SPRINGCARDS PRNHSP01 USB contacless coupler User Manual Developer s reference manual

SPRINGCARD SAS USB contacless coupler Developer s reference manual

Contents

User_manual_pmd2271-ba

PMD2271-BA - PUBLICSPRINGCARD PC/SC COUPLERS - H663 GROUPDeveloper's reference manualwww.springcard.com
PMD2271-BApage 2 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualDOCUMENT IDENTIFICATIONCategory Developer's manualFamily/Customer PC/SC CouplersReference PMD2271 Version BAStatus Classification PublicKeywords H663, CrazyWriter HSP, TwistyWriter HSP, CSB HSP, Prox'N'Roll HSP, FunkyGate HSP, PC/SC,NFC P2P, contactless cards, RFID labels, NFC tagsAbstractFile name V:\Dossiers\SpringCard\A-Notices\H663 Group\Developpement\[PMD2271-BA] H663Developer's Reference Manual.odtDate saved 13/04/15 Date printed 05/12/12SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 3 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualREVISION HISTORYVer. Date Author Valid. by Approv.byDetailsTech. Qual.AA 29/08/12 JDA Created from PMD841P-FA and PMD2176-ADAB 18/03/13 JDA Separated chapter 2 from chapter 1Renumbered the chapters (moved up “contactless hints” and“NFC initiator role”), named last chapters “annex”.New drawingsDocumented all the configuration registersRemoved the preliminary WatermarkAC 21/05/13 JDA Added the capability to stop the contactless slot when a contactsmartcard is insertedAD 23/07/13 JDA Documented new behaviour of firmware ≥ 1.75 for NFC ForumType 1 tags, including Innovision (now Broadcom) Topaz andalikeAE 17/06/14 JDA Added time-out extensions for T=0 and T=1Improved chapter 7AF 27/08/14 JDA A few rewordingsOrder codes and related documents addedAG 07/11/14 JDA New features from FW 1.81:- 'RFID memory control' instruction (INS=F6)- Support of EM5134- Recognition of Mifare Plus cards, updated the PIX.NN listingBA 13/04/15 JDA New features from FW 2.00:- buzzer- name of reader could be the serial numberAdded FreeRTOS licence informationAdded Prox'N'Roll HSPSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 4 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualCONTENTS1.INTRODUCTION....................................................................61.1.ABSTRACT.....................................................................61.2.SUPPORTED PRODUCTS.......................................................61.3.RELATED DOCUMENTS.......................................................81.4.AUDIENCE.....................................................................81.5.SUPPORT AND UPDATES......................................................81.6.USEFUL LINKS.................................................................92.PC/SC, SMARTCARDS AND NFC: QUICK INTRODUCTION ANDGLOSSARY.............................................................................102.1.SMART-CARD AND CONTACTLESS SMARTCARDS STANDARDS............102.2.PC/SC.....................................................................112.3.NON-7816-4 CONTACTLESS CARDS – INTRODUCING THE EMBEDDED APDU INTERPRETER............................................................122.4.NFC ?.....................................................................132.5.VENDOR-SPECIFIC FEATURES – DIRECT CONTROL OF THE COUPLER.....142.6.GLOSSARY – USEFUL TERMS...............................................153.EMBEDDED APDU INTERPRETER........................................193.1.BASIS........................................................................193.1.1.CLA byte of the embedded APDU interpreter..............193.1.2.Status words returned by the embedded APDU interpreter............................................................................203.1.3.Embedded APDU interpreter instruction list................213.2.INSTRUCTIONS DEFINED BY THE PC/SC STANDARD (V2 PART 3).....223.2.1.GET DATA instruction...................................................223.2.2.LOAD KEY instruction...................................................243.2.3.GENERAL AUTHENTICATE instruction...........................263.2.4.READ BINARY instruction..............................................283.2.5.UPDATE BINARY instruction.........................................303.3.SPRINGCARD-SPECIFIC INSTRUCTIONS FOR THE CONTACTLESS SLOT....323.3.1.MIFARE CLASSIC READ instruction...............................323.3.2.MIFARE CLASSIC WRITE instruction..............................343.3.3.MIFARE CLASSIC VALUE instruction..............................373.3.4.RFID MEMORY CONTROL instruction...........................403.3.5.CONTACTLESS SLOT CONTROL instruction...................443.3.6.SET FELICA RUNTIME PARAMETERS instruction...........453.3.7.ENCAPSULATE instruction for the Contactless slot.......473.3.8.ENCAPSULATE instruction for one of the Contact slots 513.4.OTHER SPRINGCARD-SPECIFIC INSTRUCTIONS...........................523.4.1.READER CONTROL instruction......................................523.4.2.TEST instruction............................................................544.WORKING WITH CONTACTLESS CARDS – USEFUL HINTS....564.1.RECOGNIZING AND IDENTIFYING PICC/VICC IN PC/SC ENVIRONMENT....................................................................564.1.1.ATR of an ISO 14443-4 compliant smartcard................564.1.2.ATR of a wired-logic PICC/VICC....................................584.1.3.Using the GET DATA instruction...................................594.1.4.Contactless protocol....................................................594.1.5.Contactless card name bytes........................................604.2.ISO 14443-4 PICCS..................................................624.2.1.Desfire first version (0.4)..............................................624.2.2.Desfire EV0 (0.6) and EV1.............................................624.2.3.Calypso cards...............................................................624.3.WIRED-LOGIC PICCS BASED ON ISO 14443-A....................634.3.1.Mifare Classic...............................................................634.3.2.Mifare Plus X and Mifare Plus S....................................654.3.3.NFC Forum Type 2 Tags – Mifare UltraLight and UltraLight C, NTAG203..........................................................674.3.4.NFC Forum Type 1 Tags – Innovision/Broadcom chips. 694.4.WIRED-LOGIC PICCS BASED ON ISO 14443-B.....................724.4.1.ST Micro Electronics SR176..........................................724.4.2.ST Micro Electronics SRI4K, SRIX4K, SRI512, SRX512, SRT512..................................................................................734.4.3.Inside Contactless PicoPass, ISO 14443-2 mode...........744.4.4.Inside Contactless PicoPass, ISO 14443-3 mode...........754.4.5.Atmel CryptoRF............................................................764.5.ISO 15693 VICCS.....................................................774.5.1.ISO 15693-3 read/write commands.............................774.5.2.Read/write commands for ST Micro Electronics chips with a 2-B block address.......................................................784.5.3.Complete ISO 15693 command set..............................784.5.4.Implementation of basic ISO 15693 commands...........794.6.OTHER NON-ISO PICCS................................................824.6.1.NFC Forum Type 3 Tags / Felica....................................824.7.OTHER NON-ISO VICCS................................................834.7.1.EM4134........................................................................835.USING THE H663 WITH A NFCIP-1 TARGET.........................845.1.INTRODUCTION.............................................................845.1.1.Functions performed by the coupler............................845.1.2.Functions to be implemented on the PC......................855.2.MAPPING OF THE NFC FUNCTIONS INTO PC/SC FUNCTIONS........855.2.1.ATR of an ISO 18092 target..........................................855.2.2.Using SCardTransmit (ENCAPSULATE) to exchange PDUs..............................................................................................865.3.ADVANCED FEATURES......................................................865.3.1.Changing the GI bytes in the ATR_REQ.........................866.DIRECT CONTROL OF THE H663..........................................886.1.BASIS........................................................................886.2.IMPLEMENTATION DETAILS.................................................886.2.1.Sample code.................................................................886.2.2.Link to SpringProx legacy protocol...............................906.2.3.Format of response, return codes................................906.2.4.Redirection to the Embedded APDU Interpreter..........906.3.LIST OF AVAILABLE CONTROL SEQUENCES.................................916.3.1.Action on the LEDs.......................................................916.3.2.Action on the buzzer....................................................926.3.3.Obtaining information on coupler and slots.................936.3.4.Stopping / starting a slot..............................................946.3.5.Forced insert/remove sequences.................................956.3.6.Reading/writing H663's configuration registers...........966.3.7.Pushing a new temporary configuration......................97SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 5 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual7.CONFIGURATION REGISTERS..............................................987.1.EDITING COUPLER'S CONFIGURATION.....................................987.1.1.By software..................................................................987.1.2.Using SpringCard MultiConf software..........................987.2.LIST OF THE CONFIGURATION REGISTERS AVAILABLE TO THE END-USER ORINTEGRATOR.......................................................................997.3.CORE CONFIGURATION...................................................1007.3.1.Configuration of the LEDs...........................................1007.3.2.Options for the LEDs and GPIOs.................................1017.3.3.Behaviour of the LEDs and buzzer..............................1017.4.PC/SC CONFIGURATION................................................1027.4.1.Slot naming and startup mode...................................1027.4.2.CLA byte of APDU interpreter....................................1027.4.3.Behaviour of the contactless slot in PC/SC mode.......1037.5.CONTACTLESS CONFIGURATION..........................................1047.5.1.Enabled protocols......................................................1047.5.2.Parameters for polling................................................1057.5.3.Options for polling......................................................1067.5.4.Allowed baudrates in T=CL (ISO 14443-4)..................1077.5.5.Options for T=CL (ISO 14443-4)..................................1087.5.6.Number of antennas + auto-stop...............................1087.6.FELICA CONFIGURATION..................................................1097.6.1.Service Codes for Felica read/write............................1097.7.ISO 18092 / NFC-DEP CONFIGURATION........................1107.7.1.Global Bytes in ATR_REQ............................................1107.8.ISO 7816 CONFIGURATION...........................................1117.8.1.Options for the smartcard slots..................................1118.ANNEX A – SPECIFIC ERROR CODES..................................1129.ANNEX B – ACTIVATING SCARDCONTROL WITH THE DIFFERENT DRIVERS............................................................1149.1.DIRECT CONTROL USING SPRINGCARD SDD480....................1149.2.DIRECT CONTROL USING MS USBCCID............................1149.3.DIRECT CONTROL USING MS WUDFUSBCCIDDRIVER.............1159.4.DIRECT CONTROL USING PCSC-LITE CCID..........................11610.3RD-PARTY LICENSES......................................................11710.1.FREERTOS............................................................117SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 6 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual1. INTRODUCTION1.1. ABSTRACTSpringCard H663 is a PC/SC RFID and NFC coupler module, featuring 0 to 5 optional T=0/T=1interfaces for contact smartcards or SIM/SAM. The H663 module is the core of numerous PC/SCCouplers offered by SpringCard, and also of specific readers designed by OEMs.This document provides all necessary information to develop software that will use the H663 core.1.2. SUPPORTED PRODUCTSAt the time of writing, this document refers to all SpringCard PC/SC Couplers in the H663 group:The H663S and H663A: OEM modules without antenna,The H663-USB: OEM coupler with integrated antenna based on the H663S,The CrazyWriter HSP: multi-interface OEM coupler based on the H663A,The TwistyWriter HSP: OEM coupler with remote antenna based on the H663S,The Prox'N'Roll HSP: desktop coupler,The CSB HSP LT: large desktop coupler based on the H663S,The CSB HSP: multi-interface desktop coupler based on the H663S.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 7 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualProduct list with order codesProduct name Order code DescriptionH663S SC14182 Contactless PC/SC OEM module for balanced antennaH663SC SC14183 Contact & contactless PC/SC OEM module for balanced antennaH663A SC14184 Contactless PC/SC OEM module for unbalanced antennaH663AC SC14185 Contact & contactless PC/SC OEM module for unbalanced antennaH663-USB SC3016 Contactless PC/SC OEM coupler with integrated antennaCrazyWriter HSPSC0168 Contact & contactless PC/SC OEM coupler with 1 x SAM + 1 x remote antenna (50)(expansion board for 3 more SAM available as an option)CrazyWriter HSP DualSC14148 Contact & contactless PC/SC OEM coupler with 1 x SAM + 2 x remote antennas (50)(expansion board for 3 more SAM available as an option)TwistyWriterHSPSC14190 Contactless PC/SC OEM coupler with remote antenna (TP)Prox'N'Roll HSP PC/SCSC15131 Desktop contactless PC/SC couplerCSB HSP SC0177 Desktop contact & contactless PC/SC coupler with 3 x SAM + 1 x ID-1 slotCSB HSP LT SC14048 Desktop contactless PC/SC couplerSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 8 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual1.3. RELATED DOCUMENTSa. End usersEditor Doc # DescriptionSpringCard PMU14186 CSB HSP, CSB HSP LT QuickStart GuideSpringCard PMU14092 CrazyWriter HSP QuickStart GuideSpringCard PMU14189 TwistyWriter HSP QuickStart Guideb. IntegratorsEditor Doc # DescriptionSpringCard PMD2236 H663 Hardware Integration guideSpringCard PNA14187 CrazyWriter HSP Hardware Integration guideSpringCard PNA14188 TwistyWriter HSP Hardware Integration guide1.4. AUDIENCEThis manual is designed for use by application developers. It assumes that the reader has expertknowledge of computer development and a basic knowledge of PC/SC, of the ISO 7816-4 standardfor smartcards, and of the NFC Forum's specifications.Chapter 2 provides a quick introduction to those technologies and concepts, but can't cover all theaspects, as would a book or a training session.1.5. SUPPORT AND UPDATESUseful related materials (product datasheets, application notes, sample software, HOWTOs andFAQs…) are available at SpringCard’s web site:www.springcard.comUpdated versions of this document and others are posted on this web site as soon as they areavailable.For technical support enquiries, please refer to SpringCard support page, on the web atwww.springcard.com/supportSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 9 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual1.6. USEFUL LINKSMicrosoft’s PC/SC reference documentation is included in Visual Studio help system, andavailable online at http://msdn.microsoft.com . Enter “winscard” or “SCardTransmit”keywords in the search box.MUSCLE PCSC-Lite project: http://www.musclecard.com (direct link to PC/SC stack:http://pcsclite.alioth.debian.org)PC/SC workgroup: http://www.pcscworkgroup.comNFC Forum: http://www.nfc-forum.orgSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 10 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual2. PC/SC, SMARTCARDS AND NFC: QUICK INTRODUCTION AND GLOSSARY2.1. SMART-CARD AND CONTACTLESS SMARTCARDS STANDARDSA smartcard is a microprocessor (running a software of course) mounted in a plastic card.The ISO 7816 family of standards defines everything for contact smartcards:ISO 7816-1 and ISO 7816-2 defines the form-factor and electrical characteristics,ISO 7816-3 introduces two transport-level protocols between the coupler and the card:“T=0” and “T=1”,ISO 7816-4 mandates a common function set. This function set exposes the smartcard as asmall file-system, with directories and files, where the data are stored. The application-level frames are called APDUs.The ISO 14443 family is the normative reference for contactless smartcards:ISO 14443-1 and ISO 14443-2 defines the form-factor, RF characteristics, and bit-levelcommunication,ISO 14443-3 specifies the byte- and frame-levels part of the communication1,ISO 14443-4 introduces a transport-level protocol that more-or-less looks like T=1, so it isoften called “T=CL” (but this name never appears is the standard).On top of T=CL, the contactless smartcard is supposed to have the same function set and APDUsformatting rules as contact smartcard, i.e. it should be “ISO 7816-4 on top of ISO 14443”.In this context, working with a smartcard (either contact or contactless) is as easy as sending acommand (C-APDU) to the card, and receive its response (R-APDU). The “smartcard reader” is onlya gateway that implements this APDU exchange stuff (with a relative abstraction from thetransport-level protocols).1 ISO 14443-2 and -3 are divided into 2 technologies: ISO 14443 type A and ISO 14443 type B. They use different codings and low-level protocols, but the transport protocol defined in ISO 14443-4 is type-agnostic: it makes no difference whether the card is type A or type B.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 11 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual2.2. PC/SCPC/SC is the de-facto standard to interface Personal Computers with Smart Cards (and smartcardreaders of course). SpringCard PC/SC Couplers comply with this standard. This makes thoseproducts usable on most operating systems, using a high-level and standardized API.To get started with PC/SC, please read our Introduction to PC/SC development and simplifieddocumentation of the API, available online athttp://www.springcard.com/download/find.php?file=pmdz061The heart of PC/SC is the SCardTransmit function, that is the implementation in the computer ofthe APDU exchange stuff.If the smartcard you are working with does comply with ISO 7816-4, there is nothing more to add!Refer to the ISO 7816-4 standard and/or to the documentation of the card2 to know the APDUsyou must send, and how to understand the responses. Then implement your card-aware processthrough a batch of SCardTransmit calls. Whether the smartcard is contactless or contact makeslittle to no difference3. a. PC/SC and a contact smartcard2 Note that a microprocessor-based smartcard is a chip plus some application running in it. It could be a monolithic application, without an operating system, or an operating system (for instance JavaCard) with some applications added. You need the documentation of the application(s) and in some situations the documentation of the operating system, not the chip's.3 Actually there's more differences between contact protocols T=0 and T=1 than between contactless protocol “T=CL” and T=1. When developing an application for a contactless smartcard, read the ISO 7816-4 standard and the documentation of the smartcard as if it were running T=1.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.PCapplicationH663ContactreaderISO7816-3smartcard(T=0 orT=1)(PPS)(PPS Resp.)Card insert event(SCardWaitStatusChange)Connect to the card(SCardConnect)C-APDU(SCardTransmit)C-APDU(T=0 or T=1 blocks)R-APDU(T=0 or T=1 blocks) R-APDU(SCardTransmit success)Disconnect from the card(SCardDisconnect) (power down)(ATR)
