crt-571带卡读写的收发卡机产品说明书sensis.kz/files/crt-591-v1[1].0...
TRANSCRIPT
SPECIFICATION Model No. CRT-591Date 2010/03/2
Card Issuing Ver. 1.0Page 1/95
CRT-591Card Issuing Machine
VER 1.0
USER MANUAL
SPECIFICATION Model No. CRT-591Date 2010/03/2
Card Issuing Ver. 1.0Page 2/95
CREATOR (CHINA) TECH CO., LTD·Add: 2F, M-10 Building, Center Area, Hi-tech Industrial Park, Shenzhen, China·TEL:+86 755 26710691 FAX:+86 755 26710105·Http://www.china-creator.com
Revision Log
Version Revision Time Content
1.0 2010.3.2 First Release
SPECIFICATION Model No. CRT-591Date 2010/03/2
Card Issuing Ver. 1.0Page 3/95
CONTENT1. OVERVIEW.............................................................................................................................62. Product Module Number Specification.............................................................................73. Structure And Dimension Drawings..................................................................................84. Move Card Sketch Map........................................................................................................95. General Specification..........................................................................................................10
SPECIFICATION Model No. CRT-591Date 2010/03/2
Card Issuing Ver. 1.0Page 4/95
6. CRT-591 Design Specification...........................................................................................116.1 Card Thickness Adjustment......................................................................................11
7. CRT-591 Communication Protocol...................................................................................127. 1 Transmission / Control Specification...................................................................127.2 Transmission control method and characters....................................................137.3 Transmission Format And Characters..................................................................14
7.3.1 Command format and characters...............................................................147.3.2 Successful responsive package format and character.........................157.3.3 Failed responsive package format and character..................................15
7.4 Address according to Multi-Device communication.........................................167.5 Communication Method...........................................................................................17
7.5.1 Ordinary operation..........................................................................................177.5.2 Irregular operation and back-up..................................................................17
8. CRT-591 Operation Command...........................................................................................198.1 Card Status Code(st0,st1,st2)............................................................................228.2 e1,e2 Error Code Table (e0 is always ‘0’)..............................................................23
9. Command Specification......................................................................................................259.1 Reset (Initialization)...................................................................................................259.2 Status Request Command.......................................................................................269.3 Carry Card Command:..............................................................................................279.4 Entry Command..........................................................................................................289.5 MAG-Track Read operation command..................................................................299.6 Multi-MAG-Track read command............................................................................31
9.6.1 ASCII mode read magnetic card..................................................................319.6.2 Binery mode of reading magnetic card.....................................................33
9.7 MAG-Track write operation command..................................................................349.7.1 Setting Hico/Loco way of writting...............................................................349.7.2 MAG-Track write for one track.....................................................................359.7.3 MAG-Track write download for one track.................................................369.7.4 MAG-Track write simultaneity......................................................................379.7.5 MAG-Track write by binery...........................................................................38
9.8 Auto-Check ICCard/RFCard Type:.........................................................................399.8.1 Auto-Check ICCard Type:..............................................................................399.8.2 Auto-Check RF Card Type:...........................................................................40
9.9 CPUCard Operation...................................................................................................419.9.1 CPUCard Reset................................................................................................419.9.2 Deactivate CPU Command............................................................................429.9.3 Inquire CPU Card Status:..............................................................................429.9.4 CPU Card Communication T=0....................................................................439.9.5 CPU Card Communication T=1.................................................................449.9.6 CPU Warm Reset..........................................................................................459.9.7 T=1, T=0 CPU Card Protocol Automatic Communication..................45
SPECIFICATION Model No. CRT-591Date 2010/03/2
Card Issuing Ver. 1.0Page 5/95
9.10 SAM(Secure Application Module) Control Command.....................................469.10.1 Active SAM Command..............................................................................469.10.2 Deactivate SAM Command......................................................................469.10.3 Inquire SAM Status Command................................................................479.10.4 SAM Communication T=0.........................................................................489.10.5 SAM Communication T=1.........................................................................499.10.6 SAM Warm Reset........................................................................................509.10.7 Auto-Check SAM Card T=0/T=1 Protocol.............................................509.10.8 Select SAM...................................................................................................51
9.11 SLE4442/4428 Control.............................................................................................529.11.1 SLE4442/4428 Reset.....................................................................................529.11.2 Deactivate SLE4442/4428............................................................................529.11.3 Inquire status of SLE4442/4428.................................................................539.11.4 SLE4442 Control...........................................................................................54
9.11.4.1 Data read from main memory on SLE4442.................................549.11.4.2 Data read from protection memory on SLE4442.......................559.11.4.3 Data read from security memory on SLE4442............................569.11.4.4 Data write to main memory on SLE4442......................................569.11.4.5 Data write to protection memory on SLE4442..........................579.11.4.5 Data write to security memory on SLE4442..............................589.11.4.6 Verification data present to SLE4442..........................................59
9.11.5 SLE4428 Control...........................................................................................609.11.5.1 Data Reading of main-memory of SLE4428................................609.11.5.2 Reading of protection-bit of SLE4428..........................................619.11.5.3 Data writing to main-memory of SLE4428...................................629.11.5.4 Data writing to main-memory of SLE4428 with protecting.....629.11.5.5 Written with protection-bit...............................................................639.11.5.6 Verification of password present to SLE4428............................63
9.12 I2C Memory Card Control Command..................................................................649.12.1 Activate I2C memory card..........................................................................649.12.2 Deactivate I2C memory card...................................................................659.12.3 Inquire Status of I2C memory card........................................................669.12.4 I2C Control......................................................................................................67
9.12.4.1 Read data from I2C............................................................................689.12.4.2 Write data to I2C.................................................................................68
9.13 Contactless IC card Operation..............................................................................699.13.1 Activated contackless IC card...................................................................699.13.2 Deactivate RFID card.................................................................................719.13.3 Inquire status of RFID card......................................................................719.13.4 Mifare 1 card control..................................................................................729.13.4 Key verification...........................................................................................72
9.13.4.2 Verify key from EEPROM.................................................................73
SPECIFICATION Model No. CRT-591Date 2010/03/2
Card Issuing Ver. 1.0Page 6/95
9.13.4.3 Modify sector key (KEY A)...............................................................749.13.4.4 Download password to EEPROM...............................................759.13.4.4 Read sector data................................................................................769.13.4.5 Write sector data................................................................................779.13.4.6 Initialization.........................................................................................789.13.4.7 Read value...........................................................................................799.13.4.8 Increment.............................................................................................809.13.4.9 Decrement...........................................................................................81
9.13.5 Type A RF card communication................................................................829.13.6 Type B RFcard communication.................................................................83
9.14 Shutter related operation.......................................................................................849.14.1 LED setting.....................................................................................................849.14.2 Jitter function setting...................................................................................859.14.3 Anti-fishing control.......................................................................................86
9.14.3.1 Anti-fishing status.............................................................................869.14.3.2 Anti-fishing work mode setting......................................................879.14.3.3 Anti-fishing pin control....................................................................88
9.15 Components of CRT-591........................................................................................899.16 Read Serial Number of CRT-591...........................................................................90
9.16.1 Read serial number......................................................................................909.16.2 Write Serial Number of CRT-591...............................................................90
9.17 Read CRT-591 configuration.................................................................................919.18 Read CRT-591 version information.....................................................................929.12. Error-card Bin Counter Control...........................................................................93
9.14.1 Read error-card bin counter.......................................................................939.14.2 Set initial value of error-card bin..............................................................93
1. OVERVIEW
CRT-591 is card issuing machine with IC/ RFID/ Magnetic card
SPECIFICATION Model No. CRT-591Date 2010/03/2
Card Issuing Ver. 1.0Page 7/95
read/ write functions.
CRT-591 has the following features:
·3 in 1: Support IC/ RFID/ Magnetic card read/ write
simultaneously and respectively
·Extendability: Third-party RFID or IC module is available.
·Customizability: Customization-friendly design
·Multi-unit communication: Max.16pcs via RS232 interface
·Compact and cost efficient
2. Product Module Number Specification
SPECIFICATION Model No. CRT-591Date 2010/03/2
Card Issuing Ver. 1.0Page 8/95
CRT - 591 - ( X X X ) X X - X X X
Client CodeR 0:RS232 StandardU0: USB Standard
XX: Customized Product
Card CaptureB: card capture binR: card capture channel
Version&Serials Nnumber 1---9
SAM/SIM CardY: With PSAM boardN: Without PSAM board
FunctionI: Contact IC card R/WC: RFID card R/WM: Mag card 3 tracks R/WE:(IC card+RFID card)R/WF:(RFID card+mag card)R/WG:(IC card+mag card)R/WH: ( mag card+I ccard+RFID card)R/WW: Special PCB and no PCB Shutter
D: CRT-380D (Electric shutter)N: Without Bezel
Mag Card OperationX: No mag headR: Mag card 3 tracks read onlyL: Lo-Co Mag card 3 tracks R/WH: Hi-Co Mag card 3 tracks R/W
SPECIFICATION Model No. CRT-591Date 2010/03/2
Card Issuing Ver. 1.0Page 9/95
3. Structure and Dimension Drawings
SPECIFICATION Model No. CRT-591Date 2010/03/2
Card Issuing Ver. 1.0Page 10/95
70. 2
134
152. 5158. 820. 2
57. 7391. 5
146.
8
6-156-
3.5
84.7
17
71.7
129.
4 175
5445
2
深 圳 市 创 自 技 术 有 限 公 司 CREATOR (CHINA) TECH CO., LTD
校 对 审 核 设 计
, 共 页 第 页 单 位 mm
图样标记 数 量 日 期
零件代码 工 艺
产品名称
版 本>120~250
A.0
>50~120 比 例
零件名称 0755-267103450755-26710105
材 料
传 真 电 话
6
QR - 066/ A. 1
>18~50
>3 6~ ± 0. 05
标 记 更改文件号 处 数 日 期 签 字
2
3
1
4
5
>6 18~ ± 0. 07±0. 10±0. 15± 0.21
± 0. 15±0. 18± 0. 25± 0. 30±0. 40
± 0. 35± 0.52± 0. 62± 0. 74± 1. 00
≤ 3 ± 0. 02 ± 0. 10 ± 0. 25
>250~500 ± 0.25 ±0. 50 ± 2. 00
范围 1 级 2 级 3 级一般公差
:无特殊说明尺寸公差执行方法1. 1一般孔径、轴的尺寸按 级公 差带执行2.一股线性公差、圆角、倒角 按2级公差带执行
.3 角度尺寸公差按3级公差带 执行
CRT-591 系列
(86mm-100mm)装卡长
4. Move Card Sketch Map
SPECIFICATION Model No. CRT-591Date 2010/03/2
Card Issuing Ver. 1.0Page 11/95
Shutter Switch
Shutter Sensor
Sensor1(PSS1)
Sensor2(PSS2)
Sensor3(PSS3)
Sensor4(PSS4)
Sensor5(PSS5)
Sensor6(PSS6)
(DSS1)
(DSS2)
Mag card operation
IC card operation
RF Card Operation
Card stop at front with holding
Card stop at front without holding
Card empty-detect sensor
(DVS)Full Error card bin sensor
(DFS)Card lack-detect sensor
(DLS)
Card Stacker
Error Card Bin
Sensor7(PSS7)
Sensor8(PSS8)
Sensor9(PSS9)
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0
Page 12/95
5. General Specification·Power Supply:
DC 24V ±5%·Current Comsumption:
Static Current: 0.1A Peak Current During Operation: 2.0A Normal Current Condition: 800mA
·Card Feeding-Out Speed: > 0.5 Cards/s (Transportation Speed)
·Communication Interface: RS232C / USB (HID) (Ex-work setting: Default unit address is ‘0’)
·Card Dimensions: Size: 55×86mm
Thickness: 0.2mm~1.0mm (Ex-work standard: 0.8mm) ·Weight:
4.0 Kg Approx.·Dimensions:
Refer to Structure and Dimension Drawings·Card Stacking Capability:
120pcs in case of 0.76mm standard card( Available to set to 500pcs max.)
