Advanced Card ACR122S User manual

Subject to change without prior notice [email protected]k
www.acs.com.hk
Communication Protocol V2.01
ACR122S
Serial NFC Reader

ACR122S – Communication Protocol [email protected]
Version 2.01 www.acs.com.hk
Page 2 of 57
Table of Contents
1.0. Introduction ............................................................................................................... 4
2.0. Features ..................................................................................................................... 5
2.1. Serial Interface.......................................................................................................................5
2.2. Bi-color LED...........................................................................................................................5
2.3. Buzzer....................................................................................................................................6
2.4. SAM Interface ........................................................................................................................6
2.5. Built-in Antenna .....................................................................................................................6
3.0. Communication between the host and contactless interface, SAM and
peripherals............................................................................................................................. 7
4.0. Serial Interface (CCID-like Frame Format) .............................................................. 8
4.1. Protocol Flow Examples ........................................................................................................9
5.0. SAM Interface .......................................................................................................... 11
5.1. Activating the SAM interface................................................................................................11
5.2. Deactivating the SAM interface ...........................................................................................12
5.3. Exchanging data through the SAM interface.......................................................................13
6.0. Pseudo-APDUs for contactless interface and peripherals control .................... 15
6.1. Direct Transmit ....................................................................................................................15
6.2. Change Communication Speed...........................................................................................18
6.3. Get Firmware Version..........................................................................................................22
6.4. Bi-color LED and Buzzer Control.........................................................................................23
6.5. Topaz512 and Jewel96........................................................................................................28
6.6. Basic program flow for ISO 14443-4 Type A and B tags.....................................................35
6.7. Basic program flow for Mifare applications..........................................................................37
6.7.1. Handling the value blocks of Mifare 1K/4K tag? .........................................................39
6.7.2. Accessing Mifare Ultralight tags..................................................................................42
6.7.3. Accessing Mifare Ultralight C tag................................................................................44
6.8. Basic program flow for FeliCa applications .........................................................................49
6.9. Basic program flow for NFC Forum Type 1 tag applications...............................................49
Appendix A. Topaz ........................................................................................................... 51
Appendix B. Topaz512 ..................................................................................................... 52
Appendix C. Jewel64........................................................................................................ 54
Appendix D. Jewel96........................................................................................................ 55
Appendix E. ACR122 Error Codes .................................................................................. 56
List of Figures
Figure 1 : ACR122S Communication Flowchart .................................................................................... 7
Figure 2 : Tag Address “ADD”.............................................................................................................. 33
Figure 3 : Tag Address “ADD8”............................................................................................................ 34

ACR122S – Communication Protocol [email protected]
Version 2.01 www.acs.com.hk
Page 3 of 57
List of Tables
Table 1 : PIN Configuration .................................................................................................................... 5
Table 2 : Mifare 1K Memory Map ......................................................................................................... 41
Table 3 : Mifare 4K Memory Map ......................................................................................................... 41
Table 4 : Mifare Ultralight Memory Map ............................................................................................... 44
Table 5 : Mifare Ultralight C Memory Map............................................................................................ 48

ACR122S – Communication Protocol [email protected]
Version 2.01 www.acs.com.hk
Page 4 of 57
1.0.Introduction
The ACR122S is a contactless smart card reader/writer used for accessing ISO 14443-4 Type A and
B, Mifare, ISO 18092 or NFC, and FeliCa tags using the serial interface. This document will discuss
the command set in implementing a smart card application using the ACR122S.

