SpringCard K531 OEM developer's guide

About this document

This document provides information regarding the SpringCard K531 OEM embedded software. You will find a detailed description of the SpringCard K531 hardware in the product datasheet.

Audience

This document is meant to be used by anyone wishing to build embedded electronic systems implementing the use of a ISO 144443 contactless interface.

History

Date Description
15/03/2004 Initial release
25/05/2004 Error regarding functions codes for read / write functions corrected
19/06/2006 Type B, T=CL, and low level RF interface parts added
22/03/2007 Error codes added
28/02/2008 ISO 15693 & ICODE1 functions (specific for SpringCard K632 OEM) added

Disclaimer

SpringCard offers a full-featured host-side software library ("SpringProx API"), available as an ANSI C source code as part of the K531 developer's kit. This software library is to be considered as the reference implementation of the K531 host-side software. This document will only help using the K531 for a specific host when no ANSI C compilator is available and explains only a small subset of the K531 functions. For more accurate information, always refer to the SpringProx API source code.

Overview

All transmissions with the SpringProx/CSB/K531 reader are handled by three protocol layers :

The commands layer handles and interprets the SpringProx commands. It consists of the command code, data, and parameters.

The transport layer handles message addressing, specifies the transmission type, and validate each transmission. The transport layer can use one out of four protocols.

The physical layer handles the data transmission itself. The physical layer uses an asynchronous serial protocol. Depending on the product, it can either be serial TTL (K531), RS485 (K531 + RS485 interface), RS232 (CSB-4S), serial tunneling over USB 1.1 (CSB-4U).

Command layer

The command layer handles and interprets the K531 commands. It consists of the command code, data, and parameters.

You send commands in the following format :

Command|DataInLen|DataIn

Where :
Command is the command code identifier
DataInLen is the length of the data
DataIn is the data accompanying the command, when appropriate

The K531 Interface Commands section describes the Command, DataInLen, and DataIn values for each command.

The K531 replies to every command it receives with a status code formatted as follows :

Status|DataOutLen|DataOut

Where :
Status is the status code identifier
DataOutLen is the length of the data
DataOut is the data accompanying the status, where appropriate

Transport layer

The transport layer handles the message addressing, specifies the transmission type, and validate each transmission.

The K531 transport layer can use one of those four protocols :

Depending on the product, some of those protocols are not implemented. For example, the multi-point protocol is not available with computer based readers (CSB / SpringProx), whence the "fast" serial protocol is not available on the OEM readers (K531).

ASCII protocol

This is a point to point protocol allowing easy handling of the reader under a terminal program (HyperTerminal for example). The transmission is made in ASCII Hexadecimal (0x12|0x34|0x56 becomes "123456").

Host to reader
Content Explanation
'$' Ascii $ ("dollar") character used as start marker
Command|DataInLen|DataIn Actual frame transmission
CR and/or LF Carriage return and/or Line feed ("enter" or "return" on the keyboard)
Reader to host
Content Explanation
'+' Ascii + ("plus") character used as start marker
Status|DataOutLen|DataOut Actual frame transmission
CR|LF Carriage return + Line feed

There is no inter-byte timeout and no checksum in this mode.

The only valid characters are CR (0x0D), LF (0x0A), '0' to '9' and 'A' to 'F' (or 'a' to 'f'). Any other character should be silently discarded.

By default, the reader echoes back the received characters. This feature can be turned off in the reader settings.

When the reader detects a length error in the received frame, it signals it to the host with '-'|0x0A instead of '+'.

Processing and answer timings

"Fast" binary protocol

This protocol is designed for high-speed communication on a reliable physical layer (short RS232 wire, or USB serial tunneling). It is a peer to peer protocol, with frame synchronization and checking, but without software flow control. Each peer is alternatively initiator (I) then target (T), with the same transmission scheme :

Host to reader
Way Content Explanation
H => R SYN Synchronization byte
H => R Sequence Sequence identifier
H => R Command|DataLen|Data Actual frame transmission
H => R Checksum XOR(Sequence|Command|DataLen|Data)
Reader to host
Way Content Explanation
R => H SYN Synchronization byte
R => H Sequence Sequence identifier
R => H Status|DataLen|Data Actual frame transmission
R => H Checksum XOR(Sequence|Command|DataLen|Data)
Where :
SYN is the ASCII synchronization character (0x16)

The timeout between each byte (I => T) is 5ms. When the target detects a timeout error, it signals it to the initiator by sending a NAK character alone.

