Advanced Card Systems ACR3901T-W1 User manual

Subject to change without prior notice [e-mail]
www.acs.com.hk
Reference Manual V1.02
ACR3901T-W1
ACSSecureBluetooth®
ContactCardReader

ACR3901T-W1 – Reference Manual [e-mail]
Version 1.02 www.acs.com.hk
Page 2 of 100
Revision History
Release Date Revision Description Version Number
2017-08-31 ●Initial Release 1.00
2017-11-06
●Updated Section 5.2.1: Battery Life
●Updated Section 6.3: Authentication
●Updated Section 6.6: Mutual Authentication
●Updated Section 6.6.1: SPH_to_RDR_ReqAuth
●Updated Section 6.6.3: SPH_to_RDR_AuthRsp
●Updated Section 6.6.5: SPH_to_RDR_DataReq
●Updated Section 6.6.6: RDR_to_SPH_DataRsp
●Updated Section 8.1.3 Get Firmware
Version Command
●Updated Section 8.1.14: Default Customer
Master Key Reset Request
1.01
2018-12-28
●Updated Formatting on Section 6.0
Software Design
●Updated Formatting on Section 7.0 Host
Programming API
●Updated Section 6.1.3: Authentication
●Updated Section 6.1.5 Bluetooth
Communication Protocol
●Updated Section 6.1.5.1: Card Power On
●Updated Section 6.1.5.2: Card Power Off
●Updated Section 6.1.5.3: Get Card Presence
●Updated Section 6.1.5.4: APDU Command
●Added Section 6.1.5.5: APDU2 Command
●Updated Section 6.1.5.6: Escape Command
●Updated Section 6.1.6.2: RDR_to_SPH_AuthRsp1
●Updated Section 6.1.6.4: RDR_to_SPH_AuthRsp2
●Updated Section 6.1.6.5: SPH_to_RDR_DataReq
●Updated Section 6.1.6.6: RDR_to_SPH_DataRsp
●Updated Section 6.2.1.1: PC_to_RDR_IccPowerOn
●Updated Section 6.2.1.4: PC_to_RDR_XfrBlock
●Updated Section 6.2.2.1: RDR_to_PC_DataBlock
●Updated Section 6.2 USB Communication Protocol
●Updated Section 7.1.1 Get Serial Number Command
●Removed Section 10.0: Other Commands
Access via PC_to_RDR_XfrBlock
●Removed Appendix A. Supported Card
Types
●Updated Appendix A. Error Codes
●Updated Product Marketing Name
1.02

ACR3901T-W1 – Reference Manual [e-mail]
Version 1.02 www.acs.com.hk
Page 3 of 100
Table of Contents
1.0. Introduction .............................................................................................................5
1.1. Reference Documents...........................................................................................................5
1.2. Symbols and Abbreviations...................................................................................................5
2.0. Features ...................................................................................................................6
3.0. Smart Card Support ................................................................................................7
3.1. MCU Cards............................................................................................................................7
3.2. Memory-based Smart Cards..................................................................................................7
4.0. System Block Diagram............................................................................................8
5.0. Hardware Design.....................................................................................................9
5.1. Battery....................................................................................................................................9
5.1.1. Battery charging............................................................................................................9
5.1.2. Battery life.....................................................................................................................9
5.2. Bluetooth Interface.................................................................................................................9
5.3. USB Interface ......................................................................................................................10
5.3.1. Communication Parameters .......................................................................................10
5.3.2. Endpoints ....................................................................................................................10
5.4. User Interface ......................................................................................................................11
5.4.1. Buttons........................................................................................................................11
5.4.2. Status LEDs ................................................................................................................11
5.5. Smart Card Interface ...........................................................................................................12
5.5.1. Smart Card Power Supply VCC (C1)..........................................................................12
5.5.2. Programming Voltage VPP (C6).................................................................................12
5.5.3. Card Type Selection....................................................................................................12
5.5.4. Interface for Microcontroller-based Cards...................................................................12
5.5.5. Card Tearing Protection..............................................................................................12
6.0. Software Design ....................................................................................................13
6.1. Bluetooth Communication Protocol .....................................................................................13
6.1.1. Bluetooth Connection Program Flow..........................................................................13
6.1.2. Profile Selection..........................................................................................................14
6.1.3. Authentication .............................................................................................................16
6.1.4. Frame Format .............................................................................................................17
6.1.5. Bluetooth Communication Protocol.............................................................................18
6.1.6. Mutual Authentication and Encryption Protocol..........................................................31
6.2.USB Communication Protocol.............................................................................................37
6.2.1. CCID Bulk-OUT Messages.........................................................................................39
6.2.2. CCID Bulk-IN Messages.............................................................................................44
7.0. Host Programming API .........................................................................................47
7.1. Peripherals Control..............................................................................................................47
7.1.1. Get Serial Number Command.....................................................................................47
7.1.2. Get Random Number Command................................................................................48
7.1.3. Get Firmware Version Command ...............................................................................49
7.1.4. Rewrite Master Key Command...................................................................................50
7.1.5. Sleep Mode Option .....................................................................................................51
7.1.6. Get Device Address....................................................................................................52
7.1.7. Set Tx Power...............................................................................................................53
7.1.8. Read Tx Power value..................................................................................................54
7.1.9. Set Card Reset Simulation Option..............................................................................55
7.1.10. Get Card Reset Simulation Option..............................................................................56
7.1.11. Set Card Response Time Interval...............................................................................57
7.1.12. Get Card Response Time Interval ..............................................................................58
7.1.13. Check Button Status ...................................................................................................59

