PUPI 4 Bytes Length of the Historical bytes 1 Byte 0x04 Historical bytes Length of the Serial Number 1 Byte 0x18 The Serial Number CUST 2M Commands Manual 43 HF ASK commands e FELICA protocol Answer to Req Felica data composed of The response code 1 byte 0x01 The IDm number 8 bytes Card Unique Manufacture IDs The PMm numver 8 bytes Manufacture Parameters IC Code 2 bytes Request Service Command 1 Byte Request Response Search Service Code Request System Code Commands 1 Byte RFU 1 Byte Read Without Encryption Command 1 Byte Write Without Encryption Command 1 Byte RFU 1 Byte The System code 2 bytes when required The status words gt 0x90 XX where XX is the MF status OxX0 card is valid 0xX1 card is invalided
15. CUST 2M Commands Manual 201 UHF RFID commands 4 2 2 Command codes 12 Devices RawReadIDs Parameters Note 13 Devices NewRawReadIDs Parameters Note 6E Devices ReadTagData Parameters all printer models with UHF module permits to get all the tag s Ids that are under the RF field of the selected source Deprecated SourceNameln SourceNameOut ReadPointName TimeStamp TaglDLen ListOfIDs ResultCode in the name of the source to use out the name of the source used out the name of the readpoint out the time at which the tags are detected out the ID length of the tags detected out the list of lds detected from the source out the result code out parameters are repeated for each readpoint in the source all printer models with UHF module permits to get all the tag s Ids that are under the RF field of the selected source SourceNameln Length TagID TagAddress in the name of the source to use optional in Filter Mask Lenght optional in the Filter Mask Value optional in Filter Mask Start Address optional For each tag detected the parameters returned by the command are SourceNameOut ReadPointName TimeStamp TagType TaglDLen TagID ResultCode out the name of the source used out the name of the readpoint out the time at which the tags are detected out the tag s type out the ID length of the ta
16. Description This function selects an application in the SAM CLASS INS DATAIN DFAID 3Bytes Directory File AID Returned response format CLASS INS DATAOUT 233 Length Status Length 1 byte Response length 0x02 Status 2 bytes See List of response code 170 Commands Manual CUST 2M HF ASK commands 11 24 Devices all printer models with ASK module Name SAM Load Init Vector DESFIRE Description This function load an init vector in the SAM for 3DES seeding CLASS INS DATAIN 24 Init Vector InitVector 8 bytes crypto seed Returned response format CLASS INS DATAOUT sa lenm status Length 1 byte Response length 0x02 Status 2 bytes See List of response code 11 25 Devices all printer models with ASK module Name SAM Get Key Entry DESFIRE Description This function returns the key entry info CLASS INS DATAIN sm s keynum Key Num 1Byte number of the key entry to be returned Returned response format CLASS INS DATAOUT s Length Staus KeyEny Length 1 byte Response length 05 for successful operation Status 2 bytes See List of response code Key Entry 3 bytes 3 key versions CUSTEM Commands Manual 171 HF ASK commands 11 26 Devices all printer models with ASK module Name SAM Get Kuc Entry DESFIRE Description This function returns the Kuc info CLASS INS DATAIN RefNumKuc 1 byte key usage counter ent
17. MI_INITERR ososan 25 MI_COMM_ABORT sscssssessssessseesseesseese 120 MI_INTERFACEERR csssessssessseesssesesseeeee 26 MI_INVALID_BASE scsssseessseesssessseteseeeeee 121 MI_ACCESSTIMEOUT ccsscessseessseessseeeee 27 MI_MFRC_RESET sscssssesssseesssesssseesseeeen 122 MI_NOBITWISEANTICOLL c scesssecssseeeee 28 MI_WRONG_VALUE sesssesssseesssesssstesseeeee 123 WO ane re ree 30 MI_VALERR uste 124 MI_CODINGERR v sscssssessssessssessssessseesseeeee 31 22 Commands Manual CUST 2M HF ASK commands 3 HF ASK COMMANDS Introduction The GEN5XX family of coupler is compliant with ISO 14443 A B and Felica ISO 18092 norms It can handle all exist ing cards in the ASK range CD97 GTML CT2000 Mifare contactless tickets CTS CTM ePassport and elD and all ISO 14443 4 A B and FELICA compliant cards and tickets see below for full list of supported cards The NFC items Card and Cell phones for example are also supported but only in passive mode It supports 3 types of modulation specified by the norms 15014443 A and B and Felica and is able to support the 150 14443 3 and 4 communication protocols This coupler is made up of a software module also called CSC which handles both low layers of the card communi cation contact and contactless and security layer by way of a contact security Application Module SAM as well as a global application layer dealing with successions of c
18. Name SENDNXP MIFAREO Description Manage the Mifare Chip Theses functions are available but shouldn t be used without a very good knowledge of the Nxp chip family gt Maintenance Functions Details Indicate the command performed on the RF head chip at Initialization level CLASS INS _ DATAIN so Length TYPE Length 1 byte 01 for the following commands TYPE 1 byte 00 Initialize the chip performed automatically at CSC reset 01 Disable chips Needed only to turn power down on chip 02 Load of the default configuration in EEPROM Should only be used at manufacturing level 03 Reset the Chip The default ASK configuration is set Returned response CLASS INS DATAOUT son lengh Status Length 1 byte 01 for this command Status 1 byte 00 Chip detected and correct operation 07 Chip not detected 09 Chip EEPROM Error B Get Key from storage area to Internal RAM Buffer on GEN5XX keys are not remaining after a reset or power down of the coupler C mns DATAN 0 Length TYPE KEY Index CLASS Length 1 byte 02 for this command TYPE 1 byte 04 type for the command that get Key from storage area Load Key KEYIndex from storage area by its index in the internal buffer for the next cryptographic operation KEY Index 1 byte value from 00 to 1F index of one of the 32 keys Returned response CLASS INS DATAOUT son lengh Staus Length 1 byte 01 for this response
19. Zz o lt D Never Key and access Operation on trailer block Key A Access Bits Key B Read Write Read Write Read Write C1 C2 C3 Remark KeyB can t authenticate Never Never Never Key A Never KeyB can t authenticate Never Key B Key A B Never Never Never Never Key A Never Never Never Key A B Never Key A Key A Key A Key B Key A Key B Never Never Key A Key B Never Key A B Never Never KeyB can t authenticate All zx A ollo D lt lt lt lt wl gt w Never Never Never ALi Ww Never Never Never 132 Commands Manual CUST 2M HF ASK commands 3 7 10 5 List of Error Codes Decimal Hexadecimal Code Description Value VEIG MF CRCERA ME EMPTY ME SERNAERA MF EEPROMERA MF IDLE ME TRANSERA MF POLLING MF ACCESSERA MF RESETERR MF COMM_ABORT MF_CALLOPEN In Italic are the Error codes not implemented yet AJJ ojojoljo Oin o PA A ojo a sea ojo NIO salalaja e o o olo o o O w gt pojo E A o ii A Oo T ar ea alxiax ax3 a AJOJN o N N N AJAJAJA alxia ax3 a ofo x o O gt N Ww APlLAlLAlL ALA rn a WOIN Ojo am mfojojuo N o 6 B EJ o 2 13 23 24 25 26 27 28 29 30 31 32 eo 100 120 121 lt a NI te CUST 2M Commands Manual 133 HF ASK commands 3 7 10 6 Reader function 10 01 Devices all printer models with ASK module
20. amp Ox0E Error in programming the Flag in EEPROM before loading Ox0C Error in programming the Flag in EEPROM after loading 00 04 Devices all printer models with ASK module Name Change of default rate Description Changes the rate of a series link in RS232 RS485 TTL series default rate configured in factory at 115200 baud The new value will be taken into account at next reset of the coupler CLASS INS DATAIN DATA IN DATA IN RS232 1 RS485 1 TTL 1 RS232 baud rate divider on RS232 serial link Baud rate divider is 1382400 BAUDRATE RS485 baud rate divider on RS485 serial link Baud rate divider is 1382400 BAUDRATE TTL baud rate divider on TTL serial link Baud rate divider is 1382400 BAUDRATE CLASS INS DATAOUT 00 04 Status 1 STATUS 1 byte 0x00 Failure 0x01 Success 36 Commands Manual CUST M HF ASK commands 00 06 Devices all printer models with ASK module Name Write SAM Number Description Writes in the EEPROM the SAM Number to use by default This value will be useful for the initialization of the CSC when selecting the SAM to use at the beginning before the first trans actions CLASS INS DATAIN 00 505 Number Number number of the SAM to use by default Note if a value below 1 or above 4 is written the default SAM will be the SAM number 1 CLASS INS DATAOUT 00 06 STATUS 1 byte 0x00 Failure 0x01 Success CUSTE2M Commands Manual 37 HF ASK commands
21. key type or number Param type of algorithm LNG buffer length diversifier data BUFFER data to check minimum 12 bytes 8 bytes diversifier 4 bytes data NB Certificate length 2 or 4 bytes Certificate x Certificate read in the CTX CLASS INS DATAOUT sa sos Staus Dam DATA2 STATUS 0x00 bad certificate 0x02 good certificate 0x03 SAM error 0x04 No SAM answer DATA1 and DATA2 correspond to a SAM error code and are present only if the status is set to 0x03 04 05 Devices all printer models with ASK module Name giveCertificate CTX Description certificate generation CLASS INS DATAIN so sos Keytype Param LNG BUFFER x NB KeyType Key type or number Param type of algorithm LNG buffer length diversifier data BUFFER data minimum 12 bytes 8 bytes diversifier 4 bytes data NB Certificate length 2 or 4 bytes CLASS INS DATAOUT 04 04 Status Certificate x STATUS 0x00 bad certificate 0x02 good certificate Certificate x Certificate calculated 92 Commands Manual CUST 2M HF ASK commands 3 7 6 Variable Class Mapping N 05 Created to enable use with identical commands for cards with fixed mapping CD97 RJJ GTML GTML2 cards with variable mapping C97 RJL CT2000 3 7 6 1 Main functions The CSC Gen2xx coupler handled cards while taking into account a fixed structure of files case of function classes CD97 03 and GTML 02 using a mapping table of the posi
22. sio sor Length Status Code PiccSerialNumber 4 bytes SectorContent N Length 1 byte Response length 36 in case of successful operation Status 1 byte See List of response code Code 1 byte 08 means MIFARE STANDARD 1K Card and 18 MIFARE 4K Picc Serial Number 4 bytes Serial number of the card SectorContent 48 bytes for a MIFARE STANDARD 1K Card or 240 bytes for a MIFARE 4K Sector read in the card in the following order Block0 Block1 Block2 or Block15 for a MIFARE 4K NB For a MIFARE 4K Card if SectorNum gt 0x28 the read function will loop back at the beginning of the sectors of the card It is identical for the MIFARE STANDARD 1K except that the Sectors from 0x10 to 0x27 are prohibited 10 10 Devices all printer models with ASK module Name WriteSectorData MIFARE Description The aim of this function is to write the data blocks of a Sector of the PICC CLASS INS DATAIN 10 so Length KkeyPicc SectorNum KeyPCD DataToWrite Length 1 byte fixed value 33 for Mifare1K or F3 for Mifare4K KeyPICC 1 byte value 0A for KEYA or 0B for KEYB SectorNum 1 byte Sector Number of the sector to authenticate value 00 to 0F KeyPCD 1 byte Index of the PCD key value 00 to 1F for storage area keys FF internal buffer Key DataToWrite 48 or 240 bytes Data to write in the selected sector CLASS INS DATA OUT sio 10 Length Status Length 1 byt
23. sm se Length Stus Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code 11 17 Devices all printer models with ASK module Name Credit DESFIRE Credit a value on a value File Cms oman O O O oO S sir Fie CommMode Amount CLASS g D 0 O he r o 3 FilelD 1 byte This is the ID of the file for which the new File is to be credited CommMode 1 byte File communication mode Amount 4 bytes amount to be credited in the value file Returned response format CLASS INS DATAOUT 17 Length Status Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code 164 Commands Manual CUST 2M HF ASK commands 11 18 Devices all printer models with ASK module Name Debit DESFIREO Description Debit a value on a value File GLASS ms DATAN sm se rue CommMode amom FilelD 1 byte This is the ID of the file for which the new File is to be credited CommMode 1 byte File communication mode Amount 4 bytes amount to be credited in the value file Returned response format CLASS ms DATAOUT sm s8 Lenn sus Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code 11 19 Devices all printer models with ASK module Name Delete File DESFIRE Description Delete a File GLASS ms DATAIN ste FilelD File
24. the master key or even the PICC master key ID OF THE CURRENTLY SELECTED APPLICATION KEYNUM KEY USED FOR AUTHENTICATION Normal application key PtSi cation master key IN E EEN EE Not alowed EA PICO master Key If the PICC level is currently selected application ID is 0 KeyNum must be 0 If an application is currently selected application ID is not 0 the given KeyNum must be in the range from 0 to number of keys created with the application Returned response format CLASS INS _ DATAOUT 0B Length Status Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code 11 0C Devices all printer models with ASK module Name Change Key Settings DESFIRE Description This function changes the key settings information if possible CLASS INS DATAIN m 0C NewKeySetting NewKeySetting 1 byte specify the new master key settings either for the currently selected application or for the whole PICC depending whether an application is currently selected Application ID is non zero or the PICC level is selected application ID is 0 Returned response format CLASS INS _ DATAOUT m oc Length status Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code CUST M Commands Manual 159 HF ASK commands 11 0D Devices all printer models with ASK module Name Get Key Settings DESFIRE Descript
25. 06 2030 C Fichier l mentaire C de compteur 3 Ev nements sp ciaux A Fichier l mentaire sp cifique a l application 02 Identifiant court 1D 2040 Comportement 0002 Identifiant long Fid lit 1E 2050 5 Nombre d enregistrements CUST M HF ASK commands 4 Affichages 05 2F10 Multiusage 3100 Param tres confidentiels Param tres publics Compteur Journal Commands Manual 71 HF ASK commands Definitions common to class functions Access mode Value on 1 byte defining the authentication principles used to access data DEFAULT No local cryptogram for the function If a session is open it is the session security that is used Otherwise only data of which the attribute is ALWAYS will be ac cessible PROTECTED 01 Ground authentication of incoming data for the badge Immediate execution by the badge STAMPED Authentication of the badge of outgoing data for the badge Remark it is impossible to combine the mode protected or the mode stamped with the session mode Execution report Value on 3 bytes 1 general byte 2 bytes of details Title byte0 Bytes 1 2 detail Execution carried out 00 62 00 Command accepted execution conditional on good session outcome no error 90 00 Command accepted and executed Abnormal execution codes cf spec CD97 reporte
26. 2 anticollision algorithm see the EPC Gen2 specification for details Attribute value is 2 bytes long all printer models with UHF module a string indicating the model and the serial number of the reader all printer models with UHF module a value representing the RF regulation to use Attribute value is 2 bytes long and can assume the following values 0x00 ETSI EN 302 208 0x01 ETSI EN 300 220 0x02 FCC 0x03 Malaysia not all the value are supported by all the readers For the list of RF regulation supported by each reader please refer to the reader s user manual all printer models with UHF module a value representing the RF channel to use Attribute value is 2 bytes long and can assume values in the range 0 9 Channels are referred to the ETSI EN 302 208 regulation CUST M UHF RFID commands 7A Devices all printer models with UHF module RSSI a value representing the backscattered RF field strenght Attribute value is 2 bytes long 96 Devices all printer models with UHF module PowerSet a value representing the RF power emitted during the communication with tags Attribute value is 4 bytes long used to set a new current value FB Devices all printer models with UHF module SourceName a string representing the name of the data source Attribute value has a maximum length of 30 bytes and can assume the following values Source_0 Source_1 Source_2 Source_3
27. 6 bytes Length 1 byte 08 for this command Type 1 byte 06 type of the command to Load an internal Key in the chip PCDIndex 1 byte the PCDIndex parameter contains the Key Index from 0x00 to 0x1F Key value 6 bytes the Key is transmitted unencrypted on 6 bytes MSB First Returned response CLASS INS DATAOUT so Length status Length 1 byte 01 for this Response Status 1 byte idem previous Status CUSTE2M Commands Manual 135 HF ASK commands F Load Key into the Internal Buffer This function can be used before any operation which needs cryptographic work to specify the key to use CLASS INS DATAIN sio Lenn TYPE Key value 6 bytes Length 1 byte 07 for this command Type 1 byte 0B type of the command to Load a Key into the internal Buffer Key value 6 bytes the Key is transmitted unencrypted on 6 bytes MSB First CLASS INS DATAOUT sio teng Status Length 1 byte 01 for this Response Status 1 byte idem previous Status G SET Chip Proper Configuration CLASS INS _ DATAIN so o Length Type Mode Length 1 byte 02 for this command Type 1 byte 0C type of the command to set a proper configuration into the Chip Mode 1 byte 00 gt 15014443 B 01 gt 15014443 A 02 gt FELICA CLASS INS DATAQUT so so lengh Length 1 byte 01 for this Response Status 1 byte idem previous Status H Get Chip identification CLASS INS _ DATAIN sio
28. ASK module Name Get Value DESFIRE Description Get Value ins JOAN Psi sc FieD Commmode FilelD 1 byte This is the ID of the file for which the setting is to be Retrieve CommMode 1 byte File communication mode Returned response format GLASS ms oaraor sm sc Length Staus Amount Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code Amount 4 bytes Amount of the value returned 11 1D Devices all printer models with ASK module Name Limited Credit DESFIREO Description Limited Credit N B This command needs a commit_transaction to be validated GLASS ms oman s FieD CommMode Amount FilelD 1 byte This is the ID of the file for which the credit is to increase CommMode 1 byte File communication mode Amount 4 bytes Max Amount that can be added to the Values File value Returned response format GLASS ms parao gt os sb Length Status Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code CUST 2M Commands Manual 167 HF ASK commands 11 1E Devices all printer models with ASK module Name Read Data DESFIRE Description Read Data INS DATAN CommMode NbByteToRead 1 E FilelD CommMode FromOffset_ NbByteToRead FilelD 1 byte This is the ID of the file for which the setting is to be Retrieve CommMode 1 byte
29. CARD INTERFACE 3 4 1 Description Remark on the Contact Interface The Contact interface is a set of up to 5 slots which can be configured in the Innovatron SAM Speed protocol up to 423 750 bauds or the ISO 7816 Bauds some baud rates are not fully supported When the Contact interface is selected in the EnterHuntPhase parameters if a device is found in the fifth Slot it is considered as a contact card and it is used in the 1507816 protocol 3 4 2 Restriction The Limitation on the implementation of the 7816 protocol is as follow e Only 5 Volt interface restriction Type A or A amp B no support of Type B card VPP is not connected thus if such a card is inserted in the slot a warning will occurs in the status of the con nection e No clock suspends procedure implemented e Limitation to 4 levels of interface character in the ATR response interpretation e Specific Fixed Guard Time implementation TC 1 1 second e Transparent mode with automatic GetResponse implementation N B The T 1 protocol is not implemented yet in the current version 3 4 3 Status Description Returned Contact Status 0x00 Correct No Warning 0x82 Correct Warning TA1 value will not be taken into account because no PPS procedure is available 0x81 Correct Warning TB1 indicates that the Writing condition could not be met OxFO Bad Ack Answer OxF1 Bad SWISW2 Answer OxF3 Character Sending Error OxF4 Character Receiving Error OxF
30. DATAOUT so soa REDO REND execution report CUS T M Commands Manual 67 HF ASK commands 02 0C Devices all printer models with ASK module Name WRITE RECORD GTML Description Writing without deletion of a record given in a linear fixed structure EF or the most recent record ing of a circular file CLASS INS DATAIN 02 0C ACCES 00 SID 1 NREC 1 LNG 1 DATA x ACCES access mode 00 other RFU values SID SID SID 00 for usually selected EF NREC recording number 01 for a circular file LNG number of bytes to write n bytes size of a recording DATA data to record CLASS INS DATAOUT 00 REND execution report 02 10 Devices all printer models with ASK module Name OPEN SECURED SESSION GTML Description Opening of a certification session Returns the paths of the DF from the MF excluded of non ratified applications and the data read in the indicated recording and file CLASS INS DATAIN so wem som mrec TYPE Type of operation 00 personalization 01 reloading 02 validation SID SID SID 00 for usually selected EF NREC recording number to read 00 no recording to read 01 reading of a number 1 or unique recording CLASS INS DATAOUT 02 10 REND 3 NBAPP 1 PATH1 2 PATHn 2 DATA 29 REND execution report NBAPP 2 n where n is the number of non ratified applications PATH1 path of the first non ratified applicati
31. EF in the current DF identifier bytes 2 to n 08 bytes 1 to n path from MF excluded LNG length of identifier or of path PATH identifier or path CLASS INS DATAOUT sos soe REND 3 FCI REND execution report FCI FCl 03 0A Devices all printer models with ASK module Name UPDATE RECORD CD97 Description Deletion then writing of a record given in a linear fixed structure EF or the most recent recording of a circular file ERA CLASS ACCES access mode SID SID SID 00 for usually selected EF NREC recording number LNG number of bytes to write n bytes size of a recording DATA data to record CLASS INS _ DATAOUT sos soa REND 5 REND execution report 82 Commands Manual CUST 2M 03 0B Devices Name Description Data In HF ASK commands all printer models with ASK module VERIFY PIN CD97 Presentation of PIN with counting of number of incorrect presentations A SelectFile of the MF should be carried out before being able to check PIN This command can t be used during a session CLASS INS DATAIN Al 1 1 1 1 MODE PIN TYPE_CMD NKEY KIF 00 KVC NSAM Data Out 00 consultation of counter of number of incorrect presentations 01 presentation of PIN 02 presentation of PIN in transparent mode for contact communication PIN 4 bytes 00 short command compatibility with the former one 01 long command SAM key number to u
32. File communication mode FromOffset 2 bytes Offset in the File NbByteToRead 2 bytes Nb byte to read Returned response format CLASS INS DATAOUT ste Length Staus NbByteToRead Length 2 bytes Response length Status 2 bytes See List of response code NbByteRead 2 bytes Nb Bytes read Data NbByteRead bytes Data read in the File 11 1F Devices all printer models with ASK module Name Read Record DESFIRE Description Read Record CLASS INS DATAIN iF FilelD CommMode FromRecord NbRecordToRead FilelD 1 byte This is the ID of the file for which the setting is to be Retrieve CommMode 1 byte File communication mode FromRecord 2 bytes Record number from which Data are read NbRecordToRead 2 bytes Number of record to read RecordSize 2 bytes record size Returned response format GLASS ms DATA Our os s Length Status NbRecordRead Data Length 2 bytes Response length Status 2 bytes See List of response code NbRecordRead 2 bytes Nb Bytes read Data NbRecordRead Record Size bytes Data read in the File 168 Commands Manual CUST 2M HF ASK commands 11 20 Devices all printer models with ASK module Name Write Data DESFIRE Description Write Data DATA IN INS sm 20 FilelD CommMode Fromoffset NbByteToWrite FilelD 1 byte This is the ID of the file for which the setting is to be Retrieve CommMode 1 byte File communication mode
33. FromOffset 2 bytes Offset in the File NbByteToWrite 2 bytes Nb byte to write Data NbByteToWrite bytes Data to write CLASS ms DATA QUE sao engh Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code 11 21 Devices all printer models with ASK module Name Write Record DESFIRE Description Write Record CLASS INS DATAIN n se FieD CommMode FromOffset NbRecordTowrite Daia FilelD 1 byte This is the ID of the file for which the setting is to be Retrieve CommMode 1 byte File communication mode FromOffset 2 bytes Record number from which Data are written NbRecordToWrite 2 bytes Number of record to write Data NbRecordToWrite bytes Data To Write Returned response format CLASS INS DATAOUT Psat Length Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code CUST 2M Commands Manual 169 HF ASK commands 11 22 Devices all printer models with ASK module Name SAM Get Version DESFIREO Description This function returns the SAM firmware info CLASS INS DATAIN Returned response format CLASS INS DATAOUT sm 2 teng Staus SAM VERSION Length 1 byte Response length 20 for successful operation Status 2 bytes See List of response code SAM VERSION 30 Bytes see spec 11 23 Devices all printer models with ASK module Name SAM Select Application DESFIRE
34. KEYB SectorNum 1 byte Sector Number of the sector to authenticate value from 00 to 0F for a MIFARE STANDARD 1K Card and from 00 to 27 for a MIFARE 4K KeyPCD 1 byte Index of the PCD key value 00 to 1F for storage area keys FF internal buffer Key CLASS INS _ DATAOUT so sos Lengh Status Code Pico serial Number 4 bytes Length 1 byte Response length Status 1 byte See List of response code Code 1 byte 08 means MIFARE STANDARD 1K Card and 18 MIFARE 4K Picc Serial Number 4 bytes Serial number of the card 142 Commands Manual CUST 2M HF ASK commands 10 06 Devices all printer models with ASK module Name ReadBlock MIFAREO Description The aim of this function is to read an authenticated block the right key according with the one of the block to authenticate must be present in the internal buffer of the RF chip CLASS INS DATAIN 06 Length BlockNum Length 1 byte fixed value 01 BlockNum 1 byte authenticated Block Number to read value from 00 to 3F for a MIFARE STANDARD 1K Card and from 00 to FF for a MIFARE 4K mns Data our so s Length Status BlockContent 16 bytes Length 1 byte Response length Status 1 byte See List of response code BlockContent 16 bytes Block content read in the card Remark This command sends back the Type and the Serial Number of the card In case of bad Transmission Error Ox0C CUST 2M Commands M
35. Status 1 byte idem previous Status 134 Commands Manual CUSTE2M HF ASK commands C Dump Current Configuration CLASS INS DATAIN sw som Length Type Length 1 byte 01 for this command Type 1 byte 05 type of the command that Dump Current configuration of all the internal register of the chip This function is only useful for expertise of problem relating to the Chip CLASS INS DATAQUT son Lengn status 32REGContent 32 bytes Length 1 byte 21 in case of success for this Response Status 1 byte idem previous Status 32REGContent 32 bytes The content of the 32 first registers is returned D Get fake Serial Number CLASS INS ___ DATAIN sw son Length Type Length 1 byte 01 for this command Type 1 byte 09 type of the command that gives the fake Serial Number of the chip for compatibil ity Returned response CLASS INS _ DATAOUT so sm Jtengt status FakeSeriaiNumber 4 bytes Length Status 1 byte 05 in case of success for this Response 1 byte idem previous Status FakeSerialNumber 4 bytes for GEN5XX it should be a fixed value 0x80 0x80 0x80 0x80 E Load Internal Key Set This function can be used before an operation on a new sector Be careful The Byte order for the KeyValue is different than the one used in the ChangeKey Command N B Keys need to be reloaded after each powerup CLASS INS DATAIN Length Type PCDIndex Key value 1 byte
36. Write Without Encryption command A2 Incorrect Block The block number is not correctly specified in the command used for reading writing or Number issuing a card A3 Incorrect Service The order of services specified on the block list is incorrect Assignment A4 Incorrect Service The service type is incorrect making it impossible to register an area or service Type A5 Incorrect Access Implies one of the following error messages Do not attempt to create a child area below the area that does not allow creation of such areas Do not try to write using the read only service Do not write IDm twice in the same card Do not use Read or write Without Encryption commands for service requiring encryption Do not attempt to divide the card that has already been logically divided A6 Incorrect Service The service being accessed is non existent The service cannot be registered because the Code service code differs inside and outside the package A7 Incorrect Access The access mode setting in the block list is incorrect The key information cannot be changed Mode by using the Write Without Encryption command A8 Incorrect Record Number A record with a number larger than the service size is being ac cessed A9 Change System Failure The Change System Block command cannot be executed because the previous operation by a registration related command or Separate command is not completed successfully SAA Key Change Failure The key canno
