CRT-571带卡读写的收发卡机产品说明书sensis.kz/files/CRT-591-V1[1].0 Specification.doc · Web viewMifare 1 card control 72 9.13.4 Key verification 72 9.13.4.2 Verify key

SPECIFICATION Model No. CRT-591Date 2010/03/2

Card Issuing Ver. 1.0Page 1/95

CRT-591Card Issuing Machine

VER 1.0

USER MANUAL



CREATOR (CHINA) TECH CO., LTD·Add: 2F, M-10 Building, Center Area, Hi-tech Industrial Park, Shenzhen, China·TEL:+86 755 26710691 FAX:+86 755 26710105·Http://www.china-creator.com

Revision Log

Version Revision Time Content

1.0 2010.3.2 First Release

http://www.china-creator.com/



CONTENT1. OVERVIEW.............................................................................................................................62. Product Module Number Specification.............................................................................73. Structure And Dimension Drawings..................................................................................84． Move Card Sketch Map........................................................................................................95. General Specification..........................................................................................................10



6. CRT-591 Design Specification...........................................................................................116.1 Card Thickness Adjustment......................................................................................11

7. CRT-591 Communication Protocol...................................................................................127. 1 Transmission / Control Specification...................................................................127.2 Transmission control method and characters....................................................137.3 Transmission Format And Characters..................................................................14

7.3.1 Command format and characters...............................................................147.3.2 Successful responsive package format and character.........................157.3.3 Failed responsive package format and character..................................15

7.4 Address according to Multi-Device communication.........................................167.5 Communication Method...........................................................................................17

7.5.1 Ordinary operation..........................................................................................177.5.2 Irregular operation and back-up..................................................................17

8. CRT-591 Operation Command...........................................................................................198.1 Card Status Code（st0,st1,st2）............................................................................228.2 e1,e2 Error Code Table (e0 is always ‘0’)..............................................................23

9. Command Specification......................................................................................................259.1 Reset (Initialization)...................................................................................................259.2 Status Request Command.......................................................................................269.3 Carry Card Command:..............................................................................................279.4 Entry Command..........................................................................................................289.5 MAG-Track Read operation command..................................................................299.6 Multi-MAG-Track read command............................................................................31

9.6.1 ASCII mode read magnetic card..................................................................319.6.2 Binery mode of reading magnetic card.....................................................33

9.7 MAG-Track write operation command..................................................................349.7.1 Setting Hico/Loco way of writting...............................................................349.7.2 MAG-Track write for one track.....................................................................359.7.3 MAG-Track write download for one track.................................................369.7.4 MAG-Track write simultaneity......................................................................379.7.5 MAG-Track write by binery...........................................................................38

9.8 Auto-Check ICCard/RFCard Type:.........................................................................399.8.1 Auto-Check ICCard Type:..............................................................................399.8.2 Auto-Check RF Card Type:...........................................................................40

9.9 CPUCard Operation...................................................................................................419.9.1 CPUCard Reset................................................................................................419.9.2 Deactivate CPU Command............................................................................429.9.3 Inquire CPU Card Status:..............................................................................429.9.4 CPU Card Communication T=0....................................................................439.9.5 CPU Card Communication T=1.................................................................449.9.6 CPU Warm Reset..........................................................................................459.9.7 T=1, T=0 CPU Card Protocol Automatic Communication..................45



9.10 SAM(Secure Application Module) Control Command.....................................469.10.1 Active SAM Command..............................................................................469.10.2 Deactivate SAM Command......................................................................469.10.3 Inquire SAM Status Command................................................................479.10.4 SAM Communication T=0.........................................................................489.10.5 SAM Communication T=1.........................................................................499.10.6 SAM Warm Reset........................................................................................509.10.7 Auto-Check SAM Card T=0/T=1 Protocol.............................................509.10.8 Select SAM...................................................................................................51

9.11 SLE4442/4428 Control.............................................................................................529.11.1 SLE4442/4428 Reset.....................................................................................529.11.2 Deactivate SLE4442/4428............................................................................529.11.3 Inquire status of SLE4442/4428.................................................................539.11.4 SLE4442 Control...........................................................................................54

9.11.4.1 Data read from main memory on SLE4442.................................549.11.4.2 Data read from protection memory on SLE4442.......................559.11.4.3 Data read from security memory on SLE4442............................569.11.4.4 Data write to main memory on SLE4442......................................569.11.4.5 Data write to protection memory on SLE4442..........................579.11.4.5 Data write to security memory on SLE4442..............................589.11.4.6 Verification data present to SLE4442..........................................59

9.11.5 SLE4428 Control...........................................................................................609.11.5.1 Data Reading of main-memory of SLE4428................................609.11.5.2 Reading of protection-bit of SLE4428..........................................619.11.5.3 Data writing to main-memory of SLE4428...................................629.11.5.4 Data writing to main-memory of SLE4428 with protecting.....629.11.5.5 Written with protection-bit...............................................................639.11.5.6 Verification of password present to SLE4428............................63

9.12 I2C Memory Card Control Command..................................................................649.12.1 Activate I2C memory card..........................................................................649.12.2 Deactivate I2C memory card...................................................................659.12.3 Inquire Status of I2C memory card........................................................669.12.4 I2C Control......................................................................................................67

9.12.4.1 Read data from I2C............................................................................689.12.4.2 Write data to I2C.................................................................................68

9.13 Contactless IC card Operation..............................................................................699.13.1 Activated contackless IC card...................................................................699.13.2 Deactivate RFID card.................................................................................719.13.3 Inquire status of RFID card......................................................................719.13.4 Mifare 1 card control..................................................................................729.13.4 Key verification...........................................................................................72

9.13.4.2 Verify key from EEPROM.................................................................73



9.13.4.3 Modify sector key (KEY A)...............................................................749.13.4.4 Download password to EEPROM...............................................759.13.4.4 Read sector data................................................................................769.13.4.5 Write sector data................................................................................779.13.4.6 Initialization.........................................................................................789.13.4.7 Read value...........................................................................................799.13.4.8 Increment.............................................................................................809.13.4.9 Decrement...........................................................................................81

9.13.5 Type A RF card communication................................................................829.13.6 Type B RFcard communication.................................................................83

9.14 Shutter related operation.......................................................................................849.14.1 LED setting.....................................................................................................849.14.2 Jitter function setting...................................................................................859.14.3 Anti-fishing control.......................................................................................86

9.14.3.1 Anti-fishing status.............................................................................869.14.3.2 Anti-fishing work mode setting......................................................879.14.3.3 Anti-fishing pin control....................................................................88

9.15 Components of CRT-591........................................................................................899.16 Read Serial Number of CRT-591...........................................................................90

9.16.1 Read serial number......................................................................................909.16.2 Write Serial Number of CRT-591...............................................................90

9.17 Read CRT-591 configuration.................................................................................919.18 Read CRT-591 version information.....................................................................929.12. Error-card Bin Counter Control...........................................................................93

9.14.1 Read error-card bin counter.......................................................................939.14.2 Set initial value of error-card bin..............................................................93

1. OVERVIEW

CRT-591 is card issuing machine with IC/ RFID/ Magnetic card



read/ write functions.

CRT-591 has the following features:

·3 in 1: Support IC/ RFID/ Magnetic card read/ write

simultaneously and respectively

·Extendability: Third-party RFID or IC module is available.

·Customizability: Customization-friendly design

·Multi-unit communication: Max.16pcs via RS232 interface

·Compact and cost efficient

2. Product Module Number Specification



CRT - 591 - ( X X X ) X X - X X X

Client CodeR 0:RS232 StandardU0: USB Standard

XX: Customized Product

Card CaptureB: card capture binR: card capture channel

Version&Serials Nnumber 1---9

SAM/SIM CardY: With PSAM boardN: Without PSAM board

FunctionI: Contact IC card R/WC: RFID card R/WM: Mag card 3 tracks R/WE:（IC card+RFID card）R/WF:（RFID card+mag card）R/WG:（IC card+mag card）R/WH: （ mag card+I ccard+RFID card）R/WW: Special PCB and no PCB Shutter

D: CRT-380D (Electric shutter)N: Without Bezel

Mag Card OperationX: No mag headR: Mag card 3 tracks read onlyL: Lo-Co Mag card 3 tracks R/WH: Hi-Co Mag card 3 tracks R/W



3. Structure and Dimension Drawings



70. 2

134

152. 5158. 820. 2

57. 7391. 5

146.

8

6-156-

3.5

84.7

17

71.7

129.