PMD2271-BApage 12 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualb. PC/SC and a contactless smartcard2.3. NON-7816-4 CONTACTLESS CARDS – INTRODUCING THE EMBEDDED APDU INTERPRETERA lot of contactless cards are not actually “smartcards” because they are not ISO 7816-4compliant. They don't comply with the ISO 14443-4 transport-level protocol, and their vendor-specific function set can't fit directly in a single “exchange” function. Therefore, they are notnatively supported by the system's PC/SC stack. This is the case of:Wired-logic memory cards (Mifare, CTS, SR... families),NFC Tags (type 1, type 2, type 3),Even some proprietary microprocessor-based cards that use a specific communicationprotocol with a frame format not compliant with ISO 7816-4 (Desfire EV0...).The role of the embedded APDU interpreter, running in the H663, is to 'emulate' a standardsmartcard in those cases. Doing so, the PC/SC stack (and as a consequence your application)doesn't have to deal with the underlying protocols and chip-specific commands.Basically, the embedded APDU interpreter exposes the card as being a T=1 compliant smartcard,and provides two functions taken from ISO 7816-4: READ BINARY and UPDATE BINARY. In ISO7816-4, those functions are intended to access data within a file (in the card's file-system), but onmemory cards they give access to the “raw” storage, using a byte-, block- or page-based accessdepending on the card technology and features.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.PCapplicationH663C/lessreaderISO14443-4smartcard(type A ortype B)Polling + anticollision(REQA, REQB, ...)Enter T=CL(RATS or ATTRIB)(ATS or R-ATTRIB)Card insert event(SCardWaitStatusChange)Connect to the card(SCardConnect)C-APDU(SCardTransmit)C-APDU(I-blocks)R-APDU(I-blocks) R-APDU(SCardTransmit success)Disconnect from the card(SCardDisconnect)Leave T=CL(Deselect)(Deselect)
PMD2271-BApage 13 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manuala. Role of the embedded APDU interpreter2.4. NFC ?NFC stands for Near Field Communication, which is the case of all communication systems usinglow frequencies or very short operating distance. But NFC is now understood as bothNFCIP-1 (Near Field Communication Interface and Protocol), i.e. the ISO 18092 standard,which defines a new transport-level protocol sometimes called “peer-to-peer” (but thisname never appears is the standard),NFC Forum, an association that promotes the uses of NFC and publishes “application-level”standards (where ISO focuses on the technical levels).SpringCard H663 and derived products are partially compliant with NFCIP-1 (initiator role, passivecommunication mode only). Please refer to chapter 5 for details. These products should alsosupport NFC Forum's applications, but no compliance with NFC Forum's low level requirements isclaimed.Note that in NFC Forum's literature,- ISO 14443 type A and ISO 18092 @ 106kbit/s is called NFC-A,- ISO 14443 type B is called NFC-B,- JIS:X6319-4 and ISO 18092 @ 212/424kbit/s is called NFC-F.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.H663C/lessreaderAPDUinterpreterPCapplicationC/lessmemorycard(or NFC Tag,RFID label,...)Polling + anticollision(all protocols)Card insert event(SCardWaitStatusChange)Connect to the card(SCardConnect)C-APDU(SCardTransmit)Card-specific function(using card-specific protocol)Card-specific response(using card-specific protocol) R-APDU(SCardTransmit success)Disconnect from the card(SCardDisconnect)
PMD2271-BApage 14 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual2.5. VENDOR-SPECIFIC FEATURES – DIRECT CONTROL OF THE COUPLERPC/SC's SCardTransmit function implements a communication channel between your applicationand the card. But sometimes the application wants to access some features of the H663 itself:driving the LEDs or buzzer, getting the serial number... In other words, the application wants totalk to the coupler and not to the card.The PC/SC's SCardControl function has been designed to do so. Chapter 6 details the commandssupported by the H663 using this direct communication channel. But opening a SCardControlchannel means getting a direct (and exclusive) access to the coupler, and as a consequence blocksthe other communication channel(s).To overcome this drawback, the embedded APDU interpreter could also be used to conveycommands to the coupler with an existing card-channel and using SCardTransmit calls (see § 3.4.1for details).SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 15 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual2.6. GLOSSARY – USEFUL TERMSThe following list contains the terms that are directly related to the subject of this document. Thisis an excerpt from our technical glossary, available online at: http://www.springcard.com/blog/technical-glossary/ ICC: integrated-circuit card. This is the standard name for a plastic card holding a siliconchip (an integrated circuit) compliant with the ISO 7816 standards. A common name issmartcard.CD: coupling device or coupler. A device able to communicate with an ICC. This is whateverybody calls a smartcard reader. Technically speaking, it could be seen as a gatewaybetween the computer and the card.Microprocessor-based card: an ICC (or a PICC) whose chip is a small computer. This is thecase of high-end cards used in payment, transport, eID/passports, access control... Keyfeatures are security, ability to store a large amount of data and to run an applicationinside the chip. Most of the time they implement the command set defined by ISO 7816-4.Memory card or wired logic card: an ICC (or a PICC) whose chip is only able to store somedata, and features a limited security scheme (or no security scheme at all). They arecheaper than microprocessor-based cards and therefore are widely used for RFIDtraceability, loyalty, access control...PICC: proximity integrated-circuit card. This is the standard name for any contactless cardcompliant with the ISO 14443 standards (proximity: less than 10cm). This could either be asmartcard or a memory card, or also any NFC object running in card emulation mode.Common names are contactless card, or RFID card, NFC Tag.PCD: proximity coupling device. A device able to communicate with a PICC, i.e. acontactless coupler compliant with ISO 14443.RFID: radio-frequency identification. This is the general name for any system using radiowaves for M2M communication (machine to machine, in our case PCD to PICC).VICC: vicinity integrated circuit card. This is the standard name for any contactless cardcompliant with the ISO 15693 standards (vicinity: less than 150cm). Common names areRFID tag, RFID label.VCD: vicinity coupling device. A device able to communicate with a VICC, i.e. a contactlesscoupler compliant with ISO 15693.NFC: near-field communication. A subset of RFID, where the operating distance is muchshorter than the wavelength of the radio waves involved. This is the case for both ISO14443: the carrier frequency is 13.56MHz, leading to a wavelength of 22m. The proximityand vicinity ranges are shorter than this wavelength.NFC Forum: an international association that aims to standardize the applications of NFC inthe 13.56MHz range. Their main contribution is the NFC Tags, which are nothing more thanSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 16 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualPICCs which data are formatted according to their specifications, so the information theycontain is understandable by any compliant application.NDEF: NFC Data Exchange Format. The format of the data on the NFC Tags specified by theNFC Forum.ISO 7816-1 and ISO 7816-2: This international standard defines the hardwarecharacteristics of the ICC. The standard smartcard format (86x54mm) is called ID-1. Asmaller form-factor is used for SIM cards (used in mobile phone) or SAM (secureauthentication module, used for payment or transport applications) and is called ID-000.ISO 7816-3: This international standard defines two communication protocols for ICCs: T=0and T=1. A compliant coupler must support both of them.ISO 7816-4: This international standard defines both a communication scheme and acommand set. The communication scheme is made of APDUs. The command set assumesthat the card is structured the same way as a computer disk drive: directories and filescould be selected (SELECT instruction) and accessed for reading or writing (READ BINARY,UPDATE BINARY instructions). More than 40 instructions are defined by the standard, butmost cards implement only a small subset, and often add their own (vendor-specific)instructions.APDU: application protocol datagram unit. These are the frames that are exchanged atapplication-level between an application running on the computer and a smartcard. Theformat of those frames is defined by ISO 7816-4 and checked by the system's PC/SC stack.The command (application to card) is called a C-APDU, the response (card to application)an R-APDU. Note that this is a request/response scheme: the smartcard has no way to sendsomething to the application unless the application asks for it.ISO 14443: This international standard defines the PCD/PICC communication scheme. It isdivided into 4 layers:1. Defines the hardware characteristics of the PICC,2. Defines the carrier frequency and the bit-level communication scheme,3. Defines the frame-level communication scheme and the session openingsequence (anti-collision),4. Defines the transport-level communication scheme (sometimes called “T=CL”).The application-level is out of the scope of ISO 14443. Most microprocessor-based PICCsimplement ISO 7816-4 on top of ISO 14443-4.A lot of wired logic PICCs (NXP Mifare family, ST Micro Electronics ST/SR families, to namea few) implements only a subset of ISO 14443, and have their own set of functions on topof either ISO 14443-2 or ISO 14443-3.Note that ISO 14443-2 and ISO 14443-3 are divided into 2 protocols called 'A' and 'B'. APCD shall implement both, but the PICCs implement only one of them4. Four4Yet some NFC objects may emulate both an ISO 14443-A and an ISO 14443-B card.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 17 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualcommunication baud rates are possible: 106 kbit/s is mandatory, higher baud rates (212,424 or 848 kbit/s) are optional.ISO 15693: This international standard defines the VCD/VICC communication scheme. It isdivided into 3 layers:1. Defines the hardware characteristics of the VICC,2. Defines the carrier frequency and the bit-level communication scheme,3. Defines the frame-level communication scheme, the session opening sequence(anti-collision/inventory), and the command set of the VICC.All VICCs are memory chips. Their data storage area is divided into blocks. The size of theblocks and the number of them depend on the VICC.Note that ISO 18000-3 mode 1 is the same as ISO 156935.ISO 18092 or NFCIP-1: This international standard defines a communication scheme (mostof the time named “peer to peer mode”) where two peer “objects” are able tocommunicate together (and not only a PCD and a PICC). The underlying protocol is ISO14443-A at 106 kbit/s and JIS:X6319-4 (aka Sony Felica protocol) at 212 and 424 kbit/s.Initiator: according to NFCIP-1, the NFC object that is the “master” of the communicationwith a peer known as target. A PCD is a sort of initiator.Target: according to NFCIP-1, the NFC object that is the “slave” in the communication witha peer known as initiator. A PICC is a sort of target.NFC-DEP: NFC Data Exchange Protocol. This is the name used by the NFC Forum for the ISO18092 “high level” protocol. After an initial handshaking (ATR_REQ/ATR_RES), the initiatorand the target exchanges transport-level blocks (DEP_REQ/DEP_RES).LLCP: Logical Link Control Protocol. A network protocol specified by the NFC Forum on topof NFC-DEP.SNEP: Simple NDEF Exchange Protocol. An application protocol specified by the NFC Forumto exchange NDEF messages on top of LLCP.ISO 21481 or NFCIP-2: This international standard defines how a NFC object shall also beable to communicate using ISO 14443 and ISO 15693 standards.Mifare: This trademark of NXP (formerly Philips Semiconductors) is the generic brandname of their PICC products. Billions of Mifare Classic cards have been deployed since the90's. This is a family of wired-logic PICCs were data storage is divided into sectors andprotected by a proprietary6 stream cipher called CRYPTO1. Every sector is protected by 2access keys called “key A” and “key B”7. NXP also offers another family of wired-logic PICCscalled Mifare UltraLight (adopted by the NFC Forum as NFC Type 2 Tags). Mifare SmartMX5ISO 15693 has been written by the workgroup in charge of smartcards, and then copied by the workgroup in charge of RFID into ISO 18000, the large family of RFID standards.6And totally broken. Do not rely on this scheme in security-sensitive applications!7A typical formatting would define key A as the key for reading, and key B as the key for reading+writing.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 18 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual(and former Pro/ProX) is a family of microprocessor-based PICCs that may run virtually anysmartcard application, typically on top a JavaCard operating system. Mifare Desfire is aparticular microprocessor-based PICC that runs a single general-purpose application.Felica: This trademark of Sony is the generic brand name of their PICC products. Theunderlying protocol has been standardized in Japan (JIS:X6319-4) and is used by ISO 18092at 212 and 424 kbit/s. The Felica standard includes a Sony-proprietary security scheme thatis not implemented in SpringCard's products. Therefore, only the Felica chips configured towork without security (“Felica Lite”, “Felica Lite-S”, or NFC Type 3 Tags) are supported.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 19 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual3. EMBEDDED APDU INTERPRETER3.1. BASISIn PC/SC architecture, the SCardTransmit function implements the dialogue between anapplication and a smartcard, the coupler being only a “passive” gateway. The coupler transmitsframes in both directions, without any specific processing. The dialogue follows the ISO 7816-4APDU rules:Application to smartcard C-APDU is CLA, INS, P1, P2, Data In (optional)Smart-card to application R-APDU is Data Out (optional), SW1, SW2In order to work with non ISO 7816-4 cards as if they were smartcards, the embedded APDUinterpreter obeys to the same rules, offering its own list of instructions under the reserved classCLA=hFF. It is therefore available through regular SCardTransmit calls.3.1.1. CLA byte of the embedded APDU interpreterDefault class is hFF. This means that every APDU starting with CLA= hFF will be interpreted by theH663, and not forwarded by the card.a. Changing the CLA byte of the embedded APDU interpreterThe CLA byte of the embedded APDU interpreter is stored in register hB2 of H663’s non volatilememory (see § 7.4.2).Note: in the following paragraphs, documentation of the APDUs is written with CLA= hFF. Changethis to match your own CLA if necessary.b. Disabling the embedded APDU interpreterDefine CLA byte = h00 (register hB2= h00, see § 7.4.2) to disable the embedded APDU interpreter.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 20 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual3.1.2. Status words returned by the embedded APDU interpreterSW1 SW2 Meaningh90 h00 Successh67 h00 Wrong length (Lc incoherent with Data In)h68 h00 CLA byte is not correcth6A h81 Function not supported (INS byte is not correct), or not available for theselected PICC/VICCh6B h00 Wrong parameter P1-P2h6F h01 PICC mute or removed during the transferSome functions provided by the embedded APDU interpreter may return specific status words.This behaviour is documented within the paragraph dedicated to each function.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 21 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual3.1.3. Embedded APDU interpreter instruction listInstruction INS Contactless Contact Notes (see below)LOAD KEY h82 CGENERAL AUTHENTICATE h86 CREAD BINARY hB0 AENVELOPE hC2 BGET DATA hCA   CUPDATE BINARY hD6 AREADER CONTROL hF0   DMICORE CONTROL hF1 DABCCORE CONTROL hF1 DMIFARE CLASSIC READ hF3 DMIFARE CLASSIC WRITE hF4 DMIFARE CLASSIC VALUE hF5 DRFID MEMORY CONTROL hF6 D – starting from FW 1.81CONTACTLESS SLOT CONTROL hFB DTEST hFD   DENCAPSULATE hFE   DNotes:AFunction fully implemented according to PC/SC standardBFunction implemented according to PC/SC standard, but some feature are not supportedCFunction implemented according to PC/SC standard, but also provides vendor-specificoptionsDVendor-specific functionSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 22 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual3.2. INSTRUCTIONS DEFINED BY THE PC/SC STANDARD (V2 PART 3)3.2.1. GET DATA instructionThe GET DATA instruction retrieves information regarding the inserted PICC. It can be used withany kind of PICC, but the returned content will vary with the type of PICC actually in the slot.GET DATA command APDUCLA INS P1 P2 Lc Data In LehFF hCA SeebelowSeebelow - - h00GET DATA command parametersP1 P2 Action FwStandard PC/SC-defined valuesh00 h00 Serial number of the PICC- ISO 14443-A : UID (4, 7 or 11 bytes)- ISO 14443-B : PUPI (4 bytes)- ISO 15693: UID (8 bytes)- Innovatron : DIV (4 bytes)- JIS:X6319-4 : IDm (8 bytes)- others: see chapter 4 for detailsSpringCard specific valuesh01 h00 - ISO 14443-A : historical bytes from the ATS- ISO 14443-B : INF field in ATTRIB response- JIS:X6319-4 : PMm (8 bytes)- ISO 18092 : GT bytes in ATR_RES- others: see chapter 4 for detailshF0 h00 Complete identifier of the PICC:- ISO 14443-A: ATQA (2 bytes) + SAK (1 byte) + UID- ISO 14443-B: complete ATQB (11 or 12 bytes)8- ISO 15693: answer to GET SYSTEM INFORMATION command9- Innovatron: REPGEN- Innovision/Broadcom/NFC Forum Type 1 Tag: HR0, HR1- JIS:X6319-4 : IDm and PMm (16 bytes)- ISO 18092 : complete ATR_RES≥ 1.758SpringCard PC/SC Couplers are ready to support the extended ATQB (12 bytes), but since a lot of PICC currently in circulation don't reply to the REQB command with the “extended” bit set, this feature is not enabled by default.9If the card doesn’t support the GET SYSTEM INFORMATION COMMAND, a valid SYSTEM INFORMATION value is constructed, including the UID and the DSFID byte.