ACR122S – Communication Protocol [email protected]
Version 2.01 www.acs.com.hk
Page 5 of 57
2.0.Features
•Serial RS-232 Interface: Baud Rate = 115200 bps, 8-N-1
•USB interface for power supply
•CCID-like frame format (Binary format)
•Smart Card Reader:
oRead/Write speed of up to 424 kbps
oBuilt-in antenna for contactless tag access, with card reading distance of up to 50 mm
(depending on tag type)
oSupport for ISO 14443 Part 4 Type A and B cards, Mifare, FeliCa, and all four types of
NFC (ISO/IEC 18092 tags)
oBuilt-in anti-collision feature (only one tag is accessed at any time)
oISO 7816-compliant SAM slot
•Built-in Peripherals:
oTwo user-controllable LEDs
oUser-controllable buzzer
•Compliant with the following standards:
oISO 14443
oCE
oFCC
oKC
oVCCI
oRoHS
2.1. Serial Interface
The ACR122S is connected to a Host through the RS-232C Serial Interface at 9600 bps, 8-N-1.
Pin Signal Function
1 VCC +5 V power supply for the reader (max. 200 mA; normal 100 mA)
2 TXD The signal from the reader to the host
3 RXD The signal from the host to the reader
4 GND Reference voltage level for power supply
Table 1: PIN Configuration
2.2. Bi-color LED
A user-controllable bi-color LED with red and green color is provided.
•The green LED will blink if the “Card Interface” is not connected.
•The green LED will turn on if the “Card Interface” is connected.
•The green LED will flash if the “Card Interface” is operating.
•The red LED is controlled by the application only.

ACR122S – Communication Protocol [email protected]
Version 2.01 www.acs.com.hk
Page 6 of 57
2.3. Buzzer
A user-controllable buzzer with a default state of OFF is provided.
2.4. SAM Interface
One SAM socket is provided.
2.5. Built-in Antenna
A 3-turn symmetric loop antenna, center-tapped is provided.
•Estimated size is 60 mm x 48 mm.
•Loop inductance is approximately 1.6 µH – 2.5 µH.
•Operating distance for a different tag is approximately up to 50 mm (depends on the tag).
•Only one tag can be accessed at a time.

ACR122S – Communication Protocol [email protected]
Version 2.01 www.acs.com.hk
Page 7 of 57
3.0.Communication between the host and contactless
interface, SAM and peripherals
The contactless interface and peripherals are accessed through the use of pseudo-APDUs.
The SAM interface is accessed through the use of standard APDUs.
Figure 1: ACR122S Communication Flowchart

ACR122S – Communication Protocol [email protected]
Version 2.01 www.acs.com.hk
Page 8 of 57
4.0.Serial Interface (CCID-like Frame Format)
Note: Communication setting: 9600 bps, 8-N-1.
The communication protocol between the host and ACR122S is very similar to the CCID protocol.
Command Frame Format
STX (02h) Bulk-OUT Header APDU Command or
Parameters Checksum ETX (03h)
1 Byte 10 Bytes M Bytes
(If applicable) 1 Byte 1 Byte
Status Frame Format
STX (02h) Status Checksum ETX (03h)
1 Byte 1 Byte 1 Byte 1 Byte
Response Frame Format
STX (02h) Bulk-IN Header APDU Response or
abData Checksum ETX (03h)
1 Byte 10 Bytes N Bytes
(If applicable) 1 Byte 1 Byte
Checksum = XOR {Bulk-OUT Header, APDU Command or Parameters}
Checksum = XOR {Bulk-IN Header, APDU Response or abData}
In general, we would make use of three types of Bulk-OUT Header:
•HOST_to_RDR_IccPowerOn: To activate the SAM interface. The ATR of the SAM will be
returned if available.
•HOST_to_RDR_IccPowerOff: To deactivate the SAM interface.
•HOST_to_RDR_XfrBlock: To exchange APDUs between the host and ACR122S.
The SAM interface must be activated in order to use the contactless interface and peripherals. In
short, all the APDUs are exchanged through the SAM interface.
Similarly, two types of Bulk-IN Header are used:
•RDR_to_HOST_DataBlock: In response to the HOST_to_RDR_IccPowerOn and
HOST_to_RDR_XfrBlock Frames.
•RDR_to_HOST_SlotStatus: In response to the HOST_to_RDR_IccPowerOff Frame.
RDR = ACR122S; HOST = Host Controller
HOST_to_RDR = Host Controller -> ACR122S
RDR_to_HOST = ACR122S -> Host Controller