4 175

5445

2

深圳市创自技术有限公司 CREATOR (CHINA) TECH CO., LTD

校对审核设计

, 共页第页单位 mm

图样标记数量日期

零件代码工艺

产品名称

版本>120~250

A.0

>50~120 比例

零件名称 0755-267103450755-26710105

材料

传真电话

6

QR - 066/ A. 1

>18~50

>3 6～ ± 0. 05

标记更改文件号处数日期签字

2

3

1

4

5

>6 18～ ± 0. 07±0. 10±0. 15± 0.21

± 0. 15±0. 18± 0. 25± 0. 30±0. 40

± 0. 35± 0.52± 0. 62± 0. 74± 1. 00

≤ 3 ± 0. 02 ± 0. 10 ± 0. 25

>250~500 ± 0.25 ±0. 50 ± 2. 00

范围 1 级 2 级 3 级一般公差

:无特殊说明尺寸公差执行方法1. 1一般孔径、轴的尺寸按级公差带执行2.一股线性公差、圆角、倒角按２级公差带执行

.３角度尺寸公差按３级公差带执行

CRT-591 系列

(86mm-100mm)装卡长

4． Move Card Sketch Map



Shutter Switch

Shutter Sensor

Sensor1(PSS1)

Sensor2(PSS2)

Sensor3(PSS3)

Sensor4(PSS4)

Sensor5(PSS5)

Sensor6(PSS6)

(DSS1)

(DSS2)

Mag card operation

IC card operation

RF Card Operation

Card stop at front with holding

Card stop at front without holding

Card empty-detect sensor

(DVS)Full Error card bin sensor

(DFS)Card lack-detect sensor

(DLS)

Card Stacker

Error Card Bin

Sensor7(PSS7)

Sensor8(PSS8)

Sensor9(PSS9)

Communication Protocol Model No. CRT-591Date 2010/3/2

Card Issuing MachineVer. 1.0

Page 12/95

5. General Specification·Power Supply:

DC 24V ±5%·Current Comsumption:

Static Current: 0.1A Peak Current During Operation: 2.0A Normal Current Condition: 800mA

·Card Feeding-Out Speed: > 0.5 Cards/s (Transportation Speed)

·Communication Interface: RS232C / USB (HID) (Ex-work setting: Default unit address is ‘0’)

·Card Dimensions: Size: 55×86mm

Thickness: 0.2mm~1.0mm (Ex-work standard: 0.8mm) ·Weight:

4.0 Kg Approx.·Dimensions:

Refer to Structure and Dimension Drawings·Card Stacking Capability:

120pcs in case of 0.76mm standard card( Available to set to 500pcs max.)

·Card Pre-Empty Detection:7~50pcs ± 2pcs ( Default setting: 15pcs)

·Enviromental Condition:Operation: 0~50℃ 0~90% RH ( Without Condensing)Storage: -10~75℃ 0~90% RH ( Without Condensing)

·Life Time: 1 million times

( In the condition: 20+/-5℃, 35~60%RH, Dispense cycle ≤ 1pcs/min) ·Support ISP Download On Line ·Compliant To RoHS

6. CRT-591 Design Specification


Card Issuing MachineVer. 1.0Page 13/95

6.1 Card Thickness AdjustmentCRT-591 makes it more accurate and convenient to dispense the cards in different

thickness via rotating the turn-knob to different gear position so as to adjust the gap

between the upper and lower transmiting wheels, which eliminates the inconvenient

and inaccurate gap adjustment defects. With this feature, CRT-591 is quite suitable

for the unattended vending devices to dispense various cards of distinct thickness.

There are several steps to adjust the thickness of cards:

1. Confirm the thickness of cards ( Raised type character are not involved in)

2. Press the turn-knob and turn around to the graducation pointed by the red arrow.

Seeing pictures below.

3. Make sure the adjustment on the right position by insert cards from stacker.

(Inserting one card from stacker will be smooth and two cards simultaneously from

behind can be impossible)

7. CRT-591 Communication Protocol7. 1 Transmission / Control Specification



1) Baud rate: 9,600/19200/38400/57600/115200BPS

2) Transmission method: Half duplex, Support multi-unit communication (16 units max)

3) Synchronous method: Asynchronous

Start

bit

D0 D1 D2 D3 D4 D5 D6 D7 Stop sbit

Start bit: 1 bit

Data length: 8bit

Check bit: none

Stop bit: 1 bit

Character Code: ASCII 8 bit code

7.2 Transmission control method and characters



CRT-591 executes particular operation according to text (command) received from HOST then

reports result of execution to HOST.. Character reference

STX (F2H) Starting bit

ETX (03H) End of bit

ACK (06H) Acknowledge

NAK (15H) Negative acknow

EOT (04H) Clear the line

ADDR The address of CRT-591

7.3 Transmission Format and Characters



7.3.1 Command format and characters STX

(0xF2)ADDR

(1 byte)LENH

(1 byte)LENL

(1 byte)CMT

(1 byte)CM

(1 byte)PM

(1 byte)DATA

(N bytes)ETX

(1 byte)BCC

(1 byte)

Range of TEXT

Range of BCC calculation

MAX 1024 byte

Code MeaningSTX (F2H) Representing the start of text in a command or a response.LENH(1 byte) Length of high byte of textLENL(1 byte) Length of low byte of textCMT Command head (‘C’ , 43H )

CM Specify as command.PM Command parameterDATA Transmission data ( N byte, N=0~512)ETX (03H) End of textBCC(1 bytes) CRC Parity

7.3.2 Successful responsive package format and characterSTX

(0xF2)ADDR

(1 byte)LENH

(1 byte)LENL

(1 byte)PMT

(1 byte)CM

(1 byte)PM

(1 byte)st0

(1 byte)st1

(1 byte)st2

(1 byte)DATA

(N bytes)ETX

(1 byte)BCC

(1 byte)

Range of TEXT




MAX 1024 byte

Code MeaningSTX (F2H) Representing the start of text in a command or a response.LENH(1 byte) Length of high byte of textLENL(1 byte) Length of low byte of textPMT Return command head ( ‘P’ , 50H )CM Return command.PM Return Command parameterst0,st1,st2 Return Status codeDATA Transmission data ( N byte, N=0~512 )ETX (03H) End of textBCC (1 byte) CRC Parity

STX(0xF2)

ADDR(1 byte)

LENH(1 byte)

LENL(1 byte)

EMT (1 byte)

CM(1 byte)

PM(1 byte)

e0(1 byte)

e1(1 byte)

e 2(1 byte)

DATA(N bytes)

ETX(1 byte)

BCC(1 byte)

Range of TEXT


MAX 1024 byte

Code MeaningSTX (F2H) Representing the start of text in a command or a response.LENH(1 byte) Length of high byte of textLENL(1 byte) Length of low byte of textEMT Return command head ( ‘N’, 45H )CM Return command.e1,e2,e0 Return error codePM Command parameterDATA Transmission data (N byte, N=0~512 ) ETX (03H) End of textBCC (1 byte) CRC Parity

7.4 Address according to Multi-Device communicationADDR：Address word for each device in multi-device communication

7.3.3 Failed responsive package format and character



Address Character



0# 00H1# 01H2# 02H3# 03H4# 04H5# 05H6# 06H7# 07H8# 08H9# 09H

10# 0AH11# 0BH12# 0CH13# 0DH14# 0EH15# 0FH

Notes:Default address is 15#. Each device has unique address.

The address of unit is setting by DIP on the main PCB Board.

DIP Address4 3 2 1

ON ON ON ON 0#ON ON ON OFF 1#ON ON OFF ON 2#ON ON OFF OFF 3#ON OFF ON ON 4#ON OFF ON OFF 5#ON OFF OFF ON 6#ON OFF OFF OFF 7#OFF ON ON ON 8#OFF ON ON OFF 9#OFF ON OFF ON 10#OFF ON OFF OFF 11#OFF OFF ON ON 12#OFF OFF ON OFF 13#OFF OFF OFF ON 14#OFF OFF OFF OFF 15#

7.5 Communication Method

7.5.1 Ordinary operation

Command ACK(HOST)



7.5.2 Irregular operation and back-up

Case 1

Case 2

Case 3

Case 4

Case 5

ACK Response(ICRW) bytes

(Execution)

Command ACK

ACK Response

(HOST)

(ICRW) bytes

(Execution)

Command

300msec Timeout

X error

Command ACK

ACK Response

(HOST)

(ICRW) bytes

(Execution)

Command

X error

NAK

Command ACK

Response Response

(HOST)

(ICRW) bytes

NAK

ACK

(Execution)

CommandACK

ACK Response

(HOST)

(ICRW) bytes

(Execution)

Command

20msec Timeout

Command(HOST)

(ICRW) bytes

EOT

(Execution)ACK

EOT

ACK



Case 6

Case 7

(discontinue)

Command(HOST)

(ICRW) bytes

300msec Timeout

ACK(Execution)

EOT

X error

EOT

EOT(discontinue)

Command(HOST)

(ICRW) bytes

EOT

(Execution)ACK

X error

Response

ACK



8. CRT-591 Operation CommandChapter Command Function CM PM description

9.1 INITIALIZE Initialize CRT-591 30H

30H If card is inside, move card to cardholding position

31H If card is inside, capture card to error card bin

32H Reset and move card to gate without holding

33H If card is inside, does not move the card.

34H Same as 30H and retract counter will work.