The checksum is used to detect transmission errors. It is calculated by XORing each byte of the transmission frame excluding the SYN character.

Checksum = Sequence XOR Command XOR DataLen XOR Data0 XOR Data1 ... XOR DataN

When the target detects a checksum error, it signals it to the initiator with NAK character alone.

Processing and answer timings

To accept longest card transactions, host application must allow a timeout of 1.2s between end of transmission and start of reply, and loop as long as frame status is 80 (time extension).

Fast "bus" binary protocol

This protocol is designed for high-speed communication on a RS485 physical layer (short RS232 wire, or USB serial tunneling). It is a multi-point protocol, with frame synchronization and checking, but without software flow control. Each peer is alternatively initiator (I) then target (T), with the same transmission scheme :

Host to reader
Way Content Explanation
H => R SOH "Start of header" marker
H => R Address Address of target (= reader address or broadcast)
H => R ACK End of header
H => R Sequence Sequence identifier
H => R Command|DataLen|Data Actual frame transmission
H => R Checksum XOR(Sequence|Command|DataLen|Data)
Reader to host
Way Content Explanation
H => R SOH "Start of header" marker
H => R Address Address of target (= host address)
H => R ACK End of header
R => H Sequence Sequence identifier
R => H Command|DataLen|Data Actual frame transmission
R => H Checksum XOR(Sequence|Command|DataLen|Data)
Where :
SOH is the ASCII start of header character (0x01)
Address can take one of the following values :
  • 0x00 is the host address,
  • 0xFF is the broadcast address (all readers will answer),
  • 0x01 to 0xFE are available as reader addresses.
  • The timeout between each byte (I => T) is 5ms. When the target detects a timeout error, it signals it to the initiator by sending a SOH|Address|NAK sequence.

    The checksum is used to detect transmission errors. It is calculated by XORing each byte of the transmission frame excluding the SOH|Address|ACK header.

    Checksum = Sequence XOR Command XOR DataLen XOR Data0 XOR Data1 ... XOR DataN

    When the target detects a checksum error, it signals it to the initiator with a SOH|Address|NAK sequence.

    Modified OSI 3964R binary protocol

    This protocol is designed for industrial application with flow control, synchronization and frame checking. It is a peer to peer protocol. Each peer is alternatively initiator (I) then target (T), with the same transmission scheme :

    Host to reader
    Way Content Explanation
    H => R STX "Start of frame" marker
    R => H DLE Initial acknowledge
    H => R Sequence Sequence identifier
    H => R Command|DataLen|Data Actual frame transmission
    H => R Checksum XOR(Sequence|Command|DataLen|Data)
    H => R DLE|ETX "End of frame" marker
    R => H DLE Final acknowledge
    Reader to host
    Way Content Explanation
    R => H STX "Start of frame" marker
    H => R DLE Initial acknowledge
    R => H Sequence Sequence identifier
    R => H Command|DataLen|Data Actual frame transmission
    R => H Checksum XOR(Sequence|Command|DataLen|Data)
    R => H DLE|ETX "End of frame" marker
    H => R DLE Final acknowledge
    Where :
    STX is the ASCII "Start of Text" character (0x02)
    ETX is the ASCII "End of Text" character (0x03)
    DLE is the ASCII "DataLink Escape" character (0x10)
    NAK is the ASCII "N-AcKnowledge" character (0x15)

    The timeout between each byte (I => T) is 5ms. When the target detects a timeout error, it signals it to the initiator with NAK|0x0E instead of DLE.

    The timeout between (I => T) STX and (T => I) DLE is 20ms. When the initiator detects a timeout error (no response from target), it shoul'd cancel the transmission.

    The timeout between (T => I) ETX and (I => T) DLE (or NAK) is 20ms. When the initiator detects a timeout error (no response from target), it shoul'd retry the transmission.