ACR3901T-W1 – Reference Manual [e-mail]
Version 1.02 www.acs.com.hk
Page 4 of 100
7.1.14. Customer Master Key Reset Request ........................................................................60
7.2. Memory Card Command Set...............................................................................................61
7.2.1. Memory Card – 1, 2, 4, 8, and 16 kilobit I2C Card .....................................................61
7.2.2. Memory Card – 32, 64, 128, 256, 512, and 1024 kilobit I2C Card .............................64
7.2.3. Memory Card – ATMEL AT88SC153..........................................................................67
7.2.4. Memory Card – ATMEL AT88C1608..........................................................................70
7.2.5. Memory Card – SLE4418/SLE4428/SLE5518/SLE5528............................................74
7.2.6. Memory Card – SLE4432/SLE4442/SLE5532/SLE5542............................................79
7.2.7. Memory Card – SLE 4406/SLE 4436/SLE 5536/SLE 6636........................................84
7.2.8. Memory Card – SLE 4404 ..........................................................................................89
7.2.9. Memory Card – AT88SC101/AT88SC102/AT88SC1003...........................................93
Appendix A. Error Codes.............................................................................................100
List of Figures
Figure 1 : ACR3901T-W1 Architecture ..................................................................................................8
Figure 2 : Bluetooth Connection Flow..................................................................................................13
Figure 3 : nRFgo Studio GATT Setting Interface.................................................................................14
Figure 4 : Authentication Procedure.....................................................................................................16
List of Tables
Table 1 : Symbols and Abbreviations.....................................................................................................5
Table 2 : Estimated Battery Lifespan......................................................................................................9
Table 3 : USB Interface Wiring.............................................................................................................10
Table 4 : LED Status.............................................................................................................................11
Table 5 : ACR3901T-W1 Service Handles and UUID Information List ................................................15
Table 6 : Bluetooth Frame Format........................................................................................................17
Table 7 : Encrypted Frame Format after Mutual Authentication...........................................................17
Table 8 : Command Code Summary....................................................................................................18
Table 9 : Response Code Summary ....................................................................................................18
Table 10 : Summary of Mutual Authentication Commands..................................................................31
Table 11 : Error Code.........................................................................................................................100