9.2 STATUS REQUEST Inquire status 31H 30H Report CRT-591 status

31H Report sensor status (Se status)

9.3 CARD MOVE Card movement 32H

30H Move card to gate without holding 31H Move card to card holding position32H Move card to RF card position33H Move card to IC position34H Move card behind magnetic head39H Move card to error card bin

9.4 CARD ENTRY 33H

30H Prohibit entry from gate31H Enable entry by switch 32H Enable entry by magnetic head

9.5Magnetic

card operation

Magnetic card register operation 35H

30H Only remove the card without upload data

31H Only upload ISO-1 track data32H Only upload ISO-2 track data33H Only upload ISO-3 track data40H Clear the data in the magnetic

register37H Only check the data status of

magnetic register51H Read ISO-1 track data by binery

mode52H Read ISO-2 track data by binery

mode53H Read ISO-3 track data by binery

mode

9.6

Combine the

magnetic card

operation

Combination of magnetic card

operation 36H

31H Only-read ISO-1 track32H Only-read ISO-2 track33H Only-read ISO-3 track34H Only-read ISO-1, ISO-2 track data35H Only-read ISO-1, ISO-3 track data36H Only-read ISO-2, ISO-3 track data

37H Only-read ISO-1, ISO-2, ISO-3 track data

9.7 Magnetic Magnetic card 37H 30H Set magnetic card operation mode



card writing

function writting operation

31H Download ISO-1 track data, and write into card



35H Only download ISO-1 track data to register



39H Write the data of ISO 1,2,3 in register into the card

40H Clear the data in the card without moving

51H Write ISO-1 track data by binery mode



9.8 CARD TYPE

ICCard/RFCardTypeCheck 50H

30H Autocheck ICCardType

31H Autocheck RFCardType

9.9CPU CARD CONTROL

CPU Card Applicatio Opertion

51H

30H CPUCard cold reset31H CPUCard power down 32H CPUCard status check33H T=0 CPUCard APDU data

exchange34H T=1 CPUCard APDU data

exchange38H CPUCard hot reset39H Auto distinguish T=0/T=1 CPUCard

APDU data exchange

9.10SAM CARD CONTROL

SAMCard Application Operation

52H

30H SAMCard cold reset31H SAMCard down power32H SAMCard status check 33H T=0 SAMCard APDU data

exchange 34H T=1 SAMCardAPDU data

exchange38H SAMCard hot reset39H Auto distinguish T=0/T=1

SAMCardAPDU data exchange40H Choose SAMCard stand

9.11SLE4442/4428CARD CONTROL

53H

30H SLE4442/4428Card reset 31H SLE4442/4428Card power down 32H Browse SLE4442/4428Card status33H Operate SLE4442Card34H Operate SLE4428Card

9.12 IC MEMORY

24C01—24C256Card

54H 30H ICCard reset31H ICCard down power



CARD Operation

32H Check ICCard status 33H Read ICCard34H Write ICCard

9.13RFCARD

CONTROL(13.56 MHZ)

Mifare standard card Type A & BT=CL protocol operation

60H

30H RF Card startup31H RF Card down power32H RF Card operation status check33H Mifare standard Card read/write34H Type A standard T=CLCard APDU

data exchange35H Type B standard T=CLCard APDU

data exchange

9. 14 Gata module

operation

80H30H Red LED Operation31H Green LED Operation

81H30H Prohibit Jitter function31H Enable Jitter function

82H

30H Anti-fishing hook status quiry31H Anti-fishing hookworking mode

setting32H Anti-fishing hook movement

9.16Machine SERIAL

NUMBERA2H

30H Read Machine Serial number31H Write Machine Serial number

9.17Read

Machine CONFIG

A3H30H Read Machine configuration

information

9.18READ

CRT-591 VERSION

A4H30H Read Card software version

information

9.19RECYCLE

BIN COUNTER

A5H30H Read number of counter of Card

error card bin31H Initiate card error card bin counter



8.1 Card Status Code（st0,st1,st2）st0 Content“0” No Card in CRT-591“1” One Card in gate“2” One Card on RF/IC Card Position

st1 Content“0” No Card in stacker“1” Few Card in stacker “2” Enough Cards in card box

st2 Content“0” Error card bin not full“1” Error card bin full



8.2 e1, e2 Error Code Table (e0 is always ‘0’)

e1,e2 Content“00” Reception of Undefined Command“01” Command Parameter Error“02” Command Sequence Error“03” Out of Hardware Support Command“04” Command Data Error“05” IC Card Contact Not Release

“06”--“09”“10” Card Jam“11” Electric shutter error“12” sensor error“13” Too Long-Card “14” Too Short-Card “15”“16” Card is moved artificially“17”“18”“19”“20” Read magnetic card error (CRC error)“21” Read magnetic card error“22” Write magnetic card error“23” Write magnetic card error( CRC error)

“24” Blank tracks“25” Write verify error (Qualit error)“26” Read error (No SS)

“27” Read error (No ES)“28” Read error (LRC error)“29” Write Verify Error (Data discordance)“30” Power Down

“31”“32”“33”

“34”“35”“36”“37”“38”

“39”“40” Card is taken away when module try to capture the card“41” IC card contact error caused by magnent malfuncton“42”“43” Disable To Move Card To IC Card Position“44”“45” Card is moved manually“46”“47”“48”“49”“50” Received Card Counter Overflow



“51” Motor error“52”“53”“54” Move Anti-fishing hook failure“55” Fail to execute the command ‘release anti-fishing hook’ “56”“57”“58”“59”“60” Short Circuit of IC Card Supply Power“61” Activiation of IC Card failure“62” Command Out Of IC Card Support “63” Data Transmittion of IC card error“64” Data transmittion of IC card error overtime“65” Disablity of IC Card “66” Command Out Of IC Current Card Support “67”“68”“69” CPU/SAM Non-Compliance To EMV Standard“80” When write-check by binary, data in the track is zero“81” When write-check by binary, the check data is error“A0” Empty-Stacker “A1” Full-Stacker “B0” Reset failure



9. Command Specification

9.1 Reset (Initialization)Command (TXET):

Positive response (TXET):

Negative response (TEXT):

This is to set the operation conditions for SCT and to initialize CRT-591.

When it execute at first time, ICRW will auto check and judge HOST BAUD Rate.

CRT-591 is initialized in Disable mode that card is not accepted by this command.

CRT-591 is in prohibed status and return software version information.

Pm: Command parameter

If there is no card in CRT-591, engine will rotate slightly to clear up card in stacker.

If there are cards in CRT-591, the disposal is show as below:

30H: Move the card to Gate portion

31H: Capture card to reject-stacker32H: Move card to gate without holding

33H: If card is inside CRT-591, does not move the card.

34H: Same as pm=30H, and Retract counter will work.

35H: Same as pm=31H, and Retract counter will work

36H: Same as 32H and retract counter will work.

37H: Same as pm=33H, and Retract counter will work

Pd: Clear card in CRT-591 when power-off

The operation when CRT-591 suddently power-off

=30H when power-off, do not clear the card in the machine

=31H when power-off, move the card in the machine to the card holding position.

Notes: Default setting Pd=30H

Rev_type: softeware version, “CRT-591-V1.00”

“C” 30H Pm Pd

“P” 30H Pm st0 st1 st2 Rev_type

“N” 30H Pm e0 e1 e2



9.2 Status Request CommandCommand

Positive response

Negative response

pm=30H : Report current status of st0, st1, st2.

pm=31H : Response is returned in form of Sensor, with the status information obtained.

The locations of sensor are referred to appearance drawing.

Sensor statusDSS1Gate sensor

30H DSS1 No card31H DSS1 Have card33H No Shutter

DSS2(Shutter sensor)

30H Shutter close31H Shutter open33H No shutter

PSS1 30H PSS1 No card31H PSS1 Have card









DVS(Card empty)

30H DVS No card31H DVS Have card

DLS(Dearth of card)

30H DLS No card31H DLS Have card

DFS(Error card bin)

30H DFS No card31H DFS Have card

“C” 31H Pm

“P” 31H Pm st0 st1 st2 Sensor(10 byte)

“N” 31H Pm e0 e1 e2



9.3 Carry Card Command: Command

Positive response

Negative response

Carry the card to the different positions by command operation

Pm=30H Move card to without holding card position

Pm=31H Move card to holding card position

Pm=32H Move card to RF Card position

Pm=33H Capture card to IC card position

Pm=34H Move card to Magnetic head back-end position

Pm=39H Move card to the gate

If card can not move to specified position, CRT-591 will return Card jam error

Note:

1. When execute Capture card command, if error card bin is full, CRT-591 will return error card bin

error.

2. Only capture the card in the machine except the card in the error card bin.

3. If there is no card in the channel of CRT-591, the machine will move the card from stacker to

the specific position and read/write. Otherwise, only move the card in the the channel.

4. Card should be move the card to the corresponding position to do magnetic, IC card, RF card

operation.

9.4 Entry Command

“C” 32H Pm

“P” 32H Pm st0 st1 st2

“N” 32H Pm e0 e1 e2



Command

Positive response

Negative response

Afert set card input from gate available, if insert card from gate, CRT-591 will carry the card to

magnetic head back-end position, The end of the insert can be detected by status inquiry

command.

Pm=30H Disable card input from gate

Pm=31H Enable card input from gate

Pm=32H Allow card in by magnetic signal

9.5 MAG-Track Read operation command

“C” 33H Pm

“P” 33H Pm st0 st1 st2

“N” 33H Pm e0 e1 e2



PM=30H： Card movements only within ICRW, and without upload. Move the card in CRT-591

and re-read the card and stop at magnetic card end-stop position or head-stop position, only

change the status in the registers without uploading data.

PM=31H： read data on ISO Track #1



The command with the above parameters allows ICRW to transmit the data of buffer, which have

been normally read during the card acceptance. When Read Error occurs, ICRW makes retrying

for 5 times until successfully reading When Read Error still occur, ICRW sends negative response.

In case of card jamming, ICRW sends negative response too. Data on the MAG-stripe is SS-ES-

LRC, or blank, then ICRW sends negative response without retrieve

Data format of ISO ASCII code:

-Track#1(IATA): 79 characters max. (6bits+ 1parity) e.g. b0, b1, b2, b3, b4, b5，P

-Track#2(ABA): 40 characters max. (4bits+1 parity) e.g. b0, b1, b2 b3，P

-Track#3(MINTS): 107 characters max. (4bits+ 1parity) e.g. b0, b1, b2 b3，P

For example:

ISO Track #1 ISO Track #2, #3bit 5 4 3 2 1 0 bit 3 2 1 0

data=0 0 1 0 0 0 0 30H data=0 0 0 0 0 30Hdata=A 1 0 0 0 0 1 41H data=9 1 0 0 1 39H

PM=37H：Without moving the card, check if there are any data in the reading register.