·Card Pre-Empty Detection:7~50pcs ± 2pcs ( Default setting: 15pcs)
·Enviromental Condition:Operation: 0~50℃ 0~90% RH ( Without Condensing)Storage: -10~75℃ 0~90% RH ( Without Condensing)
·Life Time: 1 million times
( In the condition: 20+/-5℃, 35~60%RH, Dispense cycle ≤ 1pcs/min) ·Support ISP Download On Line ·Compliant To RoHS
6. CRT-591 Design Specification
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 13/95
6.1 Card Thickness AdjustmentCRT-591 makes it more accurate and convenient to dispense the cards in different
thickness via rotating the turn-knob to different gear position so as to adjust the gap
between the upper and lower transmiting wheels, which eliminates the inconvenient
and inaccurate gap adjustment defects. With this feature, CRT-591 is quite suitable
for the unattended vending devices to dispense various cards of distinct thickness.
There are several steps to adjust the thickness of cards:
1. Confirm the thickness of cards ( Raised type character are not involved in)
2. Press the turn-knob and turn around to the graducation pointed by the red arrow.
Seeing pictures below.
3. Make sure the adjustment on the right position by insert cards from stacker.
(Inserting one card from stacker will be smooth and two cards simultaneously from
behind can be impossible)
7. CRT-591 Communication Protocol7. 1 Transmission / Control Specification
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 14/95
1) Baud rate: 9,600/19200/38400/57600/115200BPS
2) Transmission method: Half duplex, Support multi-unit communication (16 units max)
3) Synchronous method: Asynchronous
Start
bit
D0 D1 D2 D3 D4 D5 D6 D7 Stop sbit
Start bit: 1 bit
Data length: 8bit
Check bit: none
Stop bit: 1 bit
Character Code: ASCII 8 bit code
7.2 Transmission control method and characters
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 15/95
CRT-591 executes particular operation according to text (command) received from HOST then
reports result of execution to HOST.. Character reference
STX (F2H) Starting bit
ETX (03H) End of bit
ACK (06H) Acknowledge
NAK (15H) Negative acknow
EOT (04H) Clear the line
ADDR The address of CRT-591
7.3 Transmission Format and Characters
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 16/95
7.3.1 Command format and characters STX
(0xF2)ADDR
(1 byte)LENH
(1 byte)LENL
(1 byte)CMT
(1 byte)CM
(1 byte)PM
(1 byte)DATA
(N bytes)ETX
(1 byte)BCC
(1 byte)
Range of TEXT
Range of BCC calculation
MAX 1024 byte
Code MeaningSTX (F2H) Representing the start of text in a command or a response.LENH(1 byte) Length of high byte of textLENL(1 byte) Length of low byte of textCMT Command head (‘C’ , 43H )
CM Specify as command.PM Command parameterDATA Transmission data ( N byte, N=0~512)ETX (03H) End of textBCC(1 bytes) CRC Parity
7.3.2 Successful responsive package format and characterSTX
(0xF2)ADDR
(1 byte)LENH
(1 byte)LENL
(1 byte)PMT
(1 byte)CM
(1 byte)PM
(1 byte)st0
(1 byte)st1
(1 byte)st2
(1 byte)DATA
(N bytes)ETX
(1 byte)BCC
(1 byte)
Range of TEXT
Range of BCC calculation
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 17/95
MAX 1024 byte
Code MeaningSTX (F2H) Representing the start of text in a command or a response.LENH(1 byte) Length of high byte of textLENL(1 byte) Length of low byte of textPMT Return command head ( ‘P’ , 50H )CM Return command.PM Return Command parameterst0,st1,st2 Return Status codeDATA Transmission data ( N byte, N=0~512 )ETX (03H) End of textBCC (1 byte) CRC Parity
STX(0xF2)
ADDR(1 byte)
LENH(1 byte)
LENL(1 byte)
EMT (1 byte)
CM(1 byte)
PM(1 byte)
e0(1 byte)
e1(1 byte)
e 2(1 byte)
DATA(N bytes)
ETX(1 byte)
BCC(1 byte)
Range of TEXT
Range of BCC calculation
MAX 1024 byte
Code MeaningSTX (F2H) Representing the start of text in a command or a response.LENH(1 byte) Length of high byte of textLENL(1 byte) Length of low byte of textEMT Return command head ( ‘N’, 45H )CM Return command.e1,e2,e0 Return error codePM Command parameterDATA Transmission data (N byte, N=0~512 ) ETX (03H) End of textBCC (1 byte) CRC Parity
7.4 Address according to Multi-Device communicationADDR:Address word for each device in multi-device communication
7.3.3 Failed responsive package format and character
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 18/95
Address Character
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 19/95
0# 00H1# 01H2# 02H3# 03H4# 04H5# 05H6# 06H7# 07H8# 08H9# 09H
10# 0AH11# 0BH12# 0CH13# 0DH14# 0EH15# 0FH
Notes:Default address is 15#. Each device has unique address.
The address of unit is setting by DIP on the main PCB Board.
DIP Address4 3 2 1
ON ON ON ON 0#ON ON ON OFF 1#ON ON OFF ON 2#ON ON OFF OFF 3#ON OFF ON ON 4#ON OFF ON OFF 5#ON OFF OFF ON 6#ON OFF OFF OFF 7#OFF ON ON ON 8#OFF ON ON OFF 9#OFF ON OFF ON 10#OFF ON OFF OFF 11#OFF OFF ON ON 12#OFF OFF ON OFF 13#OFF OFF OFF ON 14#OFF OFF OFF OFF 15#
7.5 Communication Method
7.5.1 Ordinary operation
Command ACK(HOST)
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 20/95
7.5.2 Irregular operation and back-up
Case 1
Case 2
Case 3
Case 4
Case 5
ACK Response(ICRW) bytes
(Execution)
Command ACK
ACK Response
(HOST)
(ICRW) bytes
(Execution)
Command
300msec Timeout
X error
Command ACK
ACK Response
(HOST)
(ICRW) bytes
(Execution)
Command
X error
NAK
Command ACK
Response Response
(HOST)
(ICRW) bytes
NAK
ACK
(Execution)
CommandACK
ACK Response
(HOST)
(ICRW) bytes
(Execution)
Command
20msec Timeout
Command(HOST)
(ICRW) bytes
EOT
(Execution)ACK
EOT
ACK
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 21/95
Case 6
Case 7
(discontinue)
Command(HOST)
(ICRW) bytes
300msec Timeout
ACK(Execution)
EOT
X error
EOT
EOT(discontinue)
Command(HOST)
(ICRW) bytes
EOT
(Execution)ACK
X error
Response
ACK
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 22/95
8. CRT-591 Operation CommandChapter Command Function CM PM description
9.1 INITIALIZE Initialize CRT-591 30H
30H If card is inside, move card to cardholding position
31H If card is inside, capture card to error card bin
32H Reset and move card to gate without holding
33H If card is inside, does not move the card.
34H Same as 30H and retract counter will work.
35H Same as 31H and retract counter will work.
36H Same as 32H and retract counter will work.
37H Same as 33H and retract counter will work.
9.2 STATUS REQUEST Inquire status 31H 30H Report CRT-591 status
31H Report sensor status (Se status)
9.3 CARD MOVE Card movement 32H
30H Move card to gate without holding 31H Move card to card holding position32H Move card to RF card position33H Move card to IC position34H Move card behind magnetic head39H Move card to error card bin
9.4 CARD ENTRY 33H
30H Prohibit entry from gate31H Enable entry by switch 32H Enable entry by magnetic head
9.5Magnetic
card operation
Magnetic card register operation 35H
30H Only remove the card without upload data
31H Only upload ISO-1 track data32H Only upload ISO-2 track data33H Only upload ISO-3 track data40H Clear the data in the magnetic
register37H Only check the data status of
magnetic register51H Read ISO-1 track data by binery
mode52H Read ISO-2 track data by binery
mode53H Read ISO-3 track data by binery
mode
9.6
Combine the
magnetic card
operation
Combination of magnetic card
operation 36H
31H Only-read ISO-1 track32H Only-read ISO-2 track33H Only-read ISO-3 track34H Only-read ISO-1, ISO-2 track data35H Only-read ISO-1, ISO-3 track data36H Only-read ISO-2, ISO-3 track data
37H Only-read ISO-1, ISO-2, ISO-3 track data
9.7 Magnetic Magnetic card 37H 30H Set magnetic card operation mode
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 23/95
card writing
function writting operation
31H Download ISO-1 track data, and write into card
32H Download ISO-2 track data, and write into card
33H Download ISO-3 track data, and write into card
35H Only download ISO-1 track data to register
36H Only download ISO-2 track data to register
37H Only download ISO-3 track data to register
39H Write the data of ISO 1,2,3 in register into the card
40H Clear the data in the card without moving
51H Write ISO-1 track data by binery mode
52H Write ISO-2 track data by binery mode
53H Write ISO-3 track data by binery mode
9.8 CARD TYPE
ICCard/RFCardTypeCheck 50H
30H Autocheck ICCardType
31H Autocheck RFCardType
9.9CPU CARD CONTROL
CPU Card Applicatio Opertion
51H
30H CPUCard cold reset31H CPUCard power down 32H CPUCard status check33H T=0 CPUCard APDU data
exchange34H T=1 CPUCard APDU data
exchange38H CPUCard hot reset39H Auto distinguish T=0/T=1 CPUCard
APDU data exchange
9.10SAM CARD CONTROL
SAMCard Application Operation
52H
30H SAMCard cold reset31H SAMCard down power32H SAMCard status check 33H T=0 SAMCard APDU data
exchange 34H T=1 SAMCardAPDU data
exchange38H SAMCard hot reset39H Auto distinguish T=0/T=1
SAMCardAPDU data exchange40H Choose SAMCard stand
9.11SLE4442/4428CARD CONTROL
53H
30H SLE4442/4428Card reset 31H SLE4442/4428Card power down 32H Browse SLE4442/4428Card status33H Operate SLE4442Card34H Operate SLE4428Card
9.12 IC MEMORY
24C01—24C256Card
54H 30H ICCard reset31H ICCard down power
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 24/95
CARD Operation
32H Check ICCard status 33H Read ICCard34H Write ICCard
9.13RFCARD
CONTROL(13.56 MHZ)
Mifare standard card Type A & BT=CL protocol operation
60H
30H RF Card startup31H RF Card down power32H RF Card operation status check33H Mifare standard Card read/write34H Type A standard T=CLCard APDU
data exchange35H Type B standard T=CLCard APDU
data exchange
9. 14 Gata module
operation
80H30H Red LED Operation31H Green LED Operation
81H30H Prohibit Jitter function31H Enable Jitter function
82H
30H Anti-fishing hook status quiry31H Anti-fishing hookworking mode
setting32H Anti-fishing hook movement
9.16Machine SERIAL
NUMBERA2H
30H Read Machine Serial number31H Write Machine Serial number
9.17Read
Machine CONFIG
A3H30H Read Machine configuration
information
9.18READ
CRT-591 VERSION
A4H30H Read Card software version
information
9.19RECYCLE
BIN COUNTER
A5H30H Read number of counter of Card
error card bin31H Initiate card error card bin counter
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 25/95
8.1 Card Status Code(st0,st1,st2)st0 Content“0” No Card in CRT-591“1” One Card in gate“2” One Card on RF/IC Card Position
st1 Content“0” No Card in stacker“1” Few Card in stacker “2” Enough Cards in card box
st2 Content“0” Error card bin not full“1” Error card bin full
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 26/95
8.2 e1, e2 Error Code Table (e0 is always ‘0’)
e1,e2 Content“00” Reception of Undefined Command“01” Command Parameter Error“02” Command Sequence Error“03” Out of Hardware Support Command“04” Command Data Error“05” IC Card Contact Not Release
“06”--“09”“10” Card Jam“11” Electric shutter error“12” sensor error“13” Too Long-Card “14” Too Short-Card “15”“16” Card is moved artificially“17”“18”“19”“20” Read magnetic card error (CRC error)“21” Read magnetic card error“22” Write magnetic card error“23” Write magnetic card error( CRC error)
“24” Blank tracks“25” Write verify error (Qualit error)“26” Read error (No SS)
“27” Read error (No ES)“28” Read error (LRC error)“29” Write Verify Error (Data discordance)“30” Power Down
“31”“32”“33”
“34”“35”“36”“37”“38”
“39”“40” Card is taken away when module try to capture the card“41” IC card contact error caused by magnent malfuncton“42”“43” Disable To Move Card To IC Card Position“44”“45” Card is moved manually“46”“47”“48”“49”“50” Received Card Counter Overflow
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 27/95
“51” Motor error“52”“53”“54” Move Anti-fishing hook failure“55” Fail to execute the command ‘release anti-fishing hook’ “56”“57”“58”“59”“60” Short Circuit of IC Card Supply Power“61” Activiation of IC Card failure“62” Command Out Of IC Card Support “63” Data Transmittion of IC card error“64” Data transmittion of IC card error overtime“65” Disablity of IC Card “66” Command Out Of IC Current Card Support “67”“68”“69” CPU/SAM Non-Compliance To EMV Standard“80” When write-check by binary, data in the track is zero“81” When write-check by binary, the check data is error“A0” Empty-Stacker “A1” Full-Stacker “B0” Reset failure
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 28/95
9. Command Specification
9.1 Reset (Initialization)Command (TXET):
Positive response (TXET):
Negative response (TEXT):
This is to set the operation conditions for SCT and to initialize CRT-591.