ACR122S – Communication Protocol [email protected]
Version 2.01 www.acs.com.hk
Page 9 of 57
4.1. Protocol Flow Examples
A. Activate a SAM.
HOST RDR
1. HOST sends a frame 02 62 00 00 00 00 00 01 01 00 00
[Checksum] 03
2. RDR sends back a
positive status frame
immediately
02 00 00 03 (positive status frame) 
.. after some processing delay ..
3. RDR sends back the
response of the
command
02 80 0D 00 00 00 00 01 00 00 00 3B 2A 00
80 65 24 B0 00 02 00 82 90 00 [Checksum]
03

B. Activate a SAM (Incorrect Checksum, HOST).
HOST RDR
1. HOST sends a
corrupted frame 02 62 00 00 00 00 00 01 01 00 00 [Incorrect Checksum] 03
2. RDR sends back a
negative status frame
immediately
02 FF FF 03 (negative status frame) 
3. HOST sends the
frame again. 02 62 00 00 00 00 00 01 01 00 00 [Checksum] 03
4. RDR sends back a
positive status frame
immediately
02 00 00 03 (positive status frame) 
.. after some processing delay ..
5. RDR sends back the
response of the
command
02 80 0D 00 00 00 00 01 00 00 00 3B 2A
00 80 65 24 B0 00 02 00 82 90 00
[Checksum] 03

C. Activate a SAM (Incorrect Checksum, RDR).
HOST RDR
1. HOST sends a frame 02 62 00 00 00 00 00 01 01 00 00
[Checksum] 03
2. RDR sends back a
positive status frame
immediately
02 00 00 03 (positive status frame) 

ACR122S – Communication Protocol [email protected]
Version 2.01 www.acs.com.hk
Page 10 of 57
HOST RDR
.. after some processing delay ..
3. RDR sends back the
response (corrupted) of
the command
4. HOST sends a NAK
frame to get the response
again.
5. RDR sends back the
response of the
command

02 80 0D 00 00 00 00 01 00 00 00 3B 2A
00 80 65 24 B0 00 02 00 82 90 00
[Incorrect Checksum] 03
02 00 00 00 00 00 00 00 00 00 00 00 03
(NAK)
02 80 0D 00 00 00 00 01 00 00 00 3B 2A
00 80 65 24 B0 00 02 00 82 90 00
[Checksum] 03


Note: If the frame sent by the HOST is correctly received by the RDR, a positive status frame = {02
00 00 03} will be sent to the HOST immediately to inform the HOST the frame is correctly received.
The HOST has to wait for the response of the command. The RDR will not receive any more frames
while the command is being processed.
In case of errors, a negative status frame will be sent to the HOST to indicate the frame is either
corrupted or incorrectly formatted.
CheckSum Error Frame = {02 FF FF 03}
Length Error Frame = {02 FE FE 03}. The length dDwLength is greater than 0105h bytes.
ETX Error Frame = {02 FD FD 03}. The last byte is not equal to ETX “03h”.
The NAK Frame is only used by the HOST to get the last response.
{02 00 00 00 00 00 00 00 00 00 00 00 03} // 11 zeros

ACR122S – Communication Protocol [email protected]
Version 2.01 www.acs.com.hk
Page 11 of 57
5.0.SAM Interface
5.1. Activating the SAM interface
Command Frame Format
STX (02h) Bulk-OUT Header
(HOST_to_RDR_IccPowerOn) Parameters Checksum ETX (03h)
1 Byte 10 Bytes 0 Byte 1 Byte 1 Byte
HOST_to_RDR_IccPowerOn Format
Offset Field Size Value Description
0 bMessageType 1 62h
1 dDwLength
<LSB .. MSB> 4 00000000h Message-specific data length.
5 bSlot 1 00-FFh Identifies the slot number for this
command. Default=00h
6 bSeq 1 00-FFh Sequence number for command.
7 bPowerSelect 1
00h
01h
02h
03h
Voltage that is applied to the ICC:
00h – Automatic Voltage Selection
01h – 5V
02h – 3V
03h – 1.8 V
8 abRFU 2 Reserved for Future Use.
Response Frame Format
STX (02h) Bulk-IN Header
(RDR_to_HOST_DataBlock) abData Checksum ETX (03h)
1 Byte 10 Bytes N Bytes (ATR) 1 Byte 1 Byte
RDR_to_HOST_DataBlock Format
Offset Field Size Value Description
0 bMessageType 1 80h Indicates that a data block is
being sent from the ACR122S.
1 dwLength
<LSB .. MSB> 4 N Size of abData field (N Bytes).
5 bSlot 1 Same as Bulk-OUT Identifies the slot number for
this command.
6 bSeq 1 Same as Bulk-OUT Sequence number for
corresponding command.
7 bStatus 1
8 bError 1