Mag_Data data format:

Sn1 Sn2 Sn3

Snx =30H No data (x=1, 2, 3)

Snx =31H Have data

"C" 35H PM

"P" 35H PM st0 st1 st2 Mag_Data(n byte)

"N" 35H PM e0 e1 e2

Command

Positive response

Negative response



PM=40H: Without moving card, but clear the data in the reading register.

PM=51H: Upload data on ISO Track #1 by binery without moving the card



Binary read card differs from others in the sent data that it is not encoded and not checked by

ASCII code, which ignores error or right, and which is in the form of converted ASCII code by one

ASCII including 4 bits binary code. There are plenty of pre-load and suffix-load zeros in these sent

data, so ICRW will ignores these zeros during sending data

For example: data in a track: (HEX) = ‘0000 0000 0011 0111 1111 0000 0000 0011 0111 1111 0000

0000’

Data packet sent to HOST: 0x33 0x37 0x3F 0x30 0x30 0x33 0x37 0x3F

If there is no data in a track, then the length of Mag_Data is 0

9.6 Multi-MAG-Track read command9.6.1 ASCII mode read magnetic card



PM=31H： Read data on ISO Track #1



PM=34H： Read data on ISO Track #1，ISO Track #2



PM=37H： Read data on ISO Track #1，ISO Track #2，ISO Track #3

Mode=30H ASCII Mode

The command with the above parameters allows ICRW to transmit the data of buffer, which have

been normally read during the card acceptance. When Read Error occurs, ICRW makes retrying

for 5 times until successfully reading When Read Error still occurs, ICRW sends negative response

and error code is 21. In case of card carrying, ICRW sends negative response too. Data on the

MAG-stripe is SS-ES-LRC, or blank, then ICRW send negative response without retrieve

Data format of ISO ASCII code:

-Track#1(IATA): 79 characters max. (6bits+ 1parity) e.g. b0, b1, b2, b3, b4, b5，P

-Track#2(ABA): 40 characters max. (4bits+1 parity) e.g. b0, b1, b2 b3，P

-Track#3(MINTS): 107 characters max. (4bits+ 1parity) e.g. b0, b1, b2 b3，P

For example

ISO Track #1 ISO Track #2, #3bit 5 4 3 2 1 0 bit 3 2 1 0

data=0 0 1 0 0 0 0 30H data=0 0 0 0 0 30Hdata=A 1 0 0 0 0 1 41H data=9 1 0 0 1 39H

Response data format: ISO#1 data+7EH+ ISO#2 data+7EH+ ISO#3 data

ISO# n data:

Positive read: “P”+ track data（ASCII code excludes SS-ES-LRC）

Negative read: “N2X” , “2X” error code （“20”“23”“24”“26”“27”“28”）

Positive response:

"C" 56H PMMode

"P" 56H PM st0 st1 st2 Mag_Data (n byte)

"N" 56H PM e0 e1 e2 Mag_Data (n byte)

Command

Positive response

Negative response



PM=31H： "P" + ISO #1 data



PM=34H： "P" + ISO #1 data + 7EH + "P" + ISO #2 data



PM=37H： "P" + ISO #1 data + 7EH + "P" + ISO #2 data + 7EH + "P" + ISO #3 data

All negative response:

E1, E0: "21"

E3, E2: error code of ISO#1

E5, E4: error code of ISO#2

E7, E6 : error code of ISO#3

PM=31H： "N "+ E3, E2

PM=32H： "N" + E5, E4

PM=33H： "N" + E7, E6

PM=34H： "N "+ E3, E2 + 7EH + "N" + E5, E4

PM=35H： "N "+ E3, E2 + 7EH + "N" + E7, E6

PM=36H： "N "+ E5, E4 + 7EH + "N" + E7, E6

PM=37H： "N "+ E3, E2 + 7EH + "N" + E5, E4 + 7EH + "N" + E7,E6

9.6.2 Binery mode of reading magnetic card

"C" 36H PMMode

"P" 36H PM st0 st1 st2 Mag_Data (n byte)

"N" 36H PM e0 e1 e2 Mag_Data (n byte)

Command

Positive response

Negative response









PM=37H： read data on ISO Track #1，ISO Track #2，ISO Track #3

Mode=30H Binery Mode

Mag_Data will return and format is as follow:

ISO#1 + 7EH + ISO#2 + 7EH + ISO#3

Binary read card differs from others in the sent data that it is not encoded and not checked by

ASCII code, which ignores error or right, and which is in the form of converted ASCII code by one

ASCII including 4 bits binary code. There are plenty of pre-load and suffix-load zeros in these sent

data, so ICRW will ignores these zeros during sending data

For example: data in a track: (HEX) = ‘0000 0000 0011 0111 1111 0000 0000 0011 0111 1111

0000 0000’

Data packet sent to HOST: 0x33 0x37 0x3F 0x30 0x30 0x33 0x37 0x3F

For example: data in a track is blank, length of ISO#N data(N=1,2,3) is 0

PM=31H： ISO #1 data



PM=34H： ISO #1 data + 7EH + ISO #2 data



PM=37H： ISO #1 data + 7EH + ISO #2 data + 7EH + ISO #3 data

9.7 MAG-Track writting operation command9.7.1 Setting Hico/Loco way of writting

"C" 37H 30H Mode

"P" 37H 30H st0 st1st2

"N" 37H 30H e0 e1e2

Command

Positive response

Negative response



Mode=30H Loco

Mode=31H Hico

Mode=32H Auto-identification

Setting Hico/Loco setting to adapt Hico/Loco card

Notes:1. Only CRT-591 is Hico model, Hico/Loco setting will be available.2. Setting improperly will cause writing failure.3. If CRT-591 implement initialication command, the machine will setting to Hico/Loco option according

to actual model setting4. When setting auto-identification, enable Loco, otherwise, Hico.

9.7.2 MAG-Track writting for one track

"C" 37H PM DATA

"P" 37H PM st0 st1 st2 Result_data(n byte)

"N" 37H PM e0 e1 e2 Result_data(n byte)

Command

Positive response

Negative response



PM=31H： Write data on ISO Track #1



Transmit data part by ASCII code to ICRW. It is not necessary to add SS, ES, and LRC.

As for the write of data, a card move is performed in the state of reaching the front of MAG.

head, and then ICRW moves card through MAG. head backward, and makes verify write (done by

read operation), the verify write is performed only time in back read.

For example:

If card is in back of ICRW with card holding, ICRW carries it to front position of MAG. head,

then moves it through MAG. head to rear to write card, and makes the verify read by the reverse

direction.

If writing is done correctly, ICRW sends positive response with three results including verify

read (VF=30H)

When write error occur, ICRW retries 2 times.

when write error still occur, ICRW sends negative response with three results including verify

read, in this case, error code E1 and E0 are “22”.

In case of card jam, ICRW sends negative response.

Result structure:

Good write: “P”+“0”+ VF （3 characters）Bad write: “N”+“2X”（“20”“24”“25”“26”“27”“28”“29”）No write*: “X”+“00”

(* This track is not designated by the parameter.)

Ex) (1)#1 good

Positive response “P0”+ “0” + 7EH +“X00”+ 7EH + “X00”

(2) #2 bad

Negative response “N”+ “2X” + 7EH +“X00”+ 7EH + “X00”

(error code E1 and E0 : “22”)

9.7.3 MAG-Track write download for one track

"C" 37H PM DATA

"P" 37H PM st0 st1st2

Command

Positive response



PM=36H： Download data to ISO Track #1 buffer



This is to write the data to ISO track buffer, but ICRW does not write card.

All the stored data are cleared when card is eject.

All the stored data are cleared when ICRW received initialize command(“C56”)

9.7.4 MAG-Track writting simultaneity

"N" 37H PM e0 e1e2

"C" 37H PM

"P" 37H PM st0 st1 st2 Result_data(n byte)

"N" 37H PM e0 e1 e2 Result_data(n byte)

Negative response

Command

Positive response



PM=39H： All three tracks simultaneous write

ICRW write data to the card from the buffer.

Before writing operation, ICRW need to write data to the buffer.

If there is no data in buffer, ICRW sends back error code”02”.

As for the write of data, a card move is performed in the state of reaching the front of MAG.

head, and then ICRW moves card through MAG. head backward, and makes verify write (done by

read operation), the verify write is performed only time in back read.

For example:

If card is in back of ICRW with card holding, ICRW carries it to front position of MAG. head,

then moves it through MAG. head to rear to write card, and makes the verify read by the reverse

direction.

If writing is done correctly, ICRW sends positive response with three results including verify

read (VF=30H)

When write error occur, ICRW retries 2 times.

When write error still occurs, ICRW sends negative response with three results including verify

read, in this case, error code E1 and E0 are “22”.

In case of card jamming, ICRW sends negative response.

Result structure:

Good write: “P”+“0”+ VF （3 characters）Bad write: “N”+“2X”（“20”“24”“25”“26”“27”“28”“29”）No write*: “X”+“00”

(* This track is not designated by the parameter.)