When it execute at first time, ICRW will auto check and judge HOST BAUD Rate.
CRT-591 is initialized in Disable mode that card is not accepted by this command.
CRT-591 is in prohibed status and return software version information.
Pm: Command parameter
If there is no card in CRT-591, engine will rotate slightly to clear up card in stacker.
If there are cards in CRT-591, the disposal is show as below:
30H: Move the card to Gate portion
31H: Capture card to reject-stacker32H: Move card to gate without holding
33H: If card is inside CRT-591, does not move the card.
34H: Same as pm=30H, and Retract counter will work.
35H: Same as pm=31H, and Retract counter will work
36H: Same as 32H and retract counter will work.
37H: Same as pm=33H, and Retract counter will work
Pd: Clear card in CRT-591 when power-off
The operation when CRT-591 suddently power-off
=30H when power-off, do not clear the card in the machine
=31H when power-off, move the card in the machine to the card holding position.
Notes: Default setting Pd=30H
Rev_type: softeware version, “CRT-591-V1.00”
“C” 30H Pm Pd
“P” 30H Pm st0 st1 st2 Rev_type
“N” 30H Pm e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 29/95
9.2 Status Request CommandCommand
Positive response
Negative response
pm=30H : Report current status of st0, st1, st2.
pm=31H : Response is returned in form of Sensor, with the status information obtained.
The locations of sensor are referred to appearance drawing.
Sensor statusDSS1Gate sensor
30H DSS1 No card31H DSS1 Have card33H No Shutter
DSS2(Shutter sensor)
30H Shutter close31H Shutter open33H No shutter
PSS1 30H PSS1 No card31H PSS1 Have card
PSS2 30H PSS2 No card31H PSS2 Have card
PSS3 30H PSS3 No card31H PSS3 Have card
PSS4 30H PSS4 No card31H PSS4 Have card
PSS5 30H PSS5 No card31H PSS5 Have card
PSS6 30H PSS6 No card31H PSS6 Have card
PSS7 30H PSS7 No card31H PSS7 Have card
PSS8 30H PSS8 No card31H PSS8 Have card
PSS9 30H PSS9 No card31H PSS9 Have card
DVS(Card empty)
30H DVS No card31H DVS Have card
DLS(Dearth of card)
30H DLS No card31H DLS Have card
DFS(Error card bin)
30H DFS No card31H DFS Have card
“C” 31H Pm
“P” 31H Pm st0 st1 st2 Sensor(10 byte)
“N” 31H Pm e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 30/95
9.3 Carry Card Command: Command
Positive response
Negative response
Carry the card to the different positions by command operation
Pm=30H Move card to without holding card position
Pm=31H Move card to holding card position
Pm=32H Move card to RF Card position
Pm=33H Capture card to IC card position
Pm=34H Move card to Magnetic head back-end position
Pm=39H Move card to the gate
If card can not move to specified position, CRT-591 will return Card jam error
Note:
1. When execute Capture card command, if error card bin is full, CRT-591 will return error card bin
error.
2. Only capture the card in the machine except the card in the error card bin.
3. If there is no card in the channel of CRT-591, the machine will move the card from stacker to
the specific position and read/write. Otherwise, only move the card in the the channel.
4. Card should be move the card to the corresponding position to do magnetic, IC card, RF card
operation.
9.4 Entry Command
“C” 32H Pm
“P” 32H Pm st0 st1 st2
“N” 32H Pm e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 31/95
Command
Positive response
Negative response
Afert set card input from gate available, if insert card from gate, CRT-591 will carry the card to
magnetic head back-end position, The end of the insert can be detected by status inquiry
command.
Pm=30H Disable card input from gate
Pm=31H Enable card input from gate
Pm=32H Allow card in by magnetic signal
9.5 MAG-Track Read operation command
“C” 33H Pm
“P” 33H Pm st0 st1 st2
“N” 33H Pm e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 32/95
PM=30H: Card movements only within ICRW, and without upload. Move the card in CRT-591
and re-read the card and stop at magnetic card end-stop position or head-stop position, only
change the status in the registers without uploading data.
PM=31H: read data on ISO Track #1
PM=32H: read data on ISO Track #2
PM=33H: read data on ISO Track #3
The command with the above parameters allows ICRW to transmit the data of buffer, which have
been normally read during the card acceptance. When Read Error occurs, ICRW makes retrying
for 5 times until successfully reading When Read Error still occur, ICRW sends negative response.
In case of card jamming, ICRW sends negative response too. Data on the MAG-stripe is SS-ES-
LRC, or blank, then ICRW sends negative response without retrieve
Data format of ISO ASCII code:
-Track#1(IATA): 79 characters max. (6bits+ 1parity) e.g. b0, b1, b2, b3, b4, b5,P
-Track#2(ABA): 40 characters max. (4bits+1 parity) e.g. b0, b1, b2 b3,P
-Track#3(MINTS): 107 characters max. (4bits+ 1parity) e.g. b0, b1, b2 b3,P
For example:
ISO Track #1 ISO Track #2, #3bit 5 4 3 2 1 0 bit 3 2 1 0
data=0 0 1 0 0 0 0 30H data=0 0 0 0 0 30Hdata=A 1 0 0 0 0 1 41H data=9 1 0 0 1 39H
PM=37H:Without moving the card, check if there are any data in the reading register.
Mag_Data data format:
Sn1 Sn2 Sn3
Snx =30H No data (x=1, 2, 3)
Snx =31H Have data
"C" 35H PM
"P" 35H PM st0 st1 st2 Mag_Data(n byte)
"N" 35H PM e0 e1 e2
Command
Positive response
Negative response
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 33/95
PM=40H: Without moving card, but clear the data in the reading register.