37. a continuous wave for test purposes Attribute value is 2 bytes long and can assume the following vaules 0x00 Stop the wave generation Not 0x00 Start the wave generation Commands Manual 195 UHF RFID commands 60 Devices all printer models with UHF module BaudRate a value representing the baudrate setting of serial port Attribute value is 4 bytes long 61 Devices all printer models with UHF module DataBits a value representing the databits setting of serial port Attribute value is 4 bytes long 62 Devices all printer models with UHF module StopBits a value representing the stopbits setting of serial port Attribute value is 4 bytes long 63 Devices all printer models with UHF module Parity a value representing the parity setting of serial port Attribute value is 4 bytes long and can as sume the following values 0x00 No parity 0x01 Odd parity 0x02 Even parity 64 Devices all printer models with UHF module FlowCtrl a value representing the flow control setting of serial port Attribute value is 4 bytes long and can assume the following values 0x00 No flow control 0x01 Hardware flow control 0x02 Software flow control not yet implemented 196 Commands Manual CUST 2M UHF RFID commands 65 Devices all printer models with UHF module DateTime a value representing a date and time Attribute value has a maximum length of 30 bytes The data format is YYYY MM DD HH MM SS 66 Devic
38. all the previous bytes CRCL See Calculation of CRC CRCH This frame is sent by the reader in response to a command sent by the host All the bytes are sent one after the other without interruption The LNG value is the length of the DATA block in the frame The End of frame byte is a byte which means to the reader that the DATA block is finished and that the two follow ing blocks are the CRC 3 2 3 3 Description of pure commands CMD 1 byte See Detail of CMD and STS bytes It concerns commands reduced to CMD and whose bit 7 EXEC is at zero CMD STOP that is to say 02 CMD RST that is to say 01 Only this byte is sent by the host Remark the only command that may be interrupted by stop is Enter_HuntPhase 3 2 3 4 Description of responses to pure commands CMD 1 byte See Detail of CMD and STA bytes It concerns the response to a pure command this response is reduced to a single STA byte After a pure command CMD STOP STA ABORT that is to say 04 After a pure command CMD RST STA RES that is to say 10 26 Commands Manual CUST 2M HF ASK commands 3 2 4 Details of CMD and STA bytes 7 6 0 cmD exec ext stoP RES Note The bits are active at 1 and the unused bits must be fixed at 0 The bits EXEC STOP and RES are Exclusive Operation and may not be used simultaneously RES STOP EXEC EXT STA Reset Complete Initialization
39. block Number of Block 1 byte n Block List 2n bytes List of block to read Returned response CLASS INS DATAOUT 07 Eror Block data Error 1 byte See Error code List Block Data 16n bytes Data read 12 08 Devices all printer models with ASK module Name WRITE Secure FELICA ACCESS Description Used to write data to the card in block units using the service specified in the authentication process CLASS INS __ DATAIN 08 Number of Block List Block Data block Number of Block 1 byte n Block List 2n bytes List of block to Write Block Data 16n bytes block Data to write Returned response CLASS INS DATAOUT Error 1 byte See Error code List CUST 2M Commands Manual 179 HF ASK commands 3 8 USE EXAMPLES 3 8 1 Class CTS class 6 functions in order to do an UPDATE_CTS command EERE CSC found reset ASK CSC Message 80 02 06 01 00 55 b3 Description Type command Sens Host gt CSC TTET Command Active CTS ii Timing 0 s 20 ms Response 01 Oc 06 01 0a Of 50 02 00 93 96 67 00 00 00 2d Description Type command Sens CSC gt Host ray Function class class CTS da Response Active CTS id Ticket CTS active E lt EEEEEEEE ccc SSCS gt gt gt gt gt gt AAA AAA AAA AAA AAA AAA AA gt gt gt Message 80 04 06 02 02 02 00 27 9e Description Type command Sens Host gt CSC ina Command Read CTS eee NB 02 sara Timing 0 s 15 ms Response 01 06 06 02 03 02 00 10 00 c7 30 Descriptio
40. byte UID from LSB to MSB UIDO UID1 UID7 124 Commands Manual CUST M HF ASK commands 06 32 Devices all printer models with ASK module Name READ BLOCKS SR Family Description Read blocks CLASS INS DATAIN sos 32 Block NB BLOCK Fist block number to read SR176 0 to 15 00 to 0F SR512 family O to 15 00 to 0F or 255 FF SR4K family O to 127 00 to 7F or 255 FF NB Number of blocks to read SR176 1 to 16 01 to 10 SR512 family 1 to 16 01 to 10 SR4K family 1 to 60 01 to 3C Note SR176 has 2 byte blocks SR512 and SR4K families have 4 byte blocks CLASS INS DATAOUT o6 32 Length Status DATA x Length response length Status 00 communication interrupted 01 bad CRC 02 success 03 bad parameters DATA data read Length 1 byte CUST 2M Commands Manual 125 HF ASK commands 06 33 Devices all printer models with ASK module Name WRITE BLOCKS SR Family Description Write and verify blocks CLASS INS DATAIN sos 3 Block NB DATA x BLOCK First block number to write SR176 0 to 15 00 to 0F SR512 family O to 15 00 to 0F or 255 FF SR4K family O to 127 00 to 7F or 255 FF NB Number of blocks to write SR176 1 to 16 01 to 10 SR512 family 1 to 16 01 to 10 SR4K family 1 to 60 01 to 3C DATA Data to write NB bytes multiple of block size Note SR176 has 2 byte blocks SR
41. byte must be set to 0x00 KVC 0x00 Specifies the KVC if KIF has been specified before if not must be 0x00 CLASS INS DATAOUT 8 gt Length Status DATA x Length Status length Data length Status 00 No answer TimeOut 01 Unexpected failure 02 Success 03 Bad parameters 04 No current SAM 05 SAM not initialized 06 Bas Status SAM 07 Writing prohibited DATA present only to get the SAM status code back only when STATUS 06 CUST 2M Commands Manual 121 HF ASK commands 06 29 Devices all printer models with ASK module Name UPDATE_FIELD_ON CTx512B and MIFAREO ULTRALIGHT Description Deletes records then checks by reading the bytes written at ADD address If the Field off CTx configuration is active the field is turned on and a select is done before the command but is not turned off after the command only in CTx512b mode CLASS INS DATAIN 06 29 ByteNumber NB DATA Byte Number Address of 1st byte to record 0 63 NB Number of bytes to write from 1 to 64 DATA Data to be updates NB bytes CLASS INS DATAOUT s2 Lengh Status DATA O Length length of written and read data in bytes Status 00 No answer 01 Bad CRC 02 Success 03 Bad parameters 82 Security activated Note For the Mifare UltraLight if Status is different from 02 or 03 the card will come into the HALT state so you have to wake it up to perform other transactions DATA
42. data read after a successful write Length 1 byte 122 Commands Manual CUST 2M HF ASK commands 3 7 9 SR SRI SRT SRIX Class N 06 The SR SRI SRT SRIX are members of the range of ASK contactless tickets They come with different memory organizations The SRIX anti clone functionality is not handled by the firmware as it is France Telecom proprietary algorithm These tickets are intended for applications where active authentication of the ticket is not necessary for example ticket for immediate use etc 3 7 9 1 Memory organization SR176 SR512 family SR4K family SRI512 SRT512 SRI4K SRIX4K SRIX512 User EEPROM bits 176 512 4096 Mapping blocks bits 11x16 16 x 32 128 x 32 UID bits 64 64 64 This chips family is addressed by blocks of 2 bytes SR176 or 4 bytes SR512 and SR4K families The CSC firmware handles byte level as well as the native blocks organization CUST 2M Commands Manual 123 HF ASK commands 3 7 9 2 Set of instruction 06 31 Devices all printer models with ASK module Name ACTIVE SR Family Description Activate and select a SR SRI SRT or SRIX ticket and send back the chip type and the 64 bit UID CLASS INS o6 1 CLASS INS DATAOUT sos 31 length Status Chiptype UID Length number of response bytes here 0A Status 00 communication interrupted 01 bad CRC 0F success 80 collision Chip type 00 SR176 01 SR512 02 SR4K UID 64 bit 8
43. service registered in the card Request System Code Command Allows searching for the card s registered system code to acquire the system code list 3 7 12 3 Felica Cards Secure Access Commands Authentication 1 Enables the Reader Writer to authenticate the card Authentication2 Enables the card to authenticate the Reader Writer ps D D O Used to read card data in block units using the service specified in the authentication process Write Used to write data to the card in block units using the service specified in the authentication process Other command exists that require authentication for personalization but are not described in this document 174 Commands Manual CUST 2M HF ASK commands 3 7 12 4 Error Code List Cod Status Detail 00 No error Normal Termination 01 Purse Error Lack of balance in the decrement access mode or data overflow in the cash back access mode detected during the use of the purse service 02 Cash Back Error In the purse cash back mode the immediately preceding decrement value is smaller than the cash back data 70 Memory Error Cannot write in the memory CRC error or garbled bits detected in the memory 71 Excessive Writes The memory has been written more than 0x1FFFF 131071 times Processing continues as this is not considered an error A1 Incorrect Service The service number is not correctly specified on the service code list when using the Read Number Without Encryption or
44. the 1st for the command index number 0 the 2nd for the command index number 1 the 3rd for the command index number 2 and 4th for the command index number 3 The possible access modes are 00 NEVER 01 PIN 02 PROTECTED 0F APPLICATIVE 12 PROTECTED SESSION 1F ALWAYS Other RUF values Correspondence chart between command index number and type of file Command MF and DF Linear fixed EF circular Counter EF circular EF index structure EF specific to the number application REHABILITATE READ RECORD READ READ GetEP and RECORD RECORD READ RECORD INVALIDATE UPDATE UPDATE UPDATE ReloadEP RECORD RECORD RECORD 2 WRITE DECREASE DebitEP and RECORD UnDebitEP 3 APPEND INCREASE RECORD 74 Commands Manual CUST 2M HF ASK commands Nkey 4 bytes key index number to use Status 1 byte X0 File valid still readable if invalidated X1 File invalidated readable X2 File valid not readable if invalidated X3 File invalidated not readable 0X No errors of PIN presentation 1X One error of PIN presentation 3X Two errors of PIN presentation 7X Three errors of PIN presentation Any new presentation of the PIN is rejected Other RUF values KVC1 1 byte 00 for an EF KVC2 1 byte 00 for an EF KVC3 1 byte 00 for an EF Floor 3 bytes 000000 for files other than counter EFs Ceiling 3 bytes 000000 for files other than counter EFs CUST 2M Commands Manual 75 HF ASK commands 3 7 4 3 Set of instructions 0
45. the timeout is still positive we go on at the beginning of the searching loop CUST 2M Commands Manual 33 HF ASK commands 3 6 SOFTWARE INTERFACE This chapter describes the structures of data sent and received on the DATA zones defined in chapter 2 4 Frame 3 6 1 Classes of commands The software interface of the ASK reader is organized into classes of commands defining major types of functions System commands configuration transparent commands TAG and SAM Macro commands for cards CD97 GTML CT2000 etc 3 6 2 Structure of commands The commands are defined by Class system badge etc Instruction function number in the class Associated data CLASS INS Associated data 1 byte 1 byte xx bytes 270 bytes MAX This information is sent by the host to the DATA zone of command for frames Details on available commands are provided in chapter 5 of this document 3 6 3 Responses to commands The responses to commands are identical to the DATA zone of commands seen above 3 6 4 Error reports There are 3 levels of error reports Error detected by the reader at the level of access interface to functions class unknown function or syntax error in system class command These errors are reported by the reader to the host via the ERR bit in STA register There is no other report Error detected by a reader function called by the host class other than system class the error is reported b
46. with INNOVATRON protocol 04 Card recognized with ISO 14443 type B protocol Calypso Card 14 ISO 14443 type B protocol asked but an unwanted collision occurred 05 Card recognized with ISO 14443 type MIFARE protocol 15 ISO 14443 type MIFARE protocol asked but an unwanted collision occurred 06 CTS or CTM Ticket recognized 07 Card recognized in contact mode 08 Card recognized with ISO 14443 type A part 3 but not compliant with 14443 type A part 4 18 ISO 14443 type A protocol asked but an unwanted collision occurred 09 Card recognized with ISO 14443 type B protocol Non Calypso card 0B Card recognized with MV5000 protocol no data format control 1B MV5000 protocol asked but an unwanted collision occurred 0C Card recognized with ISO 14443 type A protocol Calypso Card 0D SRI detected 0E NFC Felica detected 0F NFC Mifare detected 6F Timeout expired 7F Response before tag research NB no collision code has been implemented for the INNOVATRON or CTx cards LNG 1 byte length of cards responses ATR N bytes _INNOVATRON protocol Long REPGEN data in the case of Innovatron protocol cards composed of The serial number 4 bytes followed by 2 bytes The Answer to reset 17 bytes for CD97 and GTML The Status words 2 bytes ISO 14443 Type B protocol The communication channel number CID 1 Byte The Serial Number if the card is Calypso Compliant otherwise t
47. 0 ReadCycle configuration 0x01 Observed Threshold configuation 0x02 Lost Threshold configuration 0x03 Starting Q value Valid values 0 15 ERC C1GEN2 Protocol only 0x04 Session Valid values 0 3 EPC C1GEN2 protocol only 0x05 Target Valid values 0 1 EPC C1GEN2 protocol only 0x06 Selected Valid values O 1 EPC C1GEN2 protocol only 0x07 Data Exchange Status B Valid values O 1 ISO 18000 6B protocol only all printer models with UHF module a value for the configuration parameter Attribute value is 4 bytes long all printer models with UHF module a value representing the number of triggers Attribute value is 2 bytes long all printer models with UHF module a value representing the number of channels Attribute value is 2 bytes long all printer models with UHF module a value representing the event handling mode Attribute value is 2 bytes long and can assume the following values 0x00 ReadCycle mode 0x01 Time Mode 0x02 No Event Mode CUST M 6F Devices UpgradeType 70 Devices UpgradeArgument 71 Devices MemoryBank 72 Devices Payload 73 Devices G2Password CUSTEM UHF RFID commands all printer models with UHF module a value representing the type of upgrade to perform Attribute value is 2 bytes long and can assume the following values 0x01 TFTP firmware upgrade all printer models with UHF module
48. 0 00 00 00 20 10 Od 00 a6 14 Description Type command Direction Host gt CSC aia Function class class 05 naiiai Command Append Record suari 00 Access in Default mode EE 00 Selected file EET Timing 0 s 41 ms Response 01 05 05 01 00 90 00 00 d5 64 Description Type command Sens CSC gt Host EEE Function class class 5 Pili Correct return EEE Response Append Record DER RR RA A RARA RARA RARA Message 80 02 05 11 00 a0 c9 Description Type command Sens Host gt CSC eee Function class class 05 ENI EEN Command Close Secured Session Sonor Timing 0 s 50 ms Response 01 05 05 11 00 90 00 00 95 dO Description Type command Sens CSC gt Host digan Function class class 5 calida Correct return TON Response Close Secured Session CUSTEM HF ASK commands Commands Manual 185 HF ASK commands 3 8 3 Class CD97 class 3 function APPEND_ RECORD command ed CSC found reset ASK CSC Message 80 02 01 01 00 50 3f Description Type command Sens Host gt CSC iia Function class system class io Command CSC version ee agit Timing 0 s 15 ms Response 014101 01 43 53 43 20 30 32 2e 30 38 20 3c 70 68 2d 39 36 30 30 2d 31 31 35 32 3e 20 4d 61 72 20 31 33 20 32 30 30 31 20 31 38 3a 30 34 3a 31 34 20 28 43 29 20 41 53 4b 20 47 45 4e 5f 33 58 30 20 00 00 91 cd Description Type command Sens CSC gt Host isc Function class system class rial Response CSC version iii In Ascii esis CSC 02 08
49. 01 O 201 CUSTEM Commands Index SFB ORO O e O N 201 BN OPE PACO OU 202 A A E T 202 PA alin ace acide Decide 202 A E 203 A A 203 a PP Uno O meal 203 GV2 etal ch et ec lc eect AEE 203 A Ter Ore tan OnT reer rrr ae rerer ry Serere en eretrrer seer 204 aiii tada 204 o no AR 204 A ee care lactlacnae Sects 204 74 8 SOORPO RCD OO i R RE sa naetaedaaccattiananits 204 Disputa 205 BU BC OE EE E O E E A E 205 O al cael eas 205 Ta PA A eae ateasnaaniesmen segues 205 SD Scotts OO OOO O EAS 205 DF IP aconetnl ee T 206 Stele E aa sashes daaaaitenents 206 A toes acon a ae EAR 206 PP A 206 BO CPP 1 UR CE o T T 206 DO leia la 207 ra EA E E ry Rer ere en ereerrer seer 207 aer isis add 207 OI PA UE 5 tesa T 207 O O aah E 208 tas 208 PPP O A 208 PIA on ES 5 O E 208 O cl cle eat acs 209 A cee T AR 209 no AS 209 IE nadar 209 Commands Manual 215 UNI EN ISO 9001 CERTIFIED QUALITY SYSTEM M U R S T Ministry University TUV Research Scientific Technology XJ Authorized laboratory no 50846ZYZ CUSTOM ENGINEERING SPA World Headquarters Via Berettine 2 43010 Fontevivo Parma ITALY Tel 39 0521 680111 Fax 39 0521 610701 info custom biz www custom biz All rights reserved www custom Diz Always Un Rev 1 00 Part Number DOMC 0002E
50. 02 Success 03 invalid parameters 8x Security activated i e data written data read 82 Security activated good CRC DATA data read Length 1 byte 06 04 Devices all printer models with ASK module Name RELEASE CTS256B Description Deactivation of the CTS CLASS INS DATAIN 06 04 Param Param 00 deactivation of the ticket using the instruction deactivate Others RFU CLASS INS DATAOUT 06 04 Status Status 00 ticket always active 02 ticket deactivated CUST 2M Commands Manual 113 HF ASK commands 3 7 8 CTx512x Class N 06 3 7 8 1 CTx512B The CTx512B is one of the members of the range of ASK contactless tickets It has a memory of 512 bits and is in tended for applications where anticollision between tickets is necessary CTM512B contains very high security features The CTx512B is addressed by words of 2 bytes The CSC handles byte level CTx512B internal EEPROM 64 bytes organisation and physical address Msb word Isb Msb word Isb o py Bytes Byteo po po Bytes Byte2 e o a ec ae m gt n9 2o ao V 2o 4 a 9 _ pe 114 Commands Manual CUST 2M HF ASK commands 3 7 8 2 Mifare UltraLight The Mifare UltraLight is a member of the Mifare family but is considered as a ticket whose characteristics are very close to the CTx521B s ones That s why the functions of the Mifare UltraLight belong to the same class as the CTx521B cl
51. 05 00 00 00 00 00 00 68 43 Description Type command Sens Host gt CSC indiana Function class CD97 class reangna Command Append Record orasima 01 Access in Protected mode TE 08 Fichier Journal de transport s lectionn TE Timing 0 s 100 ms Response 01 05 03 01 00 90 00 00 2f 7c Description Type command Sens CSC gt Host E Function class CD97 class oranan Correct return RE Response Append Record LKILLILLLLLLLLLLLLLLLLLLLLLLLL LLL LLLI Message 80 08 03 08 08 04 31 00 31 15 00 d3 29 Description Type command Sens Host gt CSC soruna Function class CD97 class aiiai Command Select File nkan Timing 0 s 31 ms Response 01 1e 03 08 00 90 00 85 17 00 04 04 1d 01 1f 12 00 12 01 03 01 03 00 00 00 00 00 00 00 00 00 00 00 5c 76 Description Type command Sens CSC gt Host Jaian Function class CD97 class Lin Correct return Dacia Response Select File aa D tail du FCI E 85 indique un Tag ARION SID 00 aa File type 04 EF badia Structure type 04 Circular Y Byte number for each record 1d A Record number 01 TAE AC Access condition for command index 0 1f ALWAYS READ RECORD Command Taaa AC Access condition for command index 1 12 PROTECTED SESSION UPDATE RECORD Command odia AC Access condition for command index 2 00 NEVER No Command EE AC Access condition for command index 3 12 PROTECTED SESSION APPEND RECORD Command i Key index to use 01 03 01 03 n File status 00 Fichier Valide Fich
52. 1 SAM SAM number 00 01 02 03 or 04 as defined in Reset Sam command LNG length of data LNG included DATA data made up of the ISO command to transmit to the SAM DIRECTION requisite for SO7816 contact mode only IN 01 OUT 02 IN_OUT 03 CLASS INS DATAOUT sia status STATUS communication status 00 data received FF no data received LNG length of data LNG included DATA data which makes up the SAM response 01 15 Devices all printer models with ASK module Name Select_CID Description Select a communication channel to communicate with an ISO 14443 card parameter entry function CLASS INS DATAIN Pst s p O ID CID value from 1 to MaxValue CLASS INS DATAOQUT sts STATUS 1 STATUS Status of operation 1 Ok 0 Nok Bad CID value CUST 2M Commands Manual 51 HF ASK commands 01 16 Devices all printer models with ASK module Name SELECT_DIV Description Select a Diversifier for the transaction Usable after a Security module change a CID change or if the option no Diversifier is chosen in the Select option command or in RS485 default option mode CLASS INS DATAIN sor 16 SLOT 1 PROT 1 CardSerialNumber 4 SLOT SAM SLOT PROT SAM PROTOCOL 0 Innovatron 1 ISO Card Serial Number Last 4 bytes of the card Serial Number CLASS INS DATAOQUT 16 STATUS 1 STATUS Status of operation 1 Ok 0 Nok 52 Commands Manual
53. 1 byte Response length 02 for successful operation Status 2 bytes See List of response code 11 13 Devices all printer models with ASK module Name Create Cyclic Record File DESFIRE CLASS INS DATAIN m sis FieiD CommMode AccessRights MaxNRecord FilelD 1 byte This is the ID of the file for which the new Cyclic record File is to be created CommMode 1 byte File communication mode AccessRights 2 bytes New File access rights settings RecordSize 3 bytes Size of the new Cyclic File in bytes MaxNRecord 3 bytes Number of the records for the new Cyclic File Returned response format GLASS ms patraor sn s3 Length Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code 162 Commands Manual CUST 2M HF ASK commands 11 14 Devices all printer models with ASK module Name Create Linear Record File DESFIRE Description Creation of a Linear Data File CLASS NS DATAN FilelD 1 byte This is the ID of the file for which the new Linear record File is to be created CommMode 1 byte File communication mode AccessRights 2 bytes New File access rights settings RecordSize 3 bytes Size of the new linear File in bytes MaxNRecord 3 bytes Number of the records for the new linear File Returned response format CLASS INS DATAOUT sta Length Length 1 byte Response length 02 for successful operation Status 2 bytes See List
54. 14443 4B timeout 1 strict check other no strict check same as GEN3XX Delay after REQ Select 0 or FF no delay same as GEN3XX other delay in ms Unconditional Mifare selection before authentication if value 1 Not significant on GEN5XX Custom Frame Waiting Time Value 10 ms 00 or FF no custom FWT 15014443 4 retries on PICC timeout if value 1 CLASS INS DATAQUT 00 07 Status 1 STATUS 1 byte 0x00 Failure 38 Commands Manual 0x01 Success CUST M HF ASK commands 00 08 Devices all printer models with ASK module Name Read Config Eeprom Description Read the value at the Index EEPROM CLASS INS DATAIN 00 08 Index 1 Index EEPROM configuration index CLASS INS DATAQUT 00 08 STATUS 1 byte 0x00 Failure 0x01 Success Value regarding index see Write Config Eeprom Default values CSC Configuration Hex Value Signification 1 R5232 Speed FF 115200 bauds 2 R5485 Speed FF 115200 bauds 3 TTL Speed FF 115200 bauds 4 Default SAM 01 SAM n 1 5 Field off CTX 1E During 30 ms 6 Auto LED FF Disabled 7 15693 modulation FF 100 8 Frame padding FF Disabled 9 15014443 4 retries FF 10 10 15014443 4 retries delay FF 10 ms 11 Default RX RF speed FF 424 kb s 12 Default TX RF speed FF 424 kb s 13 SAM reset at startup FF Yes 14 AU Pin FF VEvalL 15 High baud rate 150144434 gain FF 35 dB 16 Contact Slot 4 switch test FF No SAM 17 15014443 38 timeout strict check FF No 18
55. 15014443 4B timeout strict check FF No 19 15014443 delay after REG SELECT FF O ms 20 Mifare selection before authentication FF No 21 MUX482 selection same as MUX382 FF No 22 1 014443 4B custom Frame Waiting Time FF No 23 15014443 4 retries on PICC timeout FF Yes CUSTE2M Commands Manual 39 HF ASK commands 3 7 2 SYSTEM Class N 01 This class is dedicated to module resource administration which is not specific to a card mask communications configurations inputs outputs update etc 01 01 Devices Name Description all printer models with ASK module Software version Sends back reader software version and allows enabling or disabling the CRC computation for communications exchanges between the HOST and the CSC N B this command initializes CSC communication CLASS INS DATAIN CRC ON OFF so CRC ON OFF OxFF CRC not needed After reset Version command with CRC must be issued before using CRC disabling All other values CRC needed for each exchange By default the CRC is needed This parameter is not mandatory If not present in the command the default value will remain unchanged CAUTION this parameter has been implemented to increase the communication speed CLASS INS DATAOUT VERSION sm VERSION x character chain of software version terminated by 00 GEN5XX CSC xx yy lt iii gt Mmm jj yyy HH MM SS C ASK SAMs Where xx version number yy revision nu
56. 1E 49 RS Inventory ISO15693 1E 52 RSR Switch off the RF carrier for n milliseconds 1E 57 RS W Write 1E 61 RS a Anticollision 1E 72 RSr Read 1E 73 RSs Return the UID 1E FF RS Read write a value in the PCD register CUST 2M Commands Manual 5 HF CUSTOM commands 2 1 Commands detailed descriptions Given below are more detailed descriptions of each command 1B 3D Devices Name Format Description Notes Default Reference Example 1E 43 Devices Name Format Description Notes Default Reference Example 6 Commands Manual all printer models with RFID reader writer Pass Through ASCII ESC n Hex 1B 3D n Decimal 27 61 n n 1 Disable the communication with RF module n 5 Enable the communication with RF module For using commands RF it s necessary that the communication with RF module is enabled For using normal commands ESC POSTM it s necessary disable the communication with RF n 1 all printer models with RFID reader writer Set the PCD for ISO 15693 ASCII RS C Hex 1E 43 Decimal 30 67 Set the PCD for the IS015693 protocol Returns Status CUST M 1E 44 Devices Name Format Description Notes Default Reference Example 1E 45 Devices Name Format Description Notes Default Reference Example CUSTEM all printer models with RFID reader writer Initialize SLI ISO 15693 mode ASC
57. 3 01 Devices all printer models with ASK module Name APPEND RECORD CD97 Description Adds a record to an elementary circular file This new record becomes the first in the file the older one is suppressed CLASS INS _ DATAIN sor acces ACCES access mode SID SID SID 00 for usually selected EF LNG length of data to record n bytes size of a recording DATA data to record CLASS INS DATAOUT sos m meNDG REND execution report 76 Commands Manual CUST 2M 03 02 Devices Name Description Data In HF ASK commands all printer models with ASK module CHANGE KEY CD97 Writes the values of a key in current DF contained in the MF A SelectFile of the MF or DF should be carried out before being able to change a key This command can t be used during a session CLASS WS DATAN HA 1 1 1 1 1 1 1 IKEY index number of the key to modify 01 03 for CD97 GTML Or index number in the SAM of the new key to be loaded in the card NKEY new version of the key to modify different from 0 For the Personalization the new key version is 01 TYPE_CMD 00 short command compatibility with the former one 01 long command CKEY Index Number in the SAM of the key to encipher the transfer ALG_TAG algorithm key card to recopy ALG_SAM algorithm of the SAM used IKEY_TAG index number of the new key in the card in the DF Data Out CLASS INS DATAQUT sos sos
58. 3 Private could be used as private badge by any operator for example for control of access 3 7 4 2 Data structure The card is organized into files according to the ISO IEC 7816 4 and takes its inspiration from the EN726 3 norm The CD97 card files have various attributes type DF dedicated file or EF elementary file long identifier LID short identifier SID sub type solely for the EFs fixed structure circular counter The DFs are proper to an application payment transport etc they are like folders which contain the EFs 70 Commands Manual CUST 2M ICC Informations sur le Master File ID Identification du titulaire badge 92 0002 03 0003 1 PME intersectoriel 1000 1 Journal des chargements T l billettique 2000 Environnementet 1 Informations sur le titulaire 07 2001 OA 14 1014 E Journal des achats OA 15 1015 O Journal de transport 08 2010 Description des 4 contrats implicites 09 2020 L Fichier d di L Fichier l mentaire Fichier l mentaire lin aire structure fixe Compteur du contrat 1 implicite n 1 0A 202A Compteur du contrat 1 implicite n 2 0B 202B Compteur du contrat 1 implicite n 3 0C 202C Compteur du contrat 1 implicite n 4 0D 202D M moire d O D Fichier l mentaire circulaire
59. 3 units on 09 12 98 at 15h29 Amount FF FD Date 02 C3 Time 03 A1 Equipment Type 03 e If purchase transaction extended with display AFF 6 bytes of display cf display file CLASS INS DATAOUT sos soc REND execution report Remark in an uninitialized card note that you must do First a Null Purchase Ex 03 OE 01 0B 00 03 OD 00 00 00 00 00 00 00 02 See CD97 specification 86 Commands Manual CUST 2M HF ASK commands 03 13 Devices all printer models with ASK module Name CANCEL PURCHASE CD97 Description Cancellation of previous payment done with the PME CLASS INS DATAIN sos sis so JPAID 7 JPAID 7 first bytes of new recording in payments journal Equipment Type 1 Example for the cancellation of a debit of 3 units on 09 12 98 at 15h29 example PURCHASE Amount 00 03 Date 02 C3 Time 03 A1 Equipment Type 03 e Cancellation of a transaction with display CLASS INS DATAIN a som JPAID 7 AFF 6 JPAID 7 first bytes of the new recording in payments journal Equipment Type 1 AFF 6 bytes of display cf display file CLASS INS _ DATAOUT sos 13 REND 3 REND execution report CUS T M Commands Manual 87 HF ASK commands 03 0F Devices Name DDescription all printer models with ASK module RELOAD ELECTRONIC PURSE CD97 Charge of PME CLASS INS DATAIN CHARG1 CHARG2 0F_ CHARG1 5