    The checksum is used to detect transmission errors. It is calculated by XORing each byte of the transmission frame excluding the STX, DLE and ETX characters.

    Checksum = Sequence XOR Command XOR DataLen XOR Data0 XOR Data1 ... XOR DataN

    When the target detects a checksum error, it signals it to the initiator with NAK|0x0B instead of DLE.

    When the target detects a length error in the received frame, it signals it to the initiator with NAK|0x0A instead of DLE.

    Since DLE is a reserved character, a regular value of 0x10 must always be transmitted twice.

    Processing and answer timings

    To accept longest card transactions, host application must allow a timeout of 5s between DLE and STX.

    Physical layer

    The physical layer handles the data transmission itself. The physical layer uses an asynchronous serial protocol on top of the reader hardware interface (TTL, RS232, RS485, USB tunneling...).

    Serial asynchronous protocol

    The serial configuration is 38400 bauds, 8 bits, no parity, 1 stop bit. There is no hardware flow control.

    Depending on the reader hardware, a higher baudrate (115200 bauds) can be enabled in the reader settings.

    Status code - Time extension

    Every response from K531 starts with a status code. There are three different kinds of status codes :

    Other values are RFU.

    Status 00 - No error

    Correct execution of the command, returned data (if some) are valid.

    Status 80 - Still processing

    If command execution took more than 1000ms, K531 would send this code periodically to inform host that it is still processing. This is particulary usefull when working with slow T=CL cards, having a FWT (frame wait time) of 4s or more. Receiving status 80 at least every second, host knows that K531 is still alive and request more time to achieve the transaction with the card.

    NOTE : status 80 is only provided when using "Fast" binary or "Bus" binary protocol. In ASCII mode, this status code is replaced by a repetition of the '+' ("plus") start marker. In OSI mode, nothing is sent, host response timeout must be at least 5s.

    Software related error codes

    Status Symbolic name Meaning
    63 MI_BREAK Command execution has been interrupted by another input
    64 MI_NY_IMPLEMENTED Unknown or un-implemented command
    7B MI_WRONG_VALUE An invalid value has been specified in command input
    7D MI_WRONG_LENGTH Length of input command is invalid

    Low-level contactless error codes

    Status Symbolic name Meaning
    01 MI_NOTAGERR No answer received (no card in the field, or card is mute)
    02 MI_CRCERR CRC error in card's answer
    05 MI_PARITYERR Parity error in card's answer
    08 MI_SERNRERR CRC error in card's serial number
    0B MI_BITCOUNTERR Wrong number of bits in card's answer
    0C MI_BYTECOUNTERR Wrong number of bytes in card's answer
    13 MI_OVFLERR RC5xx's FIFO overflow
    15 MI_FRAMINGERR Framing error in card's answer
    17 MI_UNKNOWN_COMMAND RC5xx's reported unknown opcode
    18 MI_COLLERR A collision between 2 (or more) cards has occured
    1D MI_NOBITWISEANTICOLL 2 (or more) cards have been found, anticollision not supported
    34 MI_CASCLEVEX Card serial number longer than specified
    36 MI_BAUDRATE_NOT_SUPPORTED RC5xx doesn't support this baudrate

    Hardware and firmware fatal errors

    Status Symbolic name Meaning
    1A MI_INITERR RC5xx not detected
    1B MI_INTERFACEERR Invalid RC5xx status
    1C MI_ACCESSTIMEOUT Timeout on RC5xx interface
    3C MI_WRONG_PARAMETER_VALUE Invalid value specified in internal function call
    70 MI_RECBUF_OVERFLOW Internal receive buffer overflow

    Mifare related error codes

    Status Symbolic name Meaning
    04 MI_AUTHERR Authentication failed (bad key ?)
    06 MI_CODEERR Invalid card's response code
    0A MI_NOTAUTHERR Please get authenticated first
    0F MI_WRITEERR Card reported write error
    1F MI_CODINGERR Card reported another error
    6E MI_WRONG_ADDR Invalid sector or block number