ACR3901T-W1 – Reference Manual [e-mail]
Version 1.02 www.acs.com.hk
Page 5 of 100
1.0.Introduction
The ACR3901T-W1 ACS Secure Bluetooth® SIM-sized Contact Card Reader acts as an interface for
the communication between a smart card and a computer/mobile device. The direct communication,
in most cases, is prevented by various types of smart cards that have commands and communication
protocols different from each other. Through ACR3901T-W1, a uniform interface is established for a
wide variety of cards. By taking care of the card’s particulars, it releases the computer software
programmer from being responsible with smart card operations’ technical details, which in many
cases, are not relevant to the implementation of a smart card system.
1.1. Reference Documents
The following related documents are available from www.usb.org
•Universal Serial Bus Specification 2.0 (also referred to as the USB specification), April 27,
2000
•Universal Serial Bus Common Class Specification 1.0, December 16, 1997
•Universal Serial Bus Device Class: Smart Card CCID Specification for Integrated Circuit(s)
Cards Interface Devices, Revision 1.1, April 22, 2005
The following related documents can be ordered through www.ansi.org
•ISO/IEC 7816-1; Identification Cards – Integrated circuit(s) cards with contacts - Part 1:
Physical Characteristics
•ISO/IEC 7816-2; Identification Cards – Integrated circuit(s) cards with contacts - Part 2:
Dimensions and Locations of the contacts
•ISO/IEC 7816-3; Identification Cards – Integrated circuit(s) cards with contacts - Part 3:
Electronic signals and transmission protocols
1.2. Symbols and Abbreviations
Abbreviation Description
ATR Answer-To-Reset
CCID Chip/Smart Card Interface Device
ICC Integrated Circuit Cards
IFSC Information Field Sized for ICC for protocol T=1
IFSD Information Field Sized for CCID for protocol T=1
NAD Node Address
PPS Protocol and Parameters Selection
RFU Reserved for future use1
TPDU Transport Protocol Data Unit
USB Universal Serial Bus
Table 1: Symbols and Abbreviations
1Must be set to zero unless stated differently.

ACR3901T-W1 – Reference Manual [e-mail]
Version 1.02 www.acs.com.hk
Page 6 of 100
2.0.Features
•USB Full Speed Interface
•Bluetooth Interface
•Plug and Play – CCID support brings utmost mobility
•Smart Card Reader:
oContact Interface:
Supports ISO 7816 Class A, B, and C (5 V, 3 V, 1.8 V) SIM-sized cards
Supports microprocessor cards with T=0 or T=1 protocol
Supports memory cards
Supports PPS (Protocol and Parameters Selection)
Features Short Circuit Protection
Supports AES-128 encryption algorithm
•Application Programming Interface:
oSupports PC/SC
oSupports CT-API (through wrapper on top of PC/SC)
•Built-in Peripherals:
oLEDs
oButton
•USB Firmware Upgradeability2
•Supports Android™ 4.3 and later3
•Supports iOS 8.0 and later4
•Compliant with the following standards:
oEN 60950/IEC 60950
oISO 7816
oBluetooth
oPC/SC
oCCID
oCE
oFCC
oRoHS 2
oREACH
oMicrosoft® WHQL
2Applicable under PC-linked mode
3Uses an ACS-defined Android Library
4Uses an ACS-defined iOS Library

ACR3901T-W1 – Reference Manual [e-mail]
Version 1.02 www.acs.com.hk
Page 7 of 100
3.0.Smart Card Support
3.1. MCU Cards
ACR3901T-W1 is a PC/SC-compliant smart card reader that supports ISO 7816 Class A, B, and C (5
V, 3 V, and 1.8 V) smart cards. It also works with MCU cards following either the T=0 and T=1
protocol.
The card ATR indicates the specific operation mode (TA2 present; bit 5 of TA2 must be 0) and when
that particular mode is not supported by the ACR3901T-W1, it will reset the card to negotiable mode.
If the card cannot be set to negotiable mode, the reader will then reject the card.
When the card ATR indicates the negotiable mode (TA2 not present) and communication parameters
other than the default parameters, the ACR3901T-W1 will execute the PPS and try to use the
communication parameters that the card suggested in its ATR. If the card does not accept the PPS,
the reader will use the default parameters (F=372, D=1).
For the meaning of the aforementioned parameters, please refer to ISO 7816-3.
3.2. Memory-based Smart Cards
ACR3901T-W1 works with several memory-based smart cards such as:
•Cards following the I2C bus protocol (free memory cards) with maximum 128 bytes page with
capability, including:
oAtmel®: AT24C01/02/04/08/16/32/64/128/256/512/1024
oSGS-Thomson: ST14C02C, ST14C04C
oGemplus: GFM1K, GFM2K, GFM4K, GFM8K
•Cards with secure memory IC with password and authentication, including:
oAtmel®: AT88SC153 and AT88SC1608
•Cards with intelligent 1 KB EEPROM with write-protect function, including:
oInfineon®: SLE4418, SLE4428, SLE5518 and SLE5528
•Cards with intelligent 256 bytes EEPROM with write-protect function, including:
oInfineon®: SLE4432, SLE4442, SLE5532 and SLE5542
•Cards with ‘104’ type EEPROM non-reloadable token counter cards, including:
oInfineon®: SLE4406, SLE4436, SLE5536 and SLE6636
•Cards with Intelligent 416-bit EEPROM with internal PIN check, including:
oInfineon®: SLE4404
•Cards with Security Logic with Application Zone(s), including:
oAtmel®: AT88SC101, AT88SC102 and AT88SC1003