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 23 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualP1 P2 ActionhF1 h00 Type of the PICC/VICC, according to PC/SC part 3 supplementaldocument: PIX.SS (standard, 1 byte) + PIX.NN (card name, 2 bytes)See chapter 4.1 for detailshF1 h01 NFC Tag10 compliance:- h01 if the PICC is recognized as a NFC Type 1 Tag- h02 if the PICC is recognized as a NFC Type 2 Tag- h03 if the PICC is recognized as a NFC Type 3 Tag- h00 otherwisehF2 h00 “Short” serial number of the PICC- ISO 14443-A: UID truncated to 4 bytes, in “classical” order- others: same as P1,P2=h00,h00hFA h00 Card’s ATRhFC h00 ISO 14443 communication indexes on 2 bytes (DSI, DRI)hFC h01 PICC/VICC → H663 baudrate (DS in kbit/s, 2 bytes, MSB first)hFC h02 H663 → PICC/VICC baudrate (DR in kbit/s, 2 bytes, MSB first)hFC h03 Index of the active antenna on 1 bytehFF h00 Product serial number (raw value on 4 bytes)hFF h01 Not available for H663hFF h02 Name of the RF interface component (“RC663”)hFF h81 Vendor name in ASCII (“SpringCard”)hFF h82 Product name in ASCIIhFF h83 Product serial number in ASCIIhFF h84 Product USB identifier (VID/PID) in ASCIIhFF h85 Product version (“x.xx”) in ASCIIGET DATA responseData Out SW1 SW2XX … XX See belowGET DATA status wordSW1 SW2 Meaningh90 h00 Successh62 h82 End of data reached before Le bytes (Le is greater than data length)h6C XX Wrong length (Le is shorter than data length, XX in SW2 gives the correct value)10 Please refer to NFC Forum’s specifications for details. Note that NFC Forum Type 4 Tags are “standard” contactless smartcards; it is up to the application level to send the proper SELECT APPLICATION to recognize them.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 24 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual3.2.2. LOAD KEY instructionThe LOAD KEY instruction loads a 6-byte Mifare Classic access key (CRYPTO1) into the H663’smemory.LOAD KEY command APDUCLA INS P1 P2 Lc Data In LehFF h82 KeylocationKeyindexh06 Key value -LOAD KEY command parameter P1 (key location)P1h00 The key is to be loaded in H663’s volatile memoryh20 The key is to be loaded in H663’s non-volatile memory (secure E2PROM inside the RCchipset)LOAD KEY command parameter P2 (key index)When P1 = h00, P2 is the identifier of the key into H663’s volatile memory. The memory has thecapacity to store up to 4 keys of each type (A or B).P2 = h00 to P2 = h03 are “type A” keys,P2 = h10 to P2 = h13 are “type B” keys.When P1 = h20, P2 is the identifier of the key into the H663's non-volatile memory (if available).This memory can store up to 16 keys of each type (A or B).P2 = h00 to P2 = h0F are “type A” keys,P2 = h10 to P2 = h1F are “type B” keys.Note there's no way to read-back the keys stored in either volatile or non-volatile memory.LOAD KEY responseSW1 SW2See belowSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 25 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualLOAD KEY status wordSW1 SW2 Meaningh90 h00 Successh69 h86 Volatile memory is not availableh69 h87 Non-volatile memory is not availableh69 h88 Key index (P2) is not in the allowed rangeh69 h89 Key length (Lc) is not validSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 26 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual3.2.3. GENERAL AUTHENTICATE instructionThe GENERAL AUTHENTICATE instruction performs a Mifare Classic authentication (CRYPTO1).The application must provide the index of the key to be used; this key must have been loaded intothe H663 through a previous LOAD KEY instruction.Do not invoke this function if the currently activated PICC is not a Mifare Classic!GENERAL AUTHENTICATE command APDUCLA INS P1 P2 Lc Data In LehFF h86 h00 h00 h05 See below -GENERAL AUTHENTICATE Data In bytesByte 0 Byte 1 Byte 2 Byte 3 Byte 4h01 h00 BlocknumberKeylocationor KeytypeKeyindexThe block number (byte 2) is the address on the Mifare card, where the application tries to beauthenticated (note: this is the block number, not the sector number).The key location or Key type (byte 3) must be either:h60 for authentication using a CRYPTO1 “A” key (standard PC/SC-defined value),h61 for authentication using a CRYPTO1 “B” key (standard PC/SC-defined value),Same value as the P1 parameter used in the LOAD KEY instruction: h00 or h20 (SpringCardspecific value).The key index (byte 4) is defined as follow:If key type (byte 3) is h60, use values h00 to h03 to select one of the “A” keys stored in the H663'svolatile memory, and values h20 to h2F to select one of the “A” keys stored in the H663's non-volatile memory (if available),If key type (byte 3) is h61, use values h00 to h03 to select one of the “B” keys stored in the H663'svolatile memory, and values h20 to h2F to select one of the “B” keys stored in the H663's non-volatile memory (if available),If key type (byte 3) is either h00 or h20 (same value as the P1 parameter used in the LOAD keyinstruction), choose one of the values allowed for the P2 parameter in the same LOAD keyinstruction (SpringCard specific value).SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 27 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualGENERAL AUTHENTICATE responseSW1 SW2See belowGENERAL AUTHENTICATE status wordSW1 SW2 Meaningh90 h00 Successh69 h82 CRYPTO1 authentication failedh69 h86 Key location or type (byte 3) is not valid (or not available for this coupler)h69 h88 Key index (byte 4) is not in the allowed rangeSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 28 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual3.2.4. READ BINARY instructionThe READ BINARY instruction retrieves data from a memory card (wired-logic PICC or VICC). Referto chapter 4 for details.For any PICC/VICC but Mifare Classic, this instruction is executed without any prerequisite.For Mifare Classic, to be able to read the sector's data, the application must be authenticated onthe card's sector. The application must therefore invoke GENERAL AUTHENTICATE instruction(with a valid key A or key B for the sector) before invoking the READ BINARY instruction. Using theMIFARE CLASSIC READ instruction instead (§ 3.3.1) could be easier and may shorten thetransaction time.READ BINARY command APDUCLA INS P1 P2 Lc Data In LehFF hB0 AddressMSBAddressLSB- - XXP1 and P2 form the address that will be sent to the PICC/VICC in its specific read command. MostPICC/VICC are divided into small blocks (sometimes called pages). The address is a block number,and not to an absolute byte offset in memory.Both the allowed range for the address and the value for Le depend on the capabilities of thePICC/VICC. Please always refer to its datasheet for details. Note that Le = h00 should always work,provided that the address is valid.For Mifare Classic, P1,P2 is the address of the block (h0000 to h00FF), but remember that theauthentication is made on a per-sector basis. A new authentication must be performed every timeyou have to access another sector.For a NFC Type 2 Tag, P2 is the block number, and P1 the sector number if the PICC supports thisfeature. Set P1 to h00 if it is not the case.READ BINARY responseData Out SW1 SW2XX … XX See belowSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 29 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualREAD BINARY status wordSW1 SW2 Will return in Data Outh90 h00 Successh62 h82 End of data reached before Le bytes (Le is greater than data length)h69 h81 Command incompatibleh69 h82 Security status not satisfiedh6A h82 Wrong address (no such block or no such offset in the PICC/VICC)h6C XX Wrong length (Le is shorter than data length, XX in SW2 gives the correct value)SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 30 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual3.2.5. UPDATE BINARY instructionThe UPDATE BINARY instruction writes data into a memory card (wired-logic PICC or VICC). Referto chapter 4 for details.For any PICC/VICC but Mifare Classic, this instruction is executed without any prerequisite.For Mifare Classic, to be able to read the sector's data, the application must be authenticated onthe card's sector. Your application must always invoke GENERAL AUTHENTICATE instruction (witha valid key A or key B for the sector) before invoking the UPDATE BINARY instruction. Using theMIFARE CLASSIC WRITE instruction instead (§ 3.3.2) could be easier and may shorten thetransaction time.UPDATE BINARY command APDUCLA INS P1 P2 Lc Data In LehFF hD6 AddressMSBAddressLSBXX Data -P1 and P2 form the address that will be sent to the PICC/VICC in its specific write command. MostPICC/VICC are divided into small blocks (sometimes called pages). The address is a block number,and not to an absolute byte offset in memory.Both the allowed range for the address and the value for Lc depend on the capabilities of the PICC.Please always refer to its datasheet for details.For Mifare Classic, P1,P2 is the address of the block (h0000 to h00FF), but remember that theauthentication is made on a per-sector basis. A new authentication must be performed every timeyou have to access another sector. Lc must be h10 (a block is 16-B long).For a NFC Type 2 Tag, P2 is the block number, and P1 the sector number if the PICC does supportthis feature. Set P1 to h00 if it is not the case. Lc must be h04 (a block is 4-B long).UPDATE BINARY responseSW1 SW2See belowSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 31 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualUPDATE BINARY status wordSW1 SW2 Will return in Data Outh90 h00 Successh69 h82 Security status not satisfiedh6A h82 Wrong address (no such block or no such offset in the PICC)h6A h84 Wrong length (trying to write too much data at once)Important disclaimerMost PICC/VICC have specific areas:- that can be written only once (OTP: one time programming or fuse bits),- and/or that must be written carefully because they are involved in the security scheme of thechip (lock bits),- and/or because writing an invalid value will make the card unusable (sector trailer of a MifareClassic for instance).Before invoking UPDATE BINARY, always double check where you're writing, and for the sensitiveaddresses, what you're writing!SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 32 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual3.3. SPRINGCARD-SPECIFIC INSTRUCTIONS FOR THE CONTACTLESS SLOT3.3.1. MIFARE CLASSIC READ instructionThe MIFARE CLASSIC READ instruction retrieves data from a Mifare Classic PICC (e.g. Mifare 1K orMifare 4K, or Mifare Plus in level 1).The difference with READ BINARY lies in the authentication scheme:With the READ BINARY instruction, authentication must be performed before, using theGENERAL AUTHENTICATE instruction,With the MIFARE CLASSIC READ instruction, the authentication is performed automaticallyby the H663, trying every keys one after the other, until one succeed.This “automatic” authentication makes MIFARE CLASSIC READ instruction an interesting helper toread Mifare data easily.Do not invoke this function if the currently activated PICC is not a Mifare Classic!a. MIFARE CLASSIC READ using coupler’s keysIn this mode, the application doesn't specify anything. The H663 tries every keys he knows (bothpermanent keys in E2PROM and temporary keys previously loaded in volatile memory – use LOADKEY to do so) until one succeeds.Since the coupler must try all the keys, this method may take up to 1000ms. The ordering of thekeys in coupler's memory is very important to speed-up the process: the upper the right key is inthe coupler's memory, the sooner the authentication will succeed.Note that the coupler tries all “type A” keys first, and only afterwards all the “type B” keys. Thisbehaviour has been chosen because in 95% of Mifare applications, the “type A” key is thepreferred key for reading (where the “type B” key is used for writing).MIFARE CLASSIC READ command APDUCLA INS P1 P2 Lc Data In LehFF hF3 h00 Block Number - - XXRefer to the READ BINARY command (§ 3.2.4) for response and status words.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 33 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualb. MIFARE CLASSIC READ selecting a key in the couplerIn this mode, the application chooses one of the key previously loaded in the H663 through theLOAD KEY instruction.MIFARE CLASSIC READ command APDU, selecting a keyCLA INS P1 P2 Lc Data In LehFF hF3 h00 Block Number h02KeyLocationor TypeKeyIndex XXThe understanding and values for bytes Key location or Key type and Key index are documentedin § 3.2.3 (GENERAL AUTHENTICATE instruction).Refer to the READ BINARY instruction (§ 3.2.4) for response and status words.c. MIFARE CLASSIC READ with specified keyIn this mode, the application provides the 6-B value of the key to the H663.The coupler tries the key as a “type A” first, and only afterwards as a “type B”.MIFARE CLASSIC READ command APDU, with specified keyCLA INS P1 P2 Lc Data In LehFF hF3 h00 Block Number h06 Key value(6 bytes) XXRefer to the READ BINARY instruction (§ 3.2.4) for response and status words.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 34 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual3.3.2. MIFARE CLASSIC WRITE instructionThe MIFARE CLASSIC WRITE instruction writes data into a Mifare Classic PICC (e.g. Mifare 1K orMifare 4K, or Mifare Plus in level 1).The difference with UPDATE BINARY lies in the authentication scheme:With the UPDATE BINARY instruction, authentication must be performed before, using theGENERAL AUTHENTICATE instruction,With the MIFARE CLASSIC WRITE instruction, the authentication is performedautomatically by the H663, trying every keys one after the other, until one succeed.This “automatic” authentication makes MIFARE CLASSIC WRITE instruction an interesting helper towrite Mifare data easily.Do not invoke this function if the currently activated PICC is not a Mifare Classic!Important disclaimerWriting sector trailers (security blocks) is possible as long as the sector's current access conditionallows it, but Mifare sector trailers have to follow a specific formatting rule (mix-up of the accessconditions bits) to be valid. Otherwise, the sector becomes permanently unusable.Before invoking MIFARE CLASSIC WRITE, always double check that you're not writing a sectortrailer, and if you really have to do so, make sure the new content is formatted as specified in thedatasheet of the PICC.a. MIFARE CLASSIC WRITE using coupler’s keysIn this mode, the application doesn't specify anything. The H663 tries every key he knows (bothpermanent keys in E2PROM and temporary keys previously loaded in volatile memory) until onesucceeds.Since the coupler must try all the keys, this method may take up to 1000ms. The ordering of thekeys in coupler's memory is very important to speed-up the process: the upper the right key is inthe coupler's memory, the sooner the authentication will succeed.Note that the coupler tries all “type B” keys first, and only afterwards all the “type A” keys. Thisbehaviour has been chosen because in 95% of Mifare applications, the “type B” key is thepreferred key for writing11.11 Mifare Classic cards issued by NXP are delivered in “transport configuration”, with no “B” key and an “A” key allowed for both reading and writing. This “transport configuration” gives poorest writing performance ; card issuer must start the card personalisation process by enabling a “B” key for writing.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 35 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualMIFARE CLASSIC WRITE command APDUCLA INS P1 P2 Lc Data In LehFF hF4 h00 Block Number XX XX … XX -Lc must be a multiple of 16.Refer to the UPDATE BINARY instruction (§ 3.2.5) for response and status words.b. MIFARE CLASSIC WRITE selecting a key in the couplerIn this mode, the application chooses one the key previously loaded in the H663 through the LOADKEY instruction.MIFARE CLASSIC WRITE command APDU, selecting a keyCLA INS P1 P2 Lc Data In LehFF hF4 h00 Block Number XX See below -MIFARE CLASSIC WRITE command APDU, selecting a key: Data In bytesBytes 0 to Lc-3 Byte Lc-2 Byte Lc-1Data to be written(multiple of 16 bytes)KeyLocationor TypeKey IndexThe understanding and values for bytes Key location or Key type and Key index are documentedin § 3.2.3 (GENERAL AUTHENTICATE instruction).Refer to the UPDATE BINARY instruction (§ 3.2.5) for response and status words.c. MIFARE CLASSIC WRITE with specified keyIn this mode, the application provides the key to the H663.The coupler tries the key as a “type B” first, and only afterwards as a “type A”.MIFARE CLASSIC WRITE command APDU, with specified keyCLA INS P1 P2 Lc Data In LehFF hF4 h00 Block Number XX See below -SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 36 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualMIFARE CLASSIC WRITE command APDU, with specified key: Data In BytesBytes 0 to Lc-7 Bytes Lc-6 to Lc-1Data to be written(multiple of 16 bytes)Key value(6 bytes)Lc = 6 + 16 x (number of blocks to be written).Refer to the UPDATE BINARY instruction (§ 3.2.5) for response and status words.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 37 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual3.3.3. MIFARE CLASSIC VALUE instructionThe MIFARE CLASSIC VALUE instruction makes it possible to invoke the DECREMENT, INCREMENT,and RESTORE functions of a Mifare Classic PICC (e.g. Mifare 1K or Mifare 4K, or Mifare Plus in level1), followed by a TRANSFER function.The DECREMENT, INCREMENT, RESTORE (and TRANSFER) functions could be performed only on theblocks that have been formatted as VALUE block in the sector trailer (access condition bits). Do notinvoke this function on DATA blocks, and do not invoke this function if the currently activated PICCis not a Mifare Classic!MIFARE CLASSIC VALUE opcode, operand, and transfer addressThe P1 parameter in the MIFARE CLASSIC VALUE command APDU in the PICCs' operation code(opcode), as defined in Mifare Classic specification. Allowed values are:hC1 for INCREMENThC0 for DECREMENThC2 for RESTOREAll three operations requires an operand. The operand is a 4-byte signed integer.INCREMENT operation: the operand must be > 0 (between h00000001 and h7FFFFFFF). Theoperand is added to the current value of the source block, and the result is kept by thePICC in a register,DECREMENT operation: the operand must be > 0 (between h00000001 and h7FFFFFFF). Theoperand is subtracted from the current value of the source block, and the result is kept bythe PICC in a register,RESTORE operation: the operand must be 0 (h00000000). The PICC copies the current valueof the source block into a register.After the INCREMENT, DECREMENT or RESTORE operation has been performed by the PICC, theH663 invokes the TRANSFER operation: the value of the register is written into a target block.If the destination block number is not the same as the source block number, the originalvalue remains unchanged in the source block (this is a sort of “backup” feature),If the destination block number is the same as the source block number, or not destinationblock number is defined, then the source block is overwritten with the new value.a. MIFARE CLASSIC VALUE using coupler’s keysIn this mode, the application doesn't specify anything. The H663 tries every keys he knows (bothpermanent keys in E2PROM and temporary keys previously loaded in volatile memory) until onesucceeds.