    T=CL related error codes

    Status Symbolic name Meaning
    3D TCL_NOTAGERR A card has been found, but it isn't T=CL compliant
    47 TCL_CID_NOT_ACTIVE The specified CID isn't assigned yet
    4B TCL_ATSLEN Invalid length for card's ATS
    4D TCL_ATS_ERROR Invalid data in card's ATS
    4E TCL_FATAL_PROTOCOL Card's answer doesn't meet T=CL specifications
    4F TCL_RECBUF_OVERFLOW Card's answer is longer than our receive buffer
    52 TCL_TRANSMERR_NOTAG Card not answering anymore (maybe it has been removed)
    53 TCL_BAUDRATE_NOT_SUPPORTED_PICC Card doesn't support the specified baudrate
    57 TCL_PPS_FORMAT Card's answer to our PPS request is invalid
    58 TCL_PPS_ERROR Card didn't accepted our PPS request
    6C TCL_CID_ACTIVE The specified CID is already in use

    ISO/IEC 15693 related error codes

    NOTE : specific for SpringCard K632 OEM

    Status Symbolic name Meaning
    28 VIC_CUSTOMERR Custom command error codes not implemented
    2A VIC_ERR Error with no information given
    2B VIC_BLOCK_NOT_EXIST The specified block is not available (doesn’t exist)
    2C VIC_BLOCK_ALREADY_LOCKED The specified block is already locked and thus cannot be locked again
    2D VIC_BLOCK_LOCKED The specified block is locked and its content cannot be changed
    2E VIC_BLOCK_PROGRAMERR The specified block was not successfully programmed
    2F VIC_BLOCK_LOCKERR The specified block was not successfully locked

    Basic function set

    Read firmware version

    This command returns the current version of the reader module.

    Format :

    0x4F 0x00

    Returns on success :

    0x00 0x10 Product0 ... Product3 Major Minor Build RcPid0 ... RcPid4 RcSnr0 ... RcSnr3

    Where :
    ProductX is the 4-byte product ID of the reader (for instance, 0x43 0x53 0x42 0x34 for "CSB4")
    Major Minor Build is the product version and build identifier (for instance, 0x01 0x19 0x02 for "1.19 build 2")
    RcPidX is the 5-byte product ID of the embedded Philips RC chipset
    RcSnrX is the 4-byte serial number of the embedded Philips RC chipset

    Get device address

    Get the unique device address, to be used in multi-point protocols.

    Format :

    0x58 0x01 0xF0

    Returns on success :

    0x00 0x01 Address

    Where :
    Address is the device current address
    If address is 0x00 or 0xFF, the multi-point protocol is disabled and the point-to-point protocol is enabled.
    If address is between 0x01 and 0xFE, the multi-point protocol is enabled, and the point-to-point protocol is disabled.

    Set device address

    Set the unique device address, to be used in multi-point protocols.

    Format :

    0x58 0x02 0xF0 Address

    Where :
    Address is the device address to be set
    If address is 0x00 or 0xFF, the multi-point protocol is disabled and the point-to-point protocol is enabled.
    If address is between 0x01 and 0xFE, the multi-point protocol is enabled, and the point-to-point protocol is disabled.
    Returns on success :

    0x00 0x00

    Read advanced settings

    Write advanced settings

    Reset reader

    Reset RF part only

    This commands resets the RC531 chipset. Reader is back in startup conditions.

    Format :

    0x9F 0x00

    Returns on success :

    0x00 0x00

    Full software reset

    This commands execute a power on (software) reset. New configuration settings will be loaded.

    Format :

    0x9F 0x04 DE AD DE AD

    Returns on success :

    Nothing. The device resets, so host software will receive its startup string ("K531" or "CSB4" or whatever...) at default speed.

    RF settings and LED control function set

    Configure reader with startup values

    Puts reader back in the same status as it is after power-up.

    Format :

    0x58 0x02 0x0C 0x00

    Returns on success :

    0x00 0x00

    Enter ISO/IEC 14443-A mode

    NOTE : this is reader's default mode. This command must be called only after "Enter ISO/IEC 14443-B mode" to go back to default mode.