ACR3901T-W1 – Reference Manual [e-mail]
Version 1.02 www.acs.com.hk
Page 8 of 100
4.0.System Block Diagram
Figure 1: ACR3901T-W1 Architecture
ACR3901T-W1
Battery Charge
Management IC
MCU
Bluetooth
External devices,
e.g computer or
mobile phone
LEDs SAM card
Rechargeable Li-
ion Battery
Bluetooth Module
USB
External device,
e.g. computer
Buttons

ACR3901T-W1 – Reference Manual [e-mail]
Version 1.02 www.acs.com.hk
Page 9 of 100
5.0.Hardware Design
5.1. Battery
The ACR3901T-W1 is using a rechargeable Lithium-ion battery which has a capacity of 70 mAh.
5.1.1. Battery charging
Once the battery of ACR3901T-W1 runs out, it may be charged in any of the following modes: OFF,
USB, and Bluetooth; as long as it is connected to a power outlet.
5.1.2. Battery life
The battery life is dependent on the usage of the device. Below is an estimate of the battery life
depending on the various work conditions:
Mode Estimated Battery Life
Working Mode 4 days*(1)
Standby Mode 28 days*(2)
OFF Mode 1 year
Table 2: Estimated Battery Lifespan
Note: Results may vary as it depends on the smart card used.
(1) In Bluetooth mode, run 10 operations per day with 1 minute operation run.
(2) In Bluetooth mode, set sleep time as 60 seconds and wake up once per day.
5.2. Bluetooth Interface
The ACR3901T-W1 uses Bluetooth Low Energy (LE) 4.0 as the medium to pair with computer/mobile
device.

ACR3901T-W1 – Reference Manual [e-mail]
Version 1.02 www.acs.com.hk
Page 10 of 100
5.3. USB Interface
The micro-USB port is used to connect the ACR3901T-W1 to the computer as battery charging port.
This port is also used in order for the ACR3901T-W1 to operate in PC-linked mode.
5.3.1. Communication Parameters
ACR3901T-W1 is connected to a computer through USB as specified in the USB Specification 2.0.
ACR3901T-W1 is working in full speed mode, i.e. 12 Mbps.
Pin Signal Function
1 VBUS +5 V power supply for the reader
2 D- Differential signal transmits data between ACR3901T-W1 and computer
3 D+ Differential signal transmits data between ACR3901T-W1 and computer
4 GND Reference voltage level for power supply
Table 3: USB Interface Wiring
5.3.2. Endpoints
ACR3901T-W1 uses the following endpoints to communicate with the host computer:
Control Endpoint For setup and control purpose
Bulk OUT For command to be sent from host to ACR3901T-W1
(data packet size is 64 bytes)
Bulk IN For response to be sent from ACR3901T-W1 to host
(data packet size is 64 bytes)
Interrupt IN For card status message to be sent from ACR3901T-W1 to host
(data packet size is 8 bytes)