PM=51H: Upload data on ISO Track #1 by binery without moving the card
PM=52H: Upload data on ISO Track #2 by binery without moving the card
PM=53H: Upload data on ISO Track #3 by binery without moving the card
Binary read card differs from others in the sent data that it is not encoded and not checked by
ASCII code, which ignores error or right, and which is in the form of converted ASCII code by one
ASCII including 4 bits binary code. There are plenty of pre-load and suffix-load zeros in these sent
data, so ICRW will ignores these zeros during sending data
For example: data in a track: (HEX) = ‘0000 0000 0011 0111 1111 0000 0000 0011 0111 1111 0000
0000’
Data packet sent to HOST: 0x33 0x37 0x3F 0x30 0x30 0x33 0x37 0x3F
If there is no data in a track, then the length of Mag_Data is 0
9.6 Multi-MAG-Track read command9.6.1 ASCII mode read magnetic card
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 34/95
PM=31H: Read data on ISO Track #1
PM=32H: Read data on ISO Track #2
PM=33H: Read data on ISO Track #3
PM=34H: Read data on ISO Track #1,ISO Track #2
PM=35H: Read data on ISO Track #1,ISO Track #3
PM=36H: Read data on ISO Track #2,ISO Track #3
PM=37H: Read data on ISO Track #1,ISO Track #2,ISO Track #3
Mode=30H ASCII Mode
The command with the above parameters allows ICRW to transmit the data of buffer, which have
been normally read during the card acceptance. When Read Error occurs, ICRW makes retrying
for 5 times until successfully reading When Read Error still occurs, ICRW sends negative response
and error code is 21. In case of card carrying, ICRW sends negative response too. Data on the
MAG-stripe is SS-ES-LRC, or blank, then ICRW send negative response without retrieve
Data format of ISO ASCII code:
-Track#1(IATA): 79 characters max. (6bits+ 1parity) e.g. b0, b1, b2, b3, b4, b5,P
-Track#2(ABA): 40 characters max. (4bits+1 parity) e.g. b0, b1, b2 b3,P
-Track#3(MINTS): 107 characters max. (4bits+ 1parity) e.g. b0, b1, b2 b3,P
For example
ISO Track #1 ISO Track #2, #3bit 5 4 3 2 1 0 bit 3 2 1 0
data=0 0 1 0 0 0 0 30H data=0 0 0 0 0 30Hdata=A 1 0 0 0 0 1 41H data=9 1 0 0 1 39H
Response data format: ISO#1 data+7EH+ ISO#2 data+7EH+ ISO#3 data
ISO# n data:
Positive read: “P”+ track data(ASCII code excludes SS-ES-LRC)
Negative read: “N2X” , “2X” error code (“20”“23”“24”“26”“27”“28”)
Positive response:
"C" 56H PMMode
"P" 56H PM st0 st1 st2 Mag_Data (n byte)
"N" 56H PM e0 e1 e2 Mag_Data (n byte)
Command
Positive response
Negative response
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 35/95
PM=31H: "P" + ISO #1 data
PM=32H: "P" + ISO #2 data
PM=33H: "P" + ISO #3 data
PM=34H: "P" + ISO #1 data + 7EH + "P" + ISO #2 data
PM=35H: "P" + ISO #1 data + 7EH + "P" + ISO #3 data
PM=36H: "P" + ISO #2 data + 7EH + "P" + ISO #3 data
PM=37H: "P" + ISO #1 data + 7EH + "P" + ISO #2 data + 7EH + "P" + ISO #3 data
All negative response:
E1, E0: "21"
E3, E2: error code of ISO#1
E5, E4: error code of ISO#2
E7, E6 : error code of ISO#3
PM=31H: "N "+ E3, E2
PM=32H: "N" + E5, E4
PM=33H: "N" + E7, E6
PM=34H: "N "+ E3, E2 + 7EH + "N" + E5, E4
PM=35H: "N "+ E3, E2 + 7EH + "N" + E7, E6
PM=36H: "N "+ E5, E4 + 7EH + "N" + E7, E6
PM=37H: "N "+ E3, E2 + 7EH + "N" + E5, E4 + 7EH + "N" + E7,E6
9.6.2 Binery mode of reading magnetic card
"C" 36H PMMode
"P" 36H PM st0 st1 st2 Mag_Data (n byte)
"N" 36H PM e0 e1 e2 Mag_Data (n byte)
Command
Positive response
Negative response
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 36/95
PM=31H: Read data on ISO Track #1
PM=32H: Read data on ISO Track #2
PM=33H: Read data on ISO Track #3
PM=34H: Read data on ISO Track #1,ISO Track #2
PM=35H: Read data on ISO Track #1,ISO Track #3
PM=36H: Read data on ISO Track #2,ISO Track #3
PM=37H: read data on ISO Track #1,ISO Track #2,ISO Track #3
Mode=30H Binery Mode
Mag_Data will return and format is as follow:
ISO#1 + 7EH + ISO#2 + 7EH + ISO#3
Binary read card differs from others in the sent data that it is not encoded and not checked by
ASCII code, which ignores error or right, and which is in the form of converted ASCII code by one
ASCII including 4 bits binary code. There are plenty of pre-load and suffix-load zeros in these sent
data, so ICRW will ignores these zeros during sending data
For example: data in a track: (HEX) = ‘0000 0000 0011 0111 1111 0000 0000 0011 0111 1111
0000 0000’
Data packet sent to HOST: 0x33 0x37 0x3F 0x30 0x30 0x33 0x37 0x3F
For example: data in a track is blank, length of ISO#N data(N=1,2,3) is 0
PM=31H: ISO #1 data
PM=32H: ISO #2 data
PM=33H: ISO #3 data
PM=34H: ISO #1 data + 7EH + ISO #2 data
PM=35H: ISO #1 data + 7EH + ISO #3 data
PM=36H: ISO #2 data + 7EH + ISO #3 data
PM=37H: ISO #1 data + 7EH + ISO #2 data + 7EH + ISO #3 data
9.7 MAG-Track writting operation command9.7.1 Setting Hico/Loco way of writting
"C" 37H 30H Mode
"P" 37H 30H st0 st1st2
"N" 37H 30H e0 e1e2
Command
Positive response
Negative response
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 37/95
Mode=30H Loco
Mode=31H Hico
Mode=32H Auto-identification
Setting Hico/Loco setting to adapt Hico/Loco card
Notes:1. Only CRT-591 is Hico model, Hico/Loco setting will be available.2. Setting improperly will cause writing failure.3. If CRT-591 implement initialication command, the machine will setting to Hico/Loco option according
to actual model setting4. When setting auto-identification, enable Loco, otherwise, Hico.
9.7.2 MAG-Track writting for one track
"C" 37H PM DATA
"P" 37H PM st0 st1 st2 Result_data(n byte)
"N" 37H PM e0 e1 e2 Result_data(n byte)
Command
Positive response
Negative response
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 38/95
PM=31H: Write data on ISO Track #1
PM=32H: Write data on ISO Track #2
PM=33H: Write data on ISO Track #3
Transmit data part by ASCII code to ICRW. It is not necessary to add SS, ES, and LRC.
As for the write of data, a card move is performed in the state of reaching the front of MAG.
head, and then ICRW moves card through MAG. head backward, and makes verify write (done by
read operation), the verify write is performed only time in back read.
For example:
If card is in back of ICRW with card holding, ICRW carries it to front position of MAG. head,
then moves it through MAG. head to rear to write card, and makes the verify read by the reverse
direction.
If writing is done correctly, ICRW sends positive response with three results including verify
read (VF=30H)
When write error occur, ICRW retries 2 times.
when write error still occur, ICRW sends negative response with three results including verify
read, in this case, error code E1 and E0 are “22”.
In case of card jam, ICRW sends negative response.
Result structure:
Good write: “P”+“0”+ VF (3 characters)Bad write: “N”+“2X”(“20”“24”“25”“26”“27”“28”“29”)No write*: “X”+“00”
(* This track is not designated by the parameter.)
Ex) (1)#1 good
Positive response “P0”+ “0” + 7EH +“X00”+ 7EH + “X00”
(2) #2 bad
Negative response “N”+ “2X” + 7EH +“X00”+ 7EH + “X00”
(error code E1 and E0 : “22”)
9.7.3 MAG-Track write download for one track
"C" 37H PM DATA
"P" 37H PM st0 st1st2
Command
Positive response
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 39/95
PM=36H: Download data to ISO Track #1 buffer
PM=37H: Download data to ISO Track #2 buffer
PM=38H: Download data to ISO Track #3 buffer
This is to write the data to ISO track buffer, but ICRW does not write card.
All the stored data are cleared when card is eject.
All the stored data are cleared when ICRW received initialize command(“C56”)
9.7.4 MAG-Track writting simultaneity
"N" 37H PM e0 e1e2
"C" 37H PM
"P" 37H PM st0 st1 st2 Result_data(n byte)
"N" 37H PM e0 e1 e2 Result_data(n byte)
Negative response
Command
Positive response
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 40/95
PM=39H: All three tracks simultaneous write
ICRW write data to the card from the buffer.
Before writing operation, ICRW need to write data to the buffer.
If there is no data in buffer, ICRW sends back error code”02”.
As for the write of data, a card move is performed in the state of reaching the front of MAG.
head, and then ICRW moves card through MAG. head backward, and makes verify write (done by
read operation), the verify write is performed only time in back read.
For example:
If card is in back of ICRW with card holding, ICRW carries it to front position of MAG. head,
then moves it through MAG. head to rear to write card, and makes the verify read by the reverse
direction.
If writing is done correctly, ICRW sends positive response with three results including verify
read (VF=30H)
When write error occur, ICRW retries 2 times.
When write error still occurs, ICRW sends negative response with three results including verify
read, in this case, error code E1 and E0 are “22”.
In case of card jamming, ICRW sends negative response.
Result structure:
Good write: “P”+“0”+ VF (3 characters)Bad write: “N”+“2X”(“20”“24”“25”“26”“27”“28”“29”)No write*: “X”+“00”
(* This track is not designated by the parameter.)
Ex)
(1)#1 good, #2 good, #3 good
Positive response “P0”+ “0” + 7EH +“P0”+“0”+ 7EH + “P0”+“0”
(2) #1 good, #2 bad, #3 no write
Negative response “P0”+ “0” + 7EH +“N”+“2X”+ 7EH + “X00”
(Error code E1 and E0 : “22”)
PM=40H: without writing, but clear the buffer
9.7.5 MAG-Track writting by binery
"C" 37H PM Mag_Data(n byte)
"P" 37H PM st0 st1 st2
Negative response
Command
Positive response
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 41/95
PM=51H: Write binary data from HOST to ICRW buffer by ASCII code, and then write the data
on ISO Track #1
PM=52H: Write binary data from HOST to ICRW buffer by ASCII code, and then write the data
on ISO Track #2
PM=53H: Write binary data from HOST to ICRW buffer by ASCII code, and then write the data
on ISO Track #3.
All the binary data in any track are in the form of converted ASCII code by one ASCII including 4
bits binary code.
For example: slice data in a track: (HEX) = ‘0011 0111 1111’
slice data packet sent to HOST: 0x33 0x37 0x3F
As for the write of data, a card move is performed in the state of reaching the front of MAG. head,
and then ICRW moves card through MAG. head backward, and makes verify write (done by read
operation), the verify write is performed only time in back read.
Verify write in binary mode differs from others, ICRW will compare the read binary data from being
“1” with the written data bits until comparing all the write data, it is right to pass all the verify, or
else it is bad.
Two special error codes for binary verify write:
“80”:do not find the data “1”
“81”:it is bad in the compare
If writing is done correctly, ICRW sends positive response to HOST.
When write error occurs, ICRW retries 2 times (including verify write).
when write error still occurs, ICRW sends negative response with three results including verify
read, in this case, error code E1 and E0 are “22”,”80” and “81”
In case of card jamming, ICRW sends negative response.
9.8 Auto-Check ICCard/RFCard Type:
9.8.1 Auto-Check ICCard Type:Command
Positive response
"N" 37H PM e0 e1 e2
“C” 50H 30H
“P” 50H 30H st0 st1 st2 Card_type
Negative response
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 42/95
Negative response
Auto-Check type of IC Card, and carry card to IC Card position,Auto Check IC Card Type,Return Card_type information.
Cart_type(2 byte) Specification‘0’ ‘0’ Unknown IC Card Type‘1’ ‘0’ T=0 CPU Card
‘1’ T=1 CPU Card‘2’ ‘0’ SLE4442 Card
‘1’ SLE4428 Card‘3’ ‘0’ AT24C01 Card
‘1’ AT24C02 Card‘2’ AT24C04 Card‘3’ AT24C08 Card‘4’ AT24C16 Card‘5’ AT24C32 Card‘6’ AT24C64 Card‘7’ AT24C128 Card‘8’ AT24C256 Card
“N” 50H 30H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 43/95
9.8.2 Auto-Check RF Card Type: Command
Positive response
Negative response
Auto-Check type of RF card, carry card to RF card position , Auto-Check RF Card Type, Return
Card_type information
Cart_type(2 byte) Specification‘0’ ‘0’ UnknowRFCardType‘1’ ‘0’ Mifare one S50Card
‘1’ Mifare one S70Card‘2’ Mifare one ULCard
‘2’ ‘0’ Type A CPUCard‘3’ ‘0’ Type B CPUCard
“C” 50H 31H
“P” 50H 31H st0 st1 st2 Card_type
“N” 50H 31H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 44/95
9.9 CPUCard Operation9.9.1 CPUCard Reset
Command
Positive response
Negative response
To cold reset IC card. The ICRW supplies power (VCC) and clock (CLK) , return ATR.
Vcc=30H: CRT-591 supplies with +5V to VCC and activates in line with the EMV2000 ver4.0.
Vcc=33H: CRT-591 supplies with +5V to VCC and activates in line with the ISO/IEC7816-3.
Vcc=35H: CRT-591 supplies with +3V to VCC and activates in line with the ISO/IEC7816-3.