    Format :

    0x58 0x02 0x0C 0x01

    Returns on success :

    0x00 0x00

    Enter ISO/IEC 14443-B mode

    Format :

    0x58 0x02 0x0C 0x02

    Returns on success :

    0x00 0x00

    Turn RF field on

    Format :

    0x58 0x02 0x0A 0x01

    Returns on success :

    0x00 0x00

    Turn RF field off

    Format :

    0x58 0x02 0x0A 0x00

    Returns on success :

    0x00 0x00

    RF field off/on

    Format :

    0x58 0x02 0x0A StopMs

    Where :
    StopMs is the duration (milliseconds) of the OFF state
    A typical value of 5 ms is enough to reset all the cards.
    Returns on success :

    0x00 0x00

    Set LED activity

    Format :

    0x58 0x03 0x1E RedLed GreenLed

    Where :
    RedLed is the mode for the Red LED
    GreenLed is the mode for the Green LED
    Allowed values are 0 (LED is OFF), 1 (LED is ON),2 (LED is blinking),
    3 (LED is under control of reader's firmware).
    Returns on success :

    0x00 0x00

    Set USER pin

    Configure the USER I/O pin as an output, and defines its value.

    Format :

    0x58 0x02 0x1F Value

    Where :
    Value is the value for the USER pin output
    Allowed values are 0 (LOW level) or 1 (HIGH level).
    Returns on success :

    0x00 0x00

    Get USER pin

    Configure the USER I/O pin as an input, and returns its value.

    Format :

    0x58 0x01 0x1F

    Returns on success :
    0x00 0x01 Value
    Where :
    Value is the value for the USER pin input
    Relevant values are 0 (LOW level) or 1 (HIGH level).

    Set MODE pin

    Configure the MODE I/O pin as an output, and defines its value.

    Format :

    0x58 0x02 0x1D Value

    Where :
    Value is the value for the MODE pin output
    Allowed values are 0 (LOW level) or 1 (HIGH level).
    Returns on success :

    0x00 0x00

    Get MODE pin

    Configure the MODE I/O pin as an input, and returns its value.

    Format :

    0x58 0x01 0x1D

    Returns on success :
    0x00 0x01 Value
    Where :
    Value is the value for the MODE pin input
    Relevant values are 0 (LOW level) or 1 (HIGH level).

    ISO/IEC 14443-A layer 3 function set

    Reader must be in ISO/IEC 14443-A mode. Use the "Enter ISO/IEC 14443-A" command to ensure this.

    Select any

    Select the first available tag that is in the IDLE or HALTed state.

    Format :

    0x40 0x00

    Returns on success :

    0x00 3+TagSnrLen TagSnr0 TagSnr1 ... TagSnrN TagAtq0 TagAtq1 TagSak

    Where :
    TagSnrLen is the length of TagSnr (4, 7 or 12 bytes)
    TagSnrX is the selected tag serial number or unique identifier
    TagAtqX is the 2-byte value of the tag "answer to query"
    TagSak is the 1-byte value of the tag "select acknowledge"

    Select idle

    Select the first available tag that is in the IDLE state.

    Format :

    0x4D 0x00

    Returns on success :

    Same as "Select any"

    Select again

    Select "again" the last selected tag (if still available).

    Format :

    0x44 0x00

    Returns on success :

    0x00 0x00

    Halt

    Halt the currently selected tag.

    Format :

    0x92 0x00

    Returns on success :

    0x00 0x00

    Get ATS - enter ISO/IEC 14443-A layer-4

    This establish a T=CL channel between currently selected tag and host application.

    Format :

    0x81 0x02 0x10 CID

    Where :
    CID is the card identifier (use value 0xFF if you don't need the CID feature)
    Returns on success :

    0x00 0x00

    Mifare "Classic" function set

    Mifare 1k and 4k tags must be selected with ISO/IEC 14443-A "Select Any" or "Select Idle" command before read and write functions may be used.

    Read block

    Read a 16-byte block of data on the currently selected Mifare tag. Authentication is performed with every keys available in reader's EEPROM.