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 38 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualBecause the coupler must try all the keys, this method can take up to 1000ms. The ordering of thekeys in coupler's memory is very important to speed-up the process: the upper the right key is inthe coupler's memory, the sooner the authentication will succeed.For DECREMENT and RESTORE operations, the coupler tries all “type A” keys first, and onlyafterwards all the “type B” keys.For INCREMENT operation, the coupler tries all “type B” keys first, and only afterwards all the“type A” keys.The destination block could optionally be specified at the end of the command APDU. If not, thesource block is overwritten by the TRANSFER operation.MIFARE CLASSIC VALUE command APDU, using coupler's key, without backupCLA INS P1 P2 Lc Data In LehFF hF5 Opcode Sourceblock h04 Operand(4B – MSB first) -MIFARE CLASSIC VALUE command APDU, using coupler's key, with backupCLA INS P1 P2 Lc Data In LehFF hF5 Opcode Sourceblock h05 Operand(4B – MSB first)Dest.block -Refer to the UPDATE BINARY instruction (§ 3.2.5) for response and status words.b. MIFARE CLASSIC VALUE selecting a key in the couplerIn this mode, the application chooses one the key previously loaded in the H663 through the LOADKEY instruction.The destination block could optionally be specified at the end of the command APDU. If not, thesource block is overwritten by the TRANSFER operation.MIFARE CLASSIC VALUE command APDU, selecting a key, without backupCLA INS P1 P2 Lc Data In LehFF hF5 Opcode Sourceblock h06 Operand(4B – MSB first)Keylocationor TypeKeyindex -SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 39 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualMIFARE CLASSIC VALUE command APDU, selecting a key, with backupCLA INS P1 P2 Lc Data In LehFF hF5 Opcode Sourceblock h07 Operand(4B – MSB first)Keylocationor TypeKeyindexDest.block -The understanding and values for bytes Key location or Key type and Key index are documentedin § 3.2.3 (GENERAL AUTHENTICATE instruction).Refer to the UPDATE BINARY instruction (§ 3.2.5) for response and status words.c. MIFARE CLASSIC VALUE with specified keyIn this mode, the application provides the key to the H663.For DECREMENT and RESTORE operations, the coupler tries the key as a “type A” first, and onlyafterwards as a “type B”.For INCREMENT operation, the coupler tries the key as a “type B” first, and only afterwards as a“type A”.The destination block could optionally be specified at the end of the command APDU. If not, thesource block is overwritten by the TRANSFER operation.MIFARE CLASSIC VALUE command APDU, key specified, without backupCLA INS P1 P2 Lc Data In LehFF hF5 Opcode Sourceblock h0A Operand(4B – MSB first)Key value(6B) -MIFARE CLASSIC VALUE command APDU, key specified, with backupCLA INS P1 P2 Lc Data In LehFF hF5 Opcode Sourceblock h0B Operand(4B – MSB first)Key value(6B)Dest.block -Refer to the UPDATE BINARY instruction (§ 3.2.5) for response and status words.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 40 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual3.3.4. RFID MEMORY CONTROL instructionThe RFID MEMORY CONTROL instruction gives access to some functions of RFID wired-logic PICCsor VICCs that have no equivalent in the smartcard world.For instance, Reading to / Writing from a RFID memory chip maps to READ BINARY / UPDATEBINARY which are “standards” instructions defined by ISO 7816. But ISO 7816 has no equivalentfor a lot of functions defined in ISO 15693, such as “Write DSFID”, “Lock AFI”, and much more.Therefore, the RFID MEMORY CONTROL instruction is a SpringCard-defined function that easesoperating ISO 15693 and related VICCs, such as EM4134.a. Read Single BlockThis function is available for ISO 15693 and EM4134 VICCs.This function is a low-level alternative to READ BINARY.RFID MEMORY CONTROL : Read Single Block command APDUCLA INS P1 P2 Lc Data In LehFF hF6 h20 h00 h01 Address(1B) h00b. Write Single BlockThis function is available for ISO 15693 and EM4134 VICCs.This function is a low-level alternative to UPDATE BINARY.RFID MEMORY CONTROL : Write Single Block command APDUCLA INS P1 P2 Lc Data In LehFF hF6 h21 h00 h01+LenAddress(1B)Data(Len) -SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 41 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualc. Lock BlockThis function is available for ISO 15693 and EM4134 VICCs.RFID MEMORY CONTROL : Lock Block command APDUCLA INS P1 P2 Lc Data In LehFF hF6 h22 h00 h01 Address(1B) -d. Read Multiple BlocksThis function is available for ISO 15693 VICCs only.This function is a low-level alternative to READ BINARY.RFID MEMORY CONTROL : Read Multiple Blocks command APDUCLA INS P1 P2 Lc Data In LehFF hF6 h23 h00 h01 Address(1B)Count(1B) h00e. Write Multiple BlocksThis function is available for ISO 15693 VICCs only.This function is a low-level alternative to UPDATE BINARY.RFID MEMORY CONTROL : Write Multiple Block command APDUCLA INS P1 P2 Lc Data In LehFF hF6 h24 h00 h02+LenAddress(1B)Count(1B)Data(Len) -f. Write AFIThis function is available for ISO 15693 VICCs only.RFID MEMORY CONTROL : Write AFI command APDUCLA INS P1 P2 Lc Data In LehFF hF6 h27 h00 h01 AFI(1B) -SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 42 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualg. Lock AFIThis function is available for ISO 15693 VICCs only.RFID MEMORY CONTROL : Lock AFI command APDUCLA INS P1 P2 Lc LehFF hF6 h28 h00 h00 -h. Write DSFIDThis function is available for ISO 15693 VICCs only.RFID MEMORY CONTROL : Write DSFID command APDUCLA INS P1 P2 Lc Data In LehFF hF6 h29 h00 h01 DSFID(1B) -i. Lock DSFIDThis function is available for ISO 15693 VICCs only.RFID MEMORY CONTROL : Lock DSFID command APDUCLA INS P1 P2 Lc LehFF hF6 h2A h00 h00 -j. Get System InformationThis function is available for ISO 15693 VICCs only.RFID MEMORY CONTROL : Get System Information command APDUCLA INS P1 P2 Lc LehFF hF6 h2A h00 - h00Note: the H663 always sends the Get system information command to the VICC, as part of thediscovery process. Invoke the GET DATA instruction (§ 3.2.1) to retrieve the value already returnedby the VICC to the H663.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 43 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualk. Get Multiple Block SecurityThis function is available for ISO 15693 VICCs only.RFID MEMORY CONTROL : Get Multiple Block Security command APDUCLA INS P1 P2 Lc Data In LehFF hF6 h24 h00 h02 Address(1B)Count(1B) -SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 44 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual3.3.5. CONTACTLESS SLOT CONTROL instructionThe CONTACTLESS SLOT CONTROL instruction allows pausing and resuming the card trackingmechanism of the contactless slot.This is useful because card tracking implies sending commands to the PICC periodically (andwatch-out its answer). Such commands may have unwanted side-effects, such as breaking theatomicity between a pair of commands. Switching the card tracking mechanism OFF during thetransaction with solve this problem.SLOT CONTROL command APDUCLA INS P1 P2 Lc Data In LehFF hFB SeebelowSeebelow - - -SLOT CONTROL command parametersP1 P2 Actionh00 h00 Resume the card tracking mechanismh01 h00 Suspend the card tracking mechanismh10 h00 Stop the RF fieldh10 h01 Start the RF fieldh10 h02 Reset the RF field (10ms pause)h20 h00 T=CL de-activation (DESELECT12)h20 h01 T=CL activation of ISO 14443-A card (RATS)h20 h02 T=CL activation of ISO 14443-B card (Attrib)h20 h04 Disable the next T=CL activation13h20 h05 Disable every T=CL activation (until reset of the H663)h20 h06 Enable T=CL activation againh20 h07 Disable the next T=CL activation and force a RF resethFC xx Felica runtime parameters, see § 3.3.6 belowhDE hAD Stop the slotNOTE: a stopped slot is not available to SCardConnect any more. Itmay be restarted only through an SCardControl command.12 Or DISC for Innovatron cards. This makes it possible to operate ISO 14443-4 compliant cards at ISO 14443-3 level. No CARD INSERTED event is triggered, so the ATR of the card stays unchanged.13 Upon DISCONNECT, the CARD REMOVED event fires, then the CARD INSERTED event. A new ATR is computed, and reflects that the card runs at ISO 14443-3 level.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 45 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualSLOT CONTROL responseData Out SW1 SW2- See belowSLOT CONTROL status wordSW1 SW2 Meaningh90 h00 Success3.3.6. SET FELICA RUNTIME PARAMETERS instructionWorking with Felica (Lite) cards or NFC Type 3 Tags involves 4 parameters:The SYSTEM CODE is sent by the H663 during the JIS:X6319-4 polling loop (SENSF_REQ) tospecify which family of cards may answer. The value hFFFF allows any card to answer,The REQUEST CODE is sent by the H663 during the JIS:X6319-4 polling loop (SENSF_REQ) toget technical data from the cards, and not only their IDm/PPm. The value h00 prevent thecard from sending technical data,A first SERVICE CODE is a mandatory parameter used during read operations (READ BINARYinstruction) to tell the card which “service” is accessed. The value h000B has been assignedby the NFC Forum to give (read) access to a type 3 Tag's NDEF record,Another SERVICE CODE is a mandatory parameter used during write operations (UPDATEBINARY instruction) to tell the card which “service” is accessed. The value h0009 has beenassigned by the NFC Forum to give write access to a type 3 Tag's NDEF record.The values emphasized in the above paragraph are the H663's default values. They could beupdated permanently thanks to the WRITE REGISTER command (§ 6.3.6) applied to theconfiguration registers hB4 (§ 7.5.2) and hCF (§ 7.6.1).Alternatively, those values may be changed dynamically using a simple APDU command in theSCardTransmit stream, as depicted in the paragraphs below.a. SERVICE CODE for the READ BINARY instructionSET FELICA SERVICE READ command APDUCLA INS P1 P2 Lc Data In LehFF hFB hFC h01 h02 Service Code to be used by theREAD BINARY instruction(2 bytes, MSB first)-SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 46 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualb. SERVICE CODE for the UPDATE BINARY instructionSET FELICA SERVICE WRITE command APDUCLA INS P1 P2 Lc Data In LehFF hFB hFC h02 h02 Service Code to be used by theUPDATE BINARY instruction(2 bytes, MSB first)-c. SERVICE CODE for both READ BINARY and UPDATE BINARY instructionsSET FELICA SERVICES command APDUCLA INS P1 P2 Lc Data In LehFF hFB hFC h03 h02 Service Code to be used both by theREAD BINARY and UPDATE BINARYinstructions(2 bytes, MSB first)-d. SYSTEM CODE and REQUEST code for Felica pollingSET FELICA SYSTEM CODE command APDUCLA INS P1 P2 Lc Data In LehFF hFB hFC h10 h02 System Code to be used duringJIS:X6319-4 polling (SC in SENS_REQ)(2 bytes, MSB first)-SET FELICA REQUEST CODE command APDUCLA INS P1 P2 Lc Data In LehFF hFB hFC h11 h01 Request Code to be used duringJIS:X6319-4 polling (RC in SENS_REQ)(1 byte)-SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 47 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual3.3.7. ENCAPSULATE instruction for the Contactless slotThe ENCAPSULATE instruction has been designed to help the applications communicate withPICC/VICC that don’t comply with ISO 7816-4.ENCAPSULATE command APDU for the contactless slotCLA INS P1 P2 Lc Data In LehFF hFE SeebelowSeebelow XX Frame to send to the PICC/VICC XXENCAPSULATE command parameter P1 for the contactless slotP1 Standard communication protocolsh00For ISO 14443-4 (A or B) PICCs : send the frame in the T=CL stream14.Data In shall not include PCB, CID, NAD nor CRC fieldsFor ISO 18092 targets : send the frame DEP_REQ/DEP_RES stream. Data In shall notinclude PFB, DID, NAD nor CRC fieldsh01Send the frame “as is” using the ISO 14443-3 A protocol @ 106 kbit/s.The standard parity bits are added (and checked in return) by the H663.The standard CRC is added (and checked in return) by the H663.h02Send the frame “as is” using the ISO 14443-3 B protocol @ 106 kbit/s.The standard CRC is added (and checked in return) by the H663.h03Send the frame “as is” using the JIS:X6319-4 protocol @ 212 kbit/s.The standard CRC is added (and checked in return) by the H663.h04Send the frame “as is” using the ISO 15693 protocol.The standard CRC is added (and checked in return) by the H663.h05Send the frame “as is” using the ISO 15693 protocol.The UID of the VICC is added to the frame (unselected access mode).The standard CRC is added (and checked in return) by the H663.h07Send the frame “as is” using the JIS:X6319-4 protocol @ 424 kbit/s.The standard CRC is added (and checked in return) by the H663.…/…14 This is the only way to send commands to a T=CL PICC that doesn't comply with the ISO 7816-4 APDU formatting, for instance a Desfire 0.4.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 48 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualP1 Non-standard communicationh09Send the frame “as is” using the ISO 14443-3 A modulation @ 106 kbit/s.The standard parity bits are added (and checked in return) by the H663, but the CRC isnot added (and not checked) by the H663 the application must append the CRC to Data In and check it in Data Out.h0ASend the frame “as is” using the ISO 14443-3 B modulation @ 106 kbit/s.The CRC is not added (and not checked) by the H663 the application must append the CRC to Data In and check it in Data Out.h0CSend the frame “as is” using the ISO 15693 modulation.The CRC is not added (and not checked) by the H663 the application must append the CRC to Data In and check it in Data Out.P1 Mifare low level communication15h0FSend the frame “as is” using the ISO 14443-3 A modulation.The CRC is not added (and not checked) by the H663 the application must append the CRC to Data In and check it in Data Out.The parity bits are not added (and not checked) by the H663 the application must provide a valid stream, including the parity bits).The last byte is complete (8 bits will be sent)h1F Same as h0F, but only 1 bit of the last byte will be senth2F Same as h0F, but only 2 bits of the last byte will be senth3F Same as h0F, but only 3 bits of the last byte will be senth4F Same as h0F, but only 4 bits of the last byte will be senth5F Same as h0F, but only 5 bits of the last byte will be senth6F Same as h0F, but only 6 bits of the last byte will be senth7F Same as h0F, but only 7 bits of the last byte will be sent15 The above values allow an application to transmit “ciphered” Mifare frames (the CRYPTO1 stream cipher makes a non-standard use of the parity bits and CRC). The number of valid bits in the last byte of card’s answer will be reported in SW2.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 49 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualP1 Redirection to another slot16h80 Redirection to the main contact slot (if present)h81 Redirection to the 1st SIM/SAM slot (if present)h82 Redirection to the 2nd SIM/SAM slot (if present)h83 Redirection to the 3rd SIM/SAM slot (if present)h84 Redirection to the 4th SIM/SAM slot (if present)ENCAPSULATE command parameter P2 for the contactless slotP2 encodes the frame time-out.P2 Timeout valueh-0 If P1 = h00, use the default time-out defined by the PICC or the target (T=CL: card's FWT)If P1  h00, this value shall not be usedh-1 Timeout = 106 ETU  1msh-2 Timeout = 212 ETU  2msh-3 Timeout = 424 ETU  4msh-4 Timeout = 848 ETU  8msh-5 Timeout = 1696 ETU  16msh-6 Timeout = 3392 ETU  32msh-7 Timeout = 6784 ETU  65msh-8 Timeout = 13568 ETU  0,125sh-9 Timeout = 27136 ETU  0,250sh-A Timeout = 54272 ETU  0,500sh-B Timeout = 108544 ETU  1sh-C Timeout = 217088 ETU  2sh-D Timeout = 434176 ETU  4sh0- Set status word = h6F XX, XX being the contactless specific errorh8- Set status word = h63 00 on any contactless specific error16 Those values allow an application to transmit APDUs to a SAM or an auxiliary card through the PC/SC handle of the main card.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 50 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualENCAPSULATE response for the contactless slotData Out SW1 SW2Frame received from thePICC/VICC See belowENCAPSULATE status word for the contactless slotSW1 SW2 Meaningh90 h00 Success – last byte of Data Out has 8 valid bitsh90 h01 Success – last byte of Data Out has 1 valid bitsh90 h02 Success – last byte of Data Out has 2 valid bitsh90 h03 Success – last byte of Data Out has 3 valid bitsh90 h04 Success – last byte of Data Out has 4 valid bitsh90 h05 Success – last byte of Data Out has 5 valid bitsh90 h06 Success – last byte of Data Out has 6 valid bitsh90 h07 Success – last byte of Data Out has 7 valid bitsh6F XX Error reported by the contactless interface (only allowed if high-order bit of P2is 0). See chapter 8 for the list of possible values and their meaning.h63 h00 Error reported by the contactless interface (when high-order bit of P2 is 1).h62 h82 Le is greater than actual response from PICC/VICCh6C XX Le is shorter than actual response from PICC/VICCSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 51 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual3.3.8. ENCAPSULATE instruction for one of the Contact slotsThe ENCAPSULATE instruction has been designed to help the applications communicate withPICC/VICC that don’t comply with ISO 7816-4.ENCAPSULATE command APDU for a contact slotCLA INS P1 P2 Lc Data In LehFF hFE h00 h00 XX Frame to send to the card XXENCAPSULATE response for a contact slotData Out SW1 SW2Frame received from the card See belowENCAPSULATE status word for a contact slotSW1 SW2 Meaningh90 h00 Successh6F XX Error reported by the contactless interface (only allowed if high-order bit of P2is 0). See chapter 8 for the list of possible values and their meaning.h62 h82 Le is greater than actual response from cardh6C XX Le is shorter than actual response from cardSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 52 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual3.4. OTHER SPRINGCARD-SPECIFIC INSTRUCTIONS3.4.1. READER CONTROL instructionThe READER CONTROL instruction allows driving the global behaviour of the H663 (LEDs, buzzer,etc. depending on product physical characteristics).For advanced operation, or if you want to interact with the H663 even when there's no cardinserted, use SCardControl instead (see chapter 6).If your coupler is multi-slot (contactless + contact or SAM), the READER CONTROL instruction issent to one slot (a logical coupler), but is likely to have a global impact to the whole physicalcoupler.In other words, sending a READER CONTROL instruction to one card channel may have an impacton another card channel.It is highly recommended to use a synchronisation object in your application(s) (mutex, criticalsection, …) to prevent any concurrent access to the same physical coupler when the READERCONTROL instruction is called.READER CONTROL command APDUCLA INS P1 P2 Lc Data In LehFF hF0 h00 h00 Seebelow See below Seebelowa. Driving coupler’s LEDsFor a coupler with only red and green LEDs, send the APDU:FF F0 00 00 03 1E <red> <green>For a coupler with red, green and yellow / blue LEDs, send the APDU:FF F0 00 00 04 1E <red> <green> <yellow/blue>Choose values for red, green and yellow/blue in this table:h00 LED is switched OFFh01 LED is switched ONh02 LED blinks slowlyh03 LED is driven automatically by the H663’s firmware (default behaviour)h04 LED blinks quicklyh05 LED performs the “heart-beat” sequenceSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 53 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualTo go back to default (LEDs driven by the H663's firmware automatically), send the APDU:FF F0 00 00 01 1Eb. Driving coupler’s buzzerSome hardware feature a single tone beeper. To start the buzzer, send the APDU:FF F0 00 00 03 1C <duration MSB> <duration LSB>where duration specifies the length of the tone, in milliseconds (max is 60000ms).Set duration to 0000 if you need to stop the buzzer before the duration started in a previous call.To go back to default (buzzer driven by the H663's firmware automatically), send the APDU:FF F0 00 00 01 1Cc. OthersThe data block in the READER CONTROL instruction is forwarded “as is” to the reader controlinterpreter, as documented in chapter 6.Therefore, every command documented in § 6.3 and starting with code h58 may be transmitted inthe SCardTransmit link using the READER CONTROL instruction, exactly as if it were transmitted ina SCardControl link.Do not use this feature unless you know exactly what you are doing.