In case there is no Vcc word, it will have 30H as default value.
If ATR is not compliance to EMV, return e1,e0=“69”Notes: There will be error and return ATR & Type when reset in line with EMV return
Type: CPU Card protocol Type
=30H T=0 protocol CPUCard
=31H T=1 protocol CPUCard
Formate of ATR
TS TO TA1 TB1 … TCK
“C” 51H 30H Vcc
“P” 51H 30H st0 st1 st2 Type ATR
“N” 51H 30H e0 e1 e2 Type ATR
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 45/95
9.9.2 Deactivate CPU CommandCommand
Positive response
Negative response
This deactivates CPU card.
9.9.3 Inquire CPU Card Status:Command
Positive response
Negative response
ICRW tells the status of IC card with sti.
St i=30H Card not activated
=31H Card have activated, current CPU Card working frequency is 3.57 MHZ
=32H Card have activated, current CPU Card working frequency is 7.16 MHZ
If ICCard power error, return e1,e0=“60”.
“C” 51H 31H
“P” 51H 31H st0 st1 st2
“N” 51H 31H e0 e1 e2
“C” 51H 32H
“P” 51H 32H st0 st1 st2 Sti
“N” 51H 32H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 46/95
9.9.4 CPU Card Communication T=0Command
Positive response
Negative response
This exchanges data between CPU card by protocol T=0
C-APDU from HOST is range from 4 byte to 261 byte
R-APDU to HOST is range from 2 byte to 258 byte
An error “60” is returned when a power failure is detected.
If protocol type of IC card is not T=0, error code “62”is sent.
If ICC does not respond within Working Wait Time, CRT-591 deactivates an IC card and error code
“63” is sent.
If any other protocol error occurs, CRT-591 deactivates an IC card and error code “64” is sent.
If HOST tries to communicate before an IC card activation, error code “65” is sent.
Note: If you want to more about T=0 APDU format. Plese refer to ISO/IEC7816-3 and COS
command
“C” 51H 33H C-APDU
“P” 51H 33H st0 st1 st2 R-APDU
“N” 51H 33H e0 e1 e2
CLA INS P1 P2 LC Data1 …… Le
Data1 ….. Data(n) Sw1 Sw0
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 47/95
9.9.5 CPU Card Communication T=1Command
Positive response
Negative response
This exchanges data between CPU card by protocol T=1
CRT-591 should follow T=1 protocol to combinate C-APDU as I-block and send it to CPU
card.CPU card should return R-APDU to HOST
C-APDU
I-block
CRT-591 returns “R-APDU”data to HOST
I-block
R-APDU
An error “60” is returned when a power failure is detected.
If protocol type of IC card is not T=0, error code “62”is sent.
If ICC does not respond within Working Wait Time, CRT-591 deactivates an IC card and error
code “63” is sent.
If any other protocol error occurs, CRT-591 deactivates an IC card and error code “64” is sent.
If HOST tries to communicate before an IC card activation, error code “65” is sent.
Note: If you want to more about T=0 APDU format. Plese refer to ISO/IEC7816-3 and COS
command
“C” 51H 34H C-APDU
“P” 51H 34H st0 st1 st2 R-APDU
“N” 51H 34H e0 e1 e2
CLA
INS
P1
P2
Lc
Data1
… Data(Lc)
Le
NAD PCB LEN CLA INS P1 P2 Lc Data1
… Data(Lc)
Le EDC
Head block Information block End block
Head block Information block End blockNAD PCB LEN CLA INS P1 P2 Lc Data
1… Data(Lc
)Le EDC
CLA INS P1 P2 Lc Data1
… Data(Lc)
Le
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 48/95
9.9.6 CPU Warm ResetCommand
Positive response
Negative response
“N” 51H 38H e0 e1 e2
Keeping the status of the IC contact activated, then returns response upon receiving “ATR” again.
Type: CPU Card communication protocol
=30H T=0 Protocol
=31H T=1 Protocol
9.9.7 T=1, T=0 CPU Card Protocol Automatic CommunicationCommand
Positive response
Negative response
“N” 51H 39H e0 e1 e2
Protocol is recognized automatically. Set Data to “C-APDU”. CRT-591 returns “R-APDU” data to
HOST.
An error “60” is returned when a power failure is detected.
If protocol type of IC card is not T=0, error code “62”is sent.
If ICC does not respond within Working Wait Time, CRT-591 deactivates an IC card and error code
“63” is sent.
If any other protocol error occurs, CRT-591 deactivates an IC card and error code “64” is sent.
If HOST tries to communicate before an IC card activation, error code “65” is sent.
“C” 51H 38H
“P” 51H 38H st0 st1 st2 Type ATR
“C” 51H 39H C-APDU
“P” 51H 39H st0 st1 st2 R-APDU
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 49/95
9.10 SAM(Secure Application Module) Control Command9.10.1 Active SAM Command
Command
Positive response
Negative response
The CRT-591 supplies power (VCC) and clock (CLK), then reset (RST) release.
Type: SAM protocol type
=30H T=0 protocol
=31H T=1 protocol
ATR(Answer To Reset) format:TS TO TA1 TB1 … TCK
Vcc=30H: ICRW supplies with +5V to VCC and activates in line with the EMV2000 ver4.0.
Vcc=33H: ICRW supplies with +5V to VCC and activates in line with the ISO/IEC7816-3.
Vcc=35H: ICRW supplies with +3V to VCC and activates in line with the ISO/IEC7816-3.
Incase there is no Vcc, it will have 30H as default value
If ATR is not compliance to EMV, return e1,e0=“69”Notes: There will be error and return ATR & Type when reset in line with EMV return
When a power failure is recognized while a power supply is supplied to the card, error code "60" is
returned.
9.10.2 Deactivate SAM CommandCommand
Positive response
Negative response
This deactivates SAM
“C” 52H 30H Vcc
“P” 52H 30H st0 st1 st2 Type ATR
“N” 52H 30H e0 e1 e2 Type ATR
“C” 52H 31H
“P” 52H 31H st0 st1 st2
“N” 52H 31H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 50/95
9.10.3 Inquire SAM Status CommandCommand
Positive response
Negative response
CRT-591 returns the status of SAM with sti. stj
Sti =30H SAM is deactivated
Sti =31H SAM is activated, working frequency is 3.57 MHZ
Sti =32H SAM is activated, working frequency is 7.16 MHZ
Stj =30H First SAM card connector
Stj =31H Second SAM card connector (Optional)
Stj =32H Third SAM card connector (Optional)
Stj =33H Fourth SAM card connector (Optional)
Stj =34H Fifth SAM card connector (Optional)
An error “60” is returned when a power failure is detected.
“C” 52H 32H
“P” 52H 32H st0 st1 st2 Sti Stj
“N” 52H 32H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 51/95
9.10.4 SAM Communication T=0Command
Positive response
Negative response
This exchanges data between SAM by protocol T=0
If protocol type of IC card is not T=0, error code “62”is sent.
If ICC does not respond within Working Wait Time, CRT-591 deactivates an IC card and error code
“63” is sent.
If any other protocol error occurs, CRT-591 deactivates an IC card and error code “64” is sent.
If HOST tries to communicate before an IC card activation, error code “65” is sent.
Note: If you want to more about T=0 APDU format. Plese refer to ISO/IEC7816-3 and COS command
9.10.5 SAM Communication T=1Command
Positive response
Negative response
This exchange data between SAM by protocol T=1
If protocol type of IC card is not T=0, error code “62”is sent.
If ICC does not respond within Working Wait Time, CRT-591 deactivates an IC card and error code
“63” is sent.
If any other protocol error occurs, CRT-591 deactivates an IC card and error code “64” is sent.
If HOST tries to communicate before an IC card activation, error code “65” is sent.
Note: If you want to more about T=1 APDU format. Plese refer to ISO/IEC7816-3 and COS command
“C” 52H 33H C-APDU
“P” 52H 33H st0 st1 st2 R-APDU
“N” 52H 33H e0 e1 e2
“C” 52H 34H C-APDU
“P” 52H 34H st0 st1 st2 R-APDU
“N” 52H 44H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 52/95
9.10.6 SAM Warm ResetCommand
Positive response
Negative response
Keeping the status of the SAM activated, then returns response upon receiving.
Type: SAM protocol type
=30H T=0 Protocol
=31H T=1 Protocol
9.10.7 Auto-Check SAM Card T=0/T=1 Protocol Command
Positive response
Negative response
If protocol type of IC card is not T=0, error code “62”is sent.
If ICC does not respond within Working Wait Time, CRT-591 deactivates an IC card and error code
“63” is sent.
If any other protocol error occurs, CRT-591 deactivates an IC card and error code “64” is sent.
If HOST tries to communicate before an IC card activation, error code “65” is sent.
“C” 52H 38H
“P” 52H 38H st0 st1 st2 Type ATR
“N” 52H 38H e0 e1 e2
“C” 52H 39H C-APDU
“P” 52H 39H st0 st1 st2 R-APDU
“N” 52H 39H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 53/95
9.10.8 Select SAMCommand
Positive response
Negative response
HOST can select SAM 1,2,3,4 or 5.
Sel = 30H: SAM 1.
Sel = 31H: SAM 2. (option)
Sel = 32H: SAM 3. (option)
Sel = 33H: SAM 4. (option)
Sel = 34H: SAM 5. (option)
SAM command is effective only in the module selection.
When Initialize command is executed, SAM 1 will be selected.
“C” 52H 40H SAMn
“P” 52H 40H st0 st1 st2
“N” 52H 40H e0 e1 e1
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 54/95
9.11 SLE4442/4428 Control9.11.1 SLE4442/4428 Reset
Command
Positive response
Negative response
The CRT-591 supplies power (VCC) and clock (CLK), then reset (RST) release. After reset, return
ATR.
ATR: SLE4442 Card ATR=“A2H,13H,10H,91H”SLE4442 Card ATR=“92H,23H,10H,91H”
9.11.2 Deactivate SLE4442/4428 Command
Positive response
Negative response
The CRT-591 stop suppling power (VCC) and clock (CLK), then reset (RST) release.
“C” 53H 30H
“P” 53H 30H st0 st1 st2 ATR(4 byte)
“N” 54H 30H e0 e1 e2
“C” 53H 31H
“P” 53H 31H st0 st1 st2
“N” 53H 31H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 55/95
9.11.3 Inquire status of SLE4442/4428 Command
Positive response
Negative response
CRT-591 tell the status of SLE4442/4428 with Sti after the command successfully execute.
Sti= 30H SLE4442/4428 Deactivated
Sti= 31H SLE4442 Activated
Sti= 32H SLE4428 Activated
“C” 53H 32H
“P” 53H 32H st0 st1 st2 Sti
“N” 54H 32H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 56/95
9.11.4 SLE4442 ControlThese functions are specified by a command data form like C-APDU which format is based on
T=0 standard.
In this case, CRT-591 recognizes the meaning of the command data, and executes the treatment
related to the card by controlling hardware.
After the command was executed properly, CRT-591 returns a positive response with response
data 9000H like from the IC card. When an error occurs during the communication with
SLE4442, CRT-591 returns a positive response with status information in response data
"sw1+sw2” which is base on ISO/IEC 7816-3
Sw1 Sw2 Specification
90H 00H Success
6FH 00H Fail
6FH 01H Key Validation error
6FH 02H Key Validation error and Lock
67H 00H Address overflow
6BH 00H Operation length overflow
9.11.4.1. Data read from main memory on SLE4442Command
Positive response
Negative response
Notes: ab H: the start address to read data in the main memory
cd H: the length of bytes of data to read
CRT-591 reads data from the main memory of SLE4442, and transmits data on cdH bytes from the
address abH.