60. 5 PPS Failed OxF6 Bad TA1 parameter OxF7 Bad TP parameter OxF8 Bad TCK control OxF9 Bad PPS Mode OxFA SAM Signal Locked OxFB SAM Timeout OxFC SAM Length Error OxFD SAM Not defined OxFE incorrect Parameter OxFF Timeout occurs during dialogue or SAM not detected 32 Commands Manual CUST 2M HF ASK commands 3 5 DESCRIPTION OF THE NEW ENTER HUNT PHASE FEATURES Default configuration for Card Search is Max Number of cards to look up in ISO 14443 B mode is 1 Type Of ReqB RegB or WakeUp is 00 REQB Number of slots in case of collision is OO No slot marker only probabilistic method has been tested AFI value to seek is 00 All e Automatic Select Diversifier implementation is Yes for the Normal mode and no for the RS485 mode acts on both Innovatron and IS014443B card e Deselecting of the cards by just switching the field off value 0 e SelectApplication is sent at the end of the EHP procedure for the ISOB cards value 1 All theses values can be changed by the Class 01 command 17 F01_17_REQ_PARAM Parameters in Byte 0 Max Number of cards to look up at 1 up to 5 Byte 1 Type Of ReqB ReqB 0 or WakeUp 1 Byte 2 Number of slots in case of collision 0 No Slot marker 1 to 14 otherwise Byte 3 AFI value to look for see the ISO 14443 norm Byte 4 Automatic Selection of Diversifier 0 to disable automatic Byte 5 Real deselection of the cards if 1 or only Field
61. 512 and SR4K families have 4 byte blocks CLASS INS DATAOUT o6 33 Length Status DATA x Length response length Status 00 communication interrupted 01 bad CRC 02 success 03 bad parameters 8x Security activated i e data written data read 82 Security activated good CRC DATA data read back Length 1 byte 06 34 Devices all printer models with ASK module Name RELEASE SR Family Description Deactivation CLASS INS DATAIN o6 34 Param Param 00 deactivation of the ticket using the completion instruction Others RFU CLASS INS _ DATAOUT 06 34 Status Status 00 ticket always active 02 ticket deactivated 126 Commands Manual CUSTE2M 06 35 Devices Name Description HF ASK commands all printer models with ASK module READ SR Family Read bytes at a given address This function handles the chip regardless the blocks organiza tion CLASS INS DATAIN sos 85 ADD NB Address of the first reading 2 bytes LSB MSB SR176 0 to 31 00 00 to 1F 00 SR512 family O to 63 00 00 to 3F 00 or 1020 to 1023 FC 03 to FF 03 SR4K family O to 511 00 00 to FF 01 or 1020 to 1023 FC 03 to FF 03 Note ADD must be multiple of block size Number of bytes to read SR176 1 to 32 01 to 20 SR512 family 1 to 64 01 to 40 SR4K family 1 to 240 01 to F0 CLASS INS DATAQUT o6 35 Length Status DATA x
62. 7 CLASS INS DATAOUT sos 0F REND S REND execution report Remark in an un initialized card note that you must do First a Null Reload Ex 05 OE 00 0A 00 05 OF 00 00 00 02 00 00 00 00 00 00 See CD97 specification 05 13 Devices all printer models with ASK module Name CANCEL PURCHASE Description Cancellation of previous payment carried out with the PME Remark maintained for compatibility with the CD97 e Cancellation of a transaction without display CLASS INS DATAIN 13 00 WPAID 7 JPAID 7 1st bytes of new recording in payments journal Amount Date Time Equipment Type Cancellation of a transaction with display CLASS INS DATAIN o 13 soi JPAID 7 AFF 6 JPAID 7 1st bytes of new recording in payments journal Amount Date Time Equipment Type AFF 6 bytes of display cf display file NKEY SAM key number to use CLASS INS DATAOUT sos 13 REND 3 REND execution report 108 Commands Manual CUST 2M HF ASK commands 05 23 Devices all printer models with ASK module Name DECREASE _ LG Description It is a command for CD97 card only Decreases the value contained in a counter file and writes the 5 free data Records the associ ated data Remark Executed in session the new value of the counter will be returned by the CloseSecuredSes sion Data In CLASS INS DATAIN ACCES SID VALUE LID Index NKEY KIF 00 KVC 1 1 8 2 counter 1 1 1 ACCES
63. 7 Cl Counter index VALUE value to deduct 3 bytes binary number positive or nil DATA OUT NBC fois 3 REND execution report Cl Counter index VALUE new value 3 bytes binary number signed 104 Commands Manual CUST 2M HF ASK commands 05 15 Devices all printer models with ASK module Name INCREASE MULTIPLE Description Increases the value contained in a counter file The associated data is not written in the GTML Remark This function should be carried out in session and it immediately returns the new value of the counter This command is not supported by CD97 and GTML DATA IN e E voce NBC fois ACCES 1 SID LID NKEY 00 NBC 1 CI 1 VALUE 3 1 2 KVC KIF 1 1 ACCES access mode SID SID SID 00 for usually selected EF NKEY KIF SAM key number to use or KIF of the Key 00 KVC 00 if NKEY passed in the previous parameter or KVC of the Key NBC Number of counters concerned maximum 7 Cl Counter index VALUE value to add 3 bytes binary number positive or nil DATA OUT NBC fois REND 3 Cl 1 VALUE 3 REND execution report Cl Counter index VALUE new value 3 bytes binary number signed 05 12 Devices all printer models with ASK module Name LOCK UNLOCK Description Locks Unlocks the card REMARQUE Before this command a Verify Pin must be carried out After this command the current file is unchanged CLASS INS DATAIN sos s6 CMD 1
64. 8 2d 39 36 30 30 2d 31 31 35 32 3e 20 4d 61 72 20 31 33 20 32 30 30 31 20 31 38 3a 30 34 3a 31 34 20 28 43 29 20 41 53 4b 20 47 45 4e 5f 33 58 30 20 00 00 91 cd Description Type command Sens CSC gt Host ia Function class system class eer Response CSC version EEES In Ascii AE CSC 02 08 lt ph 9600 1152 gt Mar 13 2001 18 04 14 C ASK GEN_3X0 LKILLLLLLLLLLLLLLLLLLLLLLLLLL LLLI 182 Commands Manual CUST 2M HF ASK commands Message 80 08 01 03 00 00 00 00 01 00 00 17 69 Description Type command Sens Host gt CSC ing heels Function class system class Lido Command Short Enter Hunt Phase pneis Antenna number parameter 00 EET Contact parameter 00 ISOB 00 ISOA 00 E TICKET parameter 00 RMT 01 enron Timing 0 s 25 ms Response 01 1e 01 03 00 03 19 00 22 17 6c ff 40 3b 6f 00 00 80 5a 08 03 03 00 00 00 00 22 17 6c 82 90 00 00 39 4f Description Type command Direction CSC gt Host AN Function class system class ETT Response TAG search TE Antenna number parameter 00 0x80 if failed Sissi Mode RMT Choix Ok se is ATR length 19 cs Convention type 3b must be to 3B aci TO parameter 6f must be to 6F if there are 2 parameters after a TB1 parameter 00 must be to 00 LS TC1 parameter 00 must be to 00 icon Indicator category 80 must be to 80 ici Parameter nbconstr 5a must be to 5A as Type de composant 08 E Application type 03 enana ROM version 03 00 sangna EEPROM Version 00 00 satan Serial number 00 22 17 6c
65. AOUT sos awo execution report v8 m Z U 02 07 Devices all printer models with ASK module Name REHABILITATE GTML Description Cancels file invalidation CLASS INS DATAIN 02 07 ACCES 00 ACCES access mode 00 other RFU values CLASS INS DATAOUT 507 execution report v8 m Zz U 66 Commands Manual CUST M HF ASK commands 02 08 Devices all printer models with ASK module Name SELECT FILE GTML Description Explicit selection of current EF or DF This command sends back file description data CLASS INS DATAIN 02 sos CNTR LNG 1 PATH x CNTR Control of selection 00 MF 02 EF in current DF identifier bytes 2 to n 08 bytes 1 to n path from the MF excluded LNG length of identifier or path PATH identifier or path NB The command 02 08 00 00 is not supported by CD97 card CLASS INS DATAQUT 08 REND execution report FCI FCl 02 0A Devices all printer models with ASK module Name UPDATE RECORD GTML Description Deletion then writing of a record given in a linear fixed structure EF or the most recent recording of a circular file CLASS INS DATAIN 02 0A ACCES 00 SID 1 NREC 1 LNG 1 DATA x ACCES access mode 00 other RFU values SID SID SID 00 for usually selected EF NREC recording number LNG number of bytes to write n bytes size of a recording DATA data to record CLASS INS _
66. AUTHENTICATE CTM512B ONLY Description authenticates an area of the ticket 8 consecutive bytes thanks to the Anticlone function of the SAM If the Field off CTx configuration is active the field is turned on and a select is done before the command and the field is turned off after the command only in CTx512b mode CLASS INS ___ DATAIN KIF KeyRet _KVG 0x00 06 Address Address of the area to authenticate KIF KeyRef Specifies the KIF or the KeyRef but if KeyRef the following byte must be set to 0x00 KVC 0x00 Specifies the KVC if KIF has been specified before if not must be 0x00 CLASS INS DATAOUT Length Status DATA x Length Status length Data length Status 00 No answer TimeOut 01 Unexpected failure 02 Success 03 Bad parameters 04 No current SAM 05 SAM not initialized 06 Bas Status SAM DATA present only to get the SAM status code back only when STATUS 06 120 Commands Manual CUST 2M HF ASK commands 06 28 Devices all printer models with ASK module Name WRITE KEY CTM512B ONLY Description After the personalization phase writes a diversified key in the ticket If the Field off CTx configuration is active the field is turned on and a select is done before the command and the field is turned off after the command only in CTx512b mode CLASS INS DATAIN 06 28 KIF KeyRef KVC 0x00 KIF KeyRef Specifies the KIF or the KeyRef but if KeyRef the following
67. CHARG2 5 5 first bytes of new record in loading journal Date Money Batch Equipment Type Date 2 bytes Hexadecimal value of loading date The loading date is usually equal to the number of days since 1 1 97 Money Batch 2 bytes Hexadecimal value of type of changes loaded on the card i e Francs Euros Dollars etc Equipment Type 1 bytes Hexadecimal value of type of equipment used to do the loading 5 bytes offset 08 13 of new record in loading journal Amount Time Amount 3 bytes hexadecimal value of amount to credit on the card Remark this value should be positive Time 2 bytes Hexadecimal value of loading time This time is usually equal to the number of minutes since 00h00m CLASS INS DATAQUT REND Remark Ex soc execution report in an uninitialized card note that you must do First a Null Reload 03 OE 00 0A 00 03 OF 00 00 00 02 00 00 00 00 00 00 See CD97 specification 88 Commands Manual CUST 2M HF ASK commands 03 10 Devices all printer models with ASK module Name OPEN SECURED SESSION CD97 Description Opening of a certification session Returns DF paths from MF excluded from non ratified applications and the data read in the indicated record and file Remark this command should be preceded by a select file command in the directory concerned CLASS INS DATAIN em Dae E E a 1 1 1 1 1 1 1 TYPE Type of operation 00 Pers
68. CRC void unsigned short CRCVal 0 inti for i 0 i lt LNG i CRCVal TABLE CRCVal TRAME i amp OxFF CRCVal gt gt 8 TRAME LNG CRCVal 256 TRAME LNG 1 CRCVal 256 LNG LNG 2 In TABLE may be found the calculation constants of the CRC const unsigned short TABLE 256 0xF078 0xE1F1 0xD36A 0xC2E3 0xB65C 0xA7D5 0x954E 0x84C7 0x7C30 0x6DB9 0x5F22 0x4EAB 0x3A14 0x2B9D 0x1906 0x088F 0xE0F9 0xF170 0xC3EB 0xD262 0xA6DD 0xB754 0x85CF 0x9446 0x6CB1 0x7D38 0x4FA3 0x5E2A 0x2A95 0x3B1C 0x0987 0x180 0x975E 0x86D7 0xB44C 0xA5C5 0x5D32 0x4CBB 0x7E20 0x6FA9 0x1B16 0x0A9F 0x3804 0x298D OxC1FB 0xD072 0xE2 0x0B97 0x1A1E 0x28 Ox0FB7 0x1E3 0x3254 0x23DD 0x1146 0x00CF 0xF838 0x 0x64F1 0x7578 0x47E3 0x566A 0x22D5 0x335C 0x01C7 0x104 E OxD17A OxCOF3 OxF268 OxE3E1 E9 0xF360 0x87DF 0x9656 0OxA4CD 0xB544 0x4DB3 0x5C3A 0x6EA1 0x7F28 85 0x390C 0xB27C 0xA3F5 0x916E 0x80E7 0xF458 0xE5D1 0xD74A 0xC6C3 0x3E34 0x2FBD 0x1D26 0x0CAF 0x7810 0x6999 0x5B02 0x4A8B 0xA2FD 0xB374 0x81EF 0x9066 0xE4D9 0xF550 0xC7CB 0xD642 0x2EB5 0x3F3C 0x0DA7 0x1C2 0x937E 0x82F7 0xB06C 0xA1E5 0xD55A 0xC4D3 0xF648 0xE7C1 0x1F36 0x0EBF 0x3C24 0x2DAD 0x5912 0x489B 0x7A00 0x6B89 0x83FF 0x9276 0xA0ED 0xB164 0xC5DB 0xD452 0xE6C9 0xF740 E 0x6891 0x7918 0x4B83 0x5A0A
69. CUST 2M HF ASK commands 01 17 Devices all printer models with ASK module Name EnterHuntPhase Parameters Description Initialize parameters for ISOA B and Innovatron Protocol If the first parameter is set to 00 the command can send the present configuration back OLAS INS DATA 17 MAXNB REQ NB AFI Auto Deselect Select LNG DATA Felica Felica CARD 1 1 SLOT 1 1 SelDiv 1 1 Appli 1 1 x AFI 2 NBSlot 1 MAXNBCARD Max Number of cards to look up at default value is 1 for single card detection Note if 00 and nothing for others parameters the present configuration will be given back REQ Type Of Request 00 Req or 01 WakeUp default value is WakeUp Note the ISO 14443 A anticollision required type of Request Req NBSLOT Number of slots in case of collision default value is 0 for probabilistic method AFI AFI value to seek default value is O for All AFI AutoSelDiv Automatic Select Diversifier method 1 TRUE Deselect When a later deselection will be called if set to 01 gt real deselection of the found cards and if 00 gt switches the field off SelectAppli Select Application mangement for ISOA ISOB 000x xxx1 send Select Application to card after detection ISOA ISOB 000x xx1x Force to 00 instead of 94 the Select Application CLA field 000x 1xxx add selected application name in the FO1_03_EnterHuntPhase answer LNG optional data length DATA optional n
70. D mode 00 KVC 00 if NKEY passed in the previous parameter or KVC of the Key used in PROTECTED mode Data Out crass ms DATA OUT so s2s REND VALUEG REND execution report VALUE outside session for all cards new value 3 bytes binary number signed in session nothing 110 Commands Manual CUST 2M 3 7 7 CTS256B Class N 06 HF ASK commands The CTS256B is one of the members of the range of ASK contactless tickets It has a memory of 256 bits and is intended for applications where active authentication of the ticket is not necessary for example ticket for immediate use etc 3 7 7 1 Memory organization The CTS256B is addressed by words of 2 Bytes The CSC handles Byte level CUST M EEPROM 16 words Address Area Mb Byte 11 Byte 13 4 Byte 15 Byte 17 Byte 19 0 Byte 21 5 Byte 23 Byte 25 Byte 27 Byte 29 Byte 31 word Isb wo los Reed Heed heck hes lt lt lt lt lt S gt gt gt gt gt jojojo oINIajJoj 1 2 4 l 3 5 Commands Manual 111 HF ASK commands 3 7 7 2 Set of instruction 06 01 Devices all printer models with ASK module Name ACTIVE CTS265B Description Activates only the CTS ticket and sends back the first 5 blocks Equivalent to EnterHuntPhase card CLASS INS soe s CLASS INS DATAOUT o6 o jlength Status DATA x Length number of response bytes Status 00 communi
71. DATAIN so o Length Type Rx Tx Don tnegociate Length 1 byte 04 for this command Type 1 byte 10 type of the command to set RF speed limitation Rx 1 byte 00 gt 106 kb s 01 gt 212 kb s 02 gt 424 kb s 03 gt 824 kb s TX 1 byte 00 gt 106 kb s 01 gt 212 kb s 02 gt 424 kb s 03 gt 824 kb s Don t negotiate 1 byte 00 False 01 True Returned response Length 1 byte 01 for this Response Status 1 byte idem previous Status CUST 2M Commands Manual 137 HF ASK commands rc Write RF chip register in EEPROM CLASS INS _ DATAIN 10 o Length Type Address Data Length 1 byte 03 for this command Type 1 byte 12 type of the command to write in eeprom Address 1 byte address of register Data 1 byte data value Returned response CLASS INS DATAOUT so o Length Status Length 1 byte 01 for this Response Status 1 byte idem previous Status O E gt 77 on DATA IN 01 Length Length 1 byte 01 for this command Type 1 byte 13 type of the command to get chip status CLASS INS DATAOUT sio som teng Status Length 1 byte 06 for this Response Status 6 bytes RegPrimaryStatus RegSecondaryStatus RegErrorFlag Status ISO4 Rx Retries Level 1504 Rx Retries N Set custom Frame Waiting Time eass ms oman SSOC C SS so so Length Type mi iow Length 1 byte 03 for this comman
72. Detect MF MIFARE Description This function allows to detect the MIFARE card present in the antenna field and select it In case of collision a specific error code is returned No key is required at this stage in the RF chip This function realizes the 15014443 connection Norm operations such as REQA and SELECT There is no parameter needed CLASS INS DATAIN sa No input data CLASS INS DATAQUT 10 04 Length Status Code Picc serial Number 4 bytes Length 1 byte Response length 06 in case of success for this Response Status 1 byte See List of response code 0x18 for collision between two cards of the same kind 1K or 4K and 0x1B for collision between one MIFARE STANDARD 1K and a MIFARE 4k Code 1 byte 08 means MIFARE STANDARD 1K Card 18 MIFARE 4K and 0x28 for Prox Picc Serial Number 4 bytes Serial number of the card 10 05 Devices all printer models with ASK module Name Authenticate MF MIFARE Description This function authenticates a sector The right key according to the block to authenticate opera tion can be done only for one sector at a time is required in the internal buffer of the RF chip The Sector number to authenticate and indexes of key in the PCD and the PICC are transmitted as parameters in Dataln Toss ms DAA sto sos Length 03 KeyPICC SectorNum KeyPco Length 1 byte fixed value 03 KeyPICC 1 byte value 0A for KEYA or 0B for
73. E AVP Length 0x0011 AVP Type TagID OxE0040FOE AVP Value 0x06010000 AVP Value 0x0000 Reserved 0x0008 AVP Length 0x0002 AVP Type ResultCode 0x0000 AVP Value Success CUST M Commands Manual 211 UHF RFID commands 212 Commands Manual CUST 2M 5 COMMANDS INDEX HF CUSTOM COMMANDS Iii ici 6 ES a 6 A A Un Ra eaa Ea 7 MIES aria 7 A 8 1E 52 ra 8 DIED E E E 9 MESS lanas ea 9 A aaa ae a ce a 10 A A a PE E 10 SIE SP Escala ASENNE 11 DF G30 EPA PR o neem 11 PISA ai ade 12 MIES ap 12 GIP 45 anna il 13 SIF SD sonrie 13 IF ri E 14 AI uE PE E EE N N 14 A PA 15 PISOS nia 15 IESO santi ltd 16 A es anes natnaaatattaaansaancngaianiee 16 IP DO 8 ceca es co crasasiecnteacsnagatiatnuecnantgitceandddineaniudasuan ass 17 yl SOf A A IE OE CO 17 A a aaa Ae aa pel al 18 IP A A 18 SIESTA sia ii 19 SISTE rada 19 SISI ai lada 20 1F 75 satire aac td at erannd n a 20 SIF D0 o PUE A 21 IES a aN 21 CUSTEM Commands Index HF ASK COMMANDS A aa haeei ie ads 36 DOO GOA COPPER EE A r 36 500 POB sicario aaia 37 A te sataacessnctezceeaaducnsaneadecvasversdecteenscceenes 38 STOOR D S E EEEE sy cuits 39 DOT Uli ds 40 OO ica aia ais 41 DOT GOA ana 45 O1 05 nenei ithe idee terete adel a E 46 A A cecsteestateaiteaanatiitarssccaneis 47 A TA 48 DOT G22 ads 49 aO E Ee A E E T lt hraesedvanies 50 SOIS Menon 51 POT G1 aaaea an 51 A a 52 DOT ais A S 53 DOT GB CEOPOPOPEPES Em 54 A aces 54 01 23 not implemente
74. ESFIRE Description This function is used to retrieve the size available on the PICC CLASS INS DATAIN sm s Returned response format repeated n times CLASS INS DATA OUT E m so Length Status Size 3 bytes Length 1 byte Response length 02 3 for successful operation Status 2 bytes See List of response code Size 3 bytes Size of free memory available 11 07 Devices all printer models with ASK module Name Authenticate DESFIRE Description This function returns the size of the free memory in the Picc firmware CLASS INS DATAIN sm sos KeyNum 1 byte KeyNumber specify the number of the access key which will be used for the authenti cation Depending on this key number and the ID of the currently selected application KeyNum will address either an ordinary application key the master key or even the PICC master key ID OF THE CURRENTLY SELECTED APPLICATION KEYNUM KEY USED FOR AUTHENTICATION not 0 Normal application key pont Application master key po Nt Not allowed po PICC master key If the PICC level is currently selected application ID is 0 KeyNum must be 0 If an application is currently selected application ID is not 0 the given KeyNum must be in the range from 0 to number of keys created with the application Returned response format CLASS INS _ DATAOUT m o Length status Length 1 byte Response length 02 for successful operation Status 2
75. For a MIFARE 4K Card if 256 bytes have to be returned the returned Length will appear on 2 bytes with the same rule as the CSC frames see chapter 3 2 6 Frame length 144 Commands Manual CUST 2M 10 08 Devices Name Description HF ASK commands all printer models with ASK module WriteBlock MIFARE This function writes an authenticated block The right key according with the block to write needs to be present in the internal buffer of the RF Chip Caution A block will always be written entirely 16 bytes This command can be used for data block as well as for block trailer but in this case access bit would not be verified the ChangeKey command is safer for block trailer operation Remark Due to card problem the Write Block on block Trailer 3 sector 0 fails 1 over 2 times on the re read command O E gt 0 de DATA IN sw sos Length BlockNum DataToWrite DataToWrite CLASS Length Status DataVerification Name Description 1 byte length 11 1 byte authenticated Block Number to be written 16 bytes Data to write in the selected authenticated block DATA OUT Length Status DataVerification 1 byte Response length 11 for successful operation 1 byte See List of response code 16 bytes content of the memory read after operation all printer models with ASK module Halt MF MIFARE The aim of this function is to send the HALT order on active PICC GLASS
76. II RS D p Hex 1E 44 p Decimal 30 68 p Initialize SLI ISO 15693 communication mode p 53 Standard mode p 46 Fast mode Returns Status all printer models with RFID reader writer Initialize l CODE1 mode ASCII RS E p Hex 1E 45 p Decimal 30 69 p Initialize l CODE1 communication mode p 53 Standard mode p 46 Fast mode Returns Status HF CUSTOM commands Commands Manual 7 HF CUSTOM commands 1E 49 Devices Name Format Description Notes Default Reference Example 1E 52 Devices Name Format Description Notes Default Reference Example 8 Commands Manual all printer models with RFID reader writer Inventory ISO 15693 ASCII RS p a n u0 ul Hex 1E 49 p a n u0 ul Decimal 30 73 p a n u0 ul Send a request to all the TAGs present in RF Answer in accordance with the modality defined in the byte p flag the TAGs having AFI Ap plication Family Identifier specified from a and having the first n bits of the UID coinciding with the bits in u ul p FLAGS a AFI n number of bits known u0 ul Known byte of the UID Returns status Num Resp Where Num number of bytes of the answer Resp answer codified with ISO IEC 15693 all printer models with RFID reader writer Switch off the RF carrier for n milliseconds ASCII RS R n Hex 1E 52 n Decimal 30 82 n Carrier signal for the communication in RF is not transmitted fo
77. IO output mask IO Bitmap to configure in output IO output default value Default output masked value IO output Enable OpenDrain Enable OpenDrain for masked given output I O IO output Enable PullUp Enable PullUp for masked given output I O N B IO input Enable Filter mask override the value of lO input Enable PullUp mask B IO output Enable OpenDrain override the value of IO output Enable PullUp mask Response CLASS INS DATAOQUT sm ss STATUS 1 CUSTE2M Commands Manual 55 HF ASK commands 01 25 Devices all printer models with ASK module Name Extended lO Read Description Read the Extended IO word Each input lO field is a bitmap definition of the IO as follow 1o1_UCM108 102_UCM108 103_Ucm108 104_UCcm108 105 UCcM108 o o o CLASS INS _ DATAIN 01 2 Mask on 10 bitmap word Mask on IO bitmap Word on the IO concerned N B Bit O to 2 are reserved for future use input value are not taken into account and output values are non significant Response CLASS INS DATAOUT 25 Bitmap on IO word read BITMAP of IO word read IO read masked by input parameter 01 26 Devices all printer models with ASK module Name Extended IO Write Description Write on the Extended IO word Each input lO field is a bitmap definition of the IO as follow Po gor Mask on IO bitmap word Mask on Desired value Mask on IO bitmap Gives a word on the IO concerne
78. Length 1 byte m Number of Services Service List 2m to 3m bytes Service list Block Length 1 byte n Number of blocks Block List 2n to 3n bytes Block list Block Data 16m bytes Block data to write Returned response CLASS INS DATAOUT a Eror Error 1 byte See Error code List CUST 2M Commands Manual 177 HF ASK commands 12 05 Devices all printer models with ASK module Name SEARCH SERVICE CODE FREE FELICA ACCESS Description Obtain the code of area and service from the card CLASS INS DATAIN sos Serviceindex Servicelndex 2 bytes Service index of search Returned response DATA OUT Area Service End Service Code Code Error 1 byte See Error code List Area Service code 2 byte Area replied End Service code 2 byte in case of area 12 06 Devices all printer models with ASK module Name MUTUAL AUTHENTICATION Secure FELICA ACCESS Description Enables the Reader Writer to authenticate the card and card to authenticate the Reader Writer CLASS INS __ DATAIN 2 ss Returned response CLASS INS DATA OUT 2 so Eror Error 1 byte See Error code List 178 Commands Manual CUST 2M HF ASK commands 12 07 Devices all printer models with ASK module Name READ Secure FELICA ACCESS Description Used to read card data in block units using the service specified in the authentication proc ess INS DATAN 07 Number of Block List
79. MPRC uwi cccessccssseessseessstsssseessseesseeen 101 MI_BYTECOUNTERR cessscssscsssseessseessseeeee 12 MI_MFRC_NOTAUTH cessscesssesssseesssesseeeee 102 MI IDLE o sseeessecssseessscessetecsseesssesssessssessseesen 13 MI_WRONG_DES_MODE ecesscsssesesseeeee 103 MI_TRANSERRQ cssscssssesssseessseessstesseeesseeeee 14 MI_HOST_AUTH_FAILED coccion 104 MI_WRITEERR o ccssccesssessssesssseesssessseessseeeee 15 MI_WRONG_LOAD_MODE sccsssceeseeese 106 MI_INCRERR oesesscssscesssessssesssseeessessssesssseeen 16 MI_WRONG_DESKEY esscssssesssssssseeesseeee 107 MI_DECRERR uw sscsssessssessssesssessseesssseesseeeen 17 MI_MKLOAD FAILED csssccssseessseeesseeeee 108 MI_READERR iescssscssssessssessssessssessssesssseeen 18 MI_FIFOERR u cesscssssessssessssessssessssesssseesseeeen 109 MN OV FIERIR sesccstacassicanatstentcrentansiaescone 19 MI_WRONG_ADDR sssesssessssessssesssseeseeeeee 110 MI POLLING ice ot 20 MI_DESKEYLOAD FAILED 111 MI_FRAMINGERR 21 MI_RECBUF_OVERFLOW essccssesesseeeee 112 MI_ACCESSERR nsise 22 MI_WRONG_SEL_ CNT o e seeesssesssessseteseeeee 114 MI_UNKNOWN_COMMAND 0 s ccsssee 0 23 MI_WRONG_TEST_MODE cssccessesesseeees 147 MI_COLLERR vesssccssscessseessseesssesssesssseessseeen 24 MI_TEST FAILED sccssssesssseesseessssessseeen 118 MI_RESETERR u sceesccesssessssessssesssessssessseeeee 25 MI_TOC_ERROR nsaisan 119
80. On Off if 0 Byte 6 The SelectApplication command will be sent at the end of the EHP for ISOB cards if 1 If the following command is sent 01 17 00 the complete status of all the parameters in their current value will be given back The choice No automatic selection of the Select Diversifier is useful for e For the multiSam use to avoid sending this command to a SAM before that the application knows which card is detected and so can choose the good SAM slot For the multiword detection to avoid sending this command to the SAM before knowing which of the card will be chosen first For the RS485 to avoid lacks of communication affected by the critical section of the SAM communication rou tine To allow this choice a new command to Select Diversifier is implemented Function FO1_16_Select_DIV Parameters in Byte 0 Sam Slot Byte 1 protocol Byte 2 5 Card Serial Number Returned value Status of operation 1 Ok 0 Nok If the Timeout mode is chosen mode 1 the search will be performed for the all selected types until the timeout reaches 00 the timeout value to be written in the EnterHuntPhase command is in 10ms unit The order of the search is as follows GTML CD97 Ticket Mifare ISOA ISOB FELICA MV5000 Contact When the timeout is reached thanks to a raised flag the search is given up Otherwise the following type of card will be looked for At the end of the loop if
81. Others RUF Status of the field 00 OFF 01 ON 00 Memorizes the serial number of the last badge presented Parameter kept for compatibility with previous generation couplers 01 Forgets the serial number of the last badge presented Type of the present command 00 short compatibility with the former one 01 long takes into account the next byte for the timeout Duration of the present command in ms Remark a compatibility is ensured with the old Switch_Off_Antenna format only the first parameter for the FIELD parameter CLASS INS DATAOUT STATUS CUSTEM 0E STATUS 1 00 OK 01 problem of communication Commands Manual 47 HF ASK commands 01 12 Devices Name Description all printer models with ASK module Send to antenna Sends the data to the chosen transparent mode either ISOA ISOB cards understanding class 5 commands and MV5000 CLASS INS DATAIN L D STATUS si mem namo length of DATA data made up of The length of the command to transmit to the card 1 actually must be equal to LNG param eter The real frame to transmit to the card NG ATA CLASS INS DATAQUT sm 2 sTATuS LNG 1 DATA x communication status 01 data received 00 resp 03 no data received in timeout delay in Innovatron or ISOA protocol resp ISOB protocol 06 invalid CID 08 ICC fails to answer correctly FF data coding error
82. PROTECTED mode SAM key number to use or KIF of the Key used in PROTECTED mode 00 if NKEY passed in the previous parameter or KVC of the Key used in PROTECTED mode CLASS INS __ DATAOUT sos so REND 3 VALUE 3 REND VALUE execution report outside session for all cards new value 3 bytes binary number signed in session for all cards except CD97 new value 3 bytes binary number signed 96 Commands Manual CUST 2M HF ASK commands 05 04 Devices all printer models with ASK module Name INCREASE Description Increases the value contained in a counter file Records the associated data Remark Executed in session this function can return or not depending on the card type the new value of the counter for the CD97 card the new value will be returned by the CloseSecuredSession CLASS INS DATAIN 04 ACCES 1 SID 1 VALUE LID 2 Index NKEY 00 3 counter KIF 1 KVC 1 ACCES access mode default protected SID SID SID 00 for usually selected EF VALUE value to add 3 bytes binary number positive or nil LID LID used in PROTECTED mode Index counter index of the counter used in PROTECTED mode NKEY KIF SAM key number to use or KIF of the Key used in PROTECTED mode 00 KVC 00 if NKEY passed in the previous parameter or KVC of the Key used in PROTECTED mode CLASS INS DATAOUT 05 04 REND 3 VALUE 3 REND execution report VALUE outside ses