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 54 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual3.4.2. TEST instructionThe TEST instruction has been designed to test the driver and/or the applications, with arbitrarylength of data (in and out).TEST command APDUCLA INS P1 P2 Lc Data In LehFF hFD SeebelowSeebelow XX XX … XX XXTEST command parametersParameter P1 specifies the length of Data Out the application wants to receive from the H663:h00: empty Data Out, only SW returnedhFF: 255 bytes of data + SWAll values between h00 and hFF are allowed6 low-order bits of P2 specify the delay between command and response.h00: no delay, response comes immediatelyh3F: 63 seconds between command and responseAll values between 0 and 63 are allowed2 high-order bits of P2 are RFU and must be set to 0.TEST responseData Out SW1 SW2XX … XX See belowContent of Data Out is not specified, and may contain either “random” or fixed data, dependingon the H663 version and current status.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 55 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualTEST status wordWhen 2 high-order bits of P2 are 0, the embedded APDU interpreter analyses the format of theAPDU, and return appropriate status word. On the other hand, if at least one of those bits is 1,status word is fixed whatever the APDU format.SW1 SW2 Meaningh90 h00 Success, APDU correctly formattedh67 h00 APDU is badly formatted (total length incoherent with Lc value)h6A h82 Le is greater than data length specified in P1h6C P1 Le is shorter than data length specified in P1SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 56 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual4. WORKING WITH CONTACTLESS CARDS – USEFUL HINTS4.1. RECOGNIZING AND IDENTIFYING PICC/VICC IN PC/SC ENVIRONMENT4.1.1. ATR of an ISO 14443-4 compliant smartcardIf the PICC is with 14443 up to level 4 (“T=CL”), the H663 builds a pseudo-ATR using the standardformat defined in PC/SC specification:a. For ISO 14443-A:Offset Name Value Meaning (according to 7816-3)0 TS h3B Direct convention1 T0 h8… Higher nibble 8 means: no TA1, no TB1, no TC1. TD1 to followLower nibble is the number of historical bytes (0 to 15)2 TD1 h80 Higher nibble 8 means: no TA2, no TB2, no TC2. TD2 to followLower nibble 0 means: protocol T=03 TD2 h01 Higher nibble 8 means: no TA3, no TB3, no TC3, no TD3Lower nibble 1 means: protocol T=14 H1… Historical bytes from ATS response… …3+k Hk4+k TCK XX Checksum (XOR of bytes 1 to 3+k)b. For ISO 14443-B:Offset Name Value Meaning (according to 7816-3)0 TS h3B Direct convention1 T0 h88 Higher nibble 8 means: no TA1, no TB1, no TC1. TD1 to followLower nibble is the number of historical bytes (8)2 TD1 h80 Higher nibble 8 means: no TA2, no TB2, no TC2. TD2 to followLower nibble 0 means: protocol T=03 TD2 h01 Higher nibble 8 means: no TA3, no TB3, no TC3, no TD3Lower nibble 1 means: protocol T=14 H1… Application data from ATQB5 H26 H37 H4SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 57 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual8 H5… Protocol info byte from ATQB9 H610 H711 H8 XX MBLI from ATTRIB command12 TCK XX Checksum (XOR of bytes 1 to 11)c. For Innovatron (legacy Calypso cards)17:Offset Name Value Meaning (according to 7816-3)0 TS h3B Direct convention1 T0 h8… Higher nibble 8 means: no TA1, no TB1, no TC1. TD1 to followLower nibble is the number of historical bytes (0 to 15)2 TD1 h80 Higher nibble 8 means: no TA2, no TB2, no TC2. TD2 to followLower nibble 0 means: protocol T=03 TD2 h01 Higher nibble 8 means: no TA3, no TB3, no TC3, no TD3Lower nibble 1 means: protocol T=14 H1…Historical bytes from REPGEN. This is the last part of the card’s T=0ATR, including its serial number18.… …3+k Hk4+k TCK XX Checksum (XOR of bytes 1 to 3+k)Most Calypso cards are able to communicate both according to ISO 14443-B or to Innovatronprotocol. The choice between the two protocols is unpredictable.The same card will have two different ATR (one is ISO 14443-B is selected, the other if Innovatronprotocol is selected). The host application must get and check the card’s serial number19 to makesure it will not start a new transaction on the same card as earlier.17 When bit 7 of register hB3 is 0. Otherwise, the “real” card ATR (found in REPGEN) is returned. This ATR reports that the card supports T=0 only, but the card behaves as it were T=1. This behaviour is not compliant with Microsoft’s CCID driver.18 As a consequence, all the cards have a different ATR.19 Provided in the historical bytes of the ATR when the Innovatron protocol is selected, or available through the Calypso “Select Application” command.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 58 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual4.1.2. ATR of a wired-logic PICC/VICCFor contactless memory cards and RFID tags (Mifare, CTS, etc.), the H663 builds a pseudo-ATRusing the normalized format described in PC/SC specification:Offset Name Value0 TS h3B Direct convention1 T0 h8F Higher nibble 8 means: no TA1, no TB1, no TC1. TD1 to followLower nibble is the number of historical bytes (15)2 TD1 h80 Higher nibble 8 means: no TA2, no TB2, no TC2. TD2 to followLower nibble 0 means: protocol T=03 TD2 h01 Higher nibble 8 means: no TA3, no TB3, no TC3, no TD3Lower nibble 1 means: protocol T=14 H1 h805 H2 h4F Application identifier presence indicator6 H3 h0C Length to follow (12 bytes)7 H4 hA0Registered Application Provider IdentifierA0 00 00 03 06 is for PC/SC workgroup8 H5 h009 H6 h0010 H7 h0311 H8 h0612 H9 PIX.SS Protocol (see 4.1.4)13 H10 PIX.NN Card name (see 4.1.5)14 H1115 H12 00RFU16 H13 0017 H14 0018 H15 0019 TCK XX Checksum (XOR of bytes 1 to 18)SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 59 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual4.1.3. Using the GET DATA instructionWith the GET DATA instruction (documented in § 3.2.1), the host application is able to retrieveevery information needed to identify a PICC:Serial number (UID or PUPI),Protocol related values (ATQA and SAKA or ATQB, …).4.1.4. Contactless protocolThe standard byte (PIX.SS in PC/SC specification) is constructed as follow:b7 b6 b5 b4 b3 b2 b1 b0 Value Description0 0 0 0 0 0 0 0 h00 No information given0 0 0 0 0 0 0 1 h01 ISO 14443 A, level 10 0 0 0 0 0 1 0 h02 ISO 14443 A, level 20 0 0 0 0 0 1 1 h03 ISO 14443 A, level 3 or 4 (and Mifare)ISO 18092 @ 106 kbit/s “NFC-A”0 0 0 0 0 1 0 1 h05 ISO 14443 B, level 10 0 0 0 0 1 1 0 h06 ISO 14443 B, level 20 0 0 0 0 1 1 1 h07 ISO 14443 B, level 3 or 40 0 0 0 1 0 0 1 h09 ICODE 1, EM41340 0 0 0 1 0 1 1 h0B ISO 156930 0 0 1 0 0 0 1 h11JIS:X6319-4Felica cardsISO 18092 @ 212 or 424 kbit/s “NFC-F”Note: PIX.SS is defined for both memory and micro-processor based cards, but available in theATR for memory cards only. In the other case, use the GET DATA instruction (with parametersP1,P2=hF1,00) to get the underlying protocol used by the smartcard.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 60 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual4.1.5. Contactless card name bytesThe name bytes (PIX.NN in PC/SC specification) are specified as follow:NN Card name From FWValues specified by PC/SCh00 h01 NXP Mifare Classic 1kh00 h02 NXP Mifare Classic 4kh00 h03 NXP Mifare UltraLightNFC Forum Type 2 Tag with a capacity <= 64 bytesh00 h06 ST Micro Electronics SR176h00 h07 ST Micro Electronics SRI4K, SRIX4K, SRIX512, SRI512, SRT512 1.70h00 h0A Atmel AT88SC0808CRFh00 h0B Atmel AT88SC1616CRFh00 h0C Atmel AT88SC3216CRFh00 h0D Atmel AT88SC6416CRFh00 h12 Texas Instruments TAG ITh00 h13 ST Micro Electronics LRI512h00 h14 NXP ICODE SLIh00 h16 Not available in this product (NXP ICODE1)h00 h21 ST Micro Electronics LRI64h00 h24 ST Micro Electronics LR12h00 h25 ST Micro Electronics LRI128h00 h26 NXP Mifare Minih00 h2F Innovision/Broadcom Jewelh00 h30 Innovision/Broadcom TopazNFC Forum Type 1 Tagh00 h34 Atmel AT88RF04Ch00 h35 NXP ICODE SL2h00 h36 NXP Mifare Plus 2K SL1 1.81h00 h37 NXP Mifare Plus 4K SL1 1.81h00 h38 NXP Mifare Plus 2K SL2 1.81h00 h39 NXP Mifare Plus 4K SL2 1.81h00 h3A NXP Mifare UltraLight C, NXP NTAG203NFC Forum Type 2 Tag with a capacity > 64 bytesh00 h3A FelicaNFC Forum Type 3 TagSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 61 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualNN Card nameSpringCard proprietary extension20hFF hA0 Generic/unknown 14443-A cardhFF hA1 Kovio RF bar-codehFF hB0 Generic/unknown 14443-B cardhFF hB1 Not available in this product (ASK CTS 256B)hFF hB2 Not available in this product (ASK CTS 512B)hFF hB3 Pre-standard ST Micro Electronics SRI 4KhFF hB4 Pre-standard ST Micro Electronics SRI X512hFF hB5 Pre-standard ST Micro Electronics SRI 512hFF hB6 Pre-standard ST Micro Electronics SRT 512hFF hB7 Inside Contactless PICOTAG/PICOPASShFF hB8 Generic Atmel AT88SC / AT88RF cardhFF hC0 Calypso card using the Innovatron protocolhFF hD0 Generic ISO 15693 from unknown manufacturerhFF hD1 Generic ISO 15693 from EM Marin (or Legic)hFF hD2 Generic ISO 15693 from ST Micro Electronics, block number on 8 bitshFF hD3 Generic ISO 15693 from ST Micro Electronics, block number on 16 bitshFF hD5 Generic ISO 15693 from InfineonhFF hD6 EM MicroElectronic Marin EM4134 chip 1.81hFF hFF Virtual card (test only)Note: PIX.NN is specified for memory cards only. Even if the GET DATA instruction allows toretrieve PIX.NN even for micro-processor based cards (smartcards), the returned value isunspecified and shall not be used to identify the card.20 The cards in this list are not referenced by PC/SC specification at the date of writing. In case they are added to the specification, the future firmware versions will have to use the new value. It is therefore advised not to check those values in the applications, as they are likely to be removed in the future. Set bit 6 of configuration register hB3 (§ 7.4.3) to force PIX.NN = h00 h00 instead of using those proprietary values.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 62 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual4.2. ISO 14443-4 PICCS4.2.1. Desfire first version (0.4)Since this PICC is not ISO 7816-4 compliant, the Desfire commands must be wrapped in anENCAPSULATED instruction, with P1=h00 (§ 3.3.7). The H663 translates the C-APDU into a nativeDesfire command, retrieve the native Desfire answer, and translates it into a valid R-APDU.4.2.2. Desfire EV0 (0.6) and EV1This PICC is ISO 7816-4 compliant. Native commands are wrapped into ISO 7816-4 APDUs with acard-specific CLA = h90. Please refer to the card's datasheet for details.4.2.3. Calypso cardsA Calypso card is ISO 7816-4 compliant. You may work with a contactless Calypso card as if it wereinserted in a contact smartcard coupler.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 63 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual4.3. WIRED-LOGIC PICCS BASED ON ISO 14443-A4.3.1. Mifare ClassicThe PICCs covered by this chapter are:Mifare 1k (NXP MF1ICS50, PIX.NN = h0001),Mifare 4k (NXP MF1ICS70, PIX.NN = h0002),Mifare Mini (NXP MF1ICS20, PIX.NN = h0026),Mifare Plus (X or S) when used in level 1 (see § 4.3.2).Please download the datasheets of the cards at www.nxp.com. Useful information are available atwww.mifare.net.All these PICCs are divided into 16-byte blocks. The blocks are grouped in sectors. At the end ofevery sector a specific block (“sector trailer”) is reserved for security parameters (access keys andaccess conditions).Operating multi-standard PICCs as Mifare ClassicSome ISO 14443-4 compliant smartcards or NFC objects are also able to emulate Mifare Classiccards, but due to the ISO 14443-4 (T=CL) compliance, the H663 will “hide” their Mifare emulationmode and make them appear as high-level smartcards.There are 3 ways to force the H663 to stay at Mifare level:Send the T=CL DESELECT command to the PICC (SLOT CONTROL instruction withP1,P2=h20,00),Reset the RF field and temporarily disable T=CL activation (SLOT CONTROL instruction withP1,P2=h10,03),Permanently disable T=CL activation through configuration register hB3.a. READ BINARY instructionIn the READ BINARY command APDU,P1 must be h00,P2 is the address of the first block to be read (0 to 63 for a Mifare 1k, 0 to 255 for a Mifare4k),Since the size of every block is 16, Le must be a multiple of 16,When Le=h00 and the address is aligned on a sector boundary, all the data blocks of thesector are returned (48 or 240 bytes),SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 64 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualWhen Le=h00 and the address is not aligned, a single block is returned (16 bytes). Note that when a sector trailer (security block) is read, the keys are not readable (they are maskedby the PICC).The READ BINARY instruction can’t cross sector boundaries ; the GENERAL AUTHENTICATEinstruction must be called for each sector immediately before READ BINARY.Using the MIFARE CLASSIC READ instruction (§ 3.3.5) is easier and may shorten the transactiontime.b. UPDATE BINARY instructionIn the UPDATE BINARY command APDU,P1 must be h00,P2 is the address of the first block to be written (1 to 63 for a Mifare 1k, 1 to 255 for aMifare 4k),Since the size of every block is 16, Lc must be a multiple of 16 (48 bytes for standard sectors, 240bytes for the largest sectors in Mifare 4k).The UPDATE BINARY instruction can’t cross sector boundaries ; the GENERAL AUTHENTICATEinstruction must be called for each sector immediately before UPDATE BINARY.Important disclaimerWriting sector trailers (security blocks) is possible as long as the sector's current access conditionallows it, but Mifare sector trailers have to follow a specific formatting rule (mix-up of the accessconditions bits) to be valid. Otherwise, the sector becomes permanently unusable.Before invoking MIFARE CLASSIC WRITE, always double check that you're not writing a sectortrailer. If you really have to do so, make sure the new content is formatted as specified in thedatasheet of the PICC.Using the MIFARE CLASSIC WRITE instruction (§ 3.3.2) is easier and may shorten the transactiontime.c. Specific instructions for Mifare Classic3 specific instructions exist to work with Mifare Classic PICCs:MIFARE CLASSIC READ, see § 3.3.1,MIFARE CLASSIC WRITE, see § 3.3.2,MIFARE CLASSIC VALUE (implementing INCREMENT, DECREMENT and RESTORE followedby TRANSFER), see § 3.3.3.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 65 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual4.3.2. Mifare Plus X and Mifare Plus SPlease download the datasheets of the cards at www.nxp.com.The Mifare Plus implements 4 different security levels. The behaviour of the card changesdramatically with the selected security level.SpringCard has developed the PCSC_MIFPLUS software library (available as source code and aspre-compiled DLL in the SDK) to help working with Mifare Plus cards without going down at theAPDU level and without the need to implement the security scheme by yourself.For the documentation of this API, go to http://www.springcard.com/support/apidoc/pcsc_mifplus/index.htmla. Level 0At level 0, the PICC is ISO 14443-4 (T=CL) compliant. The H663 builds a smartcard ATR according to§ 4.1.1. The historical bytes of the ATS are included in the ATR and help recognizing the card atthis level.As the PICC is not ISO 7816-4 compliant, the commands shall be sent wrapped in anENCAPSULATED instruction with P1=h00 (§ 3.3.7).At the end of the personalisation process, the RF field must be reset (so the PICC will restart atLevel 1 or more). Send the SLOT CONTROL instruction with P1,P2=h10,02 to do so (§ 3.3.5)21.b. Level 1At level 1, the PICC emulates a Mifare Classic (§ 4.3.1). The H663 builds a memory card ATRaccording to § 4.1.1. The application shall use the MIFARE CLASSIC READ and MIFARE CLASSIC WRITE instructions towork with the card at this level.The PICC supports a new AES authentication Function. Use the ENCAPSULATE instruction withP1=h01 (§ 3.3.7) to implement this function.In order to increase the security level of the card (going to level 2 or level 3), an ISO 14443-4(T=CL) session must be manually started, even if the PICC announces that is is not T=CL compliant.Send the SLOT CONTROL instruction with P1,P2=h20,01 to do so (§ 3.3.5). Afterwards, process asdocumented for level 0.c. Level 2The level 2 is not available on Mifare Plus S.21 As a consequence, the card with be reported as REMOVED, then a new CARD INSERT event will be triggered (but with a different ATR as the security level is different).SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 66 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualWorking with the Mifare Plus X at this level is possible thanks to the low level instruction calls(SLOT CONTROL, ENCAPSULATE) but it is not implemented in the H663 (and not supported by oursoftware library).d. Level 3At level 3, the PICC is ISO 14443-4 (T=CL) compliant. The H663 builds a smartcard ATR according to§ 4.1.1. The historical bytes of the ATS are included in the ATR and help recognizing the card atthis level.Since the card is not ISO 7816-4 compliant, the commands shall be sent wrapped in anENCAPSULATED instruction, with P1=h00 (§ 3.3.7).SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 67 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual4.3.3. NFC Forum Type 2 Tags – Mifare UltraLight and UltraLight C, NTAG203...The cards covered by this chapter are:Mifare UL – NXP MF01CU1 (PIX.NN = h0003),Mifare UL C – NXP MF01CU2 (PIX.NN = h003A),Any PICC compliant with the specification of the NFC Forum Type 2 Tag.Please download the datasheets of the cards at www.nxp.com.Please visit www.nfcforum.org to get the specification of the Type 2 Tag.All these cards are divided into 4-byte pages. It is possible to write only 1 page at once, butreading is generally done 4 pages by 4 pages (16 bytes). A NFC Forum Type 2 Tag could also beoptionally divided into sectors of 256 pages (1024 bytes).It isn't possible to discover the actual capacity of a compliant PICC at protocol level.If the PICC is already formatted according to the specification of the NFC Forum Type 2 Tag, thecapacity is stored among other data in the 1st OTP page (CC – capability container bytes).In any other case, the application may find the number of pages by sending READ BINARYinstruction, incrementing the address, until it fails.Pay attention that unfortunately some PICCs do not fail but truncate the address; for instance aPICC with only 16 pages (0 to 15) may return the content of pages 0, 1, 2 and 3 when the address16 is read. Since pages 0 and 1 store the UID (serial number) of the PICC, compare pages 16, 17 topages 0, 1 to see that the end of the memory space has been reached.a. READ BINARY instructionIn the READ BINARY command APDU,P1 is the sector number. It must be h00 for PICCs that have only one sector,P2 is the address of the first page to be read. Please refer to the chip's datasheet to knowhow many pages could be addressed.Since the size of a page is 4 bytes, Le must be multiple of 4. When Le=h00, 4 pages are returned (16bytes).It is possible to read the complete data area of a Mifare UL in a single call by setting Le to h40 (64bytes). For Mifare UL C, the same result is achieved by setting Le to h90 (144 bytes).SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 68 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualb. UPDATE BINARY instructionIn the UPDATE BINARY command APDU,P1 is the sector number. It must be h00 for PICCs that have only one sector,P2 is the address of the (single) page to be written. Please refer to the chip's datasheet toknow how many pages could be addressed.Since the size of a page is 4 bytes, Lc must be 4, exactly.Some pages may hold- OTP (one-time-programming) bits,- and/or lock bits that are intended to make the PICC memory read only.Do not write on those pages without a good understanding of the consequences.c. Mifare UltraLight C 3-DES authenticationThe Mifare UltraLight C supports a 3-pass Triple-DES authentication feature.Use the ENCAPSULATE instruction with P1=h01 (§ 3.3.7) to implement this function.SpringCard has developed the PCSC_MIFULC software library (available as source code and aspre-compiled DLL in the SDK) to help working with Mifare UltraLight C cards without the need toimplement the security scheme by yourself.For the documentation of this API, go tohttp://www.springcard.com/support/apidoc/pcsc_mifulc/index.htmlSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 69 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual4.3.4. NFC Forum Type 1 Tags – Innovision/Broadcom chipsFirmware ≥ 1.75The PICCs covered by this chapter are:Innovision/Broadcom Topaz (PIX.NN = h002F),Innovision/Broadcom Jewel (PIX.NN = h0030),Any PICC compliant with NFC Forum Type 1 Tag specification.Please visit www.nfcforum.org to get the Type 1 Tag specification.a. Memory StructuresThere are 2 groups of PICCs in this specification:PICCs with a Static Memory Structure provide 120 bytes of data. They do support only theRALL, READ, WRITE-E and WRITE-NE functions.PICCs with a Dynamic Memory Structure provide more than 120 bytes of data. They aredivided into 8-bytes blocks. A segment is a group of 16 blocks (i.e. 128 bytes of data). Newfunctions are provided to address blocks and segments: READ8, RSEG, WRITE-E8 andWRITE-NE8.Those PICCs have 2 hardware information bytes called HR0 and HR1.HR0 = h11 denotes a Static Memory Structure,HR0 = h1y, where y ≠ 1, denotes a Dynamic Memory Structure,Other values for HR0 are RFU, HR1 is ignored.Prior to read/write PICC's data, the application shall fetch HR0 to know whether the PICC has aStatic or a Dynamic Memory Structure. To do so, the application may either:Invoke the READ BINARY instruction, specifying it wants to use the PICC's RALL functionand expects 122 bytes of data (FF B0 00 00 7A). HR0 is the first byte in the response.Invoke the GET DATA instruction, specifying it wants to get the PICC's complete identifier(FF CA F0 00 00). HR0 is the first byte in the response.