Ex)

(1)#1 good, #2 good, #3 good

Positive response “P0”+ “0” + 7EH +“P0”+“0”+ 7EH + “P0”+“0”

(2) #1 good, #2 bad, #3 no write

Negative response “P0”+ “0” + 7EH +“N”+“2X”+ 7EH + “X00”

(Error code E1 and E0 : “22”)

PM=40H: without writing, but clear the buffer

9.7.5 MAG-Track writting by binery

"C" 37H PM Mag_Data(n byte)

"P" 37H PM st0 st1 st2

Negative response

Command

Positive response



PM=51H： Write binary data from HOST to ICRW buffer by ASCII code, and then write the data

on ISO Track #1


on ISO Track #2


on ISO Track #3.

All the binary data in any track are in the form of converted ASCII code by one ASCII including 4

bits binary code.

For example: slice data in a track: (HEX) = ‘0011 0111 1111’

slice data packet sent to HOST: 0x33 0x37 0x3F

As for the write of data, a card move is performed in the state of reaching the front of MAG. head,

and then ICRW moves card through MAG. head backward, and makes verify write (done by read

operation), the verify write is performed only time in back read.

Verify write in binary mode differs from others, ICRW will compare the read binary data from being

“1” with the written data bits until comparing all the write data, it is right to pass all the verify, or

else it is bad.

Two special error codes for binary verify write:

“80”：do not find the data “1”

“81”：it is bad in the compare

If writing is done correctly, ICRW sends positive response to HOST.

When write error occurs, ICRW retries 2 times (including verify write).

when write error still occurs, ICRW sends negative response with three results including verify

read, in this case, error code E1 and E0 are “22”,”80” and “81”

In case of card jamming, ICRW sends negative response.

9.8 Auto-Check ICCard/RFCard Type:

9.8.1 Auto-Check ICCard Type:Command

Positive response

"N" 37H PM e0 e1 e2

“C” 50H 30H

“P” 50H 30H st0 st1 st2 Card_type

Negative response



Negative response

Auto-Check type of IC Card, and carry card to IC Card position，Auto Check IC Card Type,Return Card_type information.

Cart_type(2 byte) Specification‘0’ ‘0’ Unknown IC Card Type‘1’ ‘0’ T=0 CPU Card

‘1’ T=1 CPU Card‘2’ ‘0’ SLE4442 Card

‘1’ SLE4428 Card‘3’ ‘0’ AT24C01 Card

‘1’ AT24C02 Card‘2’ AT24C04 Card‘3’ AT24C08 Card‘4’ AT24C16 Card‘5’ AT24C32 Card‘6’ AT24C64 Card‘7’ AT24C128 Card‘8’ AT24C256 Card

“N” 50H 30H e0 e1 e2



9.8.2 Auto-Check RF Card Type: Command

Positive response

Negative response

Auto-Check type of RF card, carry card to RF card position , Auto-Check RF Card Type, Return

Card_type information

Cart_type(2 byte) Specification‘0’ ‘0’ UnknowRFCardType‘1’ ‘0’ Mifare one S50Card

‘1’ Mifare one S70Card‘2’ Mifare one ULCard

‘2’ ‘0’ Type A CPUCard‘3’ ‘0’ Type B CPUCard

“C” 50H 31H

“P” 50H 31H st0 st1 st2 Card_type

“N” 50H 31H e0 e1 e2



9.9 CPUCard Operation9.9.1 CPUCard Reset

Command

Positive response

Negative response

To cold reset IC card. The ICRW supplies power (VCC) and clock (CLK) , return ATR.

Vcc=30H: CRT-591 supplies with +5V to VCC and activates in line with the EMV2000 ver4.0.

Vcc=33H: CRT-591 supplies with +5V to VCC and activates in line with the ISO/IEC7816-3.

Vcc=35H: CRT-591 supplies with +3V to VCC and activates in line with the ISO/IEC7816-3.

In case there is no Vcc word, it will have 30H as default value.

If ATR is not compliance to EMV, return e1,e0=“69”Notes: There will be error and return ATR & Type when reset in line with EMV return

Type: CPU Card protocol Type

=30H T=0 protocol CPUCard

=31H T=1 protocol CPUCard

Formate of ATR

TS TO TA1 TB1 … TCK

“C” 51H 30H Vcc

“P” 51H 30H st0 st1 st2 Type ATR

“N” 51H 30H e0 e1 e2 Type ATR



9.9.2 Deactivate CPU CommandCommand

Positive response

Negative response

This deactivates CPU card.

9.9.3 Inquire CPU Card Status:Command

Positive response

Negative response

ICRW tells the status of IC card with sti.

St i=30H Card not activated

=31H Card have activated, current CPU Card working frequency is 3.57 MHZ

=32H Card have activated, current CPU Card working frequency is 7.16 MHZ

If ICCard power error, return e1,e0=“60”.

“C” 51H 31H

“P” 51H 31H st0 st1 st2

“N” 51H 31H e0 e1 e2

“C” 51H 32H

“P” 51H 32H st0 st1 st2 Sti

“N” 51H 32H e0 e1 e2



9.9.4 CPU Card Communication T=0Command

Positive response

Negative response

This exchanges data between CPU card by protocol T=0

C-APDU from HOST is range from 4 byte to 261 byte

R-APDU to HOST is range from 2 byte to 258 byte

An error “60” is returned when a power failure is detected.

If protocol type of IC card is not T=0, error code “62”is sent.

If ICC does not respond within Working Wait Time, CRT-591 deactivates an IC card and error code

“63” is sent.

If any other protocol error occurs, CRT-591 deactivates an IC card and error code “64” is sent.

If HOST tries to communicate before an IC card activation, error code “65” is sent.

Note: If you want to more about T=0 APDU format. Plese refer to ISO/IEC7816-3 and COS

command

“C” 51H 33H C-APDU

“P” 51H 33H st0 st1 st2 R-APDU

“N” 51H 33H e0 e1 e2

CLA INS P1 P2 LC Data1 …… Le

Data1 ….. Data(n) Sw1 Sw0



9.9.5 CPU Card Communication T=1Command

Positive response

Negative response

This exchanges data between CPU card by protocol T=1

CRT-591 should follow T=1 protocol to combinate C-APDU as I-block and send it to CPU

card.CPU card should return R-APDU to HOST

C-APDU

I-block

CRT-591 returns “R-APDU”data to HOST

I-block

R-APDU



If ICC does not respond within Working Wait Time, CRT-591 deactivates an IC card and error

code “63” is sent.



Note: If you want to more about T=0 APDU format. Plese refer to ISO/IEC7816-3 and COS

command



“N” 51H 34H e0 e1 e2

CLA

INS

P1

P2

Lc

Data1

… Data(Lc)

Le

NAD PCB LEN CLA INS P1 P2 Lc Data1

… Data(Lc)

Le EDC

Head block Information block End block

Head block Information block End blockNAD PCB LEN CLA INS P1 P2 Lc Data

1… Data(Lc

)Le EDC

CLA INS P1 P2 Lc Data1

… Data(Lc)

Le



9.9.6 CPU Warm ResetCommand

Positive response

Negative response

“N” 51H 38H e0 e1 e2

Keeping the status of the IC contact activated, then returns response upon receiving “ATR” again.

Type: CPU Card communication protocol

=30H T=0 Protocol

=31H T=1 Protocol

9.9.7 T=1, T=0 CPU Card Protocol Automatic CommunicationCommand

Positive response

Negative response

“N” 51H 39H e0 e1 e2

Protocol is recognized automatically. Set Data to “C-APDU”. CRT-591 returns “R-APDU” data to

HOST.




“63” is sent.



“C” 51H 38H






9.10 SAM(Secure Application Module) Control Command9.10.1 Active SAM Command

Command

Positive response

Negative response

The CRT-591 supplies power (VCC) and clock (CLK), then reset (RST) release.

Type: SAM protocol type

=30H T=0 protocol

=31H T=1 protocol

ATR(Answer To Reset) format:TS TO TA1 TB1 … TCK

Vcc=30H: ICRW supplies with +5V to VCC and activates in line with the EMV2000 ver4.0.

Vcc=33H: ICRW supplies with +5V to VCC and activates in line with the ISO/IEC7816-3.

Vcc=35H: ICRW supplies with +3V to VCC and activates in line with the ISO/IEC7816-3.

Incase there is no Vcc, it will have 30H as default value

If ATR is not compliance to EMV, return e1,e0=“69”Notes: There will be error and return ATR & Type when reset in line with EMV return

When a power failure is recognized while a power supply is supplied to the card, error code "60" is

returned.

9.10.2 Deactivate SAM CommandCommand

Positive response

Negative response

This deactivates SAM

“C” 52H 30H Vcc


“N” 52H 30H e0 e1 e2 Type ATR

“C” 52H 31H

“P” 52H 31H st0 st1 st2

“N” 52H 31H e0 e1 e2



9.10.3 Inquire SAM Status CommandCommand

Positive response

Negative response

CRT-591 returns the status of SAM with sti. stj

Sti =30H SAM is deactivated

Sti =31H SAM is activated, working frequency is 3.57 MHZ

Sti =32H SAM is activated, working frequency is 7.16 MHZ

Stj =30H First SAM card connector

Stj =31H Second SAM card connector (Optional)

Stj =32H Third SAM card connector (Optional)

Stj =33H Fourth SAM card connector (Optional)

Stj =34H Fifth SAM card connector (Optional)


“C” 52H 32H

“P” 52H 32H st0 st1 st2 Sti Stj

“N” 52H 32H e0 e1 e2



9.10.4 SAM Communication T=0Command

Positive response

Negative response

This exchanges data between SAM by protocol T=0



“63” is sent.