83. RE set of instruction 11 01 Devices all printer models with ASK module Name Create Application DESFIRE Description This function is used to create a new application in the card The application is identified by its Application Identifier on 24 bits The Application ID 000000 is reserved as a reference to the PICC itself Depending on the PICC master key settings a preceding Master Key authentication may be required C mns Daman O o AppID Opt Keynum AppID 3 bytes ID number of the App in the card Msb first Opt 1 byte Or Bit between the following options xxxx0001b if Configuration is changeable xxxx0010b if create delete operation are Free without master key xxxx0100b if access to list directory is free without master key xxxx1000b if master key setting can be changed KeyNum 1 byte Key number of key usable for that new application CLASS Returned response format CLASS INS DATAOUT son lengh Status Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code 11 02 Devices all printer models with ASK module Name Delete Application DESFIRE Description This function is used to permanently deactivate application on the PICC if that operation is al lowed Depending on the PICC master key settings a preceding Master Key authentication may be required CLASS INS DATAIN 02 AppID AppID 3 bytes ID number of the App in the card Re
84. RFID COMMANDS MANUAL Code WI A Edit by CUSTOM ENGINEERING S p A Str Berettine 2 43010 Fontevivo PARMA Italy http www custom biz All rights reserved Introduction 1 INTRODUCTION 1 1 CUSTOM command description Each Custom command reported in this manual is described as shown in the following picture In the first heading line grey colour is reported the hexadecimal command value In the second heading line are listed the devices on which it is possible to use the command for example device AAAA The next fields give all the information useful to use the command Name Command title Format ASCII hexadecimal and decimal command value Range Limits of the values the command and its variables can take Description Description of command function Notes Additional information about command use and settings Default Default value of the command and its variables Reference Pertaining commands related to described command Example 1 HEADING Command title 2 HEADING Devices that use the command Devices BBBB CCCC Name IPrint and carriage return Format IASC CR pex 0D pPecimal 13 Range Description When autofeed is CR enabled this com otherwise it is disreaarded Notes Information valid for devices AAAA BBBB CCC Pe BEBE P Information valid for devices This command sets the print positio AAAA BBBB r This command is immediately e Information valid fo
85. Save key in EEPROM of PCD ASCII US L t s k0 k5 Hex 1F 4C t s k0 k5 Decimal 31 76 t S k0 k5 Save the key like t of the sector s This command is used for Mifare TAG with key example Mf1K Mf4K t 41 t 42 key like A key like B 0 lt s lt 15 number of keys to write k0 K5 6 bytes including the key not crypted Return status all printer models with RFID reader writer Switch off the RF carrier for n milliseconds Mf1K Mf4K MfUL ASCII US R n Hex 1F 52 n Decimal 31 82 n The RF carrier isn t transferred for a n milliseconds In this way the TAG on the antenna will be reset Ifn 0 the RF transmission is switched on permanently 1 lt n lt 255 antenna switched on time Return status 14 Commands Manual CUST M 1F 53 Devices Name Format Description Notes Default Reference Example 1F 58 Devices Name Format Description Notes Default Reference Example CUSTEM HF CUSTOM commands all printer models with RFID reader writer Returns PCD status Mf1K Mf4K MfUL ASCII US S Hex 1F 53 Decimal 31 83 Return 4 bytes of the PCD register b0 RegErrorFlag b1 RegPrimaryStatus b2 RegSecondaryStatus b3 ReglnterruptRq all printer models with RFID reader writer Data Exchange with PICC CC Mf1K Mf4K MfUL ASCII US X nH nL CRC 10 t3 d0 dn Hex 1F 58 nH nL CRC 10 t3 d0 dn Decimal 31 88 nH nL CRC 10 t3 d0 dn
86. Status Commands Manual 21 HF CUSTOM commands 2 2 List of possible Status values Mossos is ioa 0 MI_SENDBYTENR scsssseesssessssesssseeseseeee 51 NOK OK isso niaaa 0 MI_CASCLEVEX sscssssessssessssesssessseesseeen 52 MICRO ZERO sita canastas 0 MI_SENDBUF_OVERFLO Wicca 53 A A 0 MI_BAUDRATE_NOT_SUPPORTED 54 o a 0 MI_SAME_BAUDRATE_REQUIRED 55 MI_NOTAGERR cccoccocccconocconocionocionicanocicnocinn 1 MI_WRONG_PARAMETER_VALUE 60 MI_CHK_ FAILED coococccccccconnoconncinncnonicicnoccon 1 M_WRONGPARAM essccsssesssseesseeessevesseees 61 MI_CRCERR sssaaa 2 11 NYIMPLEMENTED sccssscesseeesseeeeseees 62 MI_CHK_COMPERR cssscsssscessseessseessseeee 2 11 PSEA DY usada 63 MILEMPTY ooo sscceccccssscessseessseesssesssessseesseeeee 3 14 TIMEOUT pean 70 MI_AUTHERR cccoocconccconocoonoconooconaononacconoccnn 4 MANOWRITEccccoccccccononionooconanconocnonocnoancnonons 71 MI_PARITYERR ssania 5 A 72 MI_CODEERRocccooccconccconocconocinaoconacnonocicnoccnn 6 11 MISS _ANTICOLL essecssscessseessseesseeesseeees 73 MI_SERNRERR on 8 11 COMM_ABORT csssecssseessseessseessetesseeess 82 MS 9 MI_BREAK cocccccoccconocionocconocionocinainono cacao caca 99 MI_NOTAUTHERR ccccoccooocconococaconacconocicnoicon 10 MI_NY_IMPLEMENTED 0ocoococcicocoiconccconoico 100 MI_BITCOUNTERReccoccocnccnnocionicicacconocicnocicn 11 MI_NO_
87. TAOUT sos w REND 3 REND execution report 80 Commands Manual CUST M HF ASK commands 03 06 Devices all printer models with ASK module Name READ RECORD CD97 Description Reading of a record given in a circular EF a counter or a linear fixed structure EF CLASS INS _ DATAIN sos so ACCES 1 SID 1 NREC 1 LNG 1 ACCES access mode SID SID SID 00 for usually selected EF NREC recording number LNG length of data to read CLASS INS DATAOUT sos s meND s DATA REND execution report DATA data read n bytes 03 08 Devices all printer models with ASK module Name SELECT FILE CD97 Explicit selection of current EF or DF This command sends back the file description data g D 0 Q o F e CLASS INS DATAIN CNTR 1 LNG 1 PATH x CNTR Selection check 00 MF 02 EF in the current DF identifier bytes 2 to n 08 bytes 1 to n path from MF excluded LNG length of identifier or of path PATH identifier or path NB The command 03 08 00 00 is not supported by CD97 card CLASS INS DATAOUT sos sos REND S Fey REND execution report FCI FCI CUST 2M Commands Manual 81 HF ASK commands 03 09 Devices all printer models with ASK module Name STATUS CD97 Description ditto SELECT FILE but without selecting a file CLASS INS DATAIN sos sos CNTR LNG 1 PATH x CNTR Selection check 00 MF 02
88. UT o6 24 Status Status 00 Ticket still active 02 Ticket deactivated 118 Commands Manual CUSTE2M HF ASK commands 06 26 Devices all printer models with ASK module Name WRITE CTx512B and MIFARE ULTRALIGHT Description Performs a true Write operation puts bits to 1 if not but cannot write a O instead of a 1 It is useful for writing in OTP area or eventually to use the whole Data area as an OTP zone If the Field off CTx configuration is active the field is turned on and a select is done before the command and the field is turned off after the command only in CTx512b mode CLASS INS DATAIN sos 26 ByteNumber NB DATA x Byte Number Address of 1st byte to record 0 63 NB Number of bytes to write from 1 to 64 DATA Data to be written NB bytes CLASS INS DATAOUT soe 26 Length Status DATA x Length length of written and read data in bytes Status 00 No answer 01 Bad CRC 02 Success 03 Bad parameters 82 Security activated Note For the Mifare UltraLight if Status is different from 02 or 03 the card will come into the HALT state so you have to wake it up to perform other transactions DATA data obtained after the Write operation the former existing data plus the written data computed with the OR operation Length 1 byte CUST 2M Commands Manual 119 HF ASK commands 06 27 Devices all printer models with ASK module Name
89. a value representing the argument for the requested upgrade Attribute value has a maximum length of 255 bytes For TFTP upgrade code 0x01 the string has the form lt tftpserverip gt lt filename gt all printer models with UHF module a value representing the memory bank of a EPC Class 1 Generation 2 tag Attribute value is 2 bytes long and can assume the following values 0x00 Reserved Memory Bank 0x01 EPC Memory Bank 0x02 TID Memory Bank 0x03 User Memory Bank all printer models with UHF module a value representing the payload parameter for the EPC Class 1 Gen 2 lock command see the EPC Gen2 specification for details Attribute value is 4 bytes long all printer models with UHF module a value representing the Acess Kill password parameter for the EPC Class 1 Gen 2 commands see the EPC Gen2 specification for details Attribute value is 4 bytes long Commands Manual 199 UHF RFID commands 74 Devices G2NSI 75 Devices QParameter 76 Devices ReaderInfo 77 Devices RFRegulation Note 78 Devices RFChannel 200 Commands Manual all printer models with UHF module a value representing the numbering system identifier for the EPC Class 1 Gen 2 tags id see the EPC Gen2 specification for details Attribute value is 2 bytes long all printer models with UHF module a value representing the initial value for the Q parameter involved in the EPC Class 1 Gen
90. access mode default protected SID SID SID co for usually selected EF VALUE value to deduct 3 bytes binary number positive or nil 5 free bytes LID LID used in PROTECTED mode Index counter index of the counter used in PROTECTED mode NKEY KIF SAM key number to use or KIF of the Key used in PROTECTED mode 00 KVC 00 if NKEY passed in the previous parameter or KVC of the Key used in PROTECTED mode Data Out CLASS ms DATA OUT so s3 REND vaLuEG REND execution report VALUE outside session for all cards new value 3 bytes binary number signed in session nothing CUST 2M Commands Manual 109 HF ASK commands 05 24 Devices all printer models with ASK module Name INCREASE_LG Description It is a command for CD97 card only Increases the value contained in a counter file and writes the 5 free data Records the associated data Remark Executed in session the new value of the counter will be returned by the CloseSecuredSes sion Data In CLASS INS DATAIN ACCES SID VALUE LID Index NKEY KIF 00 KVC 1 1 8 2 counter 1 1 1 ACCES access mode default protected SID SID SID 00 for usually selected EF VALUE value to add 3 bytes binary number positive or nil 5 free bytes LID LID used in PROTECTED mode Index counter index of the counter used in PROTECTED mode NKEY KIF SAM key number to use or KIF of the Key used in PROTECTE
91. ame of the Application to select complete or partial in hexadecimal Default is 1TIC 0x31 0x54 0x49 0x43 0x2E Felica AFI Card function Identifier defaut is all cards OxFFFF Not implemented Yet Felica Nb Slot Slot number for Felica Anticollision default value 3 Not implemented Yet GLASS INS DATA OUT 17 MAXNB REQ NB AFI Auto Deselect Select LNG DATA Felica Felica CARD 1 1 SLOT 1 1 SelDiv 1 1 Appli 1 1 x AFI 2 NBSlot 1 The Data Out represent the present configuration for the EHP CUST 2M Commands Manual 53 HF ASK commands 01 18 Devices all printer models with ASK module Name Switch Signals Description Activates or deactivates the interface signals Led CLASS INS DATAIN a siacru RFU SIGCPU 1 byte CPU description Bit 0 Led 1 red or green activation if bit 1 deactivation if bit 0 Bit 1 Led 2 orange or green ditto Bit 2 Led 3 green ditto Bit 3 Led 4 NE or green ditto NB this byte inactive if the AUTO LEDs configuration 1 py FU Kept for compatibility this parameter is not taken into account in GEN5XX N B There is no integrated MUX 482 management Anyway it is still possible to manage this peripheral in other ways on demand CLASS INS DATAOQUT 18 STATUS 1 0 gt E 1 status 00 01 19 Devices all printer models with ASK module Name Select SAM Description Selects the SAM chosen for the applicatio
92. and This exchange is carried out on a RESET or on a STOP command the host sends only a single byte Remark the only command that may be interrupted by stop is the Enter_HuntPhase polling The reader sends back a single byte of STA status in the event of command acknowledgement HOTE CMD LEC STA In the event that the reader does not recognize the command before xx ms xx depends on estimated time of com mand execution the host can carry out a RESET of the reader HOTE LEC RES 3 3 2 2 Standard command The timeout between issuing the command and the reader s response depends on the command sent CMD LNG DATA 00__ CRCL CRCH timeout LEC STA LNG DATA 00_ CRCL CRCH The old style EnterHuntPhase commands do not call for responses search for badge card if no card is detected Anyway it is possible to use the parameter timeout of the command and use it periodically However for compat ibility reasons the STOP command is kept HOTE EnterHuntPhase EnterHuntPhase timeout 3s LEC R ponse EHP Stop a pure command CMD STOP 02 Abort the response to this pure command STA ABORT 04 EnterHuntPhase issue of CMD LNG DATA 00 CRC That is to say 80 07 01 03 00 00 00 00 01 00 65 18 See Details of reader functions EHP answer the response to EnterHuntPhase if a card is found by the antenna CUST 2M Commands Manual 31 HF ASK commands 3 4 DESCRIPTION OF THE CONTACT
93. anual 143 HF ASK commands 10 07 Devices all printer models with ASK module Name ReadSector MIFARE Description The aim of this function is to read a Sector of the PICC CLASS INS DATAIN sw o7 Length KeyPicc SectorNum KeyPCD Length 1 byte fixed value 03 KeyPICC 1 byte value 0A for KEYA or 0B for KEYB SectorNum 1 byte Sector Number of the sector to authenticate value 00 to 0F KeyPCD 1 byte Index of the PCD key value 00 to 1F for storage area keys FF internal buffer Key CLASS INS DATAOUT 10 07 Length Status Code PiccSerialnumber 4 bytes SectorContent N Length 1 byte Response length 46 in case of successful operation Status 1 byte See List of response code Code 1 byte 08 means MIFARE STANDARD 1K Card and 18 MIFARE 4K Picc Serial Number 4 bytes Serial number of the card SectorContent 64 bytes for a MIFARE STANDARD 1K Card and 256 for a MIFARE 4K Sector read in the card in the following order Block0 Block1 Block2 The Block3 or Block16 for a MI FARE 4K is the Trailer Block which includes the Keys and access bit the value read may not be the right one depending on the access bits NB For a MIFARE 4K Card if SectorNum gt 0x28 the read function will loop back at the beginning of the sectors of the card It is identical for the MIFARE STANDARD 1K except that the Sectors from 0x10 to 0x27 are prohibited NB
94. ard SAM commands enabling rapid and secure transactions without contact The user of the GEN5XX coupler may also implement many different supported cards ticket through high level com mands without bothering about details of the card SAM commands set The GEN5XX coupler has been designed to keep maximum compatibility with previous version of ASK coupler families such as GEN3XX and GEN4XX coupler The main differences therefore concern RF treatment 15693 is not implemented on all version but the Felica is now managed ll interface is not implemented anyway it still can be implemented on demana The aim of this document is to present the software interface of this coupler General description of operation Communication Protocol Description of communication scenarios Details of commands Applications e Transport ticketing Payment e Access control E Paper Functions supported e System functions for example configuration of the coupler e Software download functions e Card functions specific to each type of card handled Cards supported e CD97 RJJ and RJL masks GTML GTML2 CT2000 e CTS 256 and 512B Ticket e CTM 521B Ticket e Mifare Standard 1K Mifare 4K Mifare UltraLight e Mifare ProxX e Philips SmartWX and DESFire e Motorola MV5000 e ePassport and elD e ST ST19WR66 e ST ST19XR34 Sharp Atmel AT9OSC e Any ISO 14443 4 A B compliant card and ticket Any Felica an
95. as EE 107 A aa R A 108 OLA e AE E 108 05 23 E E no EL POE 109 A A PP rade cidade neat slahinats 110 A A TA 112 OD DO cities 112 A o oe 113 POD MUA till ibclcds 113 OG 20 na 116 A amid tiecnaeis 117 SUL rubia 117 A A A A E tio 118 SUL A iii 118 DOD O ciao la 119 PUSE ni 120 A cer atts ata 121 Sh eosin ia a 122 DUDO i AE E ETT 124 06 32 nenta a a E ESA 125 DUO DOS tala E 126 06 34 nanana A 126 POD 35 siria is 127 06 oO AA a 128 STO O ds lia 134 A R 140 DO DOD AA 141 GO OF o SR 142 10 SB tel a hese le hans taal 142 10 DOG nonna A 143 IO OT scared 144 10 FOG En 7 05 Po 145 214 Commands Manual A E Tremere rr ey 145 A niea 146 O10 SOE MEE E OO A hand 147 A A dante citetl R a 148 RO A A a 148 TO SOA stas iris 149 10 0B dute ana R 150 STO GOC dirii A ATE 151 o O 154 A ar EEE 154 A R 155 A E TA 155 TI SOS ici 156 SIT SOG oinaan aea 156 TI SOT nienn mE 157 A cts Ec Sedona 157 SIT JOI oraina a E 158 A aan 158 TI SOB coartada 159 A E T te 159 11 SOD errin rater Dee ere eerie entree 160 11 SOE ica ips 160 SUS caian bado 161 A Ac Sedat 161 SITS TO oirionn 162 A daamtaieetnenncgdiuurdunttanuesd 162 T S T ounan a R 163 Dios 163 A ar R 164 GE GT AE TE 164 A a ROS 165 A crue E 165 SIT STA EP o a E 166 A eia 166 DI OTC A En on esas 167 A eb uadidaas taunts tc chicatle es 167 MIES ino 168 A aaaea 168 TI S20 caian bandas 169 E A A enn Te 169 A A 170 Ia ori is 170 A na acean adaetaadmem taeese ch
96. ass But this card has to be searched with an ISO A search and not a Mifare search The communication layer of the UltraLight complies to parts 2 and 3 but not 4 of the ISO 14443 A standard Anti collision and Security features are also implemented The 512 bit EEPROM memory is addressed by 4 bytes wide pages but the CSC handles byte level It is organised in 16 pages favTENUMBER o 4 2 3 Page SerialNumber _sNo SN1_ sN2_ Bcco 0 Serial Number_ SN3_ sN4 sN5_ sne 1 _Internal Lock_ BCC1 Intemal Locko Loki 2 or oro om1 otra om3 3 DATA read write Data0 Datat__ Data2 Data3 4 DATA read write Data4 Data5 Daae Data7 5 DATA read write Datag___ Data9 Datato Daat 6 DATA read write Data16_ Datat7_ Datatg Datat9 8 DATA read write Data20 Data21_ Data22_ Data23 9 DATA read write Data24 Data25 Data28 Data27 10 DATA read write Data32__ Data33_ Data34 Data3s 12 DATA read write Data36___ Data37 Data3g Data3g 13 DATA read write Data40 Data4 Data42 Data43 14 DATA read write Data44 Data45_ Data4g Data47_ 15 CUST 2M Commands Manual 115 HF ASK commands 3 7 8 3 Functions list 06 20 Devices Name Description all printer models with ASK module LIST CTx512B ONLY List performs anticollision and a
97. at each power up The first command after initialization must be the SoftwareVersion Command which allows the use of other com mands 3 2 3 Frame format There are two types of message pure command messages reduced to CMD byte and the messages containing an application command system and card commands 3 2 3 1 Command frames CMD 1 byte See Detail of CMD and STA registers LNG 1 or 2 byte s See Frame length DATA x byte See Details of reader functions See Software interface End of frame 00 Fixed value 0x00 CRC 2 bytes CRC CCITT of all the previous bytes See Calculation CRCL of CRC CRCH The host sends this frame and the bytes may be sent one after another without interruption The maximum time between each byte sent by the host is checked by timer around 1500 ms The LNG value is the length of the DATA block in the frame The End of frame byte is a byte which means to the reader that the DATA block is finished and that the two follow ing blocks are the CRC The protocol does not include a mechanism of resumption on communication error CUST 2M Commands Manual 25 HF ASK commands 3 2 3 2 Response frame STA 1 byte See Detail of CMD and STA registers LNG 1 or 2 byte s See Frame length DATA x byte See Details of reader functions See Software interface End of frame 00 Fixed value 0x00 CRC 2 bytes CRC CCITT of
98. atch 2 Equipment Type 1 Balance After Reloading 3 Amount 3 Time 2 Security Device ID 4 Security Device Transaction Number 3 Tag Transaction Number 2 If purchase transaction or purchase cancellation CLASS INS DATAOUT soe rEND PMEG PAID 19 REND execution report PME PME balance Most significant Byte first JPAID 19 first bytes of most recent recording in payments journal Amount 2 Date 2 Time 2 Equipment Type 1 Security Device ID 4 Security Device Transaction Number 3 Balance After Purchase 3 Tag Transaction Number 2 CUST 2M Commands Manual 85 HF ASK commands 03 0D Devices all printer models with ASK module Name PURCHASE CD97 Description Purchase with PME CLASS INS DATAN ss so acmar saD ae ACHAT type of purchase 00 purchase transaction 01 purchase transaction with display according to type of purchase JPAID 7 first bytes of new recording in payments journal Amount 2 bytes hexadecimal value of amount to debit from the card Remark this value should be negative Date 2 bytes Hexadecimal value of debit date The debit date is usually equal to the number of days since 1 1 97 Time 2 bytes Hexadecimal value of debit time This time is usually equal to the number of minutes since 00h00m Equipment Type 1 bytes Hexadecimal value of type of equipment used to make the debit Example for a debit of
99. atified immediately except for CD97 and GTML1 4A switches OFF the field if the card doesn t answer TIMEOUT if TYPE 4A eras ms DATA OUT 2 sos sm REND mesures REND execution report RESULT result of incoming outgoing orders during the session The format is as follows 1er byte function number following bytes same format as for a function execution outside session apart from the report 3 first bytes 05 12 Devices all printer models with ASK module Name ABORT SECURED SESSION Description Stop the current certification session This still allow to continue to dialogue with the badge and in particular open a new session crass ms DATA MT No associated input data crass Ns DATAOUT s2 REG execution report P m Z U CUST 2M Commands Manual 103 HF ASK commands 05 14 Devices all printer models with ASK module Name DECREASE MULTIPLE Description Decrease the value contained in several counters Remark This function should be carried out in session and it immediately returns the new value of the counters This command is not supported by CD97 and GTML ANA o A ACCES 1 SID LID NKEY 00 NBC 1 CI 1 VALUE 3 1 2 KVC KIF 1 1 ACCES access mode SID Short ID NKEY KIF SAM key number to use or KIF of the Key 00 KVC 00 if NKEY passed in the previous parameter or KVC of the Key NBC Number of counters concerned maximum
100. ber po REHABILITATE Read Record INVALIDATE Update Record RUF Write Record or Decrease RUF Append Record or Increase Nkey 4 bytes key index number to be used Status 1 byte X0 Card Valid X1 Card invalidated 0X No errors on PIN presentation 1X An error of PIN presentation 3X Two errors of PIN presentation 7X Three errors of PIN presentation Any new presentation of PIN is rejected Other values RUF KVC1 1 byte 00 for an EF KVC2 1 byte 00 for an EF KVC3 1 byte 00 for an EF Floor 3 bytes Value fixed at 000000 Ceiling 3 bytes Value fixed at F FFFFF for the counters and at 000000 for the other types of file 62 Commands Manual CUST 2M HF ASK commands 3 7 3 4 Set of instruction 02 01 Devices all printer models with ASK module Name APPEND RECORD GTML Description Adds a record to an elementary circular file This new record becomes the first in the file the older one is suppressed CLASS INS DATAIN so m acces s00 sip inem DATA x ACCES access mode 00 other RFU values SID SID SID 00 for usually selected EF LNG length of data to record n bytes size of a recording DATA data to record CLASS INS DATAQUT soz sos meND s REND execution report 02 06 Devices all printer models with ASK module Name READ RECORD GTML Description Reading of a record given in a circular EF a counter or an EF linear fixed structure CLASS INS DATAIN so
101. blocks to read all printer models with RFID reader writer Returns UID ASCII RS S n Hex 1E T3 n Decimal 30 115 n Returns the UID of the TAG number n n number of the TAG to read for UID Return 10 Commands Manual CUST M 1E FF Devices Name Format Description Notes Default Reference Example 1F 30 Devices Name Format Description Notes Default Reference Example CUSTEM HF CUSTOM commands all printer models with RFID reader writer Read write a value in the PCD register ASCII RS n a d Hex 1E FF n a d Decimal 30 255 n a d Read or write in a PCD register having address a the value d following tha table below The data to write in the register must be specified only during the writing operation all printer models with RFID reader writer Reset the PCD ASCII US 0 Hex 1F 30 Decimal 31 48 Reset the RF device used for the communication Commands Manual 11 HF CUSTOM commands 1F 34 Devices Name Format Description Notes Default Reference Example 1F 43 Devices Name Format Description Notes Default Reference Example 12 Commands Manual all printer models with RFID reader writer Write the 4 bytes of the TAG sector MfUL ASCII US 4 n bO b3 Hex 1F 34 n bO b3 Decimal 31 52 n b0 b3 Writes the 4 bytes bO b1 b2 b3 of the page number n of TAG O lt ns15 0 lt b
102. bytes See List of response code CUST 2M Commands Manual 157 HF ASK commands 11 09 Devices all printer models with ASK module Name Commit Transaction DESFIRE Description This function commits the transaction to end a transaction operation with changes CLASS INS DATAIN o Returned response format CLASS INS DATAQUT 09 Length Status Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code 11 0A Devices all printer models with ASK module Name Abort Transaction DESFIRE Description This function aborts the current transaction to end a transaction operation with no changes CLASS INS DATAIN soa o o Returned response format CLASS INS DATAOUT 0A Length Status Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code 158 Commands Manual CUST 2M HF ASK commands 11 0B Devices all printer models with ASK module Name Change Key DESFIRE Description This function allow to change any key stored on the PICC If AID 00 00 00 is selected the change applies to the Master key and therefore only the key N 00 is valid CLASS INS DATAIN sm SOB KeyNumber 1 byte specify the number of the access key which shall be changed Depending on this key number and the ID of the currently selected application KeyNum will address either an ordinary application key
103. cation interrupted 01 bad CRC 0F success 40 detection of a card which is not a CTS 256 80 collision DATA data read Length 1 byte maximum 8 bytes of series number 06 02 Devices all printer models with ASK module Name READ CTS256B Description Reading of a number of bytes at a given address CLASS INS DATAIN sos 02 aD NB ADD Address of the first reading 0 31 in bytes NB Number of bytes to read from 1 to 32 CLASS INS DATAQUT 06 02 length Status DATA Length response length Status 00 communication interrupted 01 bad CRC 02 success 03 invalid parameters DATA data read Length 1 byte maximum 8 bytes of series number 112 Commanas Manual CUST 2M HF ASK commands 06 03 Devices all printer models with ASK module Name UPDATE CTS256B Description Deletion if necessary recording then checks by reading bytes written at ADD address CLASS INS _ DATAIN sos s am m paa _DATAInCTS 0 ADD Address of 1st byte to record 0 31 NB Number of bytes to read from 1 to 32 DATA Data to record NB bytes DATAinCTS Data already read and recorded in the ticket NB bytes enables quicker recording If the data is not known or is required to be deleted every byte of DATAinCTS must be set to OxEE CLASS INS DATAOUT o6 sos Length Status DATA x Length length of written and read data in bytes Status 00 No response 01 Bad CRC
104. ces G2Write Parameters 97 Devices G2Lock Parameters 99 Devices G2Kill Parameters 9A Devices G2Query Parameters 208 Commands Manual all printer models with UHF module permits to write data into anyone of the Gen2 tag memory banks SourceName in optional the name of the source to use TaglDLen in the ID length of the tag TaglD in the ID of the tag MemoryBank in the memory bank TagAddress in the address where to write the data Length in the number of bytes to write must be an even number TagValue in the data to write to the tag memory G2Password in the EPC Access password optional ResultCode out the result code all printer models with UHF module permits to execute the tag lock command defined by the EPC Class 1 Gen 2 protocol SourceName in optional the name of the source to use TaglDLen in the ID length of the tag TagID in the ID of the tag G2Payload in the lock payload G2Password in the EPC Access password optional ResultCode out the result code all printer models with UHF module permits to execute the tag kill command defined by the EPC Class 1 Gen 2 protocol SourceName in optional the name of the source to use TaglDLen in the ID length of the tag TaglD in the ID of the tag G2Password in the kill password ResultCode out the result code all printer models with UHF module per
105. cess bit COI so sos Lengm KeyPiGc Sectortum KoyPco newkeya Accessi FreeByie NewkeyB Finaiautkey Length 1 byte 14 for this command KeyPICC 1 byte value 0A for KEYA or 0B for KEYB used for initial authentication default is A SectorNum 1 byte Sector Number of the sector value from 00 to 0F for a MIFARE STANDARD 1K Card and from 00 to 27 for a MIFARE 4k on which the keys have to be changed KeyPCD 1 byte Index of the PCD key value 00 to 1F for storage area keys FF internal buffer Key used for initial authentication NewKeyA 6 bytes New value of the A Key unencrypted with LSB First AccessBits 3 bytes All access bits including trailer block as described in the MIFARE specification FreeByte 1 byte Last byte of the access bit of the trailer block its value can be used for any purpose NewKeyB 6 bytes New value of the B Key unencrypted with LSB First FinalAutKey 1 byte Index of the key value for final Authentication 0A for KEYA or 0B for KEYB CLASS INS DATAOUT o sos Length Status Code Pico serial Number 4 bytes Length 1 byte Response length 06 in case of success for this Response Status 1 byte See List of response code Code 1 byte 08 means MIFARE STANDARD 1K Card and 18 MIFARE 4K Picc Serial Number 4 bytes Serial number of the card CUST 2M Commands Manual 141 HF ASK commands 10 04 Devices all printer models with ASK module Name