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 70 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualb. READ BINARY instructionLEP1 P2 PICC function DescriptionBoth Static and Dynamic Structuresh00h780120 h00 h00 RALLThe coupler returns the 120 bytes of data returned by the PICC in response to RALL.The HR0 and HR1 bytes are dropped.h7A 122 h00 h00 RALLThe coupler returns the complete frame returned by the PICC in response to RALL, i.e. HR0 and HR1 followed by 120 bytes of data.h01 1h00, h00toh00, h7FREADP2 specify the byte address within the cardfrom 0 to 127.One byte is returned.Dynamic Memory Structure onlyh80 128h00, h00h00, h80h01, h00...RSEGP1, P2 specify the byte address within thecard.A complete segment (128 bytes of data) isreturned. Therefore, P1, P2 must be aligned toa segment boundary (≡ 0 mod 128).h08 8h00, h00h00, h08h00, h10...READ8P1, P2 specify the byte address within thecard.A complete block (8 bytes of data) is returned.Therefore, P1, P2 must be aligned to a blockboundary (≡ 0 mod 8).Using the RALL or RSEG functions is a lot faster than using READ/READ8 in a loop.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 71 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualc. UPDATE BINARY instructionLCP1 P2 PICC function DescriptionBoth Static and Dynamic Structuresh01 1h00, h00toh00, h7FWRITE-E The coupler writes 1 byte of data into the Tag.P2 specify the byte address (from 0 to 127)h01 1h80, h00toh80, h7FWRITE-NEThe coupler updates 1 byte of data to the Tag. The actual operation is a XOR between the current content of the card and the specified value.P2 specify the byte address (from 0 to 127)Dynamic Memory Structure onlyh01 1h00, h00h00, h08h00, h10...WRITE-E8The coupler writes 8 byte of data into the Tag.P1, P2 specify the byte address within thecard.Therefore, P1, P2 must be aligned to a block boundary (≡ 0 mod 8).h01 1h80, h00h80, h08h80, h10...WRITE-NE8The coupler updates 8 bytes of data to the Tag.The actual operation is a XOR between the current content of the card and the specified value.P10..6, P2 specify the byte address within thecard. Therefore, P10..6, P2 must be aligned to ablock boundary (≡ 0 mod 8).Some blocks holds OTP (one-time-programming) bits, and/or lock bits that are intended to makethe PICC memory read only. Do not write on those bytes without a good understanding of theconsequences.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 72 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual4.4. WIRED-LOGIC PICCS BASED ON ISO 14443-B4.4.1. ST Micro Electronics SR176These PICCs are identified by PIX.NN = h0006.They are divided into 2-byte blocks.a. READ BINARY instructionIn the READ BINARY command APDU,P1 must be h00,P2 is the address of the first block to be read (0 to 15),Since the size of every block is 2, Le must be multiple of 2 (up to 32 bytes),When Le=h00, a single block is returned (2 bytes).b. UPDATE BINARY instructionIn the UPDATE BINARY command APDU,P1 must be h00,P2 is the address of the block to be written,Since the size of every block is 2, Lc must be 2, exactly.Some blocks play a particular role in the configuration of the PICC. Do not write on those blockswithout a good understanding of the consequences.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 73 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual4.4.2. ST Micro Electronics SRI4K, SRIX4K, SRI512, SRX512, SRT512These PICCs are identified by PIX.NN = h0007.They are divided into 4-byte blocks.a. READ BINARY instructionIn the READ BINARY command APDU,P1 must be h00,P2 is the address of the first block to be read,Since the size of every block is 2, Le must be multiple of 4,When Le=h00, a single block is returned (4 bytes).b. UPDATE BINARY instructionIn the UPDATE BINARY command APDU,P1 must be h00,P2 is the address of the block to be written,Since the size of every block is 4, Lc must be 4, exactly.Some blocks play a particular role in the configuration of the PICC. Do not write on those blockswithout a good understanding of the consequences.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 74 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual4.4.3. Inside Contactless PicoPass, ISO 14443-2 modeThis part applies to chips named either “PicoPass or PicoTag” when the ISO 14443-3 compliance isNOT enabled in the card (see § 4.4.4 in the other case).Those PICCs exist in two sizes (2K  256 B, 16K  2 kB), and in non-secure (2K, 16K) or secure(2KS, 16KS) versions. They are divided into 8-byte blocks.They are currently identified by PIX.NN = hFFB7 and PIX.SS = h06 (ISO 14443-B level 2). Payattention that this may change in future versions since PC/SC has registered new PIX.NN for thesePICCs.The H663 may read/write the non-secure chips only (2K, 16K). The behaviour with the securechips is undefined.a. READ BINARY instructionIn the READ BINARY command APDU,P1 must be h00,P2 is the address of the first block to be read (2K: 0 to 31; 16K: 0 to 255),Since the size of every block is 8, Le must be multiple of 8,When Le=h00, a single block is returned (8 bytes).b. UPDATE BINARY instructionIn the UPDATE BINARY command APDU,P1 must be h00,P2 is the address of the block to be written (2K: 0 to 31; 16K: 0 to 255),Since the size of every block is 8, Lc must be 8, exactly.Some blocks play a particular role in the configuration of the PICC. Do not write on those blockswithout a good understanding of the consequences.c. Page selectThe Inside specific Page select function is not implemented in the H663. Use the ENCAPSULATEinstruction to send it directly to the PICC.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 75 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual4.4.4. Inside Contactless PicoPass, ISO 14443-3 modeThis part applies to chips named either “PicoPass or PicoTag” when the ISO 14443-3 compliance ISenabled in the card (see § 4.4.3 in the other case).Those PICCs exist in two sizes (2K  256 B, 16K  2 kB), and in non-secure (2K, 16K) or secure(2KS, 16KS) versions. They are divided into 8-byte blocks.They are currently identified by PIX.NN = hFFB7 and PIX.SS = h07 (ISO 14443-B level 3 or 4). Payattention that this may change in future versions since PC/SC has registered new PIX.NN for thesePICCs.The H663 may read/write the non-secure chips only (2K, 16K). The behaviour with the securechips is undefined.a. READ BINARY instructionIn the READ BINARY command APDU,P1 must be h00,P2 is the address of the first block to be read (2K: 0 to 31; 16K: 0 to 255),Since the size of every block is 8, Le must be multiple of 8,When Le=h00, a single block is returned (8 bytes).b. UPDATE BINARY instructionIn the UPDATE BINARY command APDU,P1 must be h00,P2 is the address of the block to be written (2K: 0 to 31; 16K: 0 to 255),Since the size of every block is 8, Lc must be 8, exactly.Some blocks play a particular role in the configuration of the PICC. Do not write on those blockswithout a good understanding of the consequences.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 76 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual4.4.5. Atmel CryptoRFThe PICCs covered by this chapter are:AT88SC0808CRF (PIX.NN = h000A),AT88SC1616CRF (PIX.NN = h000B),AT88SC3216CRF (PIX.NN = h000C),AT88SC6416CRF (PIX.NN = h000D),AT88SCRF04C (PIX.NN = h0034).The H663 implements the read and write functions in non-authenticated mode. Advancedfunctions and authenticated communication has to be implemented by the application within anENCAPSULATE instruction.The coupler always activates this PICC with CID=h01. Use this CID to build the actual command tobe sent through the ENCAPSULATE instruction.a. READ BINARY instructionIn the READ BINARY command APDU,P1,P2 is the first address to be read,Le is the length to be read (1 to 32 bytes).Note: the READ BINARY instruction maps to the “Read User Zone” low-level command. The “ReadSystem Zone” command is not implemented in the H663, and therefore must be encapsulated.b. UPDATE BINARY instructionIn the UPDATE BINARY command APDU,P1,P2 is the first address to be written,Lc is the length to be written (1 to 32 bytes).Note: the UPDATE BINARY instruction maps to the “Write User Zone” low-level command. The“Write System Zone” command is not implemented in the H663, and therefore must beencapsulated.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 77 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual4.5. ISO 15693 VICCS4.5.1. ISO 15693-3 read/write commandsThe size of the blocks depend on the chip. Known sizes are1 byte for ST Micro Electronics LRI64 (PIX.NN = h0021),4 bytes for NXP ICODE-SLI (PIX.NN = h0014) and Texas Instrument TagIT chips (PIX.NN =h0012) and other ST Micro Electronics chips,8 bytes for EM Marin chips (PIX.NN = hFFD1).Please read the documentation of the VICC you’re working with to know the actual size of itsblocks, and the number of existing blocks.Some VICCs feature special blocks called either OTP (one-time-programming), WORM (write one,read many) that can't be overwritten nor erased after a first write operation. Do not write onthose blocks without a good understanding of the consequences.a. READ BINARY instructionIn the READ BINARY command APDU,P1 must be h00,P2 is the address of the first block to be read; please read documentation of your VICC toknow its number of blocks,Le must be a multiple of the size of the blocks,When Le=h00, a single block is returned (length depending on the VICC).Note: ISO 15693 defines 2 functions to read date: READ SINGLE BLOCK and READ MULTIPLEBLOCKS. The coupler's READ BINARY instruction tries both of them until one succeed.b. UPDATE BINARY instructionIn the UPDATE BINARY command APDU,P1 must be h00,P2 is the address of the block to be written, please read documentation of your VICC toknow its number of blocks,Lc must be the size of the block, exactly.Note: ISO 15693 defines 2 functions to read date: WRITE SINGLE BLOCK and WRITE MULTIPLEBLOCKS. The coupler's UPDATE BINARY instruction tries both of them until one succeed.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 78 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual4.5.2. Read/write commands for ST Micro Electronics chips with a 2-B block addressST Micro Electronics' M24LR16E (PIX.NN = hFFD3) implements an extended version of ISO 15693'scommands, where the address are on 2 bytes instead of one.Proceed as with other ISO 15693 chips with this difference: in READ BINARY and UPDATE BINARYinstructions, P1 is the high-order byte of the address and could be non-zero.4.5.3. Complete ISO 15693 command setThe ISO 15693 standard defines numerous commands with or without an 'option' flag, and leavesthe chip manufacturers free to implement virtually any custom or proprietary commands.Starting with firmware version 1.81, the basic commands, in their basic implementation, areavailable through the RFID MEMORY CONTROL instruction (§ 3.3.4), but it remain impossible toimplement all commands and all variations in a reader.The ENCAPSULATE instruction (INS = hFE, see § 3.3.7) for ISO 15693 has therefore beenintroduced; this instruction allows to send any arbitrary command to a 15693 chip.Since the H663 operates the ISO 15693 chip in addressed mode (the VICC is never put into quietstate), the chip's UID shall be provided within every command frame. The insertion of the UID isperformed automatically by the ENCAPSULATE instruction when parameter P1 is set to h05.The APDU shall be build as follow:CLA INS P1 P2 Lc Data In LehFF hFE h05 h00 XX CommandflagsCommandcodeCommand data(optional) h00Note: Le could be omitted.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 79 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualAllowed values for the 'command flags' byteBit Value Description7 RFU 06 Option 0/1 Meaning is defined by the command description. Please referto the ISO 15693:3 standard and/or to the datasheet of theVICC for details5 Address 1 The UID of the VICC is included in the command frame4 Select 0 Not using the VICC quiet state3 Protocolextension0/1 Must be 0 for standard commandsSome VICC may implement vendor-specific commands thatrequire to have this bit set to 12 Inventory 0 It is not allowed to invoke the INVENTORY command throughan ENCAPSULATE APDU1 Data rate 1 High data rate shall be used0 Sub carrier 0 A single sub-carrier shall be usedAs a summary, typical values for the 'command flags' byte are:h22 when the option flag is not seth62 when the option flag is required by the PICC or the command4.5.4. Implementation of basic ISO 15693 commandsStarting with firmware version 1.81, the below commands are available through the RFIDMEMORY CONTROL instruction (§ 3.3.4)a. Read single blockISO 15693 command code: h20The APDU isFF FE 05 00 03 22 20 <block number>b. Write single blockISO 15693 command code: h21The APDU isFF FE 05 00 <3 + data length > 22 21 <block number> <...data...>The length of the data must match the size of the block. Please refer to the VICC's datasheet toknow the size of its block.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 80 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualc. Lock blockISO 15693 command code: h22The APDU isFF FE 05 00 03 22 22 <block number>Locking a block makes it permanently read-only. This operation can't be cancelled. Do notperform this operation without a good understanding of the consequence.d. Write AFIISO 15693 command code: h27The APDU isFF FE 05 00 03 22 27 <new AFI>e. Lock AFIISO 15693 command code: h28The APDU isFF FE 05 00 02 22 28Locking the AFI can't be cancelled. Do not perform this operation without a good understandingof the consequence.f. Write DSFIDISO 15693 command code: h29The APDU isFF FE 05 00 03 22 29 <new DSFID>g. Lock DSFIDISO 15693 command code: h2AThe APDU isFF FE 05 00 02 22 2ALocking the DSFID can't be cancelled. Do not perform this operation without a goodunderstanding of the consequence.h. Get system informationISO 15693 command code: h2BThe APDU isFF FE 05 00 02 22 2BSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 81 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualNote: the H663 always sends the Get system information command to the VICC, as part of thediscovery process. Invoke the GET DATA instruction (§ 3.2.1) to retrieve the value already returnedby the VICC to the H663.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 82 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual4.6. OTHER NON-ISO PICCS4.6.1. NFC Forum Type 3 Tags / FelicaThe PICCs covered by this chapter are:Felica Lite, Felica Lite-S (PIX.NN = h003B),Any PICC compliant with the specification of the NFC Forum Type 3 Tag.Please visit www.nfcforum.org to get the Type 3 Tag specification.a. READ BINARY instructionIn the READ BINARY command APDU,P1 must be h00,P2 is the address of the first block to read.Since the size of a block is 16 bytes, Le must be multiple of 16 (h10). When Le=h00, a single block isreturned (16 bytes).It is possible to read up to 8 blocks at once.The READ BINARY instruction is translated into the Felica “CHECK” command, using the currentSERVICE CODE for READ BINARY value as the “Service Code” parameter to the command. Thedefault value for this parameter is h000B. See § 3.3.6 if you need to change value.b. UPDATE BINARY instruction (single byte)In the UPDATE BINARY command APDU,P1 must be h00,P2 is the address of the (single) block to be written.Since the size of a block is 16 bytes, Lc must be 16 (h10), exactly.The UPDATE BINARY instruction is translated into the Felica “UPDATE” command, using thecurrent SERVICE CODE for UPDATE BINARY value as the “Service Code” parameter to thecommand. The default value for this parameter is h0009. See § 3.3.6 if you need to change value.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 83 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual4.7. OTHER NON-ISO VICCS4.7.1. EM4134These VICCs use the ISO 15693 bit modulation, but a vendor-specific frame format and commandset. They are recognized by PIX.NN = hFF D6. They are divided into 16 words, each word being 32-bit (4-Byte) wide.a. READ BINARY instructionIn the READ BINARY command APDU,P1 must be h00,P2 is the address of the first word to read (0 to 15).Since the size of a word is 4 bytes, Le must be multiple of 4 (h04). When Le=h00, a single word isreturned (4 bytes).It is possible to read up the complete card's content (16 words) at once.b. UPDATE BINARY instructionIn the UPDATE BINARY command APDU,P1 must be h00,P2 is the address of the word to be written.Since the size of a word is 4 bytes, Lc must be 4 (h04), exactly.c. LockLocking a word is implemented through the RFID MEMORY CONTROL instruction, using the LockBlock function code (§ 3.3.4.c).SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 84 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual5. USING THE H663 WITH A NFCIP-1 TARGET5.1. INTRODUCTIONThe H663 is a NFC Initiator. It could activate a remote NFC Target (only the passive communicationscheme is available).The H663 implements the ISO 18092 “NFCIP-1” Transport Protocol, also named NFC-DEP by theNFC Forum.* The PDU must be ENCAPSULATEd if it doesn't meet ISO 7816-4 constraints.5.1.1. Functions performed by the couplerThe H663 handles the NFC Transport Protocol internally:•Transmission of ATR_REQ when a potential NFC Target has been detected, handing ofATR_RES,•Initial exchange of parameters (PSL_RES / PSL_RES) if needed,•Fragmentation of DEP_REQ, chaining of DEP_RES,SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.PCapplicationH663 ISO18092target(A or F)Polling + anticollision(SENS-A, SENS-F)Enter NFC-DEP(ATR_REQ)(ATR_RES)Card insert event(SCardWaitStatusChange)Connect to the target(SCardConnect)Send PDU(ScardTransmit FF FE … *)PDU from initiator(DEP_REQ)PDU from target(DEP_RES)Recv PDU(ScardTransmit success)Send PDU(ScardTransmit FF FE … *)PDU from initiator(DEP_REQ)PDU from target(DEP_RES)Recv PDU(ScardTransmit success)(...) (...)Disconnect from the target(SCardDisconnect)Leave NFC-DEP(DSL_REQ)(DSL_RES)