ACR122S – Communication Protocol [email protected]
Version 2.01 www.acs.com.hk
Page 12 of 57
Offset Field Size Value Description
9 bChainParameter 1
Example: To activate the slot 0 (default), sequence number = 1, 5 V card.
HOST -> 02 62 00 00 00 00 00 01 01 00 00 [Checksum] 03
RDR -> 02 00 00 03
RDR -> 02 80 0D 00 00 00 00 01 00 00 00 3B 2A 00 80 65 24 B0 00 02 00 82 90 00 [Checksum]
03
The ATR = 3B 2A 00 80 65 24 B0 00 02 00 82; SW1 SW2 = 90 00
5.2. Deactivating the SAM interface
Command Frame Format
STX (02h) Bulk-OUT Header
(HOST_to_RDR_IccPowerOff) Parameters Checksum ETX (03h)
1 Byte 10 Bytes 0 Byte 1 Byte 1 Byte
HOST_to_RDR_IccPowerOff Format
Offset Field Size Value Description
0 bMessageType 1 63h
1 dDwLength
<LSB .. MSB> 4 00000000h Message-specific data length.
5 bSlot 1 00-FFh Identifies the slot number for this
command. Default=00h
6 bSeq 1 00-FFh Sequence number for command.
7 abRFU 3 Reserved for Future Use.
Response Frame Format
STX (02h) Bulk-IN Header
(RDR_to_HOST_SlotStatus) abData Checksum ETX (03h)
1 Byte 10 Bytes 0 Byte 1 Byte 1 Byte
RDR_to_HOST_DataBlock Format
Offset Field Size Value Description
0 bMessageType 1 81h Indicates that a data block is
being sent from the ACR122S.
1 dwLength
<LSB .. MSB> 4 0 Size of abData field (0 Byte).
5 bSlot 1 Same as Bulk-OUT Identifies the slot number for this
command.

ACR122S – Communication Protocol [email protected]
Version 2.01 www.acs.com.hk
Page 13 of 57
Offset Field Size Value Description
6 bSeq 1 Same as Bulk-OUT Sequence number for
corresponding command.
7 bStatus 1
8 bError 1
9 bClockStatus 1
Example: To deactivate the slot 0 (default), sequence number = 2.
HOST -> 02 63 00 00 00 00 00 02 00 00 00 [Checksum] 03
RDR -> 02 00 00 03
RDR -> 02 81 00 00 00 00 00 02 00 00 00 [Checksum] 03
5.3. Exchanging data through the SAM interface
Command Frame Format
STX (02h) Bulk-OUT Header
(HOST_to_RDR_XfrBlock) Parameters Checksum ETX (03h)
1 Byte 10 Bytes M Byte 1 Byte 1 Byte
HOST_to_RDR_XfrBlock Format
Offset Field Size Value Description
0 bMessageType 1 6Fh
1 dDwLength
<LSB .. MSB> 4 M Message-specific data length.
5 bSlot 1 00-FFh Identifies the slot number for this
command. Default=00h
6 bSeq 1 00-FFh Sequence number for command.
7 bBWI 1 00-FFh Used to extend the Block Waiting
Timeout.
8 wLevelParameter 2 0000h
Response Frame Format
STX (02h) Bulk-IN Header
(RDR_to_HOST_DataBlock) abData Checksum ETX (03h)
1 Byte 10 Bytes N Bytes (ATR) 1 Byte 1 Byte
RDR_to_HOST_DataBlock Format
Offset Field Size Value Description
0 bMessageType 1 80h Indicates that a data block is
being sent from the ACR122S.