    Format :

    0x49 0x01 BlockNum

    Where :
    BlockNum is the number of the block to be read (0 to 63 on a Mifare Classic 1k tag)
    Returns on success :

    0x00 0x10 Data0 Data1 ... Data15

    Where :
    DataX is the block data buffer

    Write block

    Write a 16-byte block of data on the currently selected Mifare tag. Authentication is performed with every key available in reader's EEPROM.

    Format :

    0x4B 0x11 BlockNum Data0 Data1 ... Data15

    Where :
    BlockNum is the number of the block to be written (0 to 63 on a Mifare Classic 1k tag)
    DataX is the block data buffer
    Returns on success :

    0x00 0x00

    Read block with key

    Read a 16-byte block of data on the currently selected Mifare tag. Authentication is performed with the supplied key.

    Format :

    0x49 0x07 BlockNum Key0 Key1 ... Key5

    Where :
    BlockNum is the number of the block to be read (0 to 63 on a Mifare Classic 1k tag)
    KeyX is the 6-byte-value of the Mifare access key
    Returns on success :

    0x00 0x10 Data0 Data1 ... Data15

    Where :
    DataX is the block data buffer

    Write block with key

    Write a 16-byte block of data on the currently selected Mifare tag. Authentication is performed with the supplied key.

    Format :

    0x4B 0x17 BlockNum Data0 Data1 ... Data15 Key0 Key1 ... Key5

    Where :
    BlockNum is the number of the block to be written (0 to 63 on a Mifare Classic 1k tag)
    DataX is the block data buffer
    KeyX is the 6-byte-value of the Mifare access key
    Returns on success :

    0x00 0x00

    Read sector

    Read a 48-byte block of data on the currently selected Mifare tag. Authentication is performed with every keys available in reader's EEPROM.

    Format :

    0x48 0x01 SectorNum

    Where :
    SectorNum is the number of the sector to be read (0 to 15 on a Mifare Classic 1k tag)
    Returns on success :

    0x00 0x30 Data0 Data1 ... Data47

    Where :
    DataX is the sector data buffer

    Write sector

    Write a 48-byte sector of data on the currently selected Mifare tag. Authentication is performed with every keys available in reader's EEPROM.

    Format :

    0x4A 0x31 BlockNum Data0 Data1 ... Data47

    Where :
    SectorNum is the number of the sector to be written (0 to 15 on a Mifare Classic 1k tag)
    DataX is the sector data buffer
    Returns on success :

    0x00 0x00

    Read sector with key

    Read a 48-byte sector of data on the currently selected Mifare tag. Authentication is performed with the supplied key.

    Format :

    0x48 0x07 SectorNum Key0 Key1 ... Key5

    Where :
    SectorNum is the number of the sector to be read (0 to 15 on a Mifare Classic 1k tag)
    KeyX is the 6-byte-value of the Mifare access key
    Returns on success :

    0x00 0x30 Data0 Data1 ... Data47

    Where :
    DataX is the sector data buffer

    Write sector with key

    Write a 48-byte sector of data on the currently selected Mifare tag. Authentication is performed with the supplied key.

    Format :

    0x4A 0x37 BlockNum Data0 Data1 ... Data47 Key0 Key1 ... Key5

    Where :
    SectorNum is the number of the sector to be written (0 to 15 on a Mifare Classic 1k tag)
    DataX is the sector data buffer
    KeyX is the 6-byte-value of the Mifare access key
    Returns on success :

    0x00 0x00

    Load key to EEPROM

    Load a Mifare access key in reader's non-volatile memory (RC's EEPROM).

    Format :

    0xA8 0x08 KeyType KeyNum Key0 Key1 ... Key5

    Where :
    KeyType can be either 0x60 for an 'A' key, or 0x61 for a 'B' key
    KeyNum is the key number between 0x00 and 0x0F
    KeyX is the 6-byte-value of the Mifare access key
    Returns on success :

    0x00 0x00

    Mifare UltraLight functions

    Mifare UltraLight tags must be selected with ISO/IEC 14443-A "Select Any" or "Select Idle" command before read and write functions may be used.

    Read 16 bytes

    Read a 16-byte buffer (4 pages) from the currently selected Mifare UL tag. No authentication is performed.