106. cess mode SID SID SID 00 for usually selected EF VALUE value to deduct 3 bytes binary number positive or nil CLASS INS DATAQUT sos REND AEO REND execution report outside session VALUE new value 3 bytes binary number signed 03 04 Devices all printer models with ASK module Name INCREASE CD97 Description Increases the value contained in a counter file Records the associated data Remark Executed in session this function does not return the new value of the counter it will be returned by the CloseSecuredSession function CLASS INS DATAIN 03 04 ACCES 1 SID 1 VALUE 3 00 00 00 00 00 ACCES access mode SID SID SID 00 for usually selected EF VALUE value to add 3 bytes binary number positive or nil CLASS INS DATAOUT 03 O 04 REND 3 VALUE 3 REND execution report outside session VALUE new value 3 bytes binary number signed CUST 2M Commands Manual 79 HF ASK commands 03 05 Devices all printer models with ASK module Name INVALIDATE CD97 Description Invalidates the current DF and consequently all related files CLASS INS DATAIN sos sos acces ACCES access mode CLASS INS DATAOUT sos so RED REND execution report 03 07 Devices all printer models with ASK module Name REHABILITATE CD97 Description Cancels file invalidation CLASS INS DATAIN sos 07 ACCES 1 ACCES access mode CLASS INS DA
107. command in the directory concerned Coss ms JD TYPE 1 SID 1 NREC 1 NKEY 00 MODE KIF 1 KvC 1 1 TYPE SID NREC NKEY KIF 00 KVC or FF MODE Type of operation 00 Personalization 01 Reloading 02 Validation SID SID 00 for usually selected EF recording number to read 00 no recording to read 01 reading of a number 1 or unique recording SAM key number to use or KIF of the Key 00 if NKEY passed in the previous parameter or KVC of the Key or OxFF if the KVC is unknown Mode of operation 00 simple mode 01 extended mode the KVC used is sent back The extended mode is not supported by CD97 and GTML Voss ms TRATA Or AAA A 29 REND NBAPP PATH1 PATH n DATA KVC execution report 2 n where n is the number of non ratified applications path of the first non ratified application path of the n non ratified application if recording to read 29 bytes of data KVC in extended mode 102 Commands Manual CUST 2M HF ASK commands 05 11 Devices all printer models with ASK module Name CLOSE SECURED SESSION Description Closure of certification session Example For an Increase function executed in session we obtain 00 90 00 04 nnnnnn where nnnnnn is the new value of the counter DATA IN TYPE_CMD TIMEOUT 1 1 TYPE_CMD 00 session will be ratified at the reception of the following command 80 session is r
108. d Type 1 byte 14 type of the command to set custom FWT Hi 1 byte high byte of custom FWT Low 1 byte low byte of custom FWT FWT Hi 256 Low If FWT 0 FWT is given by the card during detection CLASS INS DATAOUT so som teng Status Length 1 byte 01 for this Response Status 1 byte idem previous Status 138 Commands Manual CUST 2M HF ASK commands O Get current RF speed DRI and DSI CLASS INS DATAIN so o Length Length 1 byte 01 for this command Type 1 byte 15 type of the command to get current DRI and DSI Returned response CLASS INS DATAOUT so on Length Status DSI ori Length 1 byte 02 for this Response Status 1 byte idem previous Status DSI 1 byte PICC to PCD RF speed DRI 1 byte PCD to PICC RF speed DSI and DRI coding 00 106 kb s 01 212 kb s 02 424 kb s 03 847 kb s P Get current Frame Waiting Time CLASS INS DATAIN sto o Length Length 1 byte 01 for this command Type 1 byte 16 type of the command to get current FWT Returned response CLASS INS DATAOUT sor lenn m Low Length 1 byte 02 for this Response Hi 1 byte high byte of current FWT Low 1 byte low byte of current FWT FWT Hi 256 Low CUSTEM Commands Manual 139 HF ASK commands 3 7 10 7 Card functions 10 02 Devices all printer models with ASK module Name Select MF MIFARE Description This command selects one speci
109. d Mask on IO desired value values desired on IO ports according to the mask on IO bitmap N B Bit O to 2 are reserved for future use input value are not taken into account Response CLASS 56 Commands Manual CUST 2M 01 27 Devices all printer models with ASK module Name Set SAM Baudrate PPS Description Perform a PPS CLASS ms DATAN so ger ProProt Proposed protocol 0 for T 0 1 for T 1 ParamFD FiDi parameter Response GLASS ms oaao sor sar tetas status STATUS 2 bytes status CUSTEM HF ASK commands Commands Manual 57 HF ASK commands 3 7 3 GTML Class N 02 Presentation of GTML badge Generic Transport Mask Light This Card is a transport dedicated card 3 7 3 1 Main functions Ticketing ensures checking of access to public transport networks This is its main function This includes the differ ent existing pricing modes and should enable the introduction of new ones 3 7 3 2 Structure of data The card is organized into files according to ISO IEC 7816 4 and takes its inspiration from the EN726 3 norm The GTML card files have several attributes type DF dedicated file or EF elementary file long identifier LID short identifier SID sub type only for the EFs fixed structure circular counter 58 Commands Manual CUST 2M HF ASK commands Master File ID 0002 SID 02 Linear 1 record ID 3F00 SID NA TD 1D 0003 SiD 03 Linear 1
110. d NFC Passive devices e ST SR Family CUST 2M Commands Manual 23 HF ASK commands 3 1 GENERAL OPERATION 3 1 1 Introduction The GEN5XX reader communicates through a serial or a USB link and behaves as slave during all exchanges it may have with the host the latter being an application card a computer etc 3 1 2 Description of interface The communication interface with the host computer can be USB RS232C RS485 for electrical interface or TTL serial The physical characteristics of this interface as well as the mode of selection are described in the hardware specifica tion documents for GEN5XX couplers The rate of serial interface is programmable The default value retained is 115 200 bauds This default value may be changed by the user using a system command Rate is programmable between 9600 baud and 691200 baud s The link format in transmission and reception is 8 bits no parity 1 stop bit 24 Commands Manual CUST 2M HF ASK commands 3 2 COMMUNICATION PROTOCOL 3 2 1 Description The reader behaves as slave thus waits for a command coming from the host master carries out this command and sends to the host the response to this command As soon as the reader is switched on the host must before anything else carry out a zero reset of the reader After this RESET of the reader the host may send all the commands necessary to run the application 3 2 2 Reader RESET Procedure The reader is re initialized
111. d by badge 01 09 File error 01 62 82 End of recording attained 69 81 Incompatibility with file structure 6A 82 File not found 6A 83 Recording not found 6A 84 Memory insufficient in the file 98 10 Application DF or MF invalidated Badge side security 02 69 82 Security conditions non respected no alea cryptogram absent no current error session access condition unknown 63 00 Certificate incorrect in protected mode 63 CX Signature incorrect X represents the number of attempts still authorized 0 1 or 2 69 83 Command rejected since maximum number of errors 3 was reached PIN access only 98 00 PME Certificate incorrect Session Error 03 69 86 Command not authorized no current EF 64 00 EEPROM capacity insufficient for the session 69 85 Access prohibited with this command mode NEVER Session Problem Badge physical error 04 65 81 Memory failure 96 10 20 30 EEPROM Failure 72 Commands Manual CUST 2M Error application Card invalid Badge error code unknown Abnormal execution reported by security module SAM side security alert SAM physical error SAM instruction error SAM security alert SAM Answer TimeOut Communication incorrecte badge abandon dialogue SAM communication incorrect Abnormal execution reported by the CSC controller 05 06 09 codes 20 29 20 21 22 29 2F 40 41 80 HF ASK commands 6A 80 Value to deduct or ad
112. d ignored on incoming messages Length Encodes the length of the AVP packet including the length and the reserved fields Attribute type A 2 byte code identifying the attribute type Attribute value The actual attribute value according to the type It follows immediately after the Attribute Type field and runs for the remaining bytes indicated in the Length i e Length minus 6 bytes of header CUST 2M Commands Manual 189 UHF RFID commands 4 2 1 Attribute types 01 Devices all printer models with UHF module CommandName the command to be executed All the commands are specified in the relevant table Attribute value is 2 bytes long 02 Devices all printer models with UHF module ResultCode a code representing an indication on the result of the command All the commands are specified in the relevant table Attribute value is 2 bytes long 0E Devices all printer models with UHF module EventType the type of the notified event Attribute value is 4 bytes long and can assume the following val ues 0x00 Unknown Event 0x01 Tag glimpsed 0x02 Tag New 0x03 Tag Observed 0x04 Tag Lost 0x05 Tag Purged 0F Devices all printer models with UHF module TaglDLen the length of the tag ID Attribute value is 2 bytes long 10 Devices all printer models with UHF module TimeStamp an indication of the time Attribute is 8 bytes long and must be interpreted as follow the 4 least significant bytes are the seconds
113. d incorrect PIN incorrect 6A 81 function not handled 6A 87 Lc incompatible with P1 P2 6B 00 P1 or P2 incorrect 98 30 P2 incorrect 98 40 P2 of previous GetEP incorrect or GetEP omitted 98 60 Operation impossible PME already at minimum or PME capacity ex ceeded 67 00 P3 incorrect 68 00 Unsupported on CD97 and GTML KVC request on Open Secured Ses sion 6D 00 INS incorrect 62 83 DF parent or MF invalidated Badge return unknown code cf spec CD97MiniMS 69 00 Command not authorized A counter of key uses or the n of PME trans actions attained its maximum 69 85 Command not authorized conditions of use nor satisfied 69 88 Cryptogram incorrect 65 81 Eeprom Problem 94 10 Value incorrect in incoming data 94 20 Exceeding of PME badge capacity 6A 83 Recording not found The key requested is not present in the key file 6A 86 P1 P2 incorrect Key reference too large 6A 87 Lc incompatibly with P1 P2 64 00 Execution error SAM return un known code 00 EF No SAM answer byte 0 00 RUF byte 1 INS code ISO of the frame which has failed 00 if multiple com mand byte 0 00 RUF byte 1 INS code ISO of the frame which has failed 00 00 command unknown 00 01 concatenation not authorized for this func tion 00 02 maximum number of concatenable functions attained 00 03 access mode incompatible with the concatenation 00 04 access mode prohibited for th
114. d yet ooooooconnicnnciicnicco 55 DOT G24 A A ee aaee ie aides 55 DOT G2 5 SO PUC O OOO O 56 GOT uc aia aid 56 O nas 57 IA A tandem iadrsadevdehaess 63 02 06 ias 63 GO2 O iii ia iii 64 02 SOB iii os 64 DGO2 O A E 65 02 DA ii ds 65 02 05 iniciacion AEAEE REEE 66 DOD SOT rni O 66 HOZ GOB iris ati iia 67 02 GOA ad 67 02 SOG initial 68 A cerca a 68 02 GA tenors iia 69 02 li aodtaaassietiatasarsehsecderssctaders 69 GOS SOT inaen e anaa 76 DOB 02 noia 77 NA O a endrietevve tenes 78 03 GOS ias 79 GOB 04 E iii 79 RR e a 80 DOB OT R E E T A ad 80 e 056439 0 OOO POCO CO shadtaiassicaasigvasscncecdevoucladess 81 GOS GOB ica iia ln labra 81 03 GO sica 82 03 SOA iii A i 82 03 SOB ias 83 03 SOG ini oaea aeaiiai 84 03 SOE curia 85 A ataveterde vee ei drietvdanties 86 DOB GAS nas 87 Commands Manual 213 Commands Index A en a R 88 03 SIO scr 89 03 llas dirias 90 os ir caba 90 A na a 91 A Ohora anri n E 92 04 GOS icaclnsiareiamans a 92 A a ches cecil tal AEEA 94 05 O2 enen n R ee reer Pree renee etre 94 AI ooer a 95 A a 96 05 SOf cil li 97 O 97 05 SOT sitas lies 98 05 10 sacle oarsmen aaaiaimuiomonuaioeaimeane 98 05 DO ci cate theca En 99 A Seainnedataasundinaaenentaeete 99 05 POP paris 100 05 OB PR E 101 A ae ie enc a a 101 PP a a A 102 Or i EAA iuadnantiaed 103 05 y PRO oo A PP P R 103 A cher ale aan ealnaates 104 A chasse eaten A 105 O usais 105 05 GOD A o A ER 106 A a ete
115. date and time Datetime in the date and time to set up ResultCode out the result code all printer models with UHF module GroupSelectUnselect permits to execute the tag selection commands defined by the IS018000 6B protocol Parameters SourceName in optional the name of the source to use Operation in the tag selection operation Bytemask in the byte mask as defined by the protocol TagAddress in the address where to compare the data TagValue in the data to compare with the tag memory TaglD out the ID of the tag ResultCode out the result code 86 Devices all printer models with UHF module GetlO permits to read the current status of the I O lines Parameters ORedgister out the status of the I O lines ResultCode out the result code 87 Devices all printer models with UHF module SetlO permits to set the level of the output lines Parameters ORedgister in the value to set to the output lines ResultCode out the result code 88 Devices all printer models with UHF module SetlODirection permits to define the direction of the I O lines 0 input 1 output Parameters lORegister in the direction to set to the I O lines ResultCode out the result code 206 Commands Manual CUST 2M 89 Devices GetlODirection Parameters 94 Devices E119ProgramiID Parameters 95 Devices G2ProgramID Parameters 96 Devices G2Read Paramet
116. e Remark This function should be carried out in session and it immediately returns the new value of the counter CLASS INS DATAIN 02 03 ACCES 00 SID 1 VALUE 3 00 00 00 00 00 ACCES access mode 00 other RFU values SID SID SID 00 for usually selected EF VALUE value to deduct 3 bytes binary number positive or nil CLASS INS DATAOUT C s so ReDo VAE REND execution report VALUE new value 3 bytes binary number signed 02 04 Devices all printer models with ASK module Name INCREASE GTML Description Increases the value contained in a counter file The associated data is not written in the GTML Remark This function should be carried out in session and it immediately returns the new value of the counter CLASS INS DATAIN 02 04 ACCES 00 SID 1 VALUE 3 00 00 00 00 00 ACCES access mode 00 other RFU values SID SID SID 00 for usually selected EF VALUE value to add 3 bytes binary number positive or nil CLASS INS DATAOUT 02 04 REND 3 VALUE 3 REND execution report VALUE new value 3 bytes binary number signed CUSTEM Commands Manual 65 HF ASK commands 02 05 Devices all printer models with ASK module Name INVALIDATE GTML Description Invalidates current DF and consequently all the related files CLASS INS _ DATAIN so 05 ACCES 00 ACCES access mode 00 other RFU values CLASS INS DAT
117. e Response length 01 for successful operation Status 1 byte See List of response code 148 Commands Manual CUST 2M HF ASK commands 3 7 10 8 Value block functions N B To initialize a block as a value block by the access bits first the data block must be initialized by a WriteBlock command as follow Byte Number pop1ifafapajsjoej7 ejojtojt1 12 13 14 15 On an increment or a decrement command the PICC does a hardware update of the 3 fields containing value and complement of this value The Address of the block Ad bytes must be present but they are not updated in the op eration 10 0A Devices all printer models with ASK module Name Increment Value MIFARE Description This function is used to increment a PICC block initialized as a value block which is a kind of counter see chapter access control bits The block need to be previously authenticated with the right key dedicated to the increment operation The max increment value can stand on 4 bytes Overflow must be managed by the application N B The use of this function requires the knowledge of the Key and access bits present in the Picc and the Pcd INS DATAIN Length BlockPicc Increment B0 B1 B2 B3 CLASS Length 1 byte length fixed at 05 for this command BlockPicc 1 byte block number from 00 to 3F Increment 4 bytes value to increment on the counter LSB first Returned response format CLASS INS DATAOUT 0A L
118. e Restore block number from 00 to 3F where the value must be copied to restore its previous value Returned response format CLASS INS DATAOUT soc Length Status ControlValue B0 B1 B2B3 Length 1 byte Response length 05 for successful operation Status 1 byte See List of response code ControlValue 4 bytes Value after restore operation for control purpose MSB first N B On a restore command the PICC makes a hardware update of the 3 fields containing value and complement of value The Address Ad bytes have nothing to do with the address managed by the restore command considered as value during the restoration CUST 2M Commands Manual 151 HF ASK commands 3 7 11 DESFIREO Class N 11 The DESFIRE Class is based on the NXP DESFIRE card Only function accessible with a SAM MAC are available That Class of function is available only if activated by ASK 3 7 11 1 DESFIRE Cards Memory organization Flexible file system Up to 28 applications simultaneously on one PICC Up to 16 files in each application The 2 or 4 kbyte NV memory is organised using a flexible file system This file system allows a maximum of 28 diffe rent applications on one single PICC Each application provides up to 16 files Each application is represented by it s 3 bytes Application IDentifier AID Five different file types are supported 3 7 11 2 DESFIRE Cards Access Commands Application management CreateApplicatio
119. e multi application usage concept the Felica card employs two concepts called area and service The area serves as a security firewall between different providers sharing the same card The service is used to define the method of accessing the memory User access to the memory is performed via a 2 byte code called the area code or service code The memory space is divided into user block and system block areas The user block area is used to write user data It can be allocated by defining the service In addition to card unique information the system block area contains information about the card structure such as Area Definition Block s and Service Definition Block s Block Type Block Attribute Manufacture ID Block Issue ID Block System Definition Block Area 000 Definition Block Area Definition Block Service Definition Block Category System Block Random Access Block Cyclic Access Block Purse Block User Block CUSTEM Read Write Access Read Write Access w o security Read Only Acces Read Only Access w o security Read Write Access Read Write Access w o security Read Only Access Read Only Access w o security Direct Access Direct Access w o security Cash Back Decrement Access Cash Back Decrement Access w o security Decrement Access Decrement Access w o security Read Only Access Read Only Access w o security Description Provide manufacture information Provide issua
120. ee 171 BA Se chatted bios 171 A 172 A dugdivuearadtanunes 172 12 0 y OE PERO a ES 176 12 A a ET 176 12 AA R 177 A rnanan aa EAN a 177 A ono aE 178 12 A nh honda goad ey 178 12 1 0 ae eee RA A a teem 179 12 08 araritasanri ibas 179 CUST M UHF RFID COMMANDS DO AA Pm A 190 Ur il id 190 SUE Sido 190 GOR A tea S 190 TO renna E 190 A 191 PP E at itend N 191 AE E E EEE 191 E E GE O OO 191 a O E he atch ce a 191 A asmtaensactaauendia aera aeineiaitsteaentamaans 192 A a iN EEA EEEN 192 Em An 192 A A et a a 192 GAF PEC ah aca ate dc aes aes teohen sana acaaaas 192 A A PES PE 193 A nena nastaatimaaadacaeaes 193 G52 che eh el detail lala de 193 GDS ea EE 193 risa ii 193 AP e E ES PO A 194 Oi id bo a 194 58 OPE 0 A N E 194 ae E A A EE 194 A A 194 OE ihe nll cae Salt echelon aed 195 A ne ann eee Ere ME Tye ce eT Cont Sree neren eer Tere 195 iia a 195 Oe Semen E o ane enased 195 a te tanec T enlace fas de 195 A tatiana aia a A 196 e Po ati uccntedauncnantamuaue 196 A A 196 A attatched 196 A nian eatainatehtath tentataass 196 isis ir 197 GOG PEPE PI 197 A 197 OO APEC nn A E 197 ote ET A A dignos 197 iodo 198 rs dl ahaa a TS 198 A ry te A ene rarer Terr 198 bs 198 DOE A UE EE O EA 198 A ania aserecalea aa 199 e A 199 e PES RI 199 A name AN 199 NOT i i eh el ana det at aac E 199 BT OPE E as satan dean iapane Netiadstehetath Rantacaar 200 Oia is 200 E PU 200 li il A A ae 200 78 anan A 200 A a T A 2
121. elapsed from the 1 January 1970 the 4 most significant bytes are the micro seconds 190 Commands Manual CUST 2M 11 Devices TagID 12 Devices TagType 1E Devices ChannelName 1F Devices ChannelAddress 20 Devices TriggerName CUSTEM UHF RFID commands all printer models with UHF module the ID read from the tag Attribute value has a maximum length of 12 bytes For 15018000 tags only the first 8 bytes are significant while for EPC tags all the 12 bytes are significant all printer models with UHF module the tag s type Attribute value is 2 bytes long and can assume the following values 0x00 ISO18KB 0x01 EPCC1G1 0x02 ISO18KA 0x03 EPCC1G2 0x05 EPC119 all printer models with UHF module the name of the notification channel Attribute value has a maximum length of 30 bytes all printer models with UHF module the address of the notification channel Attribute value has a maximum length of 30 bytes all printer models with UHF module the name of the trigger Attribute value has a maximum length of 30 bytes Commands Manual 191 UHF RFID commands 21 Devices TriggerType 22 Devices ReadPointName 4D Devices TagValue 4E Devices TagAddress 4F Devices RESERVED all printer models with UHF module the type of the trigger Attribute value has a maximum length of 30 bytes all printer models with UHF module a st
122. ength Status _ ControlValue B0 B1 B2 B3 1 byte Response length 05 for successful operation Status 1 byte See List of response code ControlValue 4 bytes Value after increment operation for control purpose MSB first m oO 5 Q i e 10 OA 05 04 01 00 00 00 command for an increment of 1 on the value block 4 gives for example the response 10 OA 05 00 00 00 01 02 if the previous value was 0x101 the new value is 0x102 CUST 2M Commands Manual 149 HF ASK commands 10 0B Devices all printer models with ASK module Name Decrement Value MIFARE Description This function is used to decrement a PICC block initialized as a value block which is a kind of counter see chapter access control bits The block need to be previously authenticated with the right key dedicated to the decrement operation The max decrement value can stand on 4 bytes Underflow must be managed by the application N B The use of this function requires the knowledge of the Key and access bits present in the Picc and the Pcd CLASS INS DATAIN 10 0B Length BlockPicc Decrement B0 B1 B2 B3 Length 1 byte length fixed at 05 for this command BlockPicc 1 byte block number from 00 to 3F Increment 4 bytes value to increment on the counter LSB first Returned response format CLASS INS DATAOUT 0B Length Status ControlValue B0 B1 B2 B3 Length 1 byte Response length 05 for successful operat
123. epresenting an IP netmask formatted with the standard IP dotted decimal format At tribute value has a maximum length of 30 bytes 5A Devices all printer models with UHF module IPGateway a string representing an IP address formatted with the standard IP dotted decimal format At tribute value has a maximum length of 30 bytes 194 Commands Manual CUST 2M 5B Devices DESBEnable 5C Devices FWRelease 5D Devices DESBStatus 5E Devices EPCPWD 5F Devices RFOnOft CUSTEM UHF RFID commands all printer models with UHF module used to enable disable the Data Exchange Status Bit handling for 5018000 6b and EPC 1 19 anti collision algorithm Attribute value is 2 bytes long and can assume the following values 0x00 Disable the DESB handling Not 0x00 Enable the DESB handling all printer models with UHF module a string representing the device s firmware revision Attribute value has a maximum length of 200 bytes all printer models with UHF module used to check the Data Exchange Status Bit handling for 5018000 6b and EPC 1 19 anti collision algorithm Attribute value is 2 bytes long and can assume the following values 0x00 DESB handling is not enabled Not 0x00 DESB handling is enabled all printer models with UHF module a value representing an EPC tag password Attribute value is 2 bytes long all printer models with UHF module used to start the generation of
124. ers CUSTEM UHF RFID commands all printer models with UHF module permits to read the current status of the I O lines 0 input 1 output lORegister out the direction of the I O lines ResultCode out the result code all printer models with UHF module permits to write the EPC into a EPC1 19 tag SourceName in the name of the source to use TaglD in the old EPC of the tag TagValue in the EPC to write into the tag memory ResultCode out the result code all printer models with UHF module permits to write the EPC in a Class 1 Gen 2 tag SourceName in the name of the source to use TaglDLen in the ID length of the tag must be an even number TaglD in the EPC to write into the tag memory G2NSI in the EPC numbering system G2Password in the EPC Access password optional ResultCode out the result code all printer models with UHF module permits to read data from anyone of the Gen2 tag memory banks SourceName in optional the name of the source to use TaglDLen in the ID length of the tag TagID in the ID of the tag MemoryBank in the memory bank TagAddress in the address where to read the data Length in the number of bytes to read must be an even number TagValue out the data read from the tag memory G2Password in the EPC Access password optional ResultCode out the result code Commands Manual 207 UHF RFID commands 97 Devi
125. es all printer models with UHF module SelUnselOp a value representing the tag selection operation defined by the 5018000 6B protocol Attribute value is 2 bytes long and can assume the following values 0x00 select equal 0x01 select not equal 0x02 select greater than 0x03 select lower than 0x04 unselect equal 0x05 unselect not equal 0x06 unselect greater than 0x07 unselect lower than 67 Devices all printer models with UHF module Bitmask a value representing the bitmask parameter of tag selection operations defined by the IS018000 6B protocol Attribute value is 2 bytes long only 8 least significant bits are used 68 Devices all printer models with UHF module REESERVED 69 Devices all printer models with UHF module lORegister a value representing the status of the I O lines of the reader Where input lines are separated from output ones input lines are mapped on the less significant bits while outputs are mapped on the most significant Attribute value is 4 bytes long effective used bits depend on the reader model CUST 2M Commands Manual 197 UHF RFID commands 6A Devices ConfigParameter 6B Devices ConfigValue 6C Devices NoOfTriggers 6D Devices NoOfChannels 6E Devices EventMode 198 Commands Manual all printer models with UHF module a value representing a configuration parameter Attribute value is 4 bytes long and can assume the following values 0x0
126. failed since the key in the card is version 0 personalization to do 80 xx error in index input parameter xx Note These report values are proper to the class Structure of elementary counter files Value Free Data Floor Ceiling Value 3 bytes binary unsigned representing current counter value Free data 5 bytes Value fixed at 0000000000 Floor 3 bytes representing counter floor its value is fixed at 000000 Ceiling 3 bytes representing counter ceiling its value is fixed at F FFFFF CUST 2M Commands Manual 61 HF ASK commands FCI file description data Tag 1 byte Fixed value 85 Length 1 byte Fixed value 17 SID 1 byte short identifier 00 for the DF and for the MF Type 1 byte 01 for MF 02 for DF 04 for EF EFType 1 byte type of elementary file 00 for the DF and for the MF 02 Linear fixed structure 04 Circular 08 Counter RecSize 1 byte number of bytes per recording 00 for the DF and MF 1D for the EF NumRec 1 byte number of recordings in the file 00 for the DF and MF AC 4 bytes the 1st for the command index number 0 the 2nd for the command index number 1 the 3rd for the command index number 2 and 4th for the command index number 3 The possible access modes are 00 NEVER 01 PIN 10 SESSION 1F ALWAYS Other values RUF Correspondence chart between command index number and type of file Command MF and DF EF index num
127. fic MIFARE card present in the field by its Unique ID It al lows in case of collision to select one card This command requires the RF chip This function realizes the 15014443 connection such as REQA and SELECT CLASS INS DATAIN 02 O Picc serial Number 4 bytes Picc Serial Number 4 bytes Serial number of the card CLASS INS DATAQUT som Length status Code Pice serial Number 4 bytes Length 1 byte Response length 06 in case of success for this Response Status 1 byte See List of response code Code 1 byte 08 means MIFARE STANDARD 1K Card 18 MIFARE 4K 0x28 for ProX Picc Serial Number 4 bytes Serial number of the card 140 Commands Manual CUST 2M HF ASK commands 10 03 Devices all printer models with ASK module Name Change Key MIFARE Description This function allows writing in the trailer block of a PICC sector to change the keys and dedicated access rights In a first step the sector is authenticated with the old key In a second step the trailer block is modified with this same key and then re authenticated with this same key or the new parameters Remark The keys are in the inverse order than the LoadKey Command Caution The use of this function supposes to know the key present in the PCD and in the PICC and a perfect knowledge of the access bits condition on the MIFARE Picc The change of key opera tion is not always possible depending on the previous choice of the ac