PMD2271-BApage 85 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual•Detection of transmission errors and recovery procedure,•Detection of Target removal.5.1.2. Functions to be implemented on the PCIn the NFC Forum's architecture, NFC-DEP (ISO 18092) is seen as the low level transmission layer(“MAC”) of an upper-level connection-oriented protocol called LLCP.As the H663 only implements ISO 18092, upper-level protocols and applications (for instance, LLCPand SNEP on top of LLCP) must be implemented by a PC application. SpringCard SDK for PC/SC +NFC provides various samples to do so. Please download this SDK from our web site.Anyway, as support for LLCP must be claimed by the NFC initiator in its ATR_REQ, the H663 hasconfigurable GI bytes, the default being the following value, compliant with LLCP:46 66 6D 01 01 11 03 02 00 13 04 01 96To change the GI bytes, typically to disable LLCP, refer to § 5.3.15.2. MAPPING OF THE NFC FUNCTIONS INTO PC/SC FUNCTIONS5.2.1. ATR of an ISO 18092 targetThe H663 builds a pseudo-ATR using the standard format defined in PC/SC specification:Offset Name Value Meaning (according to 7816-3)0 TS h3B Direct convention1 T0 h8… Higher nibble 8 means: no TA1, no TB1, no TC1. TD1 to followLower nibble is the number of historical bytes (0 to 15)2 TD1 h80 Higher nibble 8 means: no TA2, no TB2, no TC2. TD2 to followLower nibble 0 means: protocol T=03 TD2 h01 Higher nibble 8 means: no TA3, no TB3, no TC3, no TD3Lower nibble 1 means: protocol T=14 H1… GT bytes from ATR_RES… …3+k Hk4+k TCK XX Checksum (XOR of bytes 1 to 3+k)The target is LLCP compliant if ifs GT bytes start with46 66 6DSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 86 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual5.2.2. Using SCardTransmit (ENCAPSULATE) to exchange PDUsENCAPSULATE command APDU = DEP_REQCLA INS P1 P2 Lc Data In LehFF hFE h00 h00 XX Transport databytes h00Up to 255 bytes of Transport data can be transmitted this way.The H663 adds the PFB (and the DID if required) and transmits a valid block. If the target's receivebuffer is shorter than the actual size of the transport PDU, chained blocks are automatically. NADis not supported.During the reception of chained block, the H663 re-assembles them and returns a single response.Up to 256 bytes of Transport data can be received. ENCAPSULATE response = DEP_RESData Out SW1 SW2Transport databytes See belowENCAPSULATE status wordSW1 SW2 Meaningh90 h00 Successh6F XX Error reported by the contactless interface. See chapter 6 for the list of possiblevalues and their meaning.h62 h82 Le is greater than actual response from targeth6C XX Le is shorter than actual response from target5.3. ADVANCED FEATURES5.3.1. Changing the GI bytes in the ATR_REQThe General Bytes to be transmitted in the H663's ATR_REQ (GI bytes) are stored in register hE1.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 87 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualIf this register remains empty, the default value is:46 66 6D LLCP magic number01 01 11 LLCP version 1.103 02 00 13 Services = LLC Link Management + SNEP (NDEF exchange protocol)04 01 96 Link time-out = 1.5 secondsUse the PUSH REGISTER command (§ 6.3.7) to set the new General Bytes before putting a newNFC target in front of the H663's antenna.Alternatively, use the WRITE REGISTER command (§ 6.3.6) if you want the new configuration to bepermanent. Pay attention that the non-volatile memory has a limited write endurance.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 88 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual6. DIRECT CONTROL OF THE H6636.1. BASISIn PC/SC architecture, the SCardControl function implements the dialogue between an applicationand the coupler, even when there’s no card in the slot.Access to the coupler must be gained using SCardConnect, specifying SCARD_SHARE_DIRECT ascoupler sharing mode.Not all PC/SC drivers allow the application to gain direct access to the coupler. If you're usingSpringCard SDD480 PC/SC driver for Windows, there's nothing specific to do, but for otherdrivers, a specific configuration of the driver has to be performed. Please refer to chapter 9: AnnexB – activating SCardControl with the different drivers.6.2. IMPLEMENTATION DETAILS6.2.1. Sample code#include <winscard.h>// dwControlCode for SpringCard SDD480 driver#define IOCTL_SC_PCSC_ESCAPE SCARD_CTL_CODE(2048)// dwControlCode for Microsoft CCID drivers#define IOCTL_MS_PCSC_ESCAPE SCARD_CTL_CODE(3050)// This function is a wrapper around SCardControl// It creates its own PC/SC context for convenience, but you// may remain into a previously open context// Note: Use SCardListReaders to get reader_nameLONG reader_control(const char *reader_name, const BYTE in_buffer[], DWORD in_length, BYTE out_buffer[], DWORD max_out_length, DWORD *got_out_length){ SCARDCONTEXT hContext; SCARDHANDLE hCard; LONG rc; DWORD dwProtocol; rc = SCardEstablishContext(SCARD_SCOPE_SYSTEM, NULL, NULL, &hContext); if (rc != SCARD_S_SUCCESS) return rc;SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 89 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual // get a direct connection to the reader // this must succeed even when there’s no card rc = SCardConnect(hContext, reader_name, SCARD_SHARE_DIRECT, 0, &hCard, &dwProtocol); if (rc != SCARD_S_SUCCESS) { SCardReleaseContext(hContext); return rc; } // direct control through SCardControl // dwControlCode for SpringCard SDD480 driver rc = SCardControl(hCard, IOCTL_SC_PCSC_ESCAPE, in_buffer, in_length, out_buffer, max_out_length, got_out_length); if ((rc == ERROR_INVALID_FUNCTION) || (rc == ERROR_NOT_SUPPORTED) || (rc == RPC_X_BAD_STUB_DATA)) { // direct control through SCardControl // dwControlCode for Microsoft CCID drivers rc = SCardControl(hCard, IOCTL_MS_PCSC_ESCAPE, in_buffer, in_length, out_buffer, max_out_length, got_out_length); } // close the connection // the dwDisposition parameter is coherent with the fact // that we didn’t do anything with the card (or that there’s // no card in the reader) SCardDisconnect(hCard, SCARD_LEAVE_CARD); SCardReleaseContext(hContext); return rc;}SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 90 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual6.2.2. Link to SpringProx legacy protocolSending an escape sequence through SCardControl (with appropriate value for dwControlCode) isexactly the same as sending a “legacy command” to a SpringCard coupler running in legacy mode. The detailed reference of all the command supported by our readers is available in SpringCardCSB4, K531, K632 or K663 development kits. The paragraphs below depict only a subset of thewhole function list, but the functions listed here are the most useful in the PC/SC context.6.2.3. Format of response, return codesWhen the dialogue with the H663 has been performed successfully, SCardControl returnsSCARD_S_SUCCESS, and at least one byte is returned in out_buffer (at position 0).The value of this byte is the actual coupler's status code: h00 on success, a non-zero value uponerror. The complete list of the H663’s error codes is given in chapter 8: Annex A – Specific errorcodes.When there’s some data available, the data is returned at position 1 in out_buffer.6.2.4. Redirection to the Embedded APDU InterpreterSCardControl buffers starting by hFF (CLA byte of the Embedded APDU Interpreter) as processed asif they were received in a SCardTransmit stream.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 91 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual6.3. LIST OF AVAILABLE CONTROL SEQUENCES6.3.1. Action on the LEDsa. Setting the coupler's LEDs manuallyFor a coupler with only red and green LEDs, send the sequence:58 1E <red> <green>For a coupler with red, green and yellow / blue LEDs, send the sequence:58 1E <red> <green> <yellow/blue>Choose values for red, green and yellow/blue in this table:h00 LED is switched OFFh01 LED is switched ONh02 LED blinks slowlyh04 LED blinks quicklyh05 LED performs the “heart-beat” sequenceOnce such a command has been sent to the H663, the firmware no longer manages the LEDsautomatically: the LEDs remain permanently in the last state specified by the application.Use the above command to make the firmware drive the LEDs automatically again.b. Going back to default (LEDs managed by the coupler's firmware)Send the sequence58 1ETo go back to default mode.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 92 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual6.3.2. Action on the buzzera. Starting/stopping the buzzerSome hardware feature a single tone beeper. To start the buzzer, send the sequence:58 1C <duration MSB> <duration LSB>Where duration specifies the length of the tone, in milliseconds (max is 60000ms).Set duration to 0 if you need to stop the buzzer before the duration started in a previous call.Once such a command has been sent to the H663, the firmware no longer manages the buzzerautomatically.Use the above command to make the firmware drive the buzzer automatically again.b. Going back to default (buzzer managed by the coupler's firmware)Send the sequence58 1CTo go back to default mode.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 93 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual6.3.3. Obtaining information on coupler and slotsThe sequences below are useful to retrieve textual information such as product name, slot name,etc. The numerical information (such as version, serial number) are returned as hexadecimalstrings.Remember that the returned value (if some) is prefixed by the status code (h00 on success).a. Coupler “product-wide” informationSequence Will return…58 20 01 Vendor name (“SpringCard”)58 20 02 Product name58 20 03 Product serial number (in ASCII)58 20 04 USB vendor ID and product ID (in ASCII)58 20 05 Product version (in ASCII)58 20 80 Number of slots (raw value on 1 byte)58 20 83 Product serial number (raw value on 4 bytes)58 20 84 USB vendor ID and product ID (raw value on 4 bytes)58 20 85 Product version (raw value on 3 bytes: major/minor/build)b. Slot related informationSequence Will return…58 21 Name of the current slot58 21 00 Name of slot 058 21 01 Name of slot 1...58 21 NN Name of slot NSlot naming obey to the following rule:The contactless slot is named “Contactless”,When a contact smartcard slot is present, its name is “Contact”,When only one SIM/SAM slot is present, its name is either “SAM A” or “SAM” dependingon the configuration set in factory,When more than one SIM/SAM slots are present, they are named “SIM/SAM A”, “SIM/SAMB”, “SIM/SAM C” and “SIM/SAM D”.SpringCard CCID driver for Windows (ref. SDD480) uses those names to construct the list that isreturned to SCardListReaders. Other drivers are likely to implement a different namingconvention.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 94 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual6.3.4. Stopping / starting a slotWhen a slot is stopped, the H663powers down the smartcard in the slot (if some),disable the slot22,send the “card removed” event if there was a card in the slot.When a slot is started again, the H663enable the slot23,try to power up the smartcard in the slot (if some),if a card has been found, send the “card inserted” event.a. Stopping a slotSequence Action58 22 Stop current slotb. Starting a slotSequence Action58 23 Start current slot22 On contactless slot, the antenna RF field is switched OFF23 On contactless slot, the antenna RF field is switched ONSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 95 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual6.3.5. Forced insert/remove sequencesUse these sequences to emulate card insertion or removal. This is useful for hardware where no“card presence” switch is available.Pay attention that if no card is actually present when the Card insertion is performed, the H663will be busy a long time (for nothing), before eventually giving up and reporting the “card mute”status.DO NOT use this feature unless explicitly advised by SpringCard's support team.a. Card insertionSequence Action58 40 01 01 Simulate a card insertion in the 1st card slot (ID-1 slot if existing)58 40 01 Simulate a card insertion in the current slotb. Card removeSequence Action58 40 01 00 Simulate a card removal from the 1st card slot (ID-1 slot if existing)58 40 00 Simulate a card removal from the current slotSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 96 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual6.3.6. Reading/writing H663's configuration registersThe H663 features a non-volatile memory to store configuration registers.See chapter 7 for the list of these registers, and their allowed values.a. Reading coupler’s registersTo read the value of the configuration register at <index>, send the sequence:58 0E <index>Remember that the returned value (if some) is prefixed by the status code (h00 on success, h16 ifthe value is not defined in the non-volatile memory).b. Writing coupler’s registersTo define the value of the configuration register at <index>, send the sequence:58 0D <index> <…data…>Send an empty <data> (zero-length) to erase the current value. In this case, default value will beused.The non-volatile memory has a limited write/erase endurance.Writing a different value in a configuration register more than 100 times may permanentlydamage your product.The configuration is loaded upon reset. To apply a new configuration, you must reset the H663(or cycle power).Alternatively, you may load temporary configuration settings as explained in the next paragraph.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 97 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual6.3.7. Pushing a new temporary configurationTo overrule temporarily the value of the configuration register at <index>, send the sequence:58 8D <index> <…data…>Send an empty <data> (zero-length) to reload the default value.This value will be applied immediately, but on next reset the H663 will reload its configurationregisters from the non-volatile memory.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 98 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual7. CONFIGURATION REGISTERSThe H663 features a non-volatile memory to store its configuration.The memory is divided into “registers”. Every register is identified by its address (a 1-B value) andis documented in this chapter.Warning 1Some registers are not listed in this chapter, yet they may have been defined in factory, or shoulduse the default value for correct operation. Do not write or erase any register that is not listed inthis chapter.Warning 2The non-volatile memory has a limited write/erase endurance.Writing a different value in a configuration register more than 100 times may permanentlydamage your product.7.1. EDITING COUPLER'S CONFIGURATION7.1.1. By softwareThe coupler's configuration registers are made available through a SCardControl function call.Refer to § 6.3.6 for details.The configuration is loaded upon reset. To apply the new configuration, the software shallprompt the user to reset or unplug/plug the H663.7.1.2. Using SpringCard MultiConf softwareSpringCard has developed a versatile configuration software24 that covers most products,including the H663 and all readers in the H663 family.Download SpringCard MultiConf at http://www.springcard.com/en/download/find/file/sn1400724 Available for the Windows platform only.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 99 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual7.2. LIST OF THE CONFIGURATION REGISTERS AVAILABLE TO THE END-USER OR INTEGRATORAddress Section Name See §hB0 Contactless Enabled protocols 7.5.1hB2 PC/SC CLA of the APDU interpreter 7.4.2hB3 PC/SC RF behaviour in PC/SC mode 7.4.3hB4 Contactless Parameters for polling 7.5.2hC3 7816 Options for the smartcard slots 7.8.1hC4 Contactless Allowed baudrates in T=CL 7.5.4hC5 Contactless Options for T=CL 7.5.5hC8 Contactless Number of antennas + automatic stop 7.5.6hC9 Contactless Options for polling 7.5.3hCA Core Configuration of the LEDs 7.3.1hCB Core Options for the LEDs and GPIOs 7.3.2hCC Core Behaviour of the LEDs and buzzer 7.3.3hCF Felica Service Codes for Felica read/write 7.6.1hE1 NFC P2P Global Bytes bytes in ATR_REQ 7.7.1Do not write or erase any register that is not listed in this chapter.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 100 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual7.3. CORE CONFIGURATION7.3.1. Configuration of the LEDsAddress: hCA – Size: 2 bytesBit Action if set Notemsb 15 - 12 LED 1h0: colour is undefinedh1: colour is redh2: colour is greenh3: colour is yellowh4: colour is blue11 - 8 LED 2h0: colour is undefinedh1: colour is redh2: colour is greenh3: colour is yellowh4: colour is blue7 - 4 LED 3h0: colour is undefinedh1: colour is redh2: colour is greenh3: colour is yellowh4: colour is bluelsb 3 - 0 LED 4h0: colour is undefinedh1: colour is redh2: colour is greenh3: colour is yellowh4: colour is blueDefault value: h0000SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 101 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual7.3.2. Options for the LEDs and GPIOsAddress: hC9 – Size: 1 byte1Bit Action if set Notemsb 7 Use PWM for buzzer6 RFU5 RFU4 RFU3 Invert logic for LED 42 Invert logic for LED 31 Invert logic for LED 2lsb 0 Invert logic for LED 1Default value: h007.3.3. Behaviour of the LEDs and buzzerIf the coupler has some LEDs, the coupler shows its state (card present, card absent, error) by itsLEDs. You may disable this feature by setting bit 7 of this register to 1 (the application is still ableto control the LEDs as documented in § 6.3.1.a and 3.4.1.a).If the coupler has a buzzer, the buzzer sounds every time a PICC is activated. The 6 low-order bytesof this register define the duration or this beep, in 10ms interval. To disable the automatic beepon card arrival, set this value to 0 (the application is still able to control the buzzer as documentedin § 6.3.2 and 3.4.1.b).Address: hCC – Size: 1 byteBit Values / Meaningmsb 7 1 : the H663 does signal its state on the LEDs0 : the H663 doesn't signal its state on the LEDs6 RFU, must be 0lsb 5 Duration of the automatic beep on card arrival, x 10ms (0 to 630ms)Set to h00 to disable the automatic beepDefault value: h88 (80ms beep on PICC arrival + state on LEDs)SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 102 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual7.4. PC/SC CONFIGURATION7.4.1. Slot naming and startup modeAddress: hB1 – Size: 1 byteBit Action if set Notemsb 7 Force a letter in the name of the SAM slotsEven if there's only one slot, it will benamed “SAM A”6 Force a letter in the name of the ID-1 slotsEven if there's only one slot, it will benamed “Contact A”5 RFU4 Prefix the slot name using the product's serial number (in hex)This is useful for computers with numerous products attached3 Start with SAM slot(s) OFF All the SAM slot(s) will not run until resumed by a Control command2 Start with Contact slot OFF The Contact slot will not run until resumed by a Control command1 Start with Contactless slot OFF The Contactless slot will not run untilresumed by a Control commandmsb 0 No contactless slot The Contactless slot will not be enumerated (and will never run)Default value: h007.4.2. CLA byte of APDU interpreterThis