ACR3901T-W1 – Reference Manual [e-mail]
Version 1.02 www.acs.com.hk
Page 11 of 100
5.4. User Interface
ACR3901T-W1 has two buttons and two LEDs (One Single Color: Red; One Bi-color: Green and
Blue).
5.4.1. Buttons
ACR3901T-W1 has three modes: USB, Off, and Bluetooth. User can perform one mode at a time as a
data transmission interface.
•Button (Front) - Power On, Power Off or Wake Up the reader; Simulate SAM card removal
event.
- Once pressed, the reader will power on and the default mode is the Bluetooth mode.
Once connected through a computer, it will automatically switch to USB mode.
Meanwhile, a long press will power off the device.
•Button (Back) - Reset the reader
5.4.2. Status LEDs
ACR3901T-W1 has two LEDs (One Single Color: Red; One Bi-color: Green and Blue) to show various
operation status, where:
•Red LED - Battery status
•Blue LED - Card and reader status under Bluetooth mode
•Green LED - Card and reader status under USB mode
Color LED Activity Status
Red On The battery is charging (will turn OFF after battery is fully charged)
Slow flash
(1 second/flash) The battery needs to be charged
Blue
Fast–Slow flash
(Fast: 250 ms/flash;
Slow: 500 ms/flash)Ready for Bluetooth device pairing
Slow flash
(2 seconds/flash) Bluetooth device connected and no card operation
Fast flash Data transferring between the reader and mobile device
On Card is connected and powered on
Green
Slow flash
(2 seconds/flash) No card operation and the reader is waiting for PC instructions
Fast flash Data transferring between the reader and PC
On Card is connected and powered on
Table 4: LED Status
Note: When red, blue and green LEDs are OFF, the reader is powered off. Both blue and green LEDs
will light for 1 second, and then will turn off when the reader receives critical error codes from the
Bluetooth module.

ACR3901T-W1 – Reference Manual [e-mail]
Version 1.02 www.acs.com.hk
Page 12 of 100
5.5. Smart Card Interface
The interface between the ACR3901T-W1 and the inserted smart card follows the specification of ISO
7816-3 with certain restrictions or enhancements to increase the practical functionality of ACR3901T-
W1.
5.5.1. Smart Card Power Supply VCC (C1)
The current consumption of the inserted card must not be higher than 50 mA.
5.5.2. Programming Voltage VPP (C6)
According to ISO 7816-3, the smart card contact C6 (VPP) supplies the programming voltage to the
smart card. Since all common smart cards in the market are EEPROM-based and do not require the
provision of an external programming voltage, the contact C6 (VPP) has been implemented as a
normal control signal in the ACR3901T-W1. The electrical specifications of this contact are identical to
those of the signal RST (at contact C2).
5.5.3. Card Type Selection
The controlling computer must always select the card type through the proper command sent to the
ACR3901T-W1 prior to activating the inserted card. This includes both the memory cards and MCU-
based cards.
For MCU-based cards, the reader allows to select the preferred protocol, T=0 or T=1. However, this
selection is only accepted and carried out by the reader through the PPS when the card inserted in
the reader supports both protocol types. Whenever an MCU-based card supports only one protocol
type, T=0 or T=1, the reader automatically uses that protocol type, regardless of the protocol type
selected by the application.
5.5.4. Interface for Microcontroller-based Cards
For microcontroller-based smart cards, only the contacts C1 (VCC), C2 (RST), C3 (CLK), C5 (GND)
and C7 (I/O) are used. A frequency of 4.8 MHz is applied to the CLK signal (C3).
5.5.5. Card Tearing Protection
The ACR3901T-W1 provides a mechanism to protect the inserted card when it is suddenly withdrawn
while it is powered up. The power supply to the card and the signal lines between the ACR3901T-W1
and the card is immediately deactivated while the card is being removed.However, as a rule, to
avoid any electrical damage, a card should only be removed from the reader while it is powered down.
Note: ACR3901T-W1 never switches on the power supply to the inserted card by itself. The
controlling computer through the proper command sent to the reader must explicitly do this.