128. gs detected out the tag s id out the result code out parameters are repeated for each readpoint in the source all printer models with UHF module permits to read data from the tag memory SourceName TaglDLen TagID TagAddress Length TagValue ResultCode 202 Commands Manual in the name of the source to use in the ID length of the tag in the ID of the tag in the address from which read the data in the number of bytes to read out the data read from the tag memory out the result code CUST M 6F Devices WriteTagData Parameters 70 Devices LockTag Parameters 71 Devices RESERVED 72 Devices SetBitRate Parameters CUSTEM UHF RFID commands all printer models with UHF module permits to write data to the tag memory SourceName TaglDLen TagID TagAddress Length TagValue ResultCode in the name of the source to use in the ID length of the tag in the ID of the tag in the address where to write the data in the number of bytes to write in the data to write to the tag memory out the result code all printer models with UHF module permits to lock data into the tag memory SourceName TaglDLen TagID TagAddress ResultCode in the name of the source to use in the ID length of the tag in the ID of the tag in the address where to write the data out the result code all printe
129. he first 4 bytes are filled at 00 and the 4 others are the PUPI 8 bytes 1 byte optional length 1 to 16 of application name if bit 3 of byte 6 of EnterHuntPhaseParameter 1 n byte optional application name if bit 3 of byte 6 of EnterHuntPhaseParameter 1 The Historical Bytes if the card is Calypso Compliant otherwise the last 3 are filled at 00 7bytes for GTML2 same order as in the SelectApplication command The Status words is returned if the card is Calypso Compliant filled at 00 otherwise 2 bytes MIFARE protocol The answer in this mode depends on two parameters for the request to be really sent in MIFARE mode the presence of the MIFARE chip in the reader is mandatory AND only one card must be looked for Otherwise the answer is formatted just as an ISO 14443 Type A 14443 4 compliant or not But if the search is a true MIFARE search the format is as follows Communication Status 1 Byte set to 0x00 OK Type of the card e g 0x08 for the Mifare Classic 0x18 for the Mifare 4k 0x28 for the Mifare Classic imple mentation in Prox 1 Byte The 4 Serial Number bytes 42 Commands Manual CUST 2M HF ASK commands ISO 14443 Type A protocol ISO 14443 4 compliant The communication channel number CID 1 Byte Length of the Serial Number 1 Byte The Serial Number if the card is Calypso Compliant otherwise the UID 4 7 or 10 bytes 1 byte optional length 1 to 16 of applicat
130. ich contains the key and access bits for this sector CUST 2M Commands Manual 129 HF ASK commands Key A Access Bits Key B Block N 255 FF 27 Trailer area l I Block N 128 j 32 16 Trailer area 14 Sector 32 20 Trailer area Block N 128 80 Sector 31 1F Trailer area Block N 126 7E Block N 125 7D Block N 124 7C E T A aT aT T Ena a AT ee RTT a lid Ta 1 E 1 1 Block N i 4 3 ae y y at A E ete Trailer area Sao de o A SI l A re li Block N i 4 2 Block N i 4 1 Block N i 4 Block N 3 saro LLETT TIT TT CETTE pe Block N 2 Block N 1 Block N 0 Read only Manufactured area ms HE H Sector i For more details refer to the MIFARE 4K user manual 130 Commands Manual CUSTE2M HF ASK commands 3 7 10 3 Remarks The commands Authenticate ReadSector ChangeKey authenticates a sector and load the PCD key specified in the internal memory of the RF chip The commands ReadBlock ReadMultipleBlock WriteBlock IncrementValue DecrementValue and BackupRe storeValue need to be preceded by one of the previous command in order to authenticate the card sector The cards can be detected in the field either by the command EnterHuntPhase or by the command DetectMF For anticollision detection the command DetectMF indicates the presence of more than one card by its status 0x18 just as the EnterHuntPhase i
131. ier lisible si Invalide aTi Key index KVC123 for DF 00 00 00 TET Plancher des compteurs 00 00 00 Plafond 00 00 00 LKILLLLLLLLLLLLLLLLLLLLLLLLL LLLI LI gt CUST 2M Commands Manual 187 HF ASK commands Message 80 0a 03 01 01 00 05 00 00 00 00 00 00 d4 6e Description Type command Sens Host gt CSC T Function class CD97 class panasiai Command Append Record seia 01 Access in Protected mode citada 00 Selected file id Timing 0 s 95 ms Response 01 05 03 01 00 90 00 00 2f 7c Description Type command Sens CSC gt Host asada Function class CD97 class eee Correct return PEE Response Append Record LKILLLLLLLLLLLLLLLLLLLLLLLLLL LLL LLLI 188 Commands Manual CUST M UHF RFID commands 4 UHF RFID COMMANDS 4 1 INTRODUCTION This chapter describes the message format of the communication protocol used by the host and the reader in order to issuing commands and reply with responses The protocol is based on the Attribute Value Pair AVP schema and foresees a message header in order to identify the message scope The command set and the firmware architecture draw inspiration from the Reader Protocol 1 0 specification draft from EPCGlobal but at now this protocol is not fully compatible with the same last specifications Message fields are described left to right with the most significant byte on the left and the least on the right 4 2 PROTOCOL SPECIFICATION CAEN UHF RFID Reader protocol uses two logical comm
132. ion AbortTransaction not necessary Insufficient Non Volatile memory to complete command Command code not supported CRC or MAC does not match data Invalid key number specified Length of command string invalid Current configuration Status does not allow the requested command Value of the parameter is invalid Request AID not present on PICC Unrecoverable error within application application will be disabled Current authentication status does not allow the requested command Additional data frame is expected to be sent Attempt to read write data from to beyond the file s record s limits Unrecoverable error within PICC PICC will be disabled Previous command was not fully completed not all frame were requested or provided Picc was disabled by an unrecoverable error Number of applications limited to 28 no additional Create Application possible Creation of file application failed because file application with same number already exists No DesFire Sam is available Could not complete NV write operation due to loss of power internal backup rollback mechanism activated Specified file number does not exist Unrecoverable error within file file will be disabled Bad SAM response Bad parameter Applicative level the command is not transmitted to the card Bad length parameter Appli level buffer overload command is not given to the card No response from the card Commands Manual 153 HF ASK commands 3 7 11 4 DESFI
133. ion Status 1 byte See List of response code ControlValue 4 bytes Value after increment operation for control purpose MSB first i e 10 OB 05 04 01 00 00 00 command for an decrement of 1 on the value block 4 Gives for example the response 10 OB 05 00 00 00 01 01 if the previous value was 0x102 the new value is 0x101 150 Commands Manual CUST 2M HF ASK commands 10 0C Devices all printer models with ASK module Name BackUp or Restore a Value Block MIFARE Description This function can be use as well as a Backup Command or a Restore Command The aim of this command set is to restore the previous value of a block as anti tearing protection when the card is getting out of the field during a write operation The previous value can be restored from another value block location To do so the two blocks must belong to the same sector of the PICC The block that need restoration the one which will be written need to be previously authenti cated with the key dedicated to the Restore operation see access bit condition in the Mifare documentation N B The use of this function requires the knowledge of the Key and access bits present in the Picc and the Pcd CLASS INS DATAIN sw soc Length BackupBlock RestoreBlock Length 1 byte length fixed at 02 for this command BackupBlock 1 byte backup block number from 00 to 3F where the value was copied before the failed operation RestoreBlock 1 byt
134. ion This function gets the configuration information on the PIDD and the application master key configuration settings CLASS INS DATAIN 0D Returned response format CLASS INS DATAOUT m som Length Status KeySetting Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code KeySetting 1 byte key settings either for the currently selected application or for the whole PICC depend ing whether an application is currently selected Application ID is non zero or the PICC level is selected application ID is 0 NKeys 1 byte Number of keys defined for the current selected application or for the whole PICC 11 0E Devices all printer models with ASK module Name Get Key Version DESFIRE CLASS INS DATAIN sm soe Keynumber KeyNumber 1 byte specify the number of the access key Returned response format CLASS INS DATAOUT o Length status KeyVersion Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code KeyVersion 1 byte version returned 160 Commands Manual CUST 2M HF ASK commands 11 10 Devices all printer models with ASK module Name Change File Settings DESFIREO Description This function changes the file configuration on the PICC CLASS INS DATAIN su 10 File CommEncrypted NewCommMode NewAccessRights FilelD 1 byte This is the ID of the file whose c
135. ion name if bit 3 of byte 6 of EnterHuntPhaseParameter 1 n byte optional application name if bit 3 of byte 6 of EnterHuntPhaseParameter 1 Length of the Information 1 Byte Information given back in the ATS including Maximum size of a frame accepted by the card 1 Byte Warning OxFF means 256 bytes The bit rate from the coupler to the card 1 Byte The bit rate from the card to the coupler 1 Byte Only the same baud rate for both direction is supported gt 1 if TRUE 1 Byte The Frame Waiting Time Integer which defines the Frame Waiting Time between the end of the frame sent by the coupler and the beginning of the answer of the card 1 Byte The Specific Guard Time Integer which defines the time needed by the card before answering after sending the ATS 1 Byte NAD supported gt 1 if TRUE 1 Byte CID supported gt 1 if TRUE 1 Byte Information of the Application historical bytes ISO 14443 4 non compliant for instance the MIFARE uUltraLight Set to 00 1 Byte means non ISO 4 compliant Length of the following Serial Number 1 Byte Serial Number Length Bytes e CTS or CTM Ticket recognized 9 bytes resp 10 if the EnterHuntPhase has been processed in mode 1 resp mode 0 corresponding to In mode 1 long EnterHuntPhase Ticket status 1 byte OxOF if detection successful Product code Manufacturer code 2 bytes Application code Embedder code
136. ion of PIN in transparent mode for contact communication PIN PIN 4 bytes NKEY KIF SAM key number to use or KIF of the Key 00 KVC 00 if NKEY passed in the previous parameter or KVC of the Key CLASS INS DATAOUT sos o RENDO REND execution report 05 0C Devices all printer models with ASK module Name WRITE RECORD Description Writing without deletion of a record given in a linear fixed structure EF or the most recent record ing of a circular file oras ms Jonan O O OOOO 0C ACCES 1 SID 1 NREC 1 LNG 1 DATA x LID 2 NKEY 00 KIF 1 KVC 1 ACCES access mode SID SID SID 00 for usually selected EF NREC recording number 01 for a circular file LNG number of bytes to write n bytes size of a recording DATA data to record LID LID used in PROTECTED mode NKEY KIF SAM key number to use or KIF of the Key used in PROTECTED mode 00 KVC 00 if NKEY passed in the previous parameter or KVC of the Key used in PROTECTED mode CLASS INS DATAOUT sos soc REND 3 REND execution report CUST 2M Commands Manual 101 HF ASK commands 05 10 Devices Name Description Remark all printer models with ASK module OPEN SECURED SESSION Opening of a certification session Returns DF paths from MF excluded of non ratified applications and data read in the indicated record and file this command should be preceded by a select file
137. is function 00 05 no session open 00 06 session already open 00 07 badge response incorrect 00 08 command prohibited in session 00 09 overflow of transmission buffer to the badge 00 0A SAM key reference version x not found 00 0B Change Key prohibited if not preceded by SelectFile 00 0C Change Key prohibited when the new version of key is 0 00 0D the attempt to ChangeKey with a key version gt 1 failed since the key in the card is version O personalization to do 80 xx error in index input parameter xx Note These report values are proper to the class CUSTEM Commands Manual 73 HF ASK commands Structure of elementary counter files Value Free Data Floor Ceiling Value 3 bytes binary unsigned representing current counter value Free data 5 bytes Value fixed at 0000000000 Floor 3 bytes representing counter floor its value is fixed at 000000 Ceiling 3 bytes representing counter ceiling its value is fixed at F FFFFF FCI file description data Tag 85 Length 17 Value SID 1 byte short identifier 00 for the DF and for the MF Type 1 byte 01 MF 02 DF 04 EF EFType 1 byte type of elementary file 500 for the DF and for the MF 02 Linear fixed structure 04 Circular 08 Counter 10 Specific to the application RecSize 1 byte number of bytes per recording 00 for the DF and MF DataSize 1 byte number of recordings 00 for the DF and MF AC 4 bytes
138. ite needs to be present in the internal buffer of the RF Chip SELECT must have been realised otherwise write will fail Caution A block will always be written entirely 16 bytes This command can be used for data block as well as for block trailer but in this case access bit would not be verified the ChangeKey command is safer for block trailer operation Remark Due to card problem the Write Block on block Trailer 3 sector O fails 1 over 2 times on the re read command ins oman O O OO o so so Length BlockNum DataTowrite Length 1 byte length 11 BlockNum 1 byte authenticated Block Number to be written DataToWrite 16 bytes Data to write in the selected authenticated block GLASS ms DATA OUT 7 soe Length Staus Length 1 byte Response length 01 for successful operation Status 1 byte See List of response code CUST 2M Commands Manual 147 HF ASK commands 10 0F Devices all printer models with ASK module Name ReadSectorData MIFARE Description The aim of this function is to read the data blocks of a Sector of the PICC CLASS INS DATAIN sto sor Length keyPicc SeotorNum KeyPcD Length 1 byte fixed value 03 KeyPICC 1 byte value 0A for KEYA or 0B for KEYB SectorNum 1 byte Sector Number of the sector to authenticate value 00 to 0F KeyPCD 1 byte Index of the PCD key value 00 to 1F for storage area keys FF internal buffer Key GLASS ms DATA OUT
139. ith the card is a bit more than 256 That s why the length indicator LEN may exceed the OxFF hexadecimal value In the case of a length greater than or equal to 255 the length will be en coded on two bytes the first one LEN1 will be set to OxFF and the second one LEN2 will represent the rest until the total length so as LEN will be equal to LEN1 LEN2 Hence until OxFE LEN will remain on one byte and beyond this value will be on two bytes 254 gt OxFE 255 OxFF 0x00 256 OxFF 0x01 and so on Extended mode EXT bit 1 in CMD or STA byte The frame length is 2 bytes long LNG LOW and LNG HIGH The effective frame length is LNG LOW 256 LNG HIGH The maximum frame length is 800 bytes CUSTE2M Commands Manual 29 HF ASK commands 3 2 7 Note on the USB interface There is a difference with GEN4xx family and GEN5XX family on the USB interface management The USB interface of the GEN5xx family of coupler is based on the USB Class CDC model It means that a virtual serial port is created to communicate with the coupler As it is based on the microcontroller a difference appear in the reset management From one side the microcontroller cannot keep the USB link up during the reset phase On the other side due to Operating System management it is necessary to close the com port on the host side im mediately after sending the reset command or equivalent in order to avoid dead lock when resetting the coupler Otherwi
140. l SERIAL Serial number two LSBytes CLASS INS DATAQUT o6 21 Length Status DATA x Length answer length Status 00 No answer 01 Bad CRC 02 Success DATA Serial number read should be same as serial 06 22 Devices all printer models with ASK module Name READ CTx512B and MIFARE ULTRALIGHT Description Reading of a number of bytes at a given address Internally the reader chooses read or multi read instruction depending on NB parameter If the Field off CTx configuration is active the field is turned on and a select is done before the command and the field is turned off after the command only in CTx512b mode CLASS INS DATAIN sos s22 ByteNumber NB Byte Number Address of the first reading 0 63 in bytes NB Number of bytes to read from 1 to 64 CLASS INS DATAOUT 06 2 Length Status DATA x Length response length Status 00 No answer 01 Bad CRC 02 Success 03 Bad Parameters Note For the Mifare UltraLight if Status is different from 02 or 03 the card will come into the HALT state so you have to wake it up to perform other transactions DATA data read Length 1 byte CUST 2M Commands Manual 117 HF ASK commands 06 23 Devices all printer models with ASK module Name UPDATE CTx512B and MIFARE ULTRALIGHT Description Deletes records then checks by reading the bytes written at ADD address If the Field off CTx configuration is active
141. l value for example 40 means HEX 40 4 Commands Manual CUST 2M HF CUSTOM commands 2 HF CUSTOM COMMANDS The following table lists all the commands for function management in ESC POS Emulation of the printer The com mands can be transmitted to the printer at any moment but they will only be carried out when the commands ahead of them have been executed The commands are carried out when the circular buffer is free to do so COMMAND DESCRIPTION TABLE Com HEX Com ASCII Description 1B 3D ESC Enable Disable the communication with RF module 1F 30 US 0 Reset the PCD 1F 34 US 4 Write the 4 bytes of the TAG sector 1F 43 USC PCD setting for 15014443 communication 1F 45 USE Read write EEPROM memory of PCD 1F 49 US Read identification code 1F 4C US L Save key in EEPROM 1F 52 US R Switch off the RF carrier for n milliseconds 1F 53 US S RFID status 1F 58 US X Data Exchange with PICC 1F 61 US a Mifare Anticollision 1F 62 US b Mifare Authentication keys EEPROM 1F 63 US c 15014443 A Anticollision 1F 64 US d 15014443 A Select 1F 68 US h Mifare Halt Card 1F 6B US k Mifare Authentication with keys 1F 71 US q Mifare request 1F 72 USr Mifare read 1F 73 US s Mifare select 1F 75 US u Mifare ultralight multiple Write 1F 76 US v Mifare ultralight multiple Read 1F 77 US w Mifare write 1E 43 RSC Set the PCD for IS015693 1E 44 RS D Initialize SLI 15015693 mode 1E 45 RSE Initialize ICODE1 mode
142. lD 1 byte This is the ID of the file for which the new File is to be credited Returned response format GLASS ms parao gt sn s9 Length Status Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code CUST 2M Commands Manual 165 HF ASK commands 11 1A Devices all printer models with ASK module Name Get File IDs DESFIRE Description Get File ID for the current application GLASS ms DATAIN sta gt MaxFitelDs MaxFilelDs 1 byte Max response expected Returned response format Nb times oLass ms oaraor J E sra Length Status NoFound Fien Length 1 byte Response length Status 2 bytes See List of response code NbFound 1 byte Number of Fileld found Fileld NbFound 1 bytes FilelD array 11 1B Devices all printer models with ASK module Name Get File Settings DESFIRE Description Get File Settings GLASS ms Daran sip FileiD FilelD 1 byte This is the ID of the file for which the setting is to be Retrieve Returned response format CLASS INS DATA OUT 1 B Length Status FileType AccessRights Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code CommMode 1 byte File communication mode AccessRights 2 bytes New File access rights settings 166 Commands Manual CUST 2M HF ASK commands 11 1C Devices all printer models with
143. lectFile of the MF should be carried out before being able to change the PIN This command can t be used during a session CLASS INS DATAIN IKEY KEY_NUM OLDPIN NEWPIN NKEY 00 KVC ALG 04 1 4 4 KIF 1 1 1 IKEY KEY_NUM OLDPIN NEWPIN NKEY KIF 00 KVC ALG Data Out 04 key number 00 for CD97 GTML and CT2000 04 for GTML2 CD21 CD Light 09 for POPEYE old PIN used only for CD97 new PIN SAM key number to use or KIF of the Key 00 if NKEY passed in the previous parameter or KVC of the Key algorithm of the SAM used for POPEYE card CLASS INS __ DATAOUT 04 REND execution report CUSTEM Commands Manual 95 HF ASK commands 05 03 Devices Name Description Remark all printer models with ASK module DECREASE Decreases the value contained in a counter file Records the associated data Executed in session this function can return or not depending on the card type the new value of the counter for the CD97 card the new value will be returned by the CloseSecuredSession CLASS INS DATAIN ACCES 1 SID 1 VALUE LID 2 Index NKEY 00 3 counter KIF 1 KVC 1 ACCES SID VALUE LID Index counter NKEY KIF 00 KVC access mode default protected SID SID 00 for usually selected EF value to deduct 3 bytes binary number positive or nil LID used in PROTECTED mode index of the counter used in
144. ler M 4 300kbit 0x8 Transmit PR ASK 40kbit Receive Miller M 2 250kbit not all the value are supported by all the readers For the list of mode supported by each reader please refer to the reader s user manual all printer models with UHF module a value representing the RF power Attribute value is 4 bytes long used for read the current setting all printer models with UHF module all printer models with UHF module a value representing the air protocol Attribute value is 4 bytes long and can assume the follow ing values 0x00 ISO18000 6B 0x01 EPCC1G1 0x02 ISO18000 6A 0x03 EPCC1G2 Commands Manual 193 UHF RFID commands 56 Devices all printer models with UHF module ReadPointStatus a value representing the antenna s status Attribute value is 4 bytes long and can assume the following values 0x00 Bad antenna is not connected or broken 0x01 Poor antenna has a low quality connection 0x02 Good antenna is well connected 57 Devices all printer models with UHF module Boolean a value representing a boolean data Attribute value is 2 bytes long and can assume the follow ing values 0x00 FALSE Not 0x00 TRUE 58 Devices all printer models with UHF module IPAddress a string representing an IP address formatted with the standard IP dotted decimal format At tribute value has a maximum length of 30 bytes 59 Devices all printer models with UHF module IPNetMask a string r
145. lt ph 9600 1152 gt Mar 13 2001 18 04 14 C ASK GEN_3X0 lt lt lt lt lt ccccccccccccc cc SS SCC E AAA AAA AAA gt gt gt gt gt gt gt gt gt gt gt gt AAA AAA AA gt gt Message 80 08 01 03 00 00 00 00 01 00 00 17 69 Description Type command Sens Host gt CSC pari Function class system class iaa Command Short Enter Hunt Phase os Antenna number parameter 00 ia Contact parameter 00 ISOB 00 ISOA 00 a TICKET parameter 00 RMT 01 iia Timing 0 s 24 ms Response 01 1e 01 03 00 03 19 00 10 5e f3 ff cO 3b 6f 00 00 80 5a 03 01 01 11 02 04 00 10 5e f3 82 90 00 00 03 62 Description Type command Direction CSC gt Host simi Function class system class ees eae Response TAG search ida Antenna number parameter 00 a 80 si en panne aia Mode RMT Choix Ok di ATR length 19 IES Convention type 3b must be to 3B land TO parameter 6f must be to 6F indique si 2 param suivants ii TB1 parameter 00 must be to 00 para TC1 parameter 00 must be to 00 ee aes Indicator category 80 must be to 80 i n Parameter nbconstr 5a must be to 5A is Type de composant 03 i Application type 01 rica ROM version 01 11 is EEPROM Version 02 04 ai Serial number 00 10 5e f3 iaa Nbstatus parameter 82 must be to 82 186 Commands Manual CUST 2M HF ASK commands cosido Status ATR 90 00 must be to 90 00 Ain ATR parameter OK lt lt lt lt cccccccccccccc ccc SCC AAA A AAA AAA AAA AAA AAA AAA AAA AA gt gt Message 80 0a 03 01 01 08
146. ltCode out the result code CUSTEM Commands Manual 209 UHF RFID commands 4 3 ASYNCHRONOUS NOTIFICATION PROTOCOL SPECIFICATION The notification channels are implemented only with sockets All the messages notifications are composed by a header and a body In all cases the body of the message is a list of attribute value pairs The first AVP of the body is fixed and called NotifyMessage All the packets for notification channel share the same header format of other packet as described at 8 3 The first AVP NotifyMessage is followed by a list of AVPs the number of which depends on how many tags should be notified Each AVP has the same format of the AVP described in 3 The NotifyMessage has the following fixed format 1 2 3 0123456478 9012345 6789 012345 67829 021 RESERVED 8 beeen nen ee ee beeen nee eee ee ee ee 4 i CommandName i ReportBuffer i After the NotifyMessage AVP we can receive a a list of AVPs as described in table 3 followed by an AVP with Attribute Type ResultCode b a single AVP called KillMessage with the following fixed format 1 2 3 012345678901 234567890123456780901 i RESERVED 8 i E Nee A ee ee ee ee eee ee ee eee eee eee eee eee eee 4 i KillCommand i KillCommand i a a a dend bami hai ad a eee pi ba a ait a a a il Attribute types Notification AVP List Description TimeStamp the timestamp of the notification TaglDLen the ID length of the tag TagID the ID of the tag S
147. mber iii interface USB or serial baud rate from 9600 to 691 200 baud Mmm Month 3 first letters in ASCII jj Day yyyy Year HH Hour MM Minutes SS Seconds s SAM used by default value written in EEPROM equal to if none selected 40 Commands Manual CUST 2M HF ASK commands 01 03 Devices all printer models with ASK module Name Enter Hunt Phase Description This function enables badges to be searched for in different modes and different ways oLass ms The command may be cancelled by a STOP command if no timeout is specified DATA IN MONO l ANT OTH i NFC MV ISOB ISOA Mifare Ticket INNO MODE FORGET TIMOUT 1 1 Cont Felica 1 i MONO 1 Nibble 4 for a single shot search 0 otherwise ANT 1 Nibble kept for compatibility but unused OTH 1 Nibble Other chip detection at this time only SRI is supported CONT 1st half Nibble Reserved for future use Bit 1 RFU Bit 0 SO7816 contact Card search available if extension board is present MV5K FELICA 1st half nibble Most Significant Bits Number of MV5K search 2nd half nibble Least Significant Bits Number of Felica search ISOB 1 Nibble Number of successive card search to perform in ISO B norm protocol ISOA 1 Nibble Number of successive card search to perform in ISO Anorm protocol and mandatory for the MIFARE UltraLight MIFARE 1 Nibble Number of successive card search to perform in MIFARE pro
148. meND s REND execution report CUSTEM Commands Manual 77 HF ASK commands 03 02 04 Devices all printer models with ASK module Name CHANGE KEY CD97 Description Writes the values of a key in current DF contained in the MF A SelectFile of the MF or DF should be carried out before being able to change a key This command can t be used during a session Data In CLASS WS DATAN Bea Baal lla a 04 1 4 4 1 1 1 1 1 IKEY 04 KEY_NUM key number 00 for CD97 GTML and CT2000 04 for GTML2 and CD21 09 for POPEYE OLDPIN old PIN used only for CD97 NEWPIN new PIN TYPE_CMD 00 short command compatibility with the former one 01 long command NKEY KIF SAM key number to use or KIF of the key 00 KVC 00 if NKEY passed in the previous parameter or KVC of the Key ALG algorithm of the SAM used not used for CD97 GTML1 and GTML2 NSAM SAM number 00 default SAM 01 02 03 or 04 logical number of the wanted SAM number Data Out CLASS INS DATAOUT sos soz meND s REND execution report 78 Commands Manual CUST 2M HF ASK commands 03 03 Devices all printer models with ASK module Name APPEND RECORD CD97 Adds a record to an elementary circular file This new record becomes the first in the file the older one is suppressed g D 0 Q ye O CLASS INS DATAIN 03 ACCES 1 SID 1 VALUE 3 00 00 00 00 00 ACCES ac
149. mits to execute the tag query command defined by the EPC Class 1 Gen 2 protocol Ifa tag is in the field result code is ERROR_SUCCESS 0x00 else result code is ERROR_TAGNOT PRESENT 0xCA SourceName in the name of the source to use ResultCode out the result code CUST M UHF RFID commands 9B Devices all printer models with UHF module G2SetQ permits to change the initial value of the Q parameter used in the Gen2 anticollision algori thm Parameters QParameter in the value of the Q parameter ResultCode out the result code 9C Devices all printer models with UHF module G2GetQ permits to read the initial value of the Q parameter used in the Gen2 anticollision algorithm Parameters QParameter out the value of the Q parameter ResultCode out the result code 9D Devices all printer models with UHF module G2QueryAck permits to execute the tag query and ack command defined by the EPC Class 1 Gen 2 protocol If a tag is in the field result code is ERROR_SUCCESS 0x00 and the command returns the EPC code stored in the tag else the result code is ERROR_TAGNOTPRESENT 0xCA Parameters SourceName in the name of the source to use TaglD out the ID of the tag ResultCode out the result code 9E Devices all printer models with UHF module GetReaderlnfo permits to read some information about the reader itself Parameters Readerlnfo out a string with information about the reader Resu
150. models with UHF module RFOnoff permits to start stop the generation of a continuous wave Used only for test and measurements purposes Parameters RFOnOff in 0 gt stop 0 start ResultCode out the result code 81 Devices all printer models with UHF module GetBitRate permits to get the BitRate in use Parameters BitRate out the BitRate in ResultCode out the result code 82 Devices all printer models with UHF module BlockWriteTag permits to write data to the tag memory This function uses the 15018000 6b Write4Byte com mand to speed up the writing of large amount of data at one time Parameters SourceName in the name of the source to use TaglDLen in the ID length of the tag TagID in the ID of the tag TagAddress in the address where to write the data Length in the number of bytes to write TagValue in the data to write to the tag memory ResultCode out the result code 83 Devices all printer models with UHF module SetRS232 permits to modify the settings of the serial port Parameters Baudrate in the baud rate value Databits in the data bits setting Stopbits in the stop bits setting Parity in the parity setting Flowctrl in the flow control setting ResultCode out the result code CUSTEM Commands Manual 205 UHF RFID commands 84 Devices SetDateTime Parameters 85 Devices all printer models with UHF module permits to modify