The capacity of the main memory is 256 bytes.
All the contents of the main memory can be read with the following command.
Ex) "CR3"+00B0000000
9.11.4.2. Data read from protection memory on SLE4442
“C” 53H 33H 00H B0H 00H abH cdH
“P” 53H 33H st0 st1 st2 data
“N” 53H 33H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 57/95
Command
Positive response
Negative response
Notes: ab H: the start address to read data in the main memory
cd H : the length of bytes of data to read
CRT-591 handles the data of all 32bits in the protection memory as the data on 4bytes.
The contents (32bit) of the protection memory can be read with the following command.
Ex) "CR3"+00B0010004
“C” 53H 33H 00H B0H 01H abH cdH
“P” 53H 33H st0 st1 st2 data
“N” 53H 33H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 58/95
9.11.4.3 Data read from security memory on SLE4442Command
Positive response
Negative response
Notes: ab H: the start address to read data in the main memory
cd H : the length of bytes of data to read
CRT-591 handles the data of all 32bits in the security memory as the data on 4bytes.
The contents (32bit) of the security memory can be read with the following command.
Ex) "CR3"+00B0020004
9.11.4.4 Data write to main memory on SLE4442Command
Positive response
Negative response
Notes: ab H: the start address to write data in the main memory
cd H : the length of bytes of data to write
ef H : the data to write first (cd H bytes)
Before write to main memory, the validation of key is must..
The capacity of the main memory is 256 bytes. The byte number "00" of data to write means
256bytes.
The example that data are written in the whole area of the main memory is shown in the following.
Ex) "CR3"+ 00D0000000 + Write Data (256byte)
After command execution, CRT-591 returns response with 9000H or sw1+sw2 as the result.
If the addressed data on main memory is protected by the protect status, Data is not allow.
“C” 53H 33H 00H B0H 02H abH cdH efH…
“P” 53H 33H st0 st1 st2 data
“N” 53H 33H e0 e1 e2
“C” 53H 33H 00H D0H
00H abH cdH efH…
“P” 53H 33H st0 st1 st2 data
“N” 53H 33H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 59/95
9.11.4.5 Data write to protection memory on SLE4442Command
Positive response
Negative response
Notes: ab H: the start address to write data in the main memory
cd H: the length of bytes of data to write
ef H: the data to write first (cd H bytes)
Before write to the memory, the validation of key is must..
The address of the main memory that the protection is possible is 1Fh from 00h. Each protection
condition of the protectable main memory can be controlled with 4byte (32bits) in the protection
memory. For example, if bit0 of the protection memory byte0 is '1', data on the address 00H of the
main memory are protected.
The content of protect status can not be change once setting protection.
For exampe: write 20H data to 10H address and set up protection
Ex) “CR3”+00D001100120
After command execution, CRT-591 returns with 9000H or sw1+sw2 as the result.
ICRW reads data first from the main memory, and it is compared with the value that it was
received.
When this is wrong, writing isn't begun.
Protection condition can be set up at one time in the data which continued in the main memory.
“C” 53H 33H 00H D0H
01H abH cdH efH…
“P” 53H 33H st0 st1 st2 data
“N” 53H 33H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 60/95
9.11.4.5 Data write to security memory on SLE4442Command
Positive response
Negative response
Notes: ab H : the start address to write data in the main memory
cd H : the length of bytes of data to write
ef H : the data to write first (cd H bytes)
After a password check is finished normally, the Reference-Data area of 3byte can be changed.
All 32bits are handled as 4bytes. How to change the Reference-Data is as the following.
Ex) "CR3"+ 00D0020103123456
After command execution, ICRW returns response with 9000H or sw1+sw2 as the result.
Notes: Better not to write, because the Error-counter is always allowed to write and easily make
error. Error-Counter is controlled when password is checked.
“C” 53H 33H 00H D0H
02H abH cdH efH…
“P” 53H 33H st0 st1 st2 data
“N” 53H 33H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 61/95
9.11.4.6 Verification data present to SLE4442Command
Positive response
Negative response
Notes: ef H: the data to compare (3bytes)
Before changing data, password must be check
Because this function should be made effective, the issue of the next command is necessary.
Ex) “CR3”+0020030103xxxxxx (xxxxxx: security code 3bytes)
Card will verify password between card and command.
A user must know password at least when a user wants to rewrite the data on SLE4442 card.
Error-Counter can be reset in the zero if password is given to SLE4442 card properly if the value
of Error-Counter is 2 or less.
“C” 53H 33H 00H 20H 03H 01H 03H efH…
“P” 53H 33H st0 st1 st2 data
“N” 53H 33H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 62/95
9.11.5 SLE4428 ControlThese functions are specified by a command data form like C-APDU which format is based on
T=0 standard.
In this case, CRT-591 recognizes the meaning of the command data, and executes the treatment
related to the card by controlling hardware.
After the command was executed properly, CRT-591 returns a positive response with response
data 9000H like from the IC card. When an error occurs during the communication with SLE4442,
CRT-591 returns a positive response with status information in response data "sw1+sw2” which is
base on ISO/IEC 7816-3
Sw1 Sw2 Specification
90H 00H Success
6FH 00H Fail
6FH 01H Key Validation error
6FH 02H Key Validation error and Lock
6BH 00H Address overflow
67H 00H Operation length overflow
9.11.5.1 Data Reading of main-memory of SLE4428Command
Positive response
Negative response
Notes: abc H: the start address to read data in the main memory
de H: the number of bytes of data to read
CRT-591 read data from main memory of SLE4428 through abcH and deH
The capacity of the main memory is 1024bytes.
De="00"
Data to read means 256bytes.
The head part of the main memory can be read with the following command.
Ex) "CR4"+00B0000000
“C” 53H 34H 00H B0H 0aH bcH deH
“P” 53H 34H st0 st1 st2 data
“N” 53H 34H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 63/95
9.11.5.2 Reading of protection-bit of SLE4428Command
Positive response
Negative response
Notes: ab H: the start address to read the image of protection data of the main memory
cd H: the number of bytes of data to read
The protection conditions of 1024bytes of main-memory are changed into the data on 1024bits, and
it is read.
1024bits is equivalent to 128bytes. (1024 = 128 x 8)
Data to read first become protection information to address (000H-007H) of main-memory in the
case of abH=00H.
The contents of the whole protection image can be read with the following command.
Ex) "CR4"+00B0100080
CRT-591 read protection-bit of SLE4428 according to abH
“C” 53H 34H 00H B0H 10H abH cdH
“P” 53H 34H st0 st1 st2 data
“N” 53H 34H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 64/95
9.11.5.3 Data writing to main-memory of SLE4428Command
Positive response
Negative response
Notes: abc H: the start address to write data in the main memory
de H : the number of bytes of data to write
fg H : the data to write first (de H bytes)
CRT-591 writes data in the main memory. CRT-591 returns a result after written data are checked.
Before doing this operation, password check must be done
The capacity of the main memory is 1024 bytes.
The example that data are written in from the address 100H is shown in the following.
Ex) "CR4"+ 00D0010000 + Write Data (256byte)
After command execution, ICRW returns response with 9000H or sw1+sw2 as the result.
If the addressed data on main memory is protected, the write operation is not available.
9.11.5.4 Data writing to main-memory of SLE4428 with protectingCommand
Positive response
Negative response
Notes: abc H: the start address to write data in the main memory
de H: the number of bytes of data to write
fg H: the data to write first (de H bytes)
CRT-591 writes data in the main memory. CRT-591 returns a result after written data are checked.
Before doing this operation, password check must be done
“C” 53H 34H 00H D0H 0aH bcH deH fgH…
“P” 53H 34H st0 st1 st2 data
“N” 53H 34H e0 e1 e2
“C” 53H 34H 00H D0H
1aH bcH deH fgH…
“P” 53H 34H st0 st1 st2 data
“N” 53H 34H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 65/95
9.11.5.5 Written with protection-bitCommand
Positive response
Negative response
Notes: abc H: the start address to write data in the main memory
de H: the number of bytes of data to write
fg H: the data to write first (de H bytes)
Before doing this operation that writing data with protection-bit, password check must be done
After command execution, ICRW returns response with 9000H or sw1+sw2 as the result.
CRT-591 reads data first from the main memory, and it is compared with the value that it was
received.
When this is wrong, writing isn't begun. Protection condition can be set up at a time in the data
which continued in the main memory.
9.11.5.6 Verification of password present to SLE4428Command
Positive response
Negative response
Notes: ef H : the data to compare (2bytes)
Before changing data, Password must be checked properly with SLE4428.
Because this function should be made effective, the issue of the next command is necessary.
Ex) "CR4"+ 0020000002xxxx (xxxx: security code 2bytes)
The presented data are compared with internal data in SLE4428 card itself.
User should know the password of cad if they want to change the data in SLE4442, Error-Counter
can be reset in the zero from 7 or less than 7. When error-counter is reset as zero, lock the card.
“C” 53H 34H 00H D0H
2aH bcH deH fgH…
“P” 53H 34H st0 st1 st2 data
“N” 53H 34H e0 e1 e2
“C” 53H 34H 00H 20H 00H 00H 02H efH…
“P” 53H 34H st0 st1 st2 data
“N” 53H 34H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 66/95
9.12 I2C Memory Card Control Command9.12.1 Activate I2C memory card
Command
Positive response
Negative response
To activate (24C01, 24C02, 24C04, 24C08, 24C16, 24C32, 24C64, 24C128,2 4C256) card
CRT-591 supplies a power supply (Vcc), Clock (CLK), Reset (RST).
Including:
Wrd set I2C type
Wrd =30 H To activate(24C01,24C02,24C04,24C08,24C16,24C32,24C64,24C128,24C256) card
Vcc choose voltage to card
Vcc=30H 5V
Vcc=31H 3V
Sti return I2C card type successfully
Sti =31 H To activate 24C01card
Sti =32 H To activate 24C02 card
Sti =33 H To activate 24C04 card
Sti =34 H To activate 24C08 card
Sti =35 H To activate 24C16 card
Sti =36 H To activate 24C32 card
Sti =37 H To activate 24C64 card
Sti =38 H To activate 24C128 card
Sti =39 H To activate 24C256 card
Vcc is optional parameter, no Set parameter in command is equal to Set=30H
9.12.2 Deactivate I2C memory card
“C” 54H 30H Wrd Vcc
“P” 54H 30H st0 st1 st2
“N” 54H 30H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 67/95
Command
Positive response
Negative response
CRT-591 stop suppling a power supply (Vcc), Clock(CLK), Reset(RST).
“C” 54H 31H
“P” 54H 31H st0 st1 st2
“N” 54H 31H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 68/95
9.12.3 Inquire Status of I2C memory cardCommand
Positive response
Negative response
This command is used to inquire status of I2C card and return status by Sti.