ACR3901T-W1 – Reference Manual [e-mail]
Version 1.02 www.acs.com.hk
Page 13 of 100
6.0.Software Design
6.1. Bluetooth Communication Protocol
6.1.1. Bluetooth Connection Program Flow
The program flow of a Bluetooth connection is shown below:
Figure 2: Bluetooth Connection Flow
Yes
No
Bluetooth Start
(Reset/Power up)
Successful Connection?
No
Enable Service
Disconnect?
Reset
Power Off
Authentication
Smart Card Operation with Security Channel
Successful Authentication?
Yes

ACR3901T-W1 – Reference Manual [e-mail]
Version 1.02 www.acs.com.hk
Page 14 of 100
6.1.2. Profile Selection
The ACR3901T-W1 is a smart card reader that is designed to use Bluetooth technology as an
interface to transmit data. A customized service called Commands Communication with three pipes is
used: one pipe is used for command request, the second pipe is for command response, and the third
pipe is used to notify the paired device about the card and sleep mode status.
Also, the current reader’s battery status is significant when the reader is operating in Bluetooth mode,
hence, a customized battery service is used to notify the paired device about the current battery
status. When there is a change in the battery status, the reader will notify the paired device through a
specific pipe. To simplify, the battery levels are divided into three groups. Below is a table
summarizing the battery level and its corresponding return value:
Status Voltage Return Value
Sufficient battery ≥ 3.3 V FEh
Low battery <3.3 V and ≥ 2.9 V Value other than FFh/FEh/00h
No battery <2.9 V 00h
USB mode FFh
In Card Status Notification service, it will notify the paired device of any changes in the card status or
when the reader enters sleep mode. Below is a list of the status and the corresponding return value:
Status Return Value
No card present 50 02h
Card present 50 03h
Reader has entered sleep mode 50 04h
Finally, to provide more reader information to the user, a customized Device Information service was
added. This can only be read manually, or by an application request. The characteristics include
Manufacturer Name, Firmware Revision, Model Number, and Serial Number.
Figure 3: nRFgo Studio GATT Setting Interface

ACR3901T-W1 – Reference Manual [e-mail]
Version 1.02 www.acs.com.hk
Page 15 of 100
nRFgo-Studio Configuration adds one service, and there will be totally 10 services:
#define PIPE_GAP_DEVICE_NAME_SET 1
#define PIPE_COMMANDS_COMMUNICATION_COMMANDS_RESPONSE_TX 2
#define PIPE_COMMANDS_COMMUNICATION_COMMANDS_REQUEST_RX 3
#define PIPE_COMMANDS_COMMUNICATION_CARD_STATUS_NOTIFICATION_TX 4
#define PIPE_BATTERY_BATTERY_LEVEL_TX 5
#define PIPE_BATTERY_BATTERY_LEVEL_SET 6
#define PIPE_DEVICE_INFORMATION_MANUFACTURER_NAME_STRING_SET 7
#define PIPE_DEVICE_INFORMATION_FIRMWARE_REVISION_STRING_SET 8
#define PIPE_DEVICE_INFORMATION_MODEL_NUMBER_STRING_SET 9
#define PIPE_DEVICE_INFORMATION_SERIAL_NUMBER_STRING_SET 10
#define NUMBER_OF_PIPES 10
#define PIPE_GAP_DEVICE_NAME_SET is used to change the device name at runtime by the
application controller. So that in Bluetooth mode, the advertising name will be in the format of
“ACR3901T-W1XXXXXXX”, where “XXXXXXX” is the last 7 bytes of the reader’s serial number.
In order to make the advertising name be “ACR3901T-W1XXXXXXX”, Bluetooth Mode Start operation
should be implemented first.
Bluetooth Mode Start:
1. Setup (06h) uploads the configuration to Bluetooth module.
2. Use pipe 1 to set the device name in the format of “ACR3901T-W1XXXXXXX”
(PIPE_GAP_DEVICE_NAME_SET)
3. Connect (0Fh).
4. Advertising.
Attribute Name UUID Handle
DeviceName 2A00 03h
Send (Reader →Paired device) 8002 0Bh
Receive
(Paired device →Reader) 8003 0Eh
CardStatus 8004 10h
BatteryLevel 2A19 14h
Manufacturer 2A29 18h
FW_Version 2A26 1Bh
ModelNumber 2A24 1Eh
SerialNumber 2A25 21h
Table 5: ACR3901T-W1 Service Handles and UUID Information List