151. ms Daran O so No parameters required GLASS ms oaao so CUST M Length Status 1 byte Response length 1 byte See List of response code Commands Manual 145 HF ASK commands 10 0D Devices Name Description all printer models with ASK module ReadMultipleBlock MIFARE The aim of this function is to read several blocks in an authenticated sector the right key ac cording with the one of the block to authenticate must be present in the internal buffer of the RF Chip DATA IN ie sw oD Length BlockNum Number Length BlockNum Z Cc 3 o D CLASS Zo o 5 cQ 23 BlockContent Remark 1 byte fixed value 02 1 byte authenticated Block Number to read value from 00 to 3F for a MIFARE STANDARD 1K Card and from 00 to FF for a MIFARE 4K 1 byte Number of blocks to read in a single sector Otherwise an authentication error will be sent back DATA OUT sos Length Status BlockContent 16 bytes 1 byte Response length 1 byte See List of response code Blocks content read in the card This command sends back the Type and the Serial Number of the card in case of bad Tran smission Error Ox0C 146 Commands Manual CUST 2M HF ASK commands 10 0E Devices all printer models with ASK module Name SimpleWriteBlock MIFARE Description This function writes an authenticated block The right key according with the block to wr
152. n CLASS INS DATAIN gon si9 SAm Protocol 1 SAM SAM slot number from 1 to 4 Protocol O Innovatron protocol 1 1507816 T 0 protocol 2 IS07816 T 1 protocol CLASS INS DATAOQUT sw STATUS 1 communication status 00 command possible other SAM absent 0 gt o 54 Commands Manual CUST 2M HF ASK commands 01 23 not implemented yet Devices all printer models with ASK module Name Buzzer management Description Sounds the buzzer CLASS DATA IN 23 TYPE 1 Frequency 2 Duration 2 TYPE 0 system beep 500 Hz 250 ms 1 PayPass sequence Buzzer 4 leds 2 user beep see parameters below Frequency MSB LSB frequency in Hz Duration MSB LSB duration in ms CLASS INS DATAOUT ss STATUS STATUS communication status always 00 01 24 Devices all printer models with ASK module Name Extended lO Configuration Description Configure extended IO in input or output Each input lO field is a bitmap definition of the IO as follow 101_UCM108 102_UCM108 103_Uucm108 104 _UCm108 105 UCcM108 o o o CLASS INS DATAIN Enable Enable 10 Output IO output 1O output IO output Pullup Filter mask default Enable Enable value OpenDrain Pullup IO input mask IO Bitmap to configure in input IO input Enable PullUp mask Enable PullUp for masked given input I O IO input Enable Filter mask Enable Filter for masked given input I O
153. n DeleteApplication SelectApplication FormatPICC GetApplicationIDs Security management Session AbortTransaction Authenticate ComitTransaction Change Key ChangeKey ChangeKeySettings GetKeySettings GetKeyVersion GetVersion File management ChangeFileSetings ClearRecordFile CreateBackupDataFile CreateCyclicRecordFile CreateLinearRecordFile CreateStdDataFile CreateValueFile Credit Debit DeleteFile GetFilelDs GetFileSettings GetValue LimitedCredit ReadData ReadRecords WriteData WriteRecord 152 Commands Manual CUST 2M HF ASK commands 3 7 11 3 DESFIRE Error List DESFire Card Response Data are of type SW1 0x91 SW2 0xYY And DesFire Sam response Data are of type SW1 0x90 SW2 0xYY Sw2 hex 0x00 0x0C 0x0E 0x1C 0x1E 0x40 0x7E 0x9D 0x9E 0xA0 OxA1 OxAE OxAF OxBE 0xC1 OxCA OxCD OxCE OxDE OxEA OxEE OxFO OxF 1 OxFC OxFD OxFE OxFF Status Operation ok No changes Out of eeprom error Illegal command code Integrity error No such key Length error Permission denied Parameter Error Application not found Appli Integrity error Authentication error Additional frame Boundary error PICC integrity error Command aborted PICC disabled error Count error Duplicate error No DesFireSam EEprom error File not found File integrity error Bad Length Bad Param Bad Length Timeout CUSTEM Description Successful operation No changes done to backup files CommitTransact
154. n Type command Sens CSC gt Host ere Function class class CTS dra Response Read CTS ee Read command success i Data read 00 10 lt lt lt lt lt SS E gt gt gt gt gt AAA AAA AAA AAA AAA AAA AA gt gt gt Message 80 04 06 02 Oa 04 00 35 Oc Description Type command Sens Host gt CSC ia Command Read CTS ee ates NB 04 iii Timing 0 s 20 ms Response 01 08 06 02 05 02 ff 77 77 77 00 a8 85 Description Type command Sens CSC gt Host ees Function class class CTS arar Response Read CTS eres Read command success an Data read ff 77 77 77 lt lt lt lt lt cc lt cccccccccc SiS SSS SSS SSS gt gt gt AAA gt gt gt gt gt gt AAA AAA AAA AA gt gt 180 Commands Manual CUST M HF ASK commands Message 80 08 06 03 Oa 02 55 44 ee ee 00 76 66 Description Type command Sens Host gt CSC PE TE Command Update CTS enni NB Oa EEE Data read cc cc CC CC CC CC CC CC CC CC Timing 0 s 26 ms Response 01 06 06 03 03 02 55 44 00 25 3a Description Type command Sens CSC gt Host RA Function class class CTS Dacia Response Update CTS sata Update command success ETN Data read 55 44 RRA A RA RARA RARA RARA Message 80 04 06 02 Oa 04 00 35 Oc Description Type command Sens Host gt CSC EE Command Read CTS Response 01 08 06 02 05 02 55 44 77 77 00 fb 4a Description Type command Sens CSC gt Host cda Function class class CTS SENO sans Response
155. n case of mono card search In multicard mode to select one specific card among all the cards present the command selectMF must be used otherwise only the last detected card will be selected CUST 2M Commands Manual 131 HF ASK commands 3 7 10 4 Access bit management The Access Bits are coded redundantly on the bytes 6 7 and 8 of the trailer block one of the 2 times in comple ment C1 C2 C3 Valid commands Description Read Write Sector Trailer Read Write Increment Decrement Transfert Restore Data Block Read Write Increment Decrement Transfert Restore Data Block Read Write Increment Decrement Transfert Restore Data Block Access Bits Bit7 Bit6 BitS Bit4 Bit3 Bit2 Bit1 BitO Byte 89 C3 3 C3 2 C3 1 C3 0 C2 3 C2 2 C2 1 C2 0 A bad coding of the access block kills the block access definitively The coding has a different meaning depending if the block is a trailer block or not Operation on Data Blocks Decrement C1 C2 C3 Read Write Increment Transfert Application Restore KeyA KeyA KeyA KeyA Key A Key B Key B Never Key A B Never Key B Key B Never Key B Never Key A B Never Transport Configuration Read Write Block Read Write Block ValueBlock ValueBlock Read Write Block Read Write Block Read Write Block Never Key B Never lt lt p lt BHH Ww Ww KeyA A o lt Ed w Never Never Z 2 z ojoj o lt lt lt ojoj A a a wW
156. nce information Provide definition of the entire system Definition of the highest hierarchical level Definition of hierarchy area used to control services Provide definition of the services Enable Access using block numbers Write Every time data is written renumbers data blocks from the newest one Prevents same data from being written twice Read Allows block selection by its number Allows access using the block number Using the Execute ID prevents the same processing from being repeated in the retry process Commands Manual 173 HF ASK commands 3 7 12 2 Felica Cards Free Access Commands Polling Command Polling is embedded in the ENTER Hunt Phase system command NB The Sytem code parameter 2 bytes and the TimeSlot parameter 1 Byte are part of the 01_17_Enter_Hunt_Phase_Parameter command with default values of ffffh and 03h respectively Used to identify the card from the Reader Writer Request Service Command Specifies the area service and obtains the area service key version data when the specified area service resides in the card Request Response Command Used to check the existence and status of the card Read Without Encryption Command In Mode O used to read card data in block units Write Without Encryption Command In Mode 0 used to write data into the card memory in block units Search Service Code Command Used to obtain the service code or the area code and end service code of the area
157. nication Status Description The status is that of the last exchange of radio frame The duration of radio communication is measured between the beginnings of contact before APGEN frame and end of dialogue After response to DISC or at the end of timeout of the last repetition The number of resumptions corresponds to the difference between the number of messages sent to the card and the number of messages received from the card in the course of communication not available for all card types CLASS INS DATAIN No associated input data CLASS INS DATAOUT sm so STATUS 1 TIME_END STATUS communication status of last radio exchange 01 data received 00 no data received in timeout delay FF data coding error FE error detected by communication controller FD reception buffer overflow FC timeout delay expired before end of reception FB CRC error TIME Duration in milliseconds whole not signed MSB at the head of communication REP Number of resumptions TIME_END Duration in milliseconds whole not signed MSB at the head of last communication 46 Commands Manual CUST 2M 01 0E Devices Name Description HF ASK commands all printer models with ASK module Switch off antenna switches ON or OFF the electromagnetic field of the antenna stop carrier CLASS INS DATAIN sos soe ante FELD FORGET TIMEOUT 1 ANT TIMEOUT RUF selection of antenna 00 Antenna 1
158. nswers the serial numbers of all the CTx512B present in the reader field After LIST instruction all the tickets are in HALT state Each ticket has to be selected by its se rial number before any other command After 3 REQT without answer LIST instruction answers Length 02 status 00 and NB 00 If the Field off CTx configuration is active the field is turned on and a select is done before the command and the field is turned off after the command CLASS INS RFU 06 seo so CLASS INS DATAOUT s Length status NB SERIAL GO 06 Length status SERIAL number of response bytes Length 02 2 x NB 00 no ticket x1 CTx512B in antenna field x2 CTS256B in antenna field x3 CTx512B and CTS256B in antenna field x4 identification error chip version or manufacturer x5 mysterious answer 8x Time out reached before end of anti collision problem occurs 00 no ticket xx number of tickets which are responding in the field list of serial data composed by the 2 LSB serial number address 03 116 Commands Manual CUST 2M HF ASK commands 06 21 Devices all printer models with ASK module Name SELECT CTx512B ONLY Description Selects a specific ticket by this serial number If the Field off CTx configuration is active the field is turned on and a select is done before the command and the field is turned off after the command CLASS INS DATAIN soe 1 serai seria
159. ntifier or path CLASS INS DATAOUT 05 09 REND 3 FCI x REND execution report FCI FCI CUST 2M Commands Manual 99 HF ASK commands 05 0A Devices all printer models with ASK module Name UPDATE RECORD Description Deletion then writing of a record given in a linear fixed structure EF or the most recent recording of a circular file GLASS ms TRATAN 0A ACCES 1 SID 1 NREC 1 LNG 1 DATA x LID 2 NKEY 00 KIF 1 KVC 1 ACCES access mode SID SID SID 00 for usually selected EF NREC recording number LNG number of bytes to write n bytes lt size of a recording DATA data to record LID LID used in PROTECTED mode NKEY KIF SAM key number to use or KIF of the Key used in PROTECTED mode 00 KVC 00 if NKEY passed in the previous parameter or KVC of the Key used in PROTECTED mode CLASS INS __ DATAOUT sos soa RENDO REND execution report 100 Commands Manual CUST 2M HF ASK commands 05 0B Devices all printer models with ASK module Name VERIFY PIN Description Presentation of PIN with counting of number of incorrect presentations A SelectFile of the MF should be carried out before being able to check PIN This command can t be used during a session CLASS INS DATAIN NKEY KIF 1 00 KVC 1 MODE 00 consultation of the counter of incorrect presentations 01 presentation of PIN in encrypted mode for RF communication 02 presentat
160. odan nbstatus parameter 82 must be to 82 ET Status ATR 90 00 must be to90 00 Adan ATR parameter OK KKK KKK KKK Kh KK lt lt lt lt lt EEE lt lt lt lt lt lt lt lt lt LASA gt gt gt gt gt gt gt gt gt gt gt gt gt gt Message 80 08 05 10 02 08 01 Od 00 00 00 ae 4b Description Type command Sens Host gt CSC PE Function class class 05 asean Command Open Secured Session nakain 02 validation session riial 08 Fichier Journal de transport s lectionn T 01 Record number EN Timing 0 s 55 ms Response 01 23 05 10 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 58 Description Type command Sens CSC gt Host o Function class class 5 AT Correct return ET Response Open Secured Session rait Number of non ratified applications 00 KLKILILLLLLLLLLLLLLLLLLLLLLLLL LLL LLL LI CUSTEM Commands Manual 183 HF ASK commands Message 80 Od 05 01 00 08 05 00 00 00 00 00 20 10 Od 00 Oc a8 Description Type command Direction Host gt CSC a Function class class 05 aaan Command Append Record inani 00 Access in Default mode PEET 08 Fichier Journal de transport s lectionn Se Timing 0 s 41 ms Response 01050501 00 90 00 00 d5 64 Description Type command Sens CSC gt Host ia Function class class 5 iann Correct return PT Response Append Record lt lt lt lt lt lt lt lt lt lt lt lt lt lt lt lt lt lt l
161. of CSC Stop Cancels current command This command only acts on interrupting a current Enter Hunt Phase command and in this case the reader sends back STA ABORT otherwise the reader is mute Execute Executes the command transmitted by the host into the following bytes Extended CMD byte is followed by LNG LOW and LNG HIGH 7 6 0 ERR ExT Res ABORT DATA Note The bits are active at 1 DATA ABORT RES ERR EXT Data available Data is transmitted following a command received Abort execution The interruptible current command was stopped Reset The CSC was re initialized by a physical or logical RESET CMD RES Indicates in addition that auto check succeeded Error The command syntax is erroneous class function unknown Extended CMD byte is followed by LNG LOW and LNG HIGH CUS T M Commands Manual 27 HF ASK commands 3 2 5 CRC Calculation The CRC concerns all characters in the frame including CMD and STA and 0 It is the CRC on 16 bits defined by the norms ISO 3309 CCITT V42 and CCITT X25 A portable implementation in C usable without modification on PC for calculation and verification of CRC is available ref CSC_ORD C Examples This function enables calculation of the CRC of bytes in the frame which are in the buffer of non signed characters FRAME The length of bytes in this frame are found in LNG int LNG unsigned char TRAME 256 void Set
162. of response code 11 15 Devices all printer models with ASK module Name Create Standard Data File DESFIRE Creation of a Standard Data File CLASS INS DATAIN ss Fill CommMode AccessRights FileSize O D a O 3 O gt FilelD 1 byte This is the ID of the file for which the new File is to be created CommMode 1 byte File communication mode AccessRights 2 bytes New File access rights settings FileSize 3 bytes Size of the new File in bytes Returned response format CLASS INS DATAOUT sis Length Status Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code CUST 2M Commands Manual 163 HF ASK commands 11 16 Devices all printer models with ASK module Name Create Value File DESFIREO Description Creation of a Value File GLASS ms DATAN smn sie FiletD CommMode Accessfights Lower Upper Initia Limitea FilelD 1 byte This is the ID of the file for which the new File is to be created CommMode 1 byte File communication mode AccessRights 2 bytes New File access rights settings Lower 4 bytes Min amount for the value file Upper 4 bytes Max amount for the value file Initial 4 bytes amount with which the value file will be created Limited 1 bytes Specifies wheter the limited credit command is enabled non 0 for the new value file or not Returned response format cass mns DATAOUT gt
163. ommunication mode and access rights settings shall be changed CommeEncrypted 1 byte if non 0 encrypt the communication NewCommMode 1 byte new communication mode NewAccessRights 1 byte specify the access right setting for this file Returned response format CLASS INS DATAOUT sto Length Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code 11 11 Devices all printer models with ASK module Name Clear Record File DESFIRE Description This function clears the record files selected by the input param CLASS NS DATAN sm Fiep FilelD 1 byte This is the ID of the file which shall be cleared Returned response format CLASS INS DATA OUT m Length Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code CUST 2M Commands Manual 161 HF ASK commands 11 10 Devices all printer models with ASK module Name Create Backup Data File DESFIRE Description Creation of a Backup Data File CLASS Cms DATA O O O OoOO S s12 Fie CommMode AccessRights Filesize FilelD 1 byte This is the ID of the file for which the new Backup Data File is to be created CommMode 1 byte File communication mode AccessRights 2 bytes New File access rights settings FileSize 3 bytes Size of the new Backup Data File Returned response format CLASS INS DATAOUT s2 Length Length
164. on PATHn path of the n non ratified application DATA if recording to read 29 bytes of data 68 Commands Manual CUST 2M 02 11 Devices all printer models with ASK module Name CLOSE SECURED SESSION GTML Description Closure of the certification session CLASS INS DATAIN No associated input data CLASS INS DATAQUT v8 m Z U sm renos execution report HF ASK commands 02 12 Devices all printer models with ASK module Name ABORT SECURED SESSION GTML Description Stop the current certification session This still allow to continue to dialogue with the badge and in particular open a new session Note this function is emulated in the case of the GTML CLASS INS DATAIN No associated input data CLASS INS DATAOUT ys m Zz U sm menos execution report CUSTEM Commands Manual 69 HF ASK commands 3 7 4 CD 97 Class N 03 Presentation of CD97 Card The Travel Card 1997 is a remote multi application ticket card destined for payment of transport and other services 3 7 4 1 Main functions 1 Ticketing handle control of access to public transport networks This is its main function This includes the dif ferent existing modes of pricing and should enable the introduction of new ones 2 Payment could be used as a means of payment for operators not linked to transport France T l com Ville de Paris Paris City Hall Relais H chain of newspaper stands etc
165. onalization 01 Reloading 02 Validation SID SID SID 00 for usually selected EF NREC recording number to read 00 no recording to read 01 reading of a number 1 or unique recording TYPE_CMD 00 short command compatibility with the former one for CD97 and GTML 01 long command NKEY KIF SAM key number to use Or KIF of the key 00 KVC 00 if NKEY passed in the previous parameter or KVC of the Key MODE Mode of operation 00 simple mode 01 extended mode CLASS INS DATAOUT AA ISA 29 REND execution report NBAPP 2 n where n is the number of non ratified applications PATH1 path of the first non ratified application PATHn path of the n non ratified application DATA if recording to read 29 bytes of data KVC KVC in extended mode CUST M Commands Manual 89 HF ASK commands 03 11 Devices all printer models with ASK module Name CLOSE SECURED SESSION CD97 Description Closure of certification session Example For an Increase function carried out in session we obtain 00 90 00 04 nnnnnn where nnnnnn is the new value of the counter Data In DATA IN TYPE_CMD TIMEOUT 1 1 TYPE_CMD 00 session will be ratified at the reception of the following command 80 session is ratified immediately except for CD97 and GTML 4A switches OFF the field if the card doesn t answer TIMEOUT if TYPE 4A Data Out CLASS INS DATAOQUT ss m ReND RESULT
166. or Length ASKList Error 1 byte See Error code List Length 1 byte n Number of existing Area Service return by the card among the ones requested ASKList 2 n bytes Area Service Key version list 12 02 Devices all printer models with ASK module Name REQ RESPONSE FREE FELICA ACCESS Description Control that the card still exists and gives its Mode parameter CLASS INS DATAIN Returned response CLASS INS DATAOUT Error 1 byte See Error code List Mode 1 byte internal Mode From 0 to 3 176 Commands Manual CUSTEM HF ASK commands 12 03 Devices all printer models with ASK module Name READ WITHOUT ENCRYPTION FREE FELICA ACCESS Description Used to read card data in block units 16 bytes without encryption CLASS INS DATAIN Service Service List Block Length Length Service Length 1 byte m Number of Service Service List 2m to 3m bytes Service list Block Length 1 byte n Number of blocks Block List 2n to 3n bytes Block list Returned response CLASS INS DATAOUT sos Eror Length Data Error 1 byte See Error code List Length 1 byte n Number block Data read Data 16 n bytes Data read 12 04 Devices all printer models with ASK module Name WRITE WITHOUT ENCRYPTION FREE FELICA ACCESS Description Used to read card data in block units 16 bytes without encryption CLASS INS __ DATAIN 04 Service Service List Block Length Block Data Length Service
167. ourceName the name of the source to use EventType the type of the notified event 4 4 DEFAULT CONFIGURATION The default composition of sources is the following Source Readpoints 210 Commands Manual CUST M 4 5 SAMPLES UHF RFID commands In the following sample a RawReadIDs command is examined together with the response coming from the reader Command sent 0x8001 Fixed 0x0000 Message ID 0x00005358 Vendor ID CAEN SpA 0x0021 Message Length 0x0000 Reserved 0x0008 AVP Length 0x0001 AVP Type CommandName 0x0012 AVP Value RawReadIDs 0x0000 Reserved OxOOOF AVP Length 0x00FB AVP Type SourceName Source_0 AVP Value Response received 0x0001 Fixed 0x0000 Message ID 0x00005358 Vendor ID CAEN SpA 0x0066 Message Length 0x0000 Reserved 0x0008 AVP Length 0x0001 AVP Type CommandName 0x0012 AVP Value RawReadIDs 0x0000 Reserved OxO0OO0F AVP Length Ox00FB AVP Type SourceName Source_0 AVP Value 0x0000 Reserved Ox000B AVP Length 0x0022 AVP Type ReadPointName Anto AVP Value 0x0000 Reserved Ox000E AVP Length 0x0010 AVP Type TimeStamp 0x00000578 AVP Value Thu Jan 1 01 23 20 1970 0x00000000 AVP Value 0x0000 Reserved 0x0008 AVP Length Ox000F AVP Type TagIDLen 0x0008 AVP Value 0x0000 Reserved Ox000E AVP Length 0x0011 AVP Type TagID 0x05629FFF AVP Value 0xC0113001 AVP Value 0x0000 Reserved Ox000
168. r device b This status is transmitted whenever Default Reference 0 Example The information reported in the picture are aligned with line X or line Y LINE X Description valid for all the devices listed in the second heading line LINE Y Description valid for a specific device written in bold LEGEND indicates the representation of the command hexadecimal value for example 40 means HEX 40 indicates an ASCII character not performable n m t X y are optional parameters that can have different values CUST M Commands Manual 3 Introduction 1 2 ASK command description All functions of the ASK reader will be presented as follows In the first heading line grey colour is reported the hexadecimal command value In the second heading line are listed the devices on which it is possible to use the command for example device AAAA The next fields give all the information useful to use the command 1 HEADING Command title 2 HEADING Devices that use the command Devices AAAA BBBB CCCC Name Command name Description Actions carried out by the command CLASS INS DATA IN Class Ins Pt a P2 m Px list of input data a Length in bytes of data x variable CLASS INS DATA OUT Class Ins D1 a D2 Dx list of output data a Length in bytes of data x variable LEGEND indicates the representation of the command hexadecima
169. r models with UHF module all printer models with UHF module permits to set the BitRate to use BitRate ResultCode in the BitRate to set out the result code Commands Manual 203 UHF RFID commands 74 Devices all printer models with UHF module SetProtocol permits to set the protocol to use Parameters Protocol in the protocol to use ResultCode out the result code 75 Devices all printer models with UHF module RESERVED 79 Devices all printer models with UHF module GetProtocol permits to get the protocol in use Parameters Protocol out the protocol in use ResultCode out the result code 7B Devices all printer models with UHF module SetDESB permits to enable or disable the Data Exchange Status Bit handling during the anti collision algorithm when ISO 18000 6b air protocol is in use Parameters DESBEnable in enable disable value ResultCode out the result code 7C Devices all printer models with UHF module GetFirmwareRelease permits to get the firmware revision Parameters FWRelease in the firmware release ResultCode out the result code 204 Commands Manual CUST 2M UHF RFID commands 7D Devices all printer models with UHF module GetDESB permits to get the current setting of the Data Exchange Status Bit handling Parameters DESBStatus in enabled disabled value ResultCode out the result code 80 Devices all printer
170. r n milliseconds In this mode the TAG on the antenna is reset Ifn 0 the RF transmission is switched off permanently 1 lt n lt 255 Switch off period for the antenna CUST M HF CUSTOM commands 1E 57 Devices all printer models with RFID reader writer Name Write Format ASCII RS W p u0 u7 n a d0 d3 Hex 1E 57 p u0 u7 n a d0 d3 Decimal 30 87 p u0 u7 n a d0 d3 Description Write the 4 bytes data p flags u0 u7 single UID n number of the first block to write a number of blocks to write For ICODE SLI a 1 d0 d3 data to write Notes Default Reference Example 1E 61 Devices all printer models with RFID reader writer Name Anticollision Format ASCII RS a p n Hex 1E 61 p n Decimal 30 97 p n Description Returns the number of TAGs present in RF p flags n AFI Returns Number of TAGs present in RF Notes Default Reference Example CUST 2M Commands Manual 9 HF CUSTOM commands 1E 72 Devices Name Format Description Notes Default Reference Example 1E 73 Devices Name Format Description Notes Default Reference Example all printer models with RFID reader writer Read ASCII RS r p u0 u7 n Hex 1E 72 p u0 u7 n Decimal 30 114 p u0 u7 n a a a Read a number of blocks equal to a 4 bytes block starting from block number n p flags u0 u7 single UID n number of the first block to read a number of
171. r to use If loading transaction CLASS ns DATA OUT sos REND PME CHAR 22 4NFo o REND execution report PME PME balance Most significant Byte first JCHAR 22 first bytes of most recent recording in loading journal Date Money Batch Equipment Type Balance After Reloading Amount Time Security Device ID Security Device Transaction Number Tag Transaction Number JINFO 6 bytes of information Current KVC Current Card Transaction Number Previous CryptoLo If purchase transaction or purchase cancellation CLASS INS DATAOUT soe REND 3 PmE JPAID 19 _ JINFO REND Execution report PME PME balance Most significant Byte first JPAID 19 first bytes of most recent recording in payments journal Amount Date Time Equipment Type Security Device ID Security Device Transaction Number Balance After Purchase Tag Transaction Number JINFO 6 bytes of information Current KVC Current Card Transaction Number Previous CryptoLo CUST 2M Commands Manual 107 HF ASK commands 05 0F Devices all printer models with ASK module Name RELOAD ELECTRONIC PURSE Description PME loading Remark maintained for compatibility with the CD97 CLASS INS DATAIN sos sor cHarer s CHARGZ 5 CHARG1 5 first bytes of new recording in loading journal Date Money Batch Equipment Type See CD97 CHARG2 5 bytes offset 08 13 of new recording in loading journal Amount Time See CD9
172. record ID 0018 SID 18 DEn Key Linear 1 record ID 2001 SID 07 Transport DF Environment Linear 1 record ID 2000 SID NA DE Events Log ID 2010 SID 08 Cyclic 3 records O D Memory ID 2030 SID 06 Linear 1 record ID 2040 SID 1D Linear 1 record ID 2020 SID 09 Linear 4 record ID 2069 SID 19 Linear 1 record Counter 1 ID 202A SID 0A Counter 1 record ID 202B SID 0B Counter 1 record Counter 3 P 2020 SID 0C Counter 1 record ID 202D SID 0D Counter 1 record Counter 5 D 202E SID 0E Counter 1 record Special Event Contracts AllCounters Counter 2 Counter 4 ID 202F SID 0F cones Counter 1 record Counter 7 9 2060 SID 10 Counter 1 record Counter 1 record Counter 9 ID 2062 SID 12 Counter 1 record 3 7 3 3 Functionalities Definitions common to class functions Access mode Value on 1 byte defining the authentication principles used to access data DEFAULT No local cryptogram for the function If a session is open it is the session security that is used Otherwise only data of which the attribute is ALWAYS will be accessible Concerning GTML the only authentication mode possible for recording is the session mode and for reading it is always mode or the session mode CUST 2M Commands Manual 59 HF ASK commands Execution report Value on 3 bytes 1 general byte 2 bytes of detail Title byte O By