ACR122S – Communication Protocol [email protected]
Version 2.01 www.acs.com.hk
Page 14 of 57
Offset Field Size Value Description
1 dwLength
<LSB .. MSB> 4 N Size of abData field (N Bytes).
5 bSlot 1 Same as Bulk-OUT Identifies the slot number for
this command.
6 bSeq 1 Same as Bulk-OUT Sequence number for
corresponding command.
7 bStatus 1
8 bError 1
9 bChainParameter 1
Example: To send an APDU “80 84 00 00 08” to the slot 0 (default), sequence number = 3.
HOST -> 02 6F 05 00 00 00 00 03 00 00 00 80 84 00 00 08 [Checksum] 03
RDR -> 02 00 00 03
RDR -> 02 80 0A 00 00 00 00 03 00 00 00 E3 51 B0 FC 88 AA 2D 18 90 00 [Checksum] 03
Response = E3 51 B0 FC 88 AA 2D 18; SW1 SW2 = 90 00

ACR122S – Communication Protocol [email protected]
Version 2.01 www.acs.com.hk
Page 15 of 57
6.0.Pseudo-APDUs for contactless interface and
peripherals control
ACR122S comes with two primitive commands for this purpose. <Class FFh>
6.1. Direct Transmit
This command is used to send a pseudo-APDU (Tag Commands), and returns the length of the
Response Data.
Direct Transmit Command Format (Length of the Tag Command + 5 Bytes)
Command Class INS P1 P2 Lc Data In
Direct
Transmit FFh 00h 00h 00h Number of bytes to send
Tag
Command Data
Where:
Lc Number of bytes to send (1 Byte)
Maximum 255 bytes
Data In Tag command.
The data to be sent to the tag.
Direct Transmit Response Format (Tag Response + Data + 2 Bytes)
Item Command Data Meaning
1 D4 40 Tg [DataOut[]] Tag Exchange Data
2 D4 4A MaxTg BrTy [InitiatorData[]] Tag Polling
Where:
Tg A byte containing the logical number of the relevant target. This byte also
contains the More Information (MI) bit (bit 6). When the MI bit is set to 1, this
indicates that the host controller wants to send more data which is all the data
contained in the DataOUT[] array. This bit is only valid for a TPE target.
DataOut An array of raw data (from 0 up to 262 bytes) to be sent to the target by the
contactless chip.
MaxTg Maximum number of targets to be initialized by the contactless chip. The chip is
capable of handling 2 targets maximum at once, so this field should not exceed
02h.
Brty Baud rate and the modulation type to be used during the initialization.
00h: 106 kbps type A (ISO/IEC14443 Type A),
01h: 212 kbps (FeliCa polling),
02h: 424 kbps (FeliCa polling),
03h: 106 kbps type B (ISO/IEC 14443-3B),
04h: 106 kbps Innovision Jewel tag.
InitiatorData[] An array of data to be used during the initialization of the target(s). Depending on
the Baud Rate specified, the content of this field is different.

ACR122S – Communication Protocol [email protected]
Version 2.01 www.acs.com.hk
Page 16 of 57
106 kbps type A
The field is optional and is present only when the host controller wants to initialize a target with a
known UID.
In that case, InitiatorData[] contains the UID of the card (or part of it). The UID must include the
cascade tag CT if it is cascaded level 2 or 3.
Cascade Level 1
UID1 UID2 UID3 UID4
Cascade Level 2
UID1 UID2 UID3 UID4 UID5 UID6 UID7
Cascade Level 3
UID1 UID2 UID3 UID4 UID5 UID6 UID7 UID8 UID9 UID10
106 kbps type B
In this case, InitiatorData[] is formatted as following:
AFI (1byte) [Polling Method]
AFI The AFI (Application Family Identifier) parameter represents the type of
application targeted by the device IC and is used to preselect the PICCs before
the ATQB.
This field is mandatory.
Polling Method This field is optional. It indicates the approach to be used in the ISO/IEC 14443-
3B initialization:
If bit 0 = 1: Probabilistic approach (option 1) in the ISO/IEC 14443-3B
initialization,
If bit 0 = 0: Timeslot approach (option 2) in the ISO/IEC 14443-3B
initialization,
If this field is absent, the timeslot approach will be used.
212/424 kbps In that case, this field is mandatory and contains the complete pay load
information that should be used in the polling request command (5bypes, length
bytes is excluded)
106 kbps InnoVision Jewel tag. This field is not used.
Data Out Tag Response returned by the reader.
Direct Transmit Response Format
Response Data Out
Result D5 41 Status [DataIn[]] SW1 SW2
D5 4B NbTg [TargetData1[]] [TargetData2[]]