ACR3901T-W1 – Reference Manual [e-mail]
Version 1.02 www.acs.com.hk
Page 16 of 100
6.1.3. Authentication
Before any sensitive data can be loaded into the ACR3901T-W1, the data processing server must be
authenticated by the ACR3901T-W1 for the privilege to modify the secured data inside reader. In the
ACR3901T-W1, a mutual authentication method is being used.
For better pictorial illustration, please refer to the figure below (The picture below has omitted the
bridging device for simplicity and better illustration):
Figure 4: Authentication Procedure
After successful authentication, a 16-byte Session Key is generated in both ACR3901T-W1 and the
data server.
Default Customer Master Key (Hex): FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
Note: The reader will be locked and unusable once incorrect authentication keys are entered more
than six (6) times.
For more detailed information, you may contact an ACS sales representative.
1.
Send authentication
request message
2.
Answer to the request
message
3.
Send authentication
response message
4.
Answer to the
authentication response
message
Transmitted
through the
bridging device

ACR3901T-W1 – Reference Manual [e-mail]
Version 1.02 www.acs.com.hk
Page 17 of 100
6.1.4. Frame Format
6.1.4.1. Bluetooth Frame Format
HID Frame Length (Bytes) Description
Identifiers 1 Commands
Length 2 Length {Payload+Checksum}
Payload 0-N Data
Checksum 1 XOR {Identifiers,Length,Payload}
Table 6: Bluetooth Frame Format
The frame format should be:
Identifier + LEN1 + LEN2 + N-bytes Payload + Checksum
If the total command length, including identifier, length, and payload, is greater than 20 bytes, then the
reader or the paired device will automatically divide it into several frames.
Data checksum is used in detecting errors that may have been introduced during wireless data
transmission. To calculate the data checksum: XOR {Identifiers,Length,Payload}.
Example: 62010063 => Checksum = 63h
6.1.4.2. Bluetooth Frame Format after Mutual Authentication
Mutual authentication was introduced to avoid man-in-the-middle attacks through the Bluetooth
communication channel. After a successful mutual authentication, the Bluetooth Frame Format in
Table 6 will be encrypted and packed with 1 byte header byte, 2 Len byte, and 1 check byte. The
frame format after mutual authentication should look like the structure below:
Header + Len + (Identifiers + Length + Payload + Checksum)* + Check byte
Note: Each 16 bytes of data will be encrypted with the Session Key using the AES-128 CBC
cipher mode. The initial vector is 16 bytes (00h) in AES-128 CBC cipher mode.
HID Frame Length (bytes) Description
Header byte 1 Value: 72h / 22h
Len 2 Length {Identifiers + Length + Payload + Checksum +
Check + Stop byte}
Identifiers 1 Commands
Encrypted data of
the Bluetooth frame
format;
The final data length
of this part is 16*N
bytes (N>0)
Length 2 Length {Payload + Checksum}
Payload 0-N Data
Checksum 1 XOR {Identifiers, Length, Payload}
Check byte 1 XOR {Header, Len, Encrypted(Identifiers, Length, Payload,
Checksum)}
Table 7: Encrypted Frame Format after Mutual Authentication