173. response format repeated n times DATA OUT Length Status IDs 3 bytes Length 1 byte Response length 02 nx3 for successful operation Status 2 bytes See List of response code IDs nx3 bytes Id for each application found 11 06 Devices all printer models with ASK module Name Get version DESFIRE Description This function returns the version of the Picc firmware GLASS ns DATA IN IAEA Returned response format GLASS ms DATA QUE sn soe Length Status Hardinfo Sorinto UID Batch cw Year Length 1 byte Response length 1E for successful operation Status 2 bytes See List of response code HardInfo 7 bytes byte 1 code of the vendor byte 2 code of the type byte 3 code of the subtype byte 4 code of the major version number byte 5 code of the minor version number byte 6 code of the storage size byte 7 code of the communication protocol SoftInfo 7 bytes byte 1 code of the vendor byte 2 code of the type byte 3 code of the subtype byte 4 code of the major version number byte 5 code of the minor version number byte 6 code of the storage size byte 7 code of the communication protocol UID 7bytes unique serial number Batch 5bytes production batch number Cw 1 byte calendar year of prod Year 1 byte year of manufacturing 156 Commands Manual CUST 2M HF ASK commands 11 07 Devices all printer models with ASK module Name Get Free Mem D
174. ring representing the name of the read point Attribute value has a maximum length of 5 bytes and can assume the following values Ant0 Ant1 Ant2 Ant3 all printer models with UHF module data read from the tag memory when applicable Attribute value has a maximum length of 128 bytes all printer models with UHF module the memory location address of the tag where read or write data when applicable Attribute value is 2 bytes long all printer models with UHF module 192 Commands Manual CUST M 50 Devices Length 51 Devices BitRate Note 52 Devices PowerGet 53 Devices RESERVED 54 Devices Protocol CUSTEM UHF RFID commands all printer models with UHF module a value representing the length of a parameter Attribute value is 2 bytes long all printer models with UHF module a value representing the RF BitRate Attribute value is 2 bytes long and can assume the follow ing values 0x0 Transmit DSB ASK 10kbit Receive FMO 10kbit 0x1 Transmit DSB ASK 10kbit Receive FMO 40kbit 0x2 Transmit DSB ASK 40kbit Receive FMO 40kbit 0x3 Transmit DSB ASK 40kbit Receive FMO 160kbit 0x4 Transmit DSB ASK 160kbit Receive FMO 400kbit 0x5 Transmit DSB ASK 40kbit Receive Miller M 2 160kbit 0x6 Transmit PR ASK 40kbit Receive Miller M 4 250kbit 0x7 Transmit PR ASK 40kbit Receive Mil
175. ry reference Number Returned response format CLASS INS DATAOUT C s lenm sts Kucemy 1 byte Response length 2 bytes See List of response code Qo o 5 D c Q n 3 KucEntry x bytes see spec 11 26 Devices all printer models with ASK module Name SAM Disable crypto DESFIRE Description This function disables the crypto function of certain part function on the SAM PICC CLASS INS DATAIN PRomaS PROMAS 2 bytes See explication below The NV Programming bit mask PROMAS 2 bytes parameters is defined as follow Disable Disable Disable Disable Disable RFU 0 Generate Verify Encryption Decryption SAM MAC MAC changeKey_PICC Returned response format CLASS INS DATAOUT Ps s lenm sus Length 1 byte Response length 0x02 Status 2 bytes See List of response code 172 Commands Manual CUSTE2M HF ASK commands 3 7 12 FELICA Class N 12 NOT IMPLEMENTED YET N B this class is not implemented yet The FELICA Class is based on the Sony Felica contactless protocol it allows communicating and managing the FELICA card or a NFC Device embedding the Felica protocol 3 7 12 1 Felica Cards Memory organization The unit of data access is one block 16 bytes The maximum number of simultaneously accessible blocks is 12 blocks 176 Bytes in read mode The maximum number of simultaneously accessible blocks is 8 blocks 128 Bytes in write mode Due to th
176. ryptogram incorrect SAM physical error 21 65 81 Eeprom Problem SAM instruction error 22 94 10 Value incorrect in incoming data 94 20 Exceeding of PME badge capacity 6A 83 Recording not found The key requested is not present in the key file 6A 86 P1 P2 incorrect Key reference too large 6A 87 Lc incompatibly with P1 P2 64 00 Execution error SAM security alert 29 SAM return code unknown SAM Answer TimeOut 2F 00 EF No SAM answer Incorrect card 40 byte 0 00 RUF communication byte 1 INS code ISO of the frame which has failed 00 if multiple command dialogue lost Incorrect SAM 41 byte 0 00 RUF communication byte 1 INS code ISO of the frame which has failed 60 Commands Manual CUST 2M HF ASK commands Abnormal execution 80 00 00 command unknown 00 01 concatenation not authorized for this function reported by the 00 02 maximum number of concatenable functions reached CSC controller 00 03 access mode incompatible with the concatenation 00 04 access mode prohibited for this function 00 05 no session open 00 06 session already open 00 07 badge response incorrect 00 08 command prohibited in session 00 09 overflow of transmission buffer to the badge 00 0A SAM key reference version x not found 00 0B ChangeKey prohibited if not preceded by SelectFile 00 0C ChangeKey prohibited when the new version of key is O 00 0D the attempt to ChangeKey with a key version gt 1
177. s 255 return Status all printer models with RFID reader writer PCD setting for 15014443 communication ASCII US C Hex 1F 43 Decimal 31 67 Set the registers of the RF module CUST M 1F 45 Devices Name Format Description Notes Default References Example 1F 49 Devices Name Format Description Notes Default Reference Example CUSTEM HF CUSTOM commands all printer models with RFID reader writer Read write EEPROM memory of PCD ASCII US E n al a0 L d1 dL Hex 1F 45 n al a0 L d1 dL Decimal 31 69 n al a0 L d1 dL Read write EEPROM memory of PCD a number of bytes L from address 1 to 0 a1 Starting Address byte High a0 Starting Address byte Low AddrH Read AddrH 1 lt L lt 16 number of bytes to read and write Data to write must be specified only during writing operation all printer models with RFID reader writer Read identification code Mf1K Mf4K MfUL ASCII US Hex 1F 49 Decimal 31 73 Command that inquire to TAG the identification code UID Return UD T bytes T bytes SAK Select Acknowledge 1 byte 04 07 Commands Manual 13 HF CUSTOM commands 1F 4C Devices Name Format Description Notes Default Reference Example 1F 52 Devices Name Format Description Notes Default Reference Example all printer models with RFID reader writer
178. se Or KIF of the key 00 if NKEY passed in the previous parameter or KVC of the Key SAM number 00 default SAM 01 02 03 or 04 logical number of the wanted SAM number CLASS INS DATAOUT REND CUSTEM 08 execution report Commands Manual 83 HF ASK commands 03 0C Devices all printer models with ASK module Name WRITE RECORD CD97 Description Writing without deletion of a record given in a linear fixed structure EF or the most recent record ing of a circular file CLASS INS DATAIN EZ ACCES access mode SID SID SID 00 for usually selected EF NREC recording number 01 for a circular file LNG number of bytes to write n bytes size of a recording DATA data to record CLASS INS __ DATAOUT soc execution report Pa m Z U 84 Commands Manual CUST 2M HF ASK commands 03 0E Devices all printer models with ASK module Name GET ELECTRONIC PURSE STATUS CD97 Description Informs on the status of PME and prepares purchase or loading or purchase cancellation CLASS INS DATAIN so TEO TYPE type of transaction to carry out 00 loading transaction 01 purchase transaction 02 purchase cancellation e If loading transaction CLASS INS DATAQUT so REND PMEG UCHAR 22 REND execution report PME PME balance Most significant Byte first JCHAR 22 first bytes of most recent recording in loading journal Date 2 Money B
179. se operating system will consider a session still being opened with this port and will not be able to retrieve a good communication mode after wise This particular case is taken into account in the last version of library ASKCSC DLL which manage correctly all ver sion of ASK coupler communication In order to help developers who has to implement their own interface sources of the DLL are given with the development kit and a set of function is given in a dedicated file to help for the management of USB VCP or other serial port Algorithm should then be as follow Detection of which kind of port is addressed USB CDC VCP No simple style reset management Yes Send Reset to the port Close COM port immediately Wait for getting to Down state in reset mode If VCP has Yes Break loop disappeared No While not exceeding Not exceeding max time Timeout Wait for getting back to Up state before to open Virtual Com Port If VCP has reappeared No Open VCP While not exceeding Not exceeding max time Timeout 30 Commands Manual CUSTE2M HF ASK commands 3 3 DESCRIPTION OF COMMUNICATION SCENARIOS 3 3 1 Restriction on the Master slave model The computer should specify a maximum time for the polling command 3 seconds for example and on that time is reached it can still interrupt the polling through the STOP command The RESET command can be send at any time 3 3 2 Frames 3 3 2 1 Pure comm
180. sion for all cards new value 3 bytes binary number signed in session for all cards except CD97 new value 3 bytes binary number signed 05 05 Devices all printer models with ASK module Name INVALIDATE Description Invalidates the current DF and consequently all offspring files CLASS INS DATAIN ACCES 1 LID 2 NKEY 00 KIF 1 KVC 1 ACCES access mode LID LID used in PROTECTED mode NKEY KIF SAM key number to use or KIF of the Key used in PROTECTED mode 00 KVC 00 if NKEY passed in the previous parameter or KVC of the Key used in PROTECTED mode CLASS INS _ DATAOUT sos o mEND REND execution report CUSTE2M Commands Manual 97 HF ASK commands 05 07 Devices all printer models with ASK module Name REHABILITATE Description Cancels file invalidation CLASS INS DATAIN 07 ACCES 1 LID 2 NKEY 00 KIF 1 KVC 1 ACCES access mode LID LID used in PROTECTED mode NKEY KIF SAM key number to use or KIF of the Key used in PROTECTED mode 00 KVC 00 if NKEY passed in the previous parameter or KVC of the Key used in PROTECTED mode CLASS INS DATAOUT so o REND REND execution report 05 06 Devices all printer models with ASK module Name READ RECORD Description Reading of a record given in a circular EF a counter or a linear fixed structure EF CLASS INS ___ DATAIN 06 ACCES 1 SID 1 NREC 1 LNG 1 LID 2 NKEY 00
181. t lt lt lt lt lt lt lt lt lt lt lt lt lt lt lt gt gt gt gt gt gt gt gt gt gt gt gt gt gt gt gt gt gt gt gt gt gt gt gt gt gt gt gt gt gt gt gt gt Message 80 08 05 08 08 04 20 00 20 10 00 39 93 Description Type command Sens Host gt CSC a Function class class 05 Genoi Command Select File nas Timing 0 s 35 ms Response 01 1e 05 08 00 90 00 85 17 08 04 04 1d 03 1f 10 10 10 00 03 03 03 00 00 00 00 00 00 00 00 00 00 00 06 22 Description Type command Sens CSC gt Host EN Function class class 5 nina Correct return oia Response Select File E D tail du FCI elec 85 indique un Tag ds SID 08 ii File type 04 EF LARA Structure type 04 Circular eases Byte number for each record 1d ada Record number 03 aanas AC Access condition for command index 0 1f ALWAYS Command READ RECORD sinana AC Access condition for command index 1 10 INCONNU Command UPDATE RECORD serin AC Access condition for command index 2 10 INCONNU Pas de Commande aoai AC Access condition for command index 3 10 INCONNU Command APPEND RECORD PE Key index to use 00 03 03 03 id File status 00 Fichier Valide Fichier lisible si Invalide ad Key index KVC123 pour les DF 00 00 00 ANT Plancher des compteurs 00 00 00 Plafond 00 00 00 lt lt lt lt cccccccccccccc ccc SCC AAA SSS gt gt gt gt gt gt gt gt gt AAA AAA AAA AAA AA gt gt 184 Commands Manual CUST 2M Message 80 Od 05 01 00 00 05 00 0
182. t be changed because of incorrect key change information AB Incorrect Package The package parity of the command used for issuing the card is incorrect Parity AC Incorrect Parameter Registration is impossible because the scope of service codes is inconsistent between the parent area and the area or service to be newly registered AD Double Registration Cannot register the same area or service twice of Same Service AE Incorrect System The system code of the Register Issue ID command is neither FFFF nor the same as the Code system code to be registered AF Too Many The number of blocks being written simultaneously is larger than the number of records Simultaneous available for the cyclic service This error message is not displayed when the blocks to be Cyclic Writes written do not appear consecutively on the block list FD Bad IDm The IDm replyied does not match with the IDm required in the command FE Card Timeout No card response FF SAM Timeout No SAM response CUST 2M Commands Manual 175 HF ASK commands 3 7 12 5 Reader functions 12 01 Devices all printer models with ASK module Name REQ SERVICE FREE FELICA ACCESS Description Specify Area service and obtain the Area Service Key version data when it exists on card CLASS INS DATAIN son Length ASKList Length 1 byte n Number of Area Services ASKList 2 n bytes Area Service Key version list Returned response CLASS INS DATAOUT 12 o Err
183. tatus CUST M 1F 63 Devices Name Format Description Notes Default Reference Example 1F 64 Devices Name Format Description Notes Default Reference Example CUSTEM HF CUSTOM commands all printer models with RFID reader writer ISO 14443 A Anticollision Mf1K Mf4K MfUL ASCII US c n p Hex 1F 63 n p Decimal 31 99 n Returns the complete UID 4 bytes of one of the TAG present in RF n collision level n 93 standard select code n 95 cascaded level 1 n 97 cascaded level 2 p bit number known in the UID Os p lt 32 Return Status UIDO UID1 UID2 UID3 all printer models with RFID reader writer ISO 14443 A Select Mf1K Mf4K MfUL ASCII US d n u0 u3 Hex 1F 64 n u0 u3 Decimal 31 100 n u0 u3 Select the specified UID level n 93 standard select code n 95 cascaded level 1 n 97 cascaded level 2 u0 u3 selected UID Return Status Commands Manual 17 HF CUSTOM commands 1F 68 Devices Name Format Description Notes Default Reference Example 1F 6B Devices Name Format Description Notes Default Reference Example 18 Commands Manual all printer models with RFID reader writer Mifare Halt Card Mf1K Mf4K MfUL ASCI US h Hex 1F 68 Decimal 31 104 Set with the Halt status the previous selected paper Return Status all printer models with RFID reader
184. tes 1 2 detail Execution carried 00 90 00 Command accepted and executed out no error File error 01 69 81 Incompatibility with file structure 6A 82 File not found 6A 83 Recording not found Badge side 02 69 82 Security conditions not respected no alea cryptogram absent no current security error session access condition unknown 63 CX Incorrect signature X represents the number of attempts still authorized 0 1 or 2 69 83 Command rejected since maximum number of errors 3 was reached PIN access only Session Error 03 64 00 EEPROM capacity insufficient for the session 69 85 Command forbidden the mode NEVER is indicated for this command 69 86 Command prohibited on a DF Badge physical Error 04 62 81 The data item returned is corrupted Fatal Error 65 81 EEPROM Failure Fatal Error Application Error 05 6A 80 Value to deduct or add incorrect 6A 81 Wrong key level specified 1 to 3 6A 87 Lc incompatible with P1 P2 67 00 P3 invalid returned if P3 0 6B 00 P1 P2 not supported 6D 00 INS not supported Invalid card 06 6E 00 CLA not supported Badge error 09 Badge return code unknown code unknown Abnormal execution codes cf spec CD97MiniMS reported by security 20 29 module SAM side security 20 69 00 Command not authorized A counter of key uses reached its maximum alert value 69 85 Command not authorized conditions of use nor satisfied 69 88 C
185. the MIFARE Classic and MIFARE 4K cards Once in communication with a MIFARE card it is not possible to com municate in the same time with a Type B card In addition this class allow the management of the RCXXX chip and RF baurates 3 7 10 1 MIFARE Classis Cards memory organization The MIFARE Classic Card is composed of 16 Sectors of 4 blocks each Each Block is composed of 16 Bytes The First Block of the First Sector is a read only block that contains the manufacturer information The Fourth Block of each sector contains a Trailer area which contains the key and access bits for this sector Cor oo A ltt Bits ATA oo B Block N 63 3F SOF Trailer area Block N 62 3E Block N 61 3D Block N60 sac N 60 Block N60 sac Key A Access Bits GGI PA ne Block Ne 4 2 N i Block Ne 4 2 2 Block Ne ara N i Block Ne ara 1 Block Ne 4 N Block Ne 4 Key A Access Bits E Block ez N 2 Block N 1 Block N 0 Read only sara area For more details refer to the MIFARE STANDARD user manual 3 7 10 2 MIFARE 4K Cards memory organization The MIFARE 4K Card is organised in 32 sectors with 4 blocks and 8 sectors with 16 blocks Each Block is composed of 16 Bytes The First Block of the First Sector is a read only block that contains the manufacturer information The Fourth Block of the first 32 sectors and the sixteenth of the last 8 sectors contains a Trailer area wh
186. the field is turned on and a select is done before the command and the field is turned off after the command only in CTx512b mode CLASS INS DATAIN 06 23 ByteNumber NB DATA Byte Number Address of 1st byte to record 0 63 NB Number of bytes to update from 1 to 64 DATA Data to be updated NB bytes CLASS INS DATAQUT o6 23 Length Status DATA x Length length of written and read data in bytes Status 00 No answer 01 Bad CRC 02 Success 03 Bad parameters 82 Security activated Note For the Mifare UltraLight if Status is different from 02 or 03 the card will come into the HALT state so you have to wake it up to perform other transactions DATA data read after a successful write Length 1 byte NB for the Mifare UltraLight exclusively due to the checking of the written data if the writing phase has not completed successfully the Mifare UltraLight will goes into the HALT state and so a TimeOut will be sent back 06 24 Devices all printer models with ASK module Name HALT CTx512B and MIFAREO ULTRALIGHT Description Halt CTx512x ticket If the Field off CTx configuration is active the field is turned on and a select is done before the command and the field is turned off after the command only in CTx512b mode CLASS INS DATAIN sos 24 Param 00 deactivation of the ticket using the instruction deactivate Others RFU Param CLASS INS _ DATAO
187. tion Notes Default Reference Example 1F 75 Devices Name Format Description Notes Default Reference Example 20 Commands Manual all printer models with RFID reader writer Mifare Select Mf1K Mf4K MfUL ASCI US s u0 u3 Hex 1F 73 u0 u3 Decimal 31 115 u0 u3 Select the TAG identified from the UID u0 u3 Returns Status all printer models with RFID reader writer Mifare ultralight multiple Write MfUL ASCI US u n p d0 dp Hex 1F 75 n p d0 dp Decimal 31 117 n p d0 dp Write a number of byte equal to p on a Mifare Ultraligh type TAG starting from the block number n 0 lt n lt 63 Depends on the type of TAG Returns Status CUST M 1F 76 Devices Name Format Description Notes Default Reference Example 1F 77 Devices Name Format Description Notes Default Reference Example CUST M HF CUSTOM commands all printer models with RFID reader writer Mifare ultralight multiple Read MfUL ASCI US V Hex 1F 76 Decimal 31 118 Read the values of the 64 bytes of the TAG Ultralight Returns Status d0 d64 all printer models with RFID reader writer Mifare ultralight multiple Write MfUL ASCI US w n d0 d15 Hex 1F 77 n d0 d15 Decimal 31 119 n d0 d15 Write 16 bytes in the n block of the selected Mifare Ultraligh type TAGS 0 lt n lt 63 Depends on the type of TAG Returns
188. tion of keys in the SAM according to their use This had the drawback of not being adaptable to new file structures and not being capable of handling several key versions So as to be able to handle the new variable file structure cards of the CD97 RJL and CT2000 types handling by mapping table has been abandoned in this function class To afford more scope for development of the applications without changing coupler software a NKEY parameter has been added to commands enabling the application to attribute the different SAM keys to the different card functions in compliance with the choices retained in Card SAM personalization The user can either communicate with the SAM thanks to a Key Reference or thanks to the KIF indication of key function and the KVC indication of key version The error codes restituted by the card and the SAM are not filtered by the CSC and are consequently restituted wholly to the host For more information please refer to documents detailing default card and SAM mapping retained for the personali zation of cards and SAMs 3 7 6 2 Rules Access mode value on 1 byte defining the principles of authentication used to access data DEFAULT 00 No local cryptogram for the function If a session is open it is the session security that is used Otherwise only the data of which the attribute is ALWAYS will be acces sible PROTECTED 01 Ground authentication of incoming data for the badge Immediate e
189. tocol TICKET 1 Nibble Number of successive card search to perform in CTS CTM protocol INNO 1 Nibble Number of successive card search to perform in Innovatron RF protocol MODE Type of Enter Hunt Phase 00 short compatibility with the old one 01 long take into account the 2 following bytes FORGET 1 byte 00 takes into account the serial number of the last badge presented 01 Forgets the serial number of the last badge presented TIMOUT 1 byte N x 10 ms Polling duration of the enter hunt phase Beyond this time the reader replies a status This avoids the reader staying indefinitely awaiting a badge If the value is nil waiting time is infinite NB If the MONO mode of the byte 0 is selected with the LONG MODE byte 5 1 either the Time Out lasts less than the sequence of all the searches selected and the hunt stops before the whole sequence is achieved or if greater the hunt stops after the end of the sequence before the Time Out reaches the end NB on multi protocol cards INNOVATRON and ISOB ISOB nibble should be more than 1 Commands Manual 41 CUSTEM HF ASK commands CLASS INS DATAOUT sa s ente como CNT 1 byte kept for compatibility 8x indicates that antenna x has broken down 00 otherwise COM 1 byte communication mode 01 Card recognized with Felica protocol 02 Card recognized with ISO 14443 type A protocol ISO level 4 compliant but not Calypso 03 Card recognized
190. turned response format CLASS INS DATAQUT soz Length Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code 154 Commands Manual CUST 2M HF ASK commands 11 03 Devices all printer models with ASK module Name Select Application DESFIRE Description This function is used to select one application for further access in the card CLASS INS DATAIN sos AppID AppID 3 bytes ID number of the App in the card Returned response format CLASS INS DATAQUT sos Length status Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code 11 04 Devices all printer models with ASK module Name Format PICC DESFIRE Description This function is used to format Picc card File system N B That command needs to be passed on after an authentication CLASS INS DATAIN sa AppID 3 bytes ID number of the App in the card Returned response format CLASS INS DATAOUT 04 Length Status Length 1 byte Response length 02 for successful operation Status 2 bytes See List of response code CUST 2M Commands Manual 155 HF ASK commands 11 05 Devices all printer models with ASK module Name Get Application IDs DESFIRE Description This function is used to retrieve the current Application ID CLASS INS ___ DATAIN NbID 1 byte Number of ID to return 0 to 32 Returned
191. turns the module ATR CLASS INS DATAIN DATA IN DATA IN s3 samm inm ison SAM Selection of SAM 00 SAM usually selected 01 SAM 1 02 SAM 2 03 SAM 3 04 SAM 4 Others RUF INN Selection of SAM in Innovatron High Speed protocol If 01 selection of SAM in Innovatron protocol If 00 no SAM selection in this protocol ISO selection of protocol ISO 7816 If 01 selection of SAM in 1SO7816 T 0 protocol If 02 selection of SAM in 1SO7816 T 1 protocol If 00 no SAM selection in this protocol NB1 if these 2 parameters are positioned there is first scrutinization in Innovatron protocol then in IS07816 pro tocol NB2 If this command is 01 13 00 INN 01 and ISO 00 by default CLASS INS DATAOUT sor sis status STATUS communication status 00 data received in Innovatron protocol 80 data received in ISO 7816 protocol 81 data received in ISO 7816 protocol but writing prohibited 82 data received in ISO 7816 protocol but speed is fixed at default speed FF no data received LNG length of data ATR Response to SAM RESET selected 50 Commands Manual CUST 2M HF ASK commands 01 14 Devices all printer models with ASK module Name Send to SAM Description Sends the data to the chosen transparent mode The communication parameters are those chosen using the SAM communications parameter entry function GLASS ms DATAN a 14 SAM 1 LNG 1 DATA x DIRECTION
192. unication channels one for synchronous commands and one for asynchronous notifications Command channel is mandatory and at now it is implemented on top of a TCP IP socket port 1000 and on RS232 while notification channels are implemented only with sockets All the messages commands responses and notifications are composed by a header and a body In all cases the body of the message is a list of attribute value pairs Responses always echo the Command AVP sent by the host All the packets for the control and notification channel share a common header format 1 2 3 Oe ee ec 0 RL A E E A FIXED Message ID q Vendor ID ae Length fo eee FIXED Must be 0x8001 for commands and 0x0001 for responses Message ID Id of the message It is a sequence number used to map requests to its responses a request and its corresponding response have the same message ID the id is local to the channel Vendor ID Must be 21336 the IANA SMI Network Management Private Enterprise Code assigned to CAEN SpA Length Encodes the length of the message in bytes including the header The header is followed by a list of AVPs the number of which depends on the command Each AVP have the following format 1 2 3 012345678901 23 456 78 9 0123 456 7 8 9 0 1 i RESERVED i Length i E ee AA eee ee MMMM 4 Attribute Type Attribute Value RESERVED The first 16 bits are reserved for future extensions All reserved bits must be set to 0 on outgoing mes sages an
193. writer Mifare Authentication with Keys Mf1K Mf4K ASCII US k t u0 u3b kO k5 Hex 1F 6B t u0 u3b k0 k5 Decimal 31 107 t u0 u3b k0 k5 Authentication with t type key write in k0 k5 b block of TAG with UID u0 u3 t 41 Authentication with A type key t 42 Authentication with B type key 0 lt b lt 63 number of block to authenticate u0 u3 4 bytes containing the UID of TAG to authenticate KO k5 6 bytes of the decrypted key Return status CUST M 1F 71 Devices Name Format Description Notes Default Reference Example 1F 72 Devices Name Format Description Notes Default Reference Example CUSTEM HF CUSTOM commands all printer models with RFID reader writer Mifare Request Mf1K Mf4K MfUL ASCI US q n Hex 1F 71 n Decimal 31 113 n Execute a request at the TAGs present n 52 All the TAG present answer to request also the TAG in HALT status n 26 Only the TAG in IDLE status answer to request Return Status ATQ_H ATQ_L Where ATQ is Answer to request and e identify the type of TAG all printer models with RFID reader writer Mifare Read Mf1K Mf4K MfUL ASCI US r n Hex 1F 72 n Decimal 31 114 n Read the 16 bytes of the n sector specified 0 lt n lt 63 Depends on the type of TAG Return Status d0 d15 Commands Manual 19 HF CUSTOM commands 1F 73 Devices Name Format Descrip
194. xecution by the badge STAMPED Authentication of the badge of outgoing data for the badge Remark it is impossible to combine the mode protected or the mode stamped with the session mode CUST 2M Commands Manual 93 HF ASK commands 3 7 6 3 Set of instruction 05 01 Devices all printer models with ASK module Name APPEND RECORD Description Adds a record to an elementary circular file This new record becomes the first in the file the old one is suppressed CLASS INS DATAIN ACCES 1 SID 1 LNG 1 DATA LNG LID 2 NKEY 00 KIF 1 KVC 1 ACCES access mode SID SID SID 00 for usually selected EF LNG length of data to record n bytes size of a recording DATA data to record LID LID used in PROTECTED mode NKEY KIF SAM key number to use or KIF of the Key used in PROTECTED mode 00 KVC 00 if NKEY passed in the previous parameter or KVC of the Key used in PROTECTED mode class ms DATA OUT sos m REND S REND execution report 05 02 Devices all printer models with ASK module Name CHANGE KEY WARNING This is a very specific command for personalization This command can t be used during a session eass ms DATAN sos O so sos 94 Commands Manual CUST 2M 05 02 04 Devices Name Description Data In HF ASK commands all printer models with ASK module CHANGE PIN Changes PIN value contained in the MF A Se
195. y the reader to the host by an execution report on 3 bytes 1 byte reporting the origin of the error 2 bytes of detail on the error Error detected by the badge or a SAM the error is reported by the reader to the host through an execution report on 3 bytes 1 byte representing the error family 2 bytes coming from the badge or the error details SAM The error report codes are proper to each function class 34 Commands Manual CUST 2M HF ASK commands 3 6 5 Specific SAM Errors The transparent command 01_14 SendToSAM communicates directly with the SAM and can therefore give back very specific error codes about the exchange with the SAM SAM_EXEC_OK 00 SAM_BAD_ACKANSWER E1 SAM_BAD_SW12ANSWER E2 SAM_NR2S_ERROR E3 SAM_NR2R_ERROR E4 SAM_BAD_PPSEXEC E5 SAM_BAD_TA1PARAM E6 SAM_BAD_TPARAM E7 SAM_BAD_TCK E8 SAM_BAD_PPSMODE E9 SAM_SIGNAL_LOCKED EA SAM_TIME_OUT EB SAM_LENGTH_ERROR EC SAM_NOT_DEFINED ED SAM_INCORRECT_PARAM EE SAM_NOT_DETECTED FF CUST 2M Commands Manual 35 HF ASK commands 3 7 DETAILS OF ASK READER FUNCTIONS 3 7 1 DOWNLOAD Class N 00 00 01 Devices all printer models with ASK module Name Download start Description Starts software download CLASS INS DATAIN o 01 No associated input data CLASS INS DATAOUT oo 01 Status 1 STATUS 1 byte 0x00 No error 0x01 Error while erasing sector 1 0x02 Error while erasing sector 2 0x03 Error while erasing sector 3 Ox0B

RFID COMMANDS MANUAL

Contents

Download Pdf Manuals

Related Search

Related Contents