Note: If you want to more about T=0 APDU format. Plese refer to ISO/IEC7816-3 and COS command

9.10.5 SAM Communication T=1Command

Positive response

Negative response

This exchange data between SAM by protocol T=1



“63” is sent.



Note: If you want to more about T=1 APDU format. Plese refer to ISO/IEC7816-3 and COS command



“N” 52H 33H e0 e1 e2



“N” 52H 44H e0 e1 e2



9.10.6 SAM Warm ResetCommand

Positive response

Negative response

Keeping the status of the SAM activated, then returns response upon receiving.

Type: SAM protocol type

=30H T=0 Protocol

=31H T=1 Protocol

9.10.7 Auto-Check SAM Card T=0/T=1 Protocol Command

Positive response

Negative response



“63” is sent.



“C” 52H 38H


“N” 52H 38H e0 e1 e2



“N” 52H 39H e0 e1 e2



9.10.8 Select SAMCommand

Positive response

Negative response

HOST can select SAM 1,2,3,4 or 5.

Sel = 30H: SAM 1.

Sel = 31H: SAM 2. (option)




SAM command is effective only in the module selection.

When Initialize command is executed, SAM 1 will be selected.

“C” 52H 40H SAMn

“P” 52H 40H st0 st1 st2

“N” 52H 40H e0 e1 e1



9.11 SLE4442/4428 Control9.11.1 SLE4442/4428 Reset

Command

Positive response

Negative response

The CRT-591 supplies power (VCC) and clock (CLK), then reset (RST) release. After reset, return

ATR.

ATR: SLE4442 Card ATR=“A2H，13H，10H，91H”SLE4442 Card ATR=“92H，23H，10H，91H”

9.11.2 Deactivate SLE4442/4428 Command

Positive response

Negative response

The CRT-591 stop suppling power (VCC) and clock (CLK), then reset (RST) release.

“C” 53H 30H

“P” 53H 30H st0 st1 st2 ATR(4 byte)

“N” 54H 30H e0 e1 e2

“C” 53H 31H

“P” 53H 31H st0 st1 st2

“N” 53H 31H e0 e1 e2



9.11.3 Inquire status of SLE4442/4428 Command

Positive response

Negative response

CRT-591 tell the status of SLE4442/4428 with Sti after the command successfully execute.

Sti= 30H SLE4442/4428 Deactivated

Sti= 31H SLE4442 Activated

Sti= 32H SLE4428 Activated

“C” 53H 32H


“N” 54H 32H e0 e1 e2



9.11.4 SLE4442 ControlThese functions are specified by a command data form like C-APDU which format is based on

T=0 standard.

In this case, CRT-591 recognizes the meaning of the command data, and executes the treatment

related to the card by controlling hardware.

After the command was executed properly, CRT-591 returns a positive response with response

data 9000H like from the IC card. When an error occurs during the communication with

SLE4442, CRT-591 returns a positive response with status information in response data

"sw1+sw2” which is base on ISO/IEC 7816-3

Sw1 Sw2 Specification

90H 00H Success

6FH 00H Fail

6FH 01H Key Validation error

6FH 02H Key Validation error and Lock

67H 00H Address overflow

6BH 00H Operation length overflow

9.11.4.1. Data read from main memory on SLE4442Command

Positive response

Negative response

Notes: ab H: the start address to read data in the main memory

cd H: the length of bytes of data to read

CRT-591 reads data from the main memory of SLE4442, and transmits data on cdH bytes from the

address abH.

The capacity of the main memory is 256 bytes.

All the contents of the main memory can be read with the following command.

Ex) "CR3"+00B0000000

9.11.4.2. Data read from protection memory on SLE4442

“C” 53H 33H 00H B0H 00H abH cdH

“P” 53H 33H st0 st1 st2 data

“N” 53H 33H e0 e1 e2



Command

Positive response

Negative response


cd H : the length of bytes of data to read

CRT-591 handles the data of all 32bits in the protection memory as the data on 4bytes.

The contents (32bit) of the protection memory can be read with the following command.

Ex) "CR3"+00B0010004



“N” 53H 33H e0 e1 e2



9.11.4.3 Data read from security memory on SLE4442Command

Positive response

Negative response


cd H : the length of bytes of data to read

CRT-591 handles the data of all 32bits in the security memory as the data on 4bytes.

The contents (32bit) of the security memory can be read with the following command.

Ex) "CR3"+00B0020004

9.11.4.4 Data write to main memory on SLE4442Command

Positive response

Negative response

Notes: ab H: the start address to write data in the main memory

cd H : the length of bytes of data to write

ef H : the data to write first (cd H bytes)

Before write to main memory, the validation of key is must..

The capacity of the main memory is 256 bytes. The byte number "00" of data to write means

256bytes.

The example that data are written in the whole area of the main memory is shown in the following.

Ex) "CR3"+ 00D0000000 + Write Data (256byte)

After command execution, CRT-591 returns response with 9000H or sw1+sw2 as the result.

If the addressed data on main memory is protected by the protect status, Data is not allow.

“C” 53H 33H 00H B0H 02H abH cdH efH…


“N” 53H 33H e0 e1 e2

“C” 53H 33H 00H D0H

00H abH cdH efH…


“N” 53H 33H e0 e1 e2



9.11.4.5 Data write to protection memory on SLE4442Command

Positive response

Negative response

Notes: ab H: the start address to write data in the main memory

cd H: the length of bytes of data to write

ef H: the data to write first (cd H bytes)

Before write to the memory, the validation of key is must..

The address of the main memory that the protection is possible is 1Fh from 00h. Each protection

condition of the protectable main memory can be controlled with 4byte (32bits) in the protection

memory. For example, if bit0 of the protection memory byte0 is '1', data on the address 00H of the

main memory are protected.

The content of protect status can not be change once setting protection.

For exampe: write 20H data to 10H address and set up protection

Ex) “CR3”+00D001100120

After command execution, CRT-591 returns with 9000H or sw1+sw2 as the result.

ICRW reads data first from the main memory, and it is compared with the value that it was

received.

When this is wrong, writing isn't begun.

Protection condition can be set up at one time in the data which continued in the main memory.

“C” 53H 33H 00H D0H

01H abH cdH efH…


“N” 53H 33H e0 e1 e2



9.11.4.5 Data write to security memory on SLE4442Command

Positive response

Negative response

Notes: ab H : the start address to write data in the main memory

cd H : the length of bytes of data to write

ef H : the data to write first (cd H bytes)

After a password check is finished normally, the Reference-Data area of 3byte can be changed.

All 32bits are handled as 4bytes. How to change the Reference-Data is as the following.

Ex) "CR3"+ 00D0020103123456

After command execution, ICRW returns response with 9000H or sw1+sw2 as the result.

Notes: Better not to write, because the Error-counter is always allowed to write and easily make

error. Error-Counter is controlled when password is checked.

“C” 53H 33H 00H D0H

02H abH cdH efH…


“N” 53H 33H e0 e1 e2



9.11.4.6 Verification data present to SLE4442Command

Positive response

Negative response

Notes: ef H: the data to compare (3bytes)

Before changing data, password must be check

Because this function should be made effective, the issue of the next command is necessary.

Ex) “CR3”+0020030103xxxxxx (xxxxxx: security code 3bytes)

Card will verify password between card and command.

A user must know password at least when a user wants to rewrite the data on SLE4442 card.

Error-Counter can be reset in the zero if password is given to SLE4442 card properly if the value

of Error-Counter is 2 or less.

“C” 53H 33H 00H 20H 03H 01H 03H efH…


“N” 53H 33H e0 e1 e2



9.11.5 SLE4428 ControlThese functions are specified by a command data form like C-APDU which format is based on

T=0 standard.



After the command was executed properly, CRT-591 returns a positive response with response

data 9000H like from the IC card. When an error occurs during the communication with SLE4442,

CRT-591 returns a positive response with status information in response data "sw1+sw2” which is

base on ISO/IEC 7816-3

Sw1 Sw2 Specification

90H 00H Success

6FH 00H Fail

6FH 01H Key Validation error

6FH 02H Key Validation error and Lock

6BH 00H Address overflow

67H 00H Operation length overflow

9.11.5.1 Data Reading of main-memory of SLE4428Command

Positive response

Negative response

Notes: abc H: the start address to read data in the main memory

de H: the number of bytes of data to read

CRT-591 read data from main memory of SLE4428 through abcH and deH

The capacity of the main memory is 1024bytes.

De="00"

Data to read means 256bytes.

The head part of the main memory can be read with the following command.

Ex) "CR4"+00B0000000

“C” 53H 34H 00H B0H 0aH bcH deH


“N” 53H 34H e0 e1 e2



9.11.5.2 Reading of protection-bit of SLE4428Command

Positive response

Negative response

Notes: ab H: the start address to read the image of protection data of the main memory

cd H: the number of bytes of data to read

The protection conditions of 1024bytes of main-memory are changed into the data on 1024bits, and

it is read.

1024bits is equivalent to 128bytes. (1024 = 128 x 8)

Data to read first become protection information to address (000H-007H) of main-memory in the

case of abH=00H.

The contents of the whole protection image can be read with the following command.