ACR122S – Communication Protocol [email protected]
Version 2.01 www.acs.com.hk
Page 17 of 57
Where:
Status A byte indicating if the process has been terminated successfully or not.
When in either DEP or ISO/IEC 14443-4 PCD mode, this byte also indicates
if NAD (Node Address) is used and if the transfer of data is not completed
with bit More Information.
DataIn An array of raw data (from 0 up to 262 bytes) received by the contactless
chip.
NbTg The number of initialized Targets (minimum 0, maximum 2 targets).
TargetDatai[] The “i” in TargetDatai[] refers to “1” or “2”. This contains the information about
the detected targets and depends on the baud rate selected. The following
information is given for one target, it is repeated for each target initialized
(NbTg times).
106 kbps Type A
Tg SENS_RES10
(2 bytes)
SEL_RES
(1 byte)
NFCIDLength
(1 byte)
NFCID1[]
(NFCIDLength bytes)
[ATS[]]
(ATSLength
bytes11))
106 kbps Type B
Tg ATQB Response
(12 bytes)
ATTRIB_RES Length
(1 byte)
ATTTRIB_RES[]
(ATTRIB_RES Length)
212/424 kbps
Tg
POL_RES length 01h
(response code)
NFCID2t Pad SYST_CODE
(optional)
1 byte 1 byte 1 byte 8 bytes 8 bytes 2 bytes
POL_RES
(18 or 20 bytes)
106 kbps Innovision Jewel tag
Tg SENS_RES
(2 bytes)
JEWELID[]
(4 bytes)
Data Out SW1 SW2.
Status Code returned by the reader.
Results SW1 SW2 Meaning
Success 90 00h The operation is completed successfully.
Error 63 00h The operation is failed.
Time Out Error 63 01h The TAG does not response.

ACR122S – Communication Protocol [email protected]
Version 2.01 www.acs.com.hk
Page 18 of 57
Results SW1 SW2 Meaning
Checksum Error 63 27h The checksum of the Response is wrong.
Parameter Error 63 7Fh The TAG Command is wrong.
6.2. Change Communication Speed
This command is used to change the baud rate.
Baud Rate Control Command Format (9 Bytes)
Command Class INS P1 P2 Lc
Baud Rate Control FFh 00h 44h New Baud Rate 00h
Where:
P2 New Baud Rate
00h = Set the new baud rate to 9600 bps.
01h = Set the new baud rate to 115200 bps.
Data Out SW1 SW2.
Status Code
Results SW1 SW2 Meaning
Success 90 Current Baud Rate The operation is completed successfully.
Error 63 00h The operation is failed.
Where:
SW2 Current Baud Rate
00h = The current baud rate is 9600 bps.
01h = The current baud rate is 115200 bps.
Note: After the communication speed is changed successfully, the program has to adjust its
communication speed to continue the rest of the data exchanges.
The initial communication speed is determined by the existence of R12 (0 ohm).
•With R12 = 115200 bps
•Without R12 = 9600 bps (default)
Example 1: To initialize a FeliCa Tag (Tag Polling).
Step 1. Issue a “Direct Transmit” APDU.
The APDU Command should be “FF 00 00 00 09 D4 4A 01 01 00 FF FF 01 00”
In which,
Direct Transmit APDU = “FF 00 00 00”
Length of the Tag Command = “09”
Tag Command (InListPassiveTarget 212Kbps) = “D4 4A 01 01”