ACR3901T-W1 – Reference Manual [e-mail]
Version 1.02 www.acs.com.hk
Page 18 of 100
6.1.5. Bluetooth Communication Protocol
The ACR3901T-W1 communicates to the paired device using the Bluetooth interface with a
predefined protocol. The protocol is similar to the formats of the CCID Command Pipe and Response
Pipe.
Command Mode supported Sender Description
62h Authenticated Paired
device ICC Power On
63h Authenticated Paired
device ICC Power Off
65h Authenticated Paired
device Get Card Presence
6Fh Authenticated Paired
device Exchange APDU
67h Authenticated Paired
device Exchange APDU2
61h Authenticated Paired
device Set Parameters
6Bh Authenticated Paired
device Peripheral Commands
70h Connected/Authenticated Paired
device SPH_to_RDR_ReqAuth*
71h Connected/Authenticated Paired
device SPH_to_RDR_AuthRsp*
Table 8: Command Code Summary
Command Mode Supported Sender Description
12h Authenticated Reader Response to ICC Power On
13h Authenticated Reader Response to ICC Power Off
14h Authenticated Reader Response to Get Card Presence
11h Authenticated Reader Response to Exchange APDU
17h Authenticated Reader Response to Exchange APDU2
16h Authenticated Reader Response to Set Parameters
15h Authenticated Reader Response to Peripheral
Commands
20h Connected/Authenticated Reader RDR_to_SPH_AuthRsp1*
21h Connected/Authenticated Reader RDR_to_SPH_AuthRsp2*
Table 9: Response Code Summary
*Note: These command/response codes are the communication codes being used in Mutual
Authentication.

ACR3901T-W1 – Reference Manual [e-mail]
Version 1.02 www.acs.com.hk
Page 19 of 100
6.1.5.1. Card Power On
This command sends a power on request to the reader.
Command Format
Offset Field Size Value Description
0 bMessageType 1 62h -
1 LEN1 LEN2 (wLength) 2 0100h
Number of extra bytes starting from
the next field for this message, and is
expressed in two bytes, and LEN1 is
LSB while LEN2 is MSB
3 CSUM (wChecksum) 1 63h CSUM means the XOR values of all
bytes in the command
Response Data Format
Offset Field Size Value Description
0 bMessageType 1 12h -
1 LEN1 LEN2 (wLength) 2
Number of extra bytes starting from
the next field for this message, and is
expressed in two bytes long, and
LEN1 is LSB while LEN2 is MS
3 N byte ATR N - Card Answer-To-Reset
3+N CSUM (wChecksum) 1 - CSUM means the XOR values of all
bytes in the command
Response Data Format (Error)
Offset Field Size Value Description
0 bMessageType 1 92h -
1 LEN1 LEN2 (wLength) 2 0200h
Number of extra bytes starting from
the next field for this message. It is
expressed in two bytes long. LEN1 is
LSB while LEN2 is MSB.
3 Error Code (bErrorCode) 1 - Error Code. Refer to Appendix A
4 CSUM (wChecksum) 1 - CSUM means the XOR values of all
bytes in the command
Example:
Request = 62 01 00 63
Response = 12 14 00 3B BE 11 00 00 41 01 38 00 00 00 00 12 34 56 78 01
90 00 73
ATR = 3B BE 11 00 00 41 01 38 00 00 00 00 12 34 56 78 01

ACR3901T-W1 – Reference Manual [e-mail]
Version 1.02 www.acs.com.hk
Page 20 of 100
6.1.5.2. Card Power Off
This command sends a power off request to the reader.
Command Format
Offset Field Size Value Description
0 bMessageType 1 63h -
1 LEN1 LEN2 (wLength) 2 0100h
Number of extra bytes starting from
the next field for this message, and is
expressed in two bytes long, and
LEN1 is LSB while LEN2 is MSB
3 CSUM (wChecksum) 1 62h CSUM means the XOR values of all
bytes in the command
Response Data Format
Offset Field Size Value Description
0 bMessageType 1 13h -
1 LEN1 LEN2 (wLength) 2 0100h
Number of extra bytes starting from
the next field for this message, and is
expressed in two bytes long, and
LEN1 is LSB while LEN2 is MSB
3 CSUM (wChecksum) 1 12h CSUM means the XOR values of all
bytes in the command
Response Data Format (Error)
Offset Field Size Value Description
0 bMessageType 1 93h -
1 LEN1 LEN2 (wLength) 2 0200h
Number of extra bytes starting from
the next field for this message. It is
expressed in two bytes long. LEN1 is
LSB while LEN2 is MSB.
3 Error Code (bErrorCode) 1 - Error Code. Refer to Appendix A
4 CSUM (wChecksum) 1 - CSUM means the XOR values of all
bytes in the command
Example:
Request = 62 01 00 62
Response = 13 01 00 12