Ex) "CR4"+00B0100080

CRT-591 read protection-bit of SLE4428 according to abH



“N” 53H 34H e0 e1 e2



9.11.5.3 Data writing to main-memory of SLE4428Command

Positive response

Negative response

Notes: abc H: the start address to write data in the main memory

de H : the number of bytes of data to write

fg H : the data to write first (de H bytes)

CRT-591 writes data in the main memory. CRT-591 returns a result after written data are checked.

Before doing this operation, password check must be done

The capacity of the main memory is 1024 bytes.

The example that data are written in from the address 100H is shown in the following.

Ex) "CR4"+ 00D0010000 + Write Data (256byte)


If the addressed data on main memory is protected, the write operation is not available.

9.11.5.4 Data writing to main-memory of SLE4428 with protectingCommand

Positive response

Negative response


de H: the number of bytes of data to write

fg H: the data to write first (de H bytes)

CRT-591 writes data in the main memory. CRT-591 returns a result after written data are checked.

Before doing this operation, password check must be done

“C” 53H 34H 00H D0H 0aH bcH deH fgH…


“N” 53H 34H e0 e1 e2

“C” 53H 34H 00H D0H

1aH bcH deH fgH…


“N” 53H 34H e0 e1 e2



9.11.5.5 Written with protection-bitCommand

Positive response

Negative response


de H: the number of bytes of data to write

fg H: the data to write first (de H bytes)

Before doing this operation that writing data with protection-bit, password check must be done


CRT-591 reads data first from the main memory, and it is compared with the value that it was

received.

When this is wrong, writing isn't begun. Protection condition can be set up at a time in the data

which continued in the main memory.

9.11.5.6 Verification of password present to SLE4428Command

Positive response

Negative response

Notes: ef H : the data to compare (2bytes)

Before changing data, Password must be checked properly with SLE4428.

Because this function should be made effective, the issue of the next command is necessary.

Ex) "CR4"+ 0020000002xxxx (xxxx: security code 2bytes)

The presented data are compared with internal data in SLE4428 card itself.

User should know the password of cad if they want to change the data in SLE4442, Error-Counter

can be reset in the zero from 7 or less than 7. When error-counter is reset as zero, lock the card.

“C” 53H 34H 00H D0H

2aH bcH deH fgH…


“N” 53H 34H e0 e1 e2

“C” 53H 34H 00H 20H 00H 00H 02H efH…


“N” 53H 34H e0 e1 e2



9.12 I2C Memory Card Control Command9.12.1 Activate I2C memory card

Command

Positive response

Negative response

To activate (24C01, 24C02, 24C04, 24C08, 24C16, 24C32, 24C64, 24C128,2 4C256) card

CRT-591 supplies a power supply (Vcc), Clock (CLK), Reset (RST).

Including:

Wrd set I2C type

Wrd =30 H To activate(24C01,24C02,24C04,24C08,24C16,24C32,24C64,24C128,24C256) card

Vcc choose voltage to card

Vcc=30H 5V

Vcc=31H 3V

Sti return I2C card type successfully

Sti =31 H To activate 24C01card

Sti =32 H To activate 24C02 card








Vcc is optional parameter, no Set parameter in command is equal to Set=30H

9.12.2 Deactivate I2C memory card

“C” 54H 30H Wrd Vcc

“P” 54H 30H st0 st1 st2

“N” 54H 30H e0 e1 e2



Command

Positive response

Negative response

CRT-591 stop suppling a power supply (Vcc), Clock(CLK), Reset(RST).

“C” 54H 31H

“P” 54H 31H st0 st1 st2

“N” 54H 31H e0 e1 e2



9.12.3 Inquire Status of I2C memory cardCommand

Positive response

Negative response

This command is used to inquire status of I2C card and return status by Sti.

Sti meanings:

Sti=30 H No I2C be activated

Sti=31 H Activated 24C01









9.12.4 I2C Control

“C” 54H 32H


“N” 54H 32H e0 e1 e2



These functions are specified by a command data form like C-APDU which format is based on T=0

standard.

In this case, CRT-591 recognizes the meaning of the command data, and execute the treatment


After the command was executed properly, CRT-591 returns a positive response with response data

9000H like from the IC card. When an error occurs during the communication with I2C, CRT-591

returns a positive response with status information in response data "sw1+sw2” which is base on

ISO/IEC 7816-3Sw1 Sw2 Specification90H 00H Success6FH 00H Fail6BH 00H Address overflow67H 00H Operation length overflow

Write/Read I2C and Address scope is showed below:Card_type ab,cd24C01 0000H ~ 007FH24C02 0000H ~ 00FFH24C04 0000H ~ 01FFH24C08 0000H ~ 03FFH24C16 0000H ~ 07FFH24C32 0000H ~ 0FFFH24C64 0000H ~ 1FFFH24C128 0000H ~ 3FFFH24C256 0000H ~ 7FFFH



9.12.4.1 Read data from I2CCommand

Positive response

Negative response

Value: ab H : The upper address of head address which begins to read data

cd H : The lower address of head address which begins to read data

ef H : The number of bytes of data to read

CRT-591 read efH length and returns to HOST according to address specified by abH,

cdH.Thelength of efH can not be surpass the length of I2C address up limit.

When the following command is transmitted, data can be read from the I2C memory card.

Ex) "CU3"+00B000000

9.12.4.2 Write data to I2CCommand

Positive response

Negative response

This command is recognized as follows.

ab H: The upper address of head address which begins to write data

cd H: The lower address of head address which begins to write data

ef H: The number of bytes of data to write

gh H: the data to write first (the head data of the data on ef H bytes)

CRT-591 read efH length and return to HOST according to address specified by abH, cdH.The

length of efH can not be surpass the length of I2C address up limit.

The example which data on 8bytes are written into I2C

Ex) "CU3"+ 00D0000008 + Write Data (8bytes)


“C” 54H 33H 00H B0H abH cdH efH

“P” 54H 33H st0 st1 st2 Data

“N” 54H 33H e0 e1 e2

“C” 54H 34H 00H D0H

abH cdH efH ghH…

“P” 54H 34H st0 st1 st2 Data

“N” 54H 34H e0 e1 e2



9.13 Contactless IC card Operation 9.13.1 Activated contackless IC card

Command

(1) Mifare One Card Positive Response

Mifare One Dard Negative Response

(2) 14443 Type A Card Positive Response

14443 Type A Card Negative Response

(3) 14443 Type B Card Positive Response

14443 Type b Card Negative Response

Activate RFID card

CRT-591 support activated IEC/ISO14443 Type A and IEC/ISO 14443 Type B

The process is show as below:

1).Mifare one card: 1. Request A (REQ A) / Answer Request A (ATQ A).

2.Anticollision

3.Select (SEL) / Unique Identifier (UID) & Select

Acknowledge (SAK)

When Mifare card successfully activate, CRT-591return:

ATQA( 2 byte), UID_data (4—10 byte) and SAK( 1 byte).

2).ISO/IEC 14443 Type A: 1. Request A( REQ A) / Answer Request A (ATQ A).

2.Anticollision

3. Select (SEL) / Unique Identifier (UID) & Select

Acknowledge (SAK)

4. Request for answer to select (RATS) / Answer to

Select (ATS)

Protocol and parameter selection request (PPSR) / PPS start(PPSS)

“C” 60H 30H Set1 Set2

“P” 60H 30H st0 st1 st2 Rtype ATQA UID_len UID_data SAK

“N” 60H 30H e1 e0 Rtype ATQA UID_len UID_data SAK

“P” 60H 30H st0 st1 st2 Rtype ATQA UID_len UID_data SAK ATS

“N” 60H 30H e0 e1 e2 Rtype ATQA UID_len UID_data SAK ATS

“P” 60H 30H st0 st1 st2 Rtype ATQB

“N” 60H 30H e0 e1 e2 Rtype ATQB



When ISO/IEC 14443 Type A card successfully activated, CRT-591 return:

Mifare card return value increase (ATS (1-254 byte) and protocol parameter (1 byte))

3).ISO/IEC 14443 Type B: 1. Request B( REQ B) / Answer Request B (ATQ B).

2. Attribute (A TTRIB) / Answer to ATTRIB

When ISO/IEC 14443 Type B card successfully activated, CRT-591 return ATQB 12

byte(including following information):

50H, PUPI (4 byte) , App.data(4 byte), Protoclol info(3 byte)

Notes:

Set1, Set2 set sequence of operation for different type of protocol

Valid value: 41H (‘A’= Type A )，42H(‘B’= Type B ), 30H( ‘0’= Do not use)

Ex1：Set1=‘A’，Set2 =‘B’ (default)

Activate sequence： Type A protocol (first sequence), Type B protocol (second sequence)

Ex2：Set1=‘B’，Set2 =‘A’ Activate sequence： Type B protocol (first sequence), Type A protocol (second sequence)

Ex3：Set1=‘A’，Set2 =‘0’ Activate sequence： Type A protocol (first sequence), Type B protocol (Deactivated)

Ex4：Set1=‘B’，Set2 =‘0’，

Activate sequence： Type B protocol (first sequence), Type A protocol (Deactivated)

Rtype: Protocol

= 41H (‘A’) In line with ISO/IEC 14443 Type A protocol

= 42H (‘B’) In line with ISO/IEC 14443 Type B protocol

= 4DH (‘M’) In line with Philps Mifare one card protocol

When Rtype= 4DH (‘M’)

ATQA= 0044H Mifare Ultralight Card

ATQA= 0004H Mifare S50 1K Card

ATQA= 0002H Mifare S70 4K Card

Mifare one, ISO/IEC 14443 Type A return UID (The length of UID_data)

UID_len=4 The length of UID_data is 4 byte

UID_len=7 The length of UID_data is 7 byte

UID_len=10 The length of UID_data is10 byte



9.13.2 Deactivate RFID cardCommand

Positive response

Negative response

Deactivate RFIN card and Output signal to antanna is closed.