ACR122S – Communication Protocol [email protected]
Version 2.01 www.acs.com.hk
Page 19 of 57
Tag Command (System Code Request) = “00 FF FF 01 00”
To send an APDU to the slot 0 (default), sequence number = 1.
HOST -> 02 6F 0E 00 00 00 00 01 00 00 00
FF 00 00 00 09 D4 4A 01 01 00 FF FF 01 00
[Checksum] 03
RDR -> 02 00 00 03
RDR -> 02 81 1A 00 00 00 00 01 00 00 00
D5 4B 01 01 14 01 01 01 05 01 86 04 02 02 03 00
4B 02 4F 49 8A 8A 80 08 90 00
[Checksum] 03
The APDU Response is
“D5 4B 01 01 14 01 01 01 05 01 86 04 02 02 03 00 4B 02 4F 49 8A 8A 80 08 90 00”
In which,
Response returned by the contactless chip = “D5 4B 01 01 14 01 01 01 05 01 86 04 02 02 03 00
4B 02 4F 49 8A 8A 80 08”
NFCID2t of the FeliCa Tag = “01 01 05 01 86 04 02 02”
Status Code returned by the reader = “90 00”
Example 2: To write 16 bytes data to the FeliCa Tag (Tag Write).
Step 1. Issue a “Direct Transmit” APDU.
The APDU Command should be “FF 00 00 00 23 D4 40 01 20 08 01 01 05 01 86 04 02 02 01 09 01
01 80 00 00 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA”
In which,
Direct Transmit APDU = “FF 00 00 00”
Length of the Tag Command = “23”
Tag Command (InDataExchange) = “D4 40 01”
Tag Command (Write Data) = “20 08 01 01 05 01 86 04 02 02 01 09 01 01 80 00 00 AA 55 AA 55
AA 55 AA 55 AA 55 AA 55 AA 55 AA”.
To send an APDU to the slot 0 (default), sequence number = 2.
HOST -> 02 6F 26 00 00 00 00 02 00 00 00
FF 00 00 00 21 D4 40 01 20 08 01 01 05 01 86
04 02 02 01 09 01 01 80 00 00 AA 55 AA 55 AA 55
AA 55 AA 55 AA 55 AA
[Checksum] 03

ACR122S – Communication Protocol [email protected]
Version 2.01 www.acs.com.hk
Page 20 of 57
RDR -> 02 00 00 03
RDR -> 02 81 11 00 00 00 00 02 00 00 00
D5 41 00 0C 09 01 01 05 01 86 04 02 02 00 00 90 00
[Checksum] 03
The APDU Response would be “D5 41 00 0C 09 01 01 05 01 86 04 02 02 00 00 90 00”
In which,
Response returned by the contactless chip = “D5 41”
Response returned by the FeliCa Tag = “00 0C 09 01 01 05 01 86 04 02 02 00 00”
Status Code returned by the reader = “90 00”
Example 3: To read 16 bytes data from the FeliCa Tag (Tag Write).
Step 1. Issue a “Direct Transmit” APDU.
The APDU Command should be “FF 00 00 00 13 D4 40 01 10 06 01 01 05 01 86 04 02 02 01 09 01
01 80 00”
In which,
Direct Transmit APDU = “FF 00 00 00”
Length of the Tag Command = “13”
Tag Command (InDataExchange) = “D4 40 01”
Tag Command (Read Data) = “10 06 01 01 05 01 86 04 02 02 01 09 01 01 80 00”
To send an APDU to the slot 0 (default), sequence number = 3.
HOST -> 02 6F 18 00 00 00 00 03 00 00 00
FF 00 00 00 13 D4 40 01 10 06 01 01 05 01 86 04
02 02 01 09 01 01 80 00
[Checksum] 03
RDR -> 02 00 00 03
RDR -> 02 81 22 00 00 00 00 03 00 00 00
D5 41 00 1D 07 01 01 05 01 86 04 02 02 00 00 01 00
AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 90 00
[Checksum] 03
The APDU Response would be
“D5 41 00 1D 07 01 01 05 01 86 04 02 02 00 00 01 00 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
AA 90 00”