    Format :

    0x8E 0x03 0x30 PageNum 0x10

    Where :
    PageNum is the number of the first page to be read (0 to 15 on a Mifare UltraLight tag)
    Returns on success :

    0x00 0x10 Data0 Data1 ... Data15

    Where :
    DataX is the data buffer (4 pages x 4 bytes)

    Write 4 bytes

    Write a 4-byte buffer (1 page) on the currently selected Mifare UL tag. No authentication is performed.

    Format :

    0x8F 0x07 0xA2 PageNum 0x04 Data0 ... Data3

    Where :
    PageNum is the number of the page to be written (0 to 15 on a Mifare UltraLight tag)
    DataX is the page data buffer
    Returns on success :

    0x00 0x00

    ISO/IEC 14443-B layer 3 function set

    Reader must be in ISO/IEC 14443-B mode. Use the "Enter ISO/IEC 14443-B" command to ensure this.

    Select any

    Select the first available tag that is in the IDLE or HALTed state.

    Format :

    0x40 0x00

    Returns on success :

    0x00 0x0B TagAtq0 TagAtq1 ... TagAtq10

    Where :
    TagAtqX is the 11-byte value of the tag "answer to query"

    Select idle

    Select the first available tag that is in the IDLE state.

    Format :

    0x4D 0x00

    Returns on success :

    Same as "Select any"

    Halt

    Halt the currently selected tag.

    Format :

    0x92 0x00

    Returns on success :

    0x00 0x00

    Attrib - enter ISO/IEC 14443-B layer-4

    This establish a T=CL channel between currently selected tag and host application.

    Format :

    0x81 0x02 0x20 CID

    Where :
    CID is the card identifier (use value 0xFF if you don't need the CID feature)
    Returns on success :

    0x00 0x00

    T=CL (ISO/IEC 14443 layer 4) functions

    Those functions are common to type-A and type-B cards, once they have been activated (Get ATS for type-A, Attrib for type-B).

    Exchange

    This is the basic T=CL exchange function (analog to SCardTransmit in PC/SC)

    The reader handles the whole T=CL protocol internally.

    Format :

    0x82 SendLen+1 0xFF Send0 Send1 ... SendN

    Where :
    SendLen+1 is the size of the frame to send, plus 1 for the CID
    CID is the card identifier (use value 0xFF if you don't need the CID feature)
    SendX are the data to send to the card
    Returns on success :

    0x00 RecvLen Recv0 Recv1 ... RecvN

    Where :
    RecvLen is the size of the frame answered by the card
    RecvX are the data returned by the card

    Deselect - halt the T=CL card

    Format :

    0x81 0x02 0x12 CID

    Where :
    CID is the card identifier (use value 0xFF if you don't need the CID feature)
    Returns on success :

    0x00 0x00

    Low level RF interface functions

    Read RC register

    Retrieve current value of a register. See Philips RC documentation for information on registers.

    Format :

    0xAB 0x01 RegAddr

    Where :
    RegAddr is the address of the register
    Returns on success :

    0x00 0x01 RegValue

    Where :
    RegValue is the value of the register

    Write RC register

    Set new current value for a register. See Philips RC documentation for information on registers.

    Format :

    0xAC 0x02 RegAddr RegValue

    Where :
    RegAddr is the address of the register
    RegValue is the value of the register
    Returns on success :

    0x00 0x00

    Exchange frame - ISO/IEC 14443-A

    Send a frame using current ISO/IEC 14443-A parameters and CRC A.

    Reader must be in ISO/IEC 14443-A mode. Use the "Enter ISO/IEC 14443-A" command to ensure this.

    Format :

    0x94 SendLen+9 0x00 SendLen+2 0x00 MaxRecvLen 0x01 TimeoutH TimeoutL Send0 Send1 ... SendN 0xCC 0xCC

    Where :
    SendLen+2 is the size of the frame to send, including 2 CRC bytes
    MaxRecvLen is the maximum size of the frame to accept in reply (including 2 CRC bytes)
    TimeoutH TimeoutL is the 16-bit timeout value (in ETU, see ISO/IEC 14443 for details ; if you don't know, try 0x02 0x00, 0x10 0x00 or 0x40 0x00 until it works...)
    SendX are the data to send to the card

    The reader will replace the last 2 bytes of the frame by the CRC A before sending the frame to the card.