Sti meanings:
Sti=30 H No I2C be activated
Sti=31 H Activated 24C01
Sti=32 H Activated 24C02
Sti=33 H Activated 24C04
Sti=34 H Activated 24C08
Sti=35 H Activated 24C16
Sti=36 H Activated 24C32
Sti=37 H Activated 24C64
Sti=38 H Activated 24C128
Sti=39 H Activated 24C256
9.12.4 I2C Control
“C” 54H 32H
“P” 54H 32H st0 st1 st2 Sti
“N” 54H 32H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 69/95
These functions are specified by a command data form like C-APDU which format is based on T=0
standard.
In this case, CRT-591 recognizes the meaning of the command data, and execute the treatment
related to the card by controlling hardware.
After the command was executed properly, CRT-591 returns a positive response with response data
9000H like from the IC card. When an error occurs during the communication with I2C, CRT-591
returns a positive response with status information in response data "sw1+sw2” which is base on
ISO/IEC 7816-3Sw1 Sw2 Specification90H 00H Success6FH 00H Fail6BH 00H Address overflow67H 00H Operation length overflow
Write/Read I2C and Address scope is showed below:Card_type ab,cd24C01 0000H ~ 007FH24C02 0000H ~ 00FFH24C04 0000H ~ 01FFH24C08 0000H ~ 03FFH24C16 0000H ~ 07FFH24C32 0000H ~ 0FFFH24C64 0000H ~ 1FFFH24C128 0000H ~ 3FFFH24C256 0000H ~ 7FFFH
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 70/95
9.12.4.1 Read data from I2CCommand
Positive response
Negative response
Value: ab H : The upper address of head address which begins to read data
cd H : The lower address of head address which begins to read data
ef H : The number of bytes of data to read
CRT-591 read efH length and returns to HOST according to address specified by abH,
cdH.Thelength of efH can not be surpass the length of I2C address up limit.
When the following command is transmitted, data can be read from the I2C memory card.
Ex) "CU3"+00B000000
9.12.4.2 Write data to I2CCommand
Positive response
Negative response
This command is recognized as follows.
ab H: The upper address of head address which begins to write data
cd H: The lower address of head address which begins to write data
ef H: The number of bytes of data to write
gh H: the data to write first (the head data of the data on ef H bytes)
CRT-591 read efH length and return to HOST according to address specified by abH, cdH.The
length of efH can not be surpass the length of I2C address up limit.
The example which data on 8bytes are written into I2C
Ex) "CU3"+ 00D0000008 + Write Data (8bytes)
After command execution, ICRW returns response with 9000H or sw1+sw2 as the result.
“C” 54H 33H 00H B0H abH cdH efH
“P” 54H 33H st0 st1 st2 Data
“N” 54H 33H e0 e1 e2
“C” 54H 34H 00H D0H
abH cdH efH ghH…
“P” 54H 34H st0 st1 st2 Data
“N” 54H 34H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 71/95
9.13 Contactless IC card Operation 9.13.1 Activated contackless IC card
Command
(1) Mifare One Card Positive Response
Mifare One Dard Negative Response
(2) 14443 Type A Card Positive Response
14443 Type A Card Negative Response
(3) 14443 Type B Card Positive Response
14443 Type b Card Negative Response
Activate RFID card
CRT-591 support activated IEC/ISO14443 Type A and IEC/ISO 14443 Type B
The process is show as below:
1).Mifare one card: 1. Request A (REQ A) / Answer Request A (ATQ A).
2.Anticollision
3.Select (SEL) / Unique Identifier (UID) & Select
Acknowledge (SAK)
When Mifare card successfully activate, CRT-591return:
ATQA( 2 byte), UID_data (4—10 byte) and SAK( 1 byte).
2).ISO/IEC 14443 Type A: 1. Request A( REQ A) / Answer Request A (ATQ A).
2.Anticollision
3. Select (SEL) / Unique Identifier (UID) & Select
Acknowledge (SAK)
4. Request for answer to select (RATS) / Answer to
Select (ATS)
Protocol and parameter selection request (PPSR) / PPS start(PPSS)
“C” 60H 30H Set1 Set2
“P” 60H 30H st0 st1 st2 Rtype ATQA UID_len UID_data SAK
“N” 60H 30H e1 e0 Rtype ATQA UID_len UID_data SAK
“P” 60H 30H st0 st1 st2 Rtype ATQA UID_len UID_data SAK ATS
“N” 60H 30H e0 e1 e2 Rtype ATQA UID_len UID_data SAK ATS
“P” 60H 30H st0 st1 st2 Rtype ATQB
“N” 60H 30H e0 e1 e2 Rtype ATQB
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 72/95
When ISO/IEC 14443 Type A card successfully activated, CRT-591 return:
Mifare card return value increase (ATS (1-254 byte) and protocol parameter (1 byte))
3).ISO/IEC 14443 Type B: 1. Request B( REQ B) / Answer Request B (ATQ B).
2. Attribute (A TTRIB) / Answer to ATTRIB
When ISO/IEC 14443 Type B card successfully activated, CRT-591 return ATQB 12
byte(including following information):
50H, PUPI (4 byte) , App.data(4 byte), Protoclol info(3 byte)
Notes:
Set1, Set2 set sequence of operation for different type of protocol
Valid value: 41H (‘A’= Type A ),42H(‘B’= Type B ), 30H( ‘0’= Do not use)
Ex1:Set1=‘A’,Set2 =‘B’ (default)
Activate sequence: Type A protocol (first sequence), Type B protocol (second sequence)
Ex2:Set1=‘B’,Set2 =‘A’ Activate sequence: Type B protocol (first sequence), Type A protocol (second sequence)
Ex3:Set1=‘A’,Set2 =‘0’ Activate sequence: Type A protocol (first sequence), Type B protocol (Deactivated)
Ex4:Set1=‘B’,Set2 =‘0’,
Activate sequence: Type B protocol (first sequence), Type A protocol (Deactivated)
Rtype: Protocol
= 41H (‘A’) In line with ISO/IEC 14443 Type A protocol
= 42H (‘B’) In line with ISO/IEC 14443 Type B protocol
= 4DH (‘M’) In line with Philps Mifare one card protocol
When Rtype= 4DH (‘M’)
ATQA= 0044H Mifare Ultralight Card
ATQA= 0004H Mifare S50 1K Card
ATQA= 0002H Mifare S70 4K Card
Mifare one, ISO/IEC 14443 Type A return UID (The length of UID_data)
UID_len=4 The length of UID_data is 4 byte
UID_len=7 The length of UID_data is 7 byte
UID_len=10 The length of UID_data is10 byte
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 73/95
9.13.2 Deactivate RFID cardCommand
Positive response
Negative response
Deactivate RFIN card and Output signal to antanna is closed.
9.13.3 Inquire status of RFID cardCommand
Positive response
Negative response
Inquire status of RFID sti,stj: sti stj Specification‘0’ ‘0’ Deactivated RF‘1’ ‘0’ Mifare one S50 card
‘1’ Mifare one S70 card‘2’ Mifare one UL card
‘2’ ‘0’ Type A CPU card ‘3’ ‘0’ Type B CPU card
“C” 60H 31H
“P” 60H 31H st0 st1 st2
“N” 60H 31H e0 e1 e2
“C” 60H 32H
“P” 60H 32H st0 st1 st2 sti stj
“N” 60H 32H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 74/95
9.13.4 Mifare 1 card controlThese functions are specified by a command data form like C-APDU which format is based on T=0
standard.
In this case, CRT-591 recognizes the meaning of the command data, and executes the treatment
related to the card by controlling hardware.
After the command was executed properly, CRT-591 returns a positive response with response data
9000H like from the IC card. When an error occurs during the communication with Mifare 1 card
CRT-591 returns a positive response with status information in response data "sw1+sw2” which is
base on ISO/IEC 7816-3.
Sw1 Sw2 Specification90H 00H Success6FH 00H Fail6BH 00H Address overflow67H 00H Operation length overflow
9.13.4 Key verificationCommand
Positive response
Negative response
Download key to CRT-591 and verify the key directly
ks(1byte): key select (Key A=00H,Key B=01H)
sn (1byte): sector number (S50 card sn=00H-0FH, S70 card sn=00H-27H)
lc (1byte): password length lc=06H
pdata (6 byte): password data
rdata (2 byte): return data( positive response with data 9000H, and negtive response with “
sw1+sw2”)
9.13.4.2 Verify key from EEPROM
“C” 60H 33H 00H 20H ks sn lc pdata
“P” 60H 33H st0 st1 st2 rdata
“N” 60H 33H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 75/95
Command
Positive response
Negative response
Read key from EEPROM of RF module and verify the sector key
Download key via command mentioned in 9.10.4.4
EEPROM can preserve 32 groups of key data
ks(1byte): key select (Key A=00H,Key B=01H)
sn (1byte): sector number (sn=00H-0FH)
rdata (2 byte): return data ( positive response with 9000H)
“C” 60H 33H 00H 21H ks sn
“P” 60H 33H st0 st1 st2 rdata
“N” 60H 33H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 76/95
9.13.4.3 Modify sector key (KEY A)Command
Positive response
Negative response
Modify sector key (key A)
This command only can modify KEY A, an d modify KEY B as“0xFF, 0xFF, 0xFF,0xFF,0xFF,0xFF
in the mean timemodify control words as“0xFF, 0x07, 0x80, 0x69” (ex-work default)
Use block command to modify Key A, Key B control word
sn(1byte): sector number (S50 card sn=00H-0FH, S70 card sn=00H-27H)
lc(1byte): password length lc=06H
pdata: password data 6 byte.
rdata(2 byte): return data
(Positive response with data 9000H, and negtive response with “ sw1+sw2”)
“C” 60H 33H 00H D5H 00H sn lc pdata
“P” 60H 33H st0 st1 st2 rdata
“N” 60H 33H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 77/95
9.13.4.4 Download password to EEPROMCommand
Positive response
Negative response
Read key from EEPROM of RF module and verify the sector key
EEPROM can preserve 32 groups of key data
ks(1byte): key select (Key A=00H, Key B=01H)
sn (1byte): sector number (sn=00H-0FH)
lc (1byte): password length lc=06H
pdata (6 byte): password data
rdata (2 byte): return data.
Positive response sw1+sw2=9000H.
Negtive response sw1+sw2=6F00H
“C” 60H 33H 00H D0H ks sn lc pdata
“P” 60H 33H st0 st1 st2 rdata
“N” 60H 33H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 78/95
9.13.4.4 Read sector dataCommand
Positive response
Negative response
Read block and sequence blocks from RF card
sn (1 byte): sector number
bn (1 byte): block number
le (1 byte): block number (le=01H read one block, le=03H read three blocks)
rdata (2 byte): return data
(positive response with data 9000H, and negtive response with “ sw1+sw2”)
Notes:1.Ultralight Card only have one block in one sector, every block have 4 byte data. S50,S70
have16 byte data in one block.