register defines the CLA (class) byte affected to the APDU interpreter (see § 3.1.1).To disable the APDU interpreter, define this register to h00.Address: hB2 – Size: 1 byteDefault value: hFFSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 103 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual7.4.3. Behaviour of the contactless slot in PC/SC modeThis register defines the behaviour of the H663's contactless slot in PC/SC mode.Address: hB3 – Size: 1 byteBit Action if set Notemsb 7 Innovatron: return the “real” T=0 ATR(as supplied in REPGEN) instead ofbuilding a pseudo ATRSetting this bit breaks the compatibilitywith MS CCID driver, because the cardis connected in T=1 where its ATRclaims it is T=0 only6 Use only standard values for PIX.NN inthe ATRNumerous contactless PICCs/VICCs have not been registered by their vendor in the PC/SC specification to get a standard PIX.NN.SpringCard has defined vendor-specificvalues for those cards (see 4.1.5).If this bit is set, these non-standard values will not be used, and PIX.NN willbe fixed to h0000 for all PICCs/VICCs that are not in the standard.5 Disable the pause in RF field after the PICC/VICC has been removedWhen the PICC/VICC stops responding,the H663 pauses its RF field for 10 to 20ms. Setting this bit disable this behaviour.4 Disable the pause in RF field after the PICC/VICC during the pollingDuring the polling sequence, the H663 pauses its RF field for 10 to 20ms between the polling loops. Setting this bit disable this behaviour.3 No NFC-DEP activation over Felica(ISO 18092 @ 212 or 424 kbit/s)2 No NFC-DEP activation over ISO 14443-A (ISO 18092 @ 106 kbit/s)1 No T=CL (ISO-DEP) activation over ISO 14443-BSend SLOT CONTROL P1,P2=h20,01 to activate the PICC manuallylsb 0 No T=CL (ISO-DEP) activation over ISO 14443-ASend SLOT CONTROL P1,P2=h20,02 to activate the PICC manuallyDefault value: h00 (T=CL active over 14443 A and B, NFC-DEP active over 14443 A and Felica)SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 104 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual7.5. CONTACTLESS CONFIGURATION7.5.1. Enabled protocolsThis register defines the list of protocols the H663 will look for during its polling loop. AnyPICC/VICC compliant with one of the active protocols will be “seen”, and the others ignored.Address: hB0 – Size: 2 bytes (MSB first)Bit Active. protocol (if set) Versionmsb 15 RFU14 RFU13 RFU12 JIS:X6319-4 (Felica)ISO 18092 @ 212 kbit/s and 424 kbit/sNFC Forum Type 3 Tags11 Kovio RF barcode10 NFC Forum Type 1 Tags (Innovision/Broadcom chips)9RFU8 EM 4134 ≥ 1.817 Innovatron(legacy Calypso cards – sometimes called 14443-B’)6RFU5 ST Micro Electronics SRxxx4 Inside Contactless PicoPass (also HID iClass)3RFU2 ISO 156931 ISO 14443-BNFC Forum Type 4-B Tagslsb 0 ISO 14443-AISO 18092 @ 106kbit/sNFC Forum Type 2 and Type 4-A TagsDefault value: hF7FF (all supported protocols but Kovio RF barcode are activated)SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 105 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual7.5.2. Parameters for pollingThis register defines the parameters used by the H663 for the PICC/VICC polling.Address: hB4 – Size: 5 bytesByte Data DefaultvalueRemark0 AFI for ISO 14443-B h00 Specify the Application Family Identifier to be used during ISO 14443-B polling.h00 means that all PICCs shall answer.1 AFI for ISO 15693 h00 Specify the Application Family Identifier to be used during ISO 15693 polling.h00 means that all VICCs shall answer.2 - 3 SC for JIS:X6319-4and ISO 18092 @ 212 and 424 kbit/shFFFF Specify the System Code to used during Felica polling (SENSF_REQ). The value is stored MSB first.hFFFF means that all targets shall answer.4 RC for JIS:X6319-4and ISO 18092 @ 212 and 424 kbit/sh00 Specify the Request Code to used during Felica polling (SENSF_REQ).This value shall be h00 to accept both NFC Type 3 Tags and NFC devices running in P2P mode (NFC-DEP), or h01 to accept only NFC Type 3 TagsSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 106 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual7.5.3. Options for pollingUse this register to configure the extended ATQB support for ISO 14443-B cards, and to disableJIS:X6319-4 / ISO 18092 @ 424 kbit/s.Address: hC9 – Size: 1 byteBit Action if set Notemsb 7 RFU6 RFU5 RFU4 Activate extended ATQB If this bit is set, the H663 will ask for anextended ATQB from ISO 14443-B.Not all cards do support this feature.3 Disable JIS:X6319-4 / ISO 18092 @ 424 kbit/sIf this bit is set, the H663 will communicate with Felica cards and NFC P2P targets up to 212 kbit/s only2 RFU1 RFUlsb 0 RFUDefault value: h00 (normal ATQB, allow 424kbit/s for JIS:X6319-4)SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 107 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual7.5.4. Allowed baudrates in T=CL (ISO 14443-4)Use this register to let the H663 negotiate a baudrate greater than 106 kbit/s with ISO 14443-4PICCs (DSI, DRI defined in PPS for ISO 14443 A, in ATTRIB for ISO 14443 B).The H663 is theoretically able to communicate with PICCs at 848 kbit/s in both directions, but theactual maximum speed depends heavily on the characteristics of the PICC, and on the coupler’sactual antenna and environment.Address: hC4 – Size: 2 bytes (MSB first)Bit Meaning (if set)ISO 14443-A DSmsb 15 RFU, must be 014 Allow ISO 14443 A PICC  H663 @ 848 kbit/s (DSI = 3 in PPS)13 Allow ISO 14443 A PICC  H663 @ 424 kbit/s (DSI = 2 in PPS)12 Allow ISO 14443 A PICC  H663 @ 212 kbit/s (DSI = 1 in PPS)ISO 14443-A DR11 RFU, must be 010 Allow ISO 14443 A H663  PICC @ 848 kbit/s (DRI = 3 in PPS)9 Allow ISO 14443 A H663  PICC @ 424 kbit/s (DRI = 2 in PPS)8 Allow ISO 14443 A H663  PICC @ 212 kbit/s (DRI = 1 in PPS)ISO 14443-B DS7 RFU, must be 06 Allow ISO 14443 B PICC  H663 @ 848 kbit/s (DSI = 3 in ATTRIB)5 Allow ISO 14443 B PICC  H663 @ 424 kbit/s (DSI = 2 in ATTRIB)4 Allow ISO 14443 B PICC  H663 @ 212 kbit/s (DSI = 1 in ATTRIB)ISO 14443-B DR3 RFU, must be 02 Allow ISO 14443 B H663  PICC @ 848 kbit/s (DRI = 3 in ATTRIB)1 Allow ISO 14443 B H663  PICC @ 424 kbit/s (DRI = 2 in ATTRIB)lsb 0 Allow ISO 14443 B H663  PICC @ 212 kbit/s (DRI = 1 in ATTRIB)Default value: h3333 (up to 424 kbit/s).You must lower-down the allowed baudrates to 106kbps (h0000) if your antenna is not capable tohandle the higher baudrates without communication errors.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 108 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual7.5.5. Options for T=CL (ISO 14443-4)This register defines the behaviour of the ISO 14443-4 subsystem.Address: hC5 – Size: 4 bytesByte Data DefaultvalueRemark0 Extra guard time h00 Guard time (specified in ms) to add before sending a frame to the PICC.1 Retries on card mute h03 Number of retries before giving up when the PICC does not answer (communication timeout, and no other error detected)2 Retries on comm. errorh03 Number of retries before giving up when the PCC does not understand the PICC's response (CRC, parity, framing errors...)3 RFU h00 This byte must be h007.5.6. Number of antennas + auto-stopAddress: hC8 – Size: 1 byteBit Action if set Notemsb 7 RFU6 RFU5 RFU4 Suspend the contactless slot when a contact card is insertedThis feature is needed by some 'dual' cards which can't work in both modes3 RFU2 RFU1 RFUlsb 0 Activate the secondary antennaDefault value: h00 (only one antenna)Please refer to doc. PNA2236 “H663 integration guide” for information regarding the secondantenna. This feature is available for H663S (unbalanced) only. Note that both antennas musthave exactly the same RF characteristics.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 109 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual7.6. FELICA CONFIGURATION7.6.1. Service Codes for Felica read/writeUse this register to define how the H663 processes Felica cards and NFC Type 3 Tags.Address: hCF – Size: 4 bytesByte Data Default value Remark0 - 1 Read Service Codeh000B Service Code used when the READ BINARY instruction is invoked (MSB first)The value h000B is mandated by the specification of the NFC Forum Type 3 Tag2 - 3 Update Service Codeh0009 Service Code used when the UPDATE BINARY instruction isinvoked (MSB first)The value h0009 is mandated by the specification of the NFC Forum Type 3 TagThose values may be temporarily overwritten right into the SCardTransmit stream using the SETFELICA RUNTIME PARAMETERS instruction (§ 3.3.6).SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 110 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual7.7. ISO 18092 / NFC-DEP CONFIGURATION7.7.1. Global Bytes in ATR_REQAddress: hE1 – Size: 0 to 15 bytesThis register defines the GI bytes sent in ATR_REQ.If this register remains empty, the default value is:46 66 6D LLCP magic number01 01 11 LLCP version 1.103 02 00 13 Services = LLC Link Management + SNEP (NDEF exchange protocol)04 01 96 Link timeout = 1.5 secondsSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 111 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual7.8. ISO 7816 CONFIGURATION7.8.1. Options for the smartcard slotsThis register defines the parameters used by the H663 for the smartcard and SIM/SAM slots.Address: hC3 – Size: 5 bytesByte Data Default value Remark0 Configuration of the ID-1 slothB3 - Contact if the coupler has a ID-1 slot- not used otherwise1 Configuration of the SAM1 slothB3 - “SAM A” if the coupler has 1 or 4 SAMs- not used otherwise2 Configuration of the SAM2 slothB3 - “SAM A” if the coupler has 3 SAMs- “SAM B” if the coupler has 4 SAMs2 Configuration of the SAM3 slothB3 - “SAM B” if the coupler has 3 SAMs- “SAM C” if the coupler has 4 SAMs4 Configuration of the SAM4 slothB3 - “SAM C” if the coupler has 3 SAMs- “SAM D” if the coupler has 3 SAMsEvery byte's bits are defined as follow:Bit Action if set Notemsb 7 Enable automatic PPS6 Enable HSP Use this only with Calypso SAMs5 Enable EMV power on EMV mode is tried before standard mode4 Enable non-EMV power on Non-EMV cards will be rejected3 RFU2 Enable class C (1.8V) The coupler tries the lower voltage class first, and then increments until one matches.1 Enable class B (3V)lsb 0 Enable class A (5V)hB3 stands for•PPS automatic•HSP disabled•EMV power on tried before standard power on•Class = AB (3V then 5V)SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 112 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual8. ANNEX A – SPECIFIC ERROR CODESWhen the APDU interpreter returns SW1 = h6F, the value of SW2 maps to one of the H663 specificerror codes listed below.SW2 Symbolic name25 Meaningh01 MI_NOTAGERR No answer received (no card in the field, or card is mute)h02 MI_CRCERR CRC error in card's answerh03 MI_EMPTY No data availableh04 MI_AUTHERR Card authentication failedh05 MI_PARITYERR Parity error in card's answerh06 MI_CODEERR Invalid card response opcodeh07 MI_CASCLEVEX Bad anti-collision sequenceh08 MI_SERNRERR Card's serial number is invalidh09 MI_LOCKED Card or block lockedh0A MI_NOTAUTHERR Card operation denied, must be authenticated firsth0B MI_BITCOUNTERR Wrong number of bits in card's answerh0C MI_BYTECOUNTERR Wrong number of bytes in card's answerh0D MI_VALUEERR Card counter errorh0E MI_TRANSERR Card transaction errorh0F MI_WRITEERR Card write errorh10 MI_INCRERR Card counter increment errorh11 MI_DECRERR Card counter decrement errorh12 MI_READERR Card read errorh13 MI_OVFLERR RC: FIFO overflowh15 MI_FRAMINGERR Framing error in card's answerh16 MI_ACCESSERR Card access errorh17 MI_UNKNOWN_COMMAND RC: unknown opcodeh18 MI_COLLERR A collision has occurredh19 MI_COMMAND_FAILED RC: command execution failedh1A MI_INTERFACEERR RC: hardware failureh1B MI_ACCESSTIMEOUT RC: timeouth1C MI_NOBITWISEANTICOLL Anti-collision not supported by the card(s)h1D MI_EXTERNAL_FIELD An external RF field is already present, unable to activate the coupler's RF field25 As used in SpringProx API (defines in springprox.h)SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 113 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualh1F MI_CODINGERR Bad card statush20 MI_CUSTERR Card: vendor specific errorh21 MI_CMDSUPERR Card: command not supportedh22 MI_CMDFMTERR Card: format of command invalidh23 MI_CMDOPTERR Card: option of command invalidh24 MI_OTHERERR Card: other errorh3C MI_WRONG_PARAMETER Coupler: invalid parameterh64 MI_UNKNOWN_FUNCTION Coupler: invalid opcodeh70 MI_BUFFER_OVERFLOW Coupler: internal buffer overflowh7D MI_WRONG_LENGTH Coupler: invalid lengthSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 114 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual9. ANNEX B – ACTIVATING SCARDCONTROL WITH THE DIFFERENT DRIVERSBeing compliant with the CCID specification, the H663 is supported by (at least) 4 USB drivers:SpringCard CCID driver for Windows (ref. SDD480),Microsoft CCID kernel-mode driver (USBCCID) coming with Windows 2000/XP/Vista,Microsoft CCID user-mode driver (WUDFUsbccidDriver) coming with Windows 7,The open-source CCID driver from the PCSC-Lite package on Linux, MacOS X, and otherUNIX operating systems.9.1. DIRECT CONTROL USING SPRINGCARD SDD480Direct control is always enabled in SpringCard SDD480 driver.With this driver, in SCardControl function call, parameter dwControlCode shall be set toSCARD_CTL_CODE(2048).SCARD_CTL_CODE is a macro defined in header winscard.h from Windows SDK. For non-C/C++languages, replace SCARD_CTL_CODE(2048) by constant value h00241FE4 (d3219456).9.2. DIRECT CONTROL USING MS USBCCIDWith MS USBCCID driver, direct control of the coupler must be enabled on a per-coupler basis:each coupler has its own USB serial number, and the direct control has to be unequivocallyenabled for this serial number.This is done by writing a value in registry, either using regedit or custom software. See for instancethe command line tool ms_ccid_escape_enable, available with its source code in SpringCardPC/SC SDK.The target key in registry isHKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBVID_1C34&PID_91B1yyyyyyyyDevice Parameterswhere yyyyyyyy is the coupler’s Serial Number.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 115 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualUnder this registry key, create the registry entry EscapeCommandEnabled, of type DWORD, andset it to value 1. Once the value has been written, unplug and plug the coupler again (or restartthe computer) so the driver will restart, taking the new parameter into account.With this driver, in SCardControl function call, parameter dwControlCode shall be set toSCARD_CTL_CODE(3050).SCARD_CTL_CODE is a macro defined in header winscard.h from Windows SDK. For non-C/C++languages, replace SCARD_CTL_CODE(3500) by constant value h004074F8 (d3225264).9.3. DIRECT CONTROL USING MS WUDFUSBCCIDDRIVERWith MS WUDFUsbccidDriver (new user-mode driver introduced in Windows 7), direct control ofthe coupler must also be enabled on a per-coupler basis: each coupler has its own USB serialnumber, and the direct control has to be unequivocally enabled for this serial number.This is done by writing a value in registry, either using regedit or custom software. See for instancethe command line tool ms_ccid_escape_enable, available with its source code in SpringCardPC/SC SDK.The target key in registry isHKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBVID_1C34&PID_91B1yyyyyyyyDevice ParametersWUDFUsbccidDriverwhere yyyyyyyy is the coupler’s Serial Number.Under this registry key, create the registry entry EscapeCommandEnabled, of type DWORD, andset it to value 1. Once the value has been written, unplug and plug the coupler again (or restartthe computer) so the driver will restart, taking the new parameter into account.With this driver, in SCardControl function call, parameter dwControlCode shall be set toSCARD_CTL_CODE(3050).SCARD_CTL_CODE is a macro defined in header winscard.h from Windows SDK. For non-C/C++languages, replace SCARD_CTL_CODE(3500) by constant value h004074F8 (d3225264).SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 116 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual9.4. DIRECT CONTROL USING PCSC-LITE CCIDTo be written.SPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 117 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manual10. 3RD-PARTY LICENSESSpringCard H663 uses one 3-rd party open-source software component.10.1. FREERTOSFreeRTOS is a market leading real time operating system (or RTOS) from Real Time Engineers Ltd.Starting from firmware version 2.00, SpringCard H663 runs on FreeRTOS v8.2.0.FreeRTOS is distributed under a modified GNU General Public License (GPL) that allows to use it incommercial, closed-source products.For more information, or to download the source code of FreeRTOS, please visitwww.freertos.orgSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.
PMD2271-BApage 118 of 118SPRINGCARD PC/SC COUPLERS - H663 GROUP - Developer's reference manualDISCLAIMERThis document is provided for informational purposes only and shall not be construed as a commercial offer, a license,an advisory, fiduciary or professional relationship between PRO ACTIVE and you. No information provided in thisdocument shall be considered a substitute for your independent investigation. The information provided in document may be related to products or services that are not available in your country.This document is provided "as is" and without warranty of any kind to the extent allowed by the applicable law. WhilePRO ACTIVE will use reasonable efforts to provide reliable information, we don't warrant that this document is free ofinaccuracies, errors and/or omissions, or that its content is appropriate for your particular use or up to date. PROACTIVE reserves the right to change the information at any time without notice.PRO ACTIVE doesn't warrant any results derived from the use of the products described in this document. PRO ACTIVEwill not be liable for any indirect, consequential or incidental damages, including but not limited to lost profits orrevenues, business interruption, loss of data arising out of or in connection with the use, inability to use or reliance onany product (either hardware or software) described in this document.These products are not designed for use in life support appliances, devices, or systems where malfunction of theseproduct may result in personal injury. PRO ACTIVE customers using or selling these products for use in suchapplications do so on their own risk and agree to fully indemnify PRO ACTIVE for any damages resulting from suchimproper use or sale.COPYRIGHT NOTICEAll information in this document is either public information or is the intellectual property of PRO ACTIVE and/or itssuppliers or partners.You are free to view and print this document for your own use only. Those rights granted to you constitute a licenseand not a transfer of title: you may not remove this copyright notice nor the proprietary notices contained in thisdocuments, and you are not allowed to publish or reproduce this document, either on the web or by any mean,without written permission of PRO ACTIVE.Copyright © PRO ACTIVE SAS 2015, all rights reserved.EDITOR’S INFORMATIONPRO ACTIVE SAS company with a capital of 227 000 €RCS EVRY B 429 665 482Parc Gutenberg, 2 voie La Cardon91120 Palaiseau – FRANCECONTACT INFORMATIONFor more information and to locate our sales office or distributor in your country or area, please visitwww.springcard.comSPRINGCARD, the SPRINGCARD logo, PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS.All other brand names, product names, or trademarks belong to their respective holders.Information in this document is subject to change without notice. Reproduction without written permission of PRO ACTIVE is forbidden.

Navigation menu