    Returns on success :

    0x00 RecvLen+2 Recv0 Recv1 ... RecvN CrcH CrcL

    Where :
    RecvLen+2 is the size of the frame answered by the card, + 2 reserved for CRC
    RecvX are the data returned by the card

    The reader will check that the last 2 bytes are a valid CRC A, before forwarding the frame from the card to the host.

    Exchange frame - ISO/IEC 14443-B

    Send a frame using current ISO/IEC 14443-B parameters and CRC B.

    Reader must be in ISO/IEC 14443-B mode. Use the "Enter ISO/IEC 14443-B" command to ensure this.

    Format :

    0x97 SendLen+9 0x00 SendLen+2 0x00 MaxRecvLen 0x01 TimeoutH TimeoutL Send0 Send1 ... SendN 0xCC 0xCC

    Where :
    SendLen+2 is the size of the frame to send, including 2 CRC bytes
    MaxRecvLen is the maximum size of the frame to accept in reply (including 2 CRC bytes)
    TimeoutH TimeoutL is the 16-bit timeout value (in ETU, see ISO/IEC 14443 for details ; if you don't know, try 0x02 0x00, 0x10 0x00 or 0x40 0x00 until it works...)
    SendX are the data to send to the card

    The reader will replace the last 2 bytes of the frame by the CRC B before sending the frame to the card.

    Returns on success :

    0x00 RecvLen+2 Recv0 Recv1 ... RecvN CrcH CrcL

    Where :
    RecvLen+2 is the size of the frame answered by the card, + 2 reserved for CRC
    RecvX are the data returned by the card

    The reader will check that the last 2 bytes are a valid CRC B, before forwarding the frame from the card to the host.

    ISO/IEC 15693 function set

    NOTE : specific for SpringCard K632 OEM

    Reader must be in ISO/IEC 15693 standard or fast mode. Use the "Enter ISO/IEC 15693" command to ensure this.

    Select any

    Select the first available tag.

    Format :

    0x40 0x00

    Returns on success :

    0x00 0x08 TagSnr0 TagSnr1 ... TagSnr7

    Where :
    TagSnrX is the 8-byte value of the tag serial number or unique identifier

    Select again

    Select "again" the last selected tag (if still available).

    Format :

    0x44 0x00

    Returns on success :

    0x00 0x00

    Halt

    Halt the currently selected tag.

    Format :

    0x45 0x00

    Returns on success :

    0x00 0x00

    ISO 15693 tags must be selected with ISO/IEC 15693 "Select Any" or "Select again" command before read and write functions may be used.

    Read block

    Read a 4-byte block of data on the currently selected ISO 15693 tag.

    Format :

    0x49 0x01 BlockNum

    Where :
    BlockNum is the number of the block to be read
    Returns on success :

    0x00 0x04 Data0 Data1 ... Data3

    Where :
    DataX is the block data buffer

    Write block

    Write a 4-byte block of data on the currently selected ISO 15693 tag.

    Format :

    0x4B 0x05 BlockNum Data0 Data1 ... Data3

    Where :
    BlockNum is the number of the block to be written
    DataX is the block data buffer
    Returns on success :

    0x00 0x00

    Lock block

    Lock permanently 4-byte block of data on the currently selected ISO 15693 tag.

    Format :

    0x59 0x01 BlockNum

    Where :
    BlockNum is the number of the block to be locked
    Returns on success :

    0x00 0x00

    ICODE1 function set

    NOTE : specific for SpringCard K632 OEM

    Reader must be in ICODE1 standard or fast mode. Use the "Enter ICODE1" command to ensure this.

    Select any

    Select the first available tag that is in the field.

    Format :

    0x40 0x00

    Returns on success :

    0x00 0x08 TagSnr0 TagSnr1 ... TagSnr7

    Where :
    TagSnrX is the 8-byte value of the tag serial number or unique identifier