2. Ultralight Card, Mifare 1k (S50), Mifare 1k (S70) card range of capacity is shown as below:
Ultralight Card: sn=00H-0FH, bn=00H, le=01H-0FH
Mifare 1k (S50): sn=00H-0FH,bn=00H-03H,le=01H-04H
Mifare 1k (S70): sn=00H-20H,bn=00H-03H,le=01H-04H
sn=21H-27H, bn=00H-0FH,le=01H-10H (S70 card last 8 sector have 16 blocks)
“C” 60H 33H 00H B0H sn bn le
“P” 60H 33H st0 st1 st2 rdata
“N” 60H 33H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 79/95
9.13.4.5 Write sector dataCommand
Positive response
Negative response
Read block and sequence blocks from RF card
sn(1 byte): sector number
bn(1 byte): block number
le(1 byte): block number
wdata: block to write (n byte)
rdata(2 byte): return data
(Positive response with data 9000H and negtive response with “sw1+sw2”)
Notes:1. Ultralight Card only have one block in one sector,every block have 4 byte data. S50, S70
have16 byte data in one block
2. Ultralight Card, Mifare 1k (S50), Mifare 1k (S70) card card range of capacity is shown as below:
Ultralight Card: sn=00H-0FH, bn=00H-03H,lc=01H-03H
Mifare 1k(S50): sn=00H-0FH, bn=00H-03H,lc=01H-03H
Mifare 1k(S70): sn=00H-20H, bn=00H-03H,lc=01H-03H
sn=21H-27H, bn=00H-0FH, lc=01H-0FH
(S70 card last 8 sector have 16 blocks)
3. S50,S70 card last block of each sector is control sector to preserve Key A, read/write control
words, Key B.
Cautions: Do note write last block and CRT-591 also will prohibid to write last block.
“C” 60H 33H 00H D1H sn bn lc wdata
“P” 60H 33H st0 st1 st2 rdata
“N” 60H 33H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 80/95
9.13.4.6 Initialization Command
Positive response
Negative response
Initialization operation to RF card
sn(1 byte): sector number
bn(1 byte): block number
lc(1byte): length lc=04H
wdata: data (4 byte)
rdata(2 byte): return data
(Positive response with data 9000H, and negtive response with “ sw1+sw2”)Notes:Mifare 1k (S50), Mifare 1k (S70) card operation sector(Sector can not be out of range and last block can not be operated)
Mifare 1k(S50): sn=00H-0FH, bn=00H-03H,
Mifare 1k(S70): sn=00H-20H, bn=00H-03H,
sn=20H-27H, bn=00H-0EH,
(S70 card last 8 sector have 16 blocks)
“C” 60H 33H 00H D2H sn bn lc wdata
“P” 60H 33H st0 st1 st2 rdata
“N” 60H 33H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 81/95
9.13.4.7 Read valueCommand
Positive response
Negative response
Read value operations to RF card
sn(1 byte): sector number
bn(1 byte): block number
rdata(2 byte): return data
(Positive response with data 9000H and negtive response with “sw1+sw2”)
Notes:Mifare 1k(S50), Mifare 1k (S70) card operation sector
(Sector can not be out of range and last block can not be operated)
Mifare 1k(S50): sn=00H-0FH, bn=00H-03H,
Mifare 1k(S70): sn=00H-20H, bn=00H-03H,
sn=20H-27H, bn=00H-0EH,
(S70 card last 8 sector have 16 blocks)
“C” 60H 33H 00H B1H sn bn
“P” 60H 33H st0 st1 st2 rdata
“N” 60H 33H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 82/95
9.13.4.8 IncrementCommand
Positive response
Negative response
Increment operation to RF card
sn(1 byte): sector number
bn(1 byte): block number
lc(1byte): increment length lc=04H
wdata: increment data (4 byte)
rdata(2 byte): return data
(Positive response with data 9000H and negtive response with “sw1+sw2”)
Notes:Mifare 1k(S50), Mifare 1k (S70) card operation sector
(Sector can not be out of range and last block can not be operated)
Mifare 1k(S50): sn=00H-0FH, bn=00H-03H,
Mifare 1k(S70): sn=00H-20H, bn=00H-03H,
sn=20H-27H, bn=00H-0EH,
(S70 card last 8 sector have 16 blocks)
“C” 60H 33H 00H D3H
sn bn lc wdata
“P” 60H 33H st0 st1 st2 rdata
“N” 60H 33H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 83/95
9.13.4.9 DecrementCommand
Positive response
Negative response
Decrement operation to RF sector
sn(1 byte): sector number
bn(1 byte): block number
lc(1byte): Decrement length lc=04H
wdata: Decrement data(4 byte)
rdata (2 byte): return data(Positive response with data 9000H and negtive response with “sw1+sw2”)
Notes:Mifare 1k(S50), Mifare 1k (S70) card operation sector
(Sector can not be out of range and last block can not be operated)
Mifare 1k(S50): sn=00H-0FH, bn=00H-03H,
Mifare 1k(S70): sn=00H-20H, bn=00H-03H,
sn=20H-27H, bn=00H-0EH,
(S70 card last 8 sector have 16 blocks)
“C” 60H 33H 00H D4H
sn bn lc wdata
“P” 60H 33H st0 st1 st2 rdata
“N” 60H 33H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 84/95
9.13.5 Type A RF card communicationCommand
Positive response
Negative response
This exchanges data between RF card by protocol RF Type A T=CL according to ISO/IEC 14443-4
Notes: The max.length of C-APDU is 261 byte, the max. length of R-APDU is 258 byte.
“C” 60H 34H C-APDU
“P” 60H 34H st0 st1 st2 R-APDU
“N” 60H 34H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 85/95
9.13.6 Type B RFcard communicationCommand
Positive response
Negative response
This exchanges data between RF card by protocol RF Type B T=CL according to ISO/IEC 14443-4
Notes: The max.length of C-APDU is 261 bytes, the max.length of R-APDU is 258 byte.
“C” 60H 35H C-APDU
“P” 60H 35H st0 st1 st2 R-APDU
“N” 60H 35H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 86/95
9.14 Shutter related operation9.14.1 LED setting
This is to control the lights (red and green) in entry to on or off
PM=31H: Red light control
PM=32H: Green light control
LED=30H: On
LED=31H: Off
LED=32H: glitter(cycle is 2sec., on for 1 sec., off for 1sec.)
9.14.2 Jitter function setting
"C" 80H PM LED
"P" 80H PM st0 st1st2
"N" 80H PM e0 e1e2
"C" 81H 30H set
Command
Positive response
Negative response
Command
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 87/95
Jitter function setting control
Set=30H: Disable jitter
Set=31H: Set jitter function when card in with magnetic signal
Notes: 1. The jitter function will not change when execute reset command
2. Only allow D/E/F bezal to set jitter function
3. Jitter is not allowed when power-on reset
4. Set jitter function before ‘C31’, ‘C32’ card-in configuration command.
9.14.3 Anti-fishing control9.14.3.1 Anti-fishing status
"P" 81H 30H st0 st1st2
"N" 81H 30H e0 e1e2
“C” 82H 30H
Positive response
Negative response
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 88/95
Command
Positive response
Negative response
The mode and pin statusMode
Pin Status
0 0 Anti-fishing pin is not activated,Pin is not up (Irregular)0 1 Anti-fishing pin is not activated, pin is up (correctly) 1 0 Anti-fishing pin is activated, pin is not up (correctly)1 1 Anti-fishing pin is activated, pin is up (Irregular)
Notes: The anti-fishing control only available on E/F beze
9.14.3.2 Anti-fishing work mode setting
Command
“C” 82H 30H st0 st1 st2 Mode Pin
“N” 82H 30H e0 e1 e2
“C” 82H 31H Mode
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 89/95
Positive response
Negative response
Setting work mode:Mode=30H Disable (Default)
Anti-fishing pin will not be up automatically when error happened
Mode=31H Enable
Anti-fishing pin will be up automatically when error happened
Notes: Pin will be up automatically when following error occur.
a: e1,e2= “10”: Card jam
b: e1,e2 =“11”: Shutter failure
9.14.3.3 Anti-fishing pin control
Command
“C” 82H 31H st0 st1 st2 Mode Pin
“N” 82H 31H e0 e1 e2
“C” 82H 32H Mode
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 90/95
Positive response
Negative response
Up and release operation
Mode=30H Pin will be up
Mode=31H Pin will be release
Notes: 1. Pin fails to be up, ICRW returns error e1,e2=’54’
2. Anti-fishing pin release failure, ICRW returns error e1,e2=’54’
3. When receiving the command after execution of this command, ICRW returns error e1,e2=’55’
4. In Enable mode of anti-fishing, if the pin is up because card jam or error happens, Host must
execute this command is to release the pin. After executing this command, ICRW needs
initialize command to clear error (Card jam/shutter error)
9.15 Components of CRT-591 Omitted
“C” 63H 32H st0 st1 st2
“N” 63H 32H st0 st1 st2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 92/95
9.16 Read Serial Number of CRT-5919.16.1 Read serial number
Command
Positive response
Negative response
RF Sleep / wake-up operation
Set=30H Sleep operation
Set=31H Wake-up operation
Len: read length of CRT-591serial number (0byte-18byte)
ICRW_SN: CRT-591 serial number
9.16.2 Write Serial Number of CRT-591Command
Positive response
Negative response
Len: The length of serial number
ICRW_SN: Cotents of serial number
“C” A2H 30H
“P” A2H 30H st0 st1 st2 len ICRW_SN
“N” A2H 30H e0 e1 e2
“C” A2H 31H len ICRW_SN
“P” A2H 31H st0 st1 st2
“N” A2H 31H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 93/95
9.17 Read CRT-591 configurationCommand
Positive response
Negative response
CRT-591 configuration specification:ICRW_Config: Read machine configuration informationAddress Name Value Description00H S1 CRT Reader Type option
“9” S1 =“9”01H~03H S2/
S3/S4(3
Byte)
User Code option“V10” CRT version
04H S5 Card r/w type option“I” IC card r/w“C” RF card r/w“M” Mag card r/w“P” Mag card r/w“E” IC + RF card r/w “F” Mag + RF card r/w“G” Mag + IC card r/w“H” Mag + IC + RF card r/w
05H S6 Interface type option“R” RS-232Interface type“U” USB Interface type
06H S7 Mag card write type“R” Mag card read only“L” Low-Co mag card write“H” High-Co mag card write
07H S8 Shutter type option“0” Not Shutter“D” “D”type Shutter“E” “E”type Shutter“F” “F”type Shutter
08H S9 SAM option“0” Not SAM“1” SAM 1“2” SAM 2“3” SAM 3“4” SAM 4“5” SAM 5
“C” A3H 30H
“P” A3H 30H st0 st1 st2 ICRW_Config
“N” A3H 30H e1 e0
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 94/95
9.18 Read CRT-591 version informationCommand
Positive response
Negative response
Read information of CRT-591 version.
Pm=30H Read machine software information
Ex: Rev =“C591_V1.00_A_090910”
9.12 Error-card Bin Counter Control
“C” A4H Pm
“P” A4H 30H st0 st1 st2 Rev
“N” A4H 30H e0 e1 e2
Communication Protocol Model No. CRT-591Date 2010/3/2
Card Issuing MachineVer. 1.0Page 95/95
9.14.1 Read error-card bin counterCommand
Positive response
Negative response
After reset error-card bin counter, Capture on card, counter one plus
Count= “000” ~ “999”
Counter overflow will return machine status (e1,e0=“50”)
9.14.2 Set initial value of error-card binCommand
Positive response
Negative response
Set initial value of error-card bin.
Count= “000” ~ “999”
Count value range (0-999)
“C” A5H 30H
“P” A5H 30H st0 st1 st2 Count(3 byte)
“N” A5H 30H e0 e1 e2
“C” A5H 31H Count(3 byte)
“P” A5H 31H st0 st1 st2
“N” A5H 31H e0 e1 e2