9.13.3 Inquire status of RFID cardCommand

Positive response

Negative response

Inquire status of RFID sti,stj： sti stj Specification‘0’ ‘0’ Deactivated RF‘1’ ‘0’ Mifare one S50 card

‘1’ Mifare one S70 card‘2’ Mifare one UL card

‘2’ ‘0’ Type A CPU card ‘3’ ‘0’ Type B CPU card

“C” 60H 31H

“P” 60H 31H st0 st1 st2

“N” 60H 31H e0 e1 e2

“C” 60H 32H

“P” 60H 32H st0 st1 st2 sti stj

“N” 60H 32H e0 e1 e2



9.13.4 Mifare 1 card controlThese functions are specified by a command data form like C-APDU which format is based on T=0

standard.



After the command was executed properly, CRT-591 returns a positive response with response data

9000H like from the IC card. When an error occurs during the communication with Mifare 1 card

CRT-591 returns a positive response with status information in response data "sw1+sw2” which is

base on ISO/IEC 7816-3.

Sw1 Sw2 Specification90H 00H Success6FH 00H Fail6BH 00H Address overflow67H 00H Operation length overflow

9.13.4 Key verificationCommand

Positive response

Negative response

Download key to CRT-591 and verify the key directly

ks(1byte): key select (Key A=00H，Key B=01H)

sn (1byte): sector number (S50 card sn=00H-0FH, S70 card sn=00H-27H)

lc (1byte): password length lc=06H

pdata (6 byte): password data

rdata (2 byte): return data( positive response with data 9000H, and negtive response with “

sw1+sw2”)

9.13.4.2 Verify key from EEPROM

“C” 60H 33H 00H 20H ks sn lc pdata

“P” 60H 33H st0 st1 st2 rdata

“N” 60H 33H e0 e1 e2



Command

Positive response

Negative response

Read key from EEPROM of RF module and verify the sector key

Download key via command mentioned in 9.10.4.4

EEPROM can preserve 32 groups of key data

ks(1byte): key select (Key A=00H，Key B=01H)

sn (1byte): sector number (sn=00H-0FH)

rdata (2 byte): return data ( positive response with 9000H)

“C” 60H 33H 00H 21H ks sn


“N” 60H 33H e0 e1 e2



9.13.4.3 Modify sector key (KEY A)Command

Positive response

Negative response

Modify sector key (key A)

This command only can modify KEY A, an d modify KEY B as“0xFF, 0xFF, 0xFF,0xFF,0xFF,0xFF

in the mean timemodify control words as“0xFF, 0x07, 0x80, 0x69” (ex-work default)

Use block command to modify Key A, Key B control word

sn(1byte): sector number (S50 card sn=00H-0FH, S70 card sn=00H-27H)

lc(1byte): password length lc=06H

pdata: password data 6 byte.

rdata(2 byte): return data

(Positive response with data 9000H, and negtive response with “ sw1+sw2”)

“C” 60H 33H 00H D5H 00H sn lc pdata


“N” 60H 33H e0 e1 e2



9.13.4.4 Download password to EEPROMCommand

Positive response

Negative response

Read key from EEPROM of RF module and verify the sector key

EEPROM can preserve 32 groups of key data

ks(1byte): key select (Key A=00H， Key B=01H)

sn (1byte): sector number (sn=00H-0FH)

lc (1byte): password length lc=06H

pdata (6 byte): password data

rdata (2 byte): return data.

Positive response sw1+sw2=9000H.

Negtive response sw1+sw2=6F00H

“C” 60H 33H 00H D0H ks sn lc pdata


“N” 60H 33H e0 e1 e2



9.13.4.4 Read sector dataCommand

Positive response

Negative response

Read block and sequence blocks from RF card

sn (1 byte): sector number

bn (1 byte): block number

le (1 byte): block number (le=01H read one block, le=03H read three blocks)

rdata (2 byte): return data

(positive response with data 9000H, and negtive response with “ sw1+sw2”)

Notes：1.Ultralight Card only have one block in one sector， every block have 4 byte data. S50,S70

have16 byte data in one block.

2. Ultralight Card, Mifare 1k (S50), Mifare 1k (S70) card range of capacity is shown as below:

Ultralight Card: sn=00H-0FH, bn=00H, le=01H-0FH

Mifare 1k (S50): sn=00H-0FH,bn=00H-03H,le=01H-04H

Mifare 1k (S70): sn=00H-20H,bn=00H-03H,le=01H-04H

sn=21H-27H, bn=00H-0FH,le=01H-10H (S70 card last 8 sector have 16 blocks)

“C” 60H 33H 00H B0H sn bn le


“N” 60H 33H e0 e1 e2



9.13.4.5 Write sector dataCommand

Positive response

Negative response

Read block and sequence blocks from RF card

sn(1 byte): sector number

bn(1 byte): block number

le(1 byte): block number

wdata: block to write (n byte)


(Positive response with data 9000H and negtive response with “sw1+sw2”)

Notes：1. Ultralight Card only have one block in one sector，every block have 4 byte data. S50, S70

have16 byte data in one block

2. Ultralight Card, Mifare 1k (S50), Mifare 1k (S70) card card range of capacity is shown as below:

Ultralight Card: sn=00H-0FH, bn=00H-03H,lc=01H-03H

Mifare 1k(S50): sn=00H-0FH, bn=00H-03H,lc=01H-03H

Mifare 1k(S70): sn=00H-20H, bn=00H-03H,lc=01H-03H

sn=21H-27H, bn=00H-0FH, lc=01H-0FH

(S70 card last 8 sector have 16 blocks)

3. S50,S70 card last block of each sector is control sector to preserve Key A, read/write control

words, Key B.

Cautions: Do note write last block and CRT-591 also will prohibid to write last block.

“C” 60H 33H 00H D1H sn bn lc wdata


“N” 60H 33H e0 e1 e2



9.13.4.6 Initialization Command

Positive response

Negative response

Initialization operation to RF card



lc(1byte): length lc=04H

wdata: data (4 byte)


(Positive response with data 9000H, and negtive response with “ sw1+sw2”)Notes：Mifare 1k (S50), Mifare 1k (S70) card operation sector(Sector can not be out of range and last block can not be operated)

Mifare 1k(S50): sn=00H-0FH, bn=00H-03H,

Mifare 1k(S70): sn=00H-20H, bn=00H-03H,

sn=20H-27H, bn=00H-0EH,


“C” 60H 33H 00H D2H sn bn lc wdata


“N” 60H 33H e0 e1 e2



9.13.4.7 Read valueCommand

Positive response

Negative response

Read value operations to RF card





Notes：Mifare 1k(S50), Mifare 1k (S70) card operation sector

(Sector can not be out of range and last block can not be operated)



sn=20H-27H, bn=00H-0EH,


“C” 60H 33H 00H B1H sn bn


“N” 60H 33H e0 e1 e2



9.13.4.8 IncrementCommand

Positive response

Negative response

Increment operation to RF card



lc(1byte): increment length lc=04H

wdata: increment data (4 byte)







sn=20H-27H, bn=00H-0EH,


“C” 60H 33H 00H D3H

sn bn lc wdata


“N” 60H 33H e0 e1 e2



9.13.4.9 DecrementCommand

Positive response

Negative response

Decrement operation to RF sector



lc(1byte): Decrement length lc=04H

wdata: Decrement data(4 byte)

rdata (2 byte): return data(Positive response with data 9000H and negtive response with “sw1+sw2”)





sn=20H-27H, bn=00H-0EH,


“C” 60H 33H 00H D4H

sn bn lc wdata


“N” 60H 33H e0 e1 e2



9.13.5 Type A RF card communicationCommand

Positive response

Negative response

This exchanges data between RF card by protocol RF Type A T=CL according to ISO/IEC 14443-4

Notes: The max.length of C-APDU is 261 byte, the max. length of R-APDU is 258 byte.



“N” 60H 34H e0 e1 e2



9.13.6 Type B RFcard communicationCommand

Positive response

Negative response

This exchanges data between RF card by protocol RF Type B T=CL according to ISO/IEC 14443-4

Notes: The max.length of C-APDU is 261 bytes, the max.length of R-APDU is 258 byte.



“N” 60H 35H e0 e1 e2



9.14 Shutter related operation9.14.1 LED setting

This is to control the lights (red and green) in entry to on or off

PM=31H： Red light control

PM=32H： Green light control

LED=30H： On

LED=31H： Off

LED=32H： glitter（cycle is 2sec., on for 1 sec., off for 1sec.）

9.14.2 Jitter function setting

"C" 80H PM LED

"P" 80H PM st0 st1st2

"N" 80H PM e0 e1e2

"C" 81H 30H set

Command

Positive response

Negative response

Command



Jitter function setting control

Set=30H: Disable jitter

Set=31H: Set jitter function when card in with magnetic signal

Notes: 1. The jitter function will not change when execute reset command

2. Only allow D/E/F bezal to set jitter function

3. Jitter is not allowed when power-on reset

4. Set jitter function before ‘C31’, ‘C32’ card-in configuration command.

9.14.3 Anti-fishing control9.14.3.1 Anti-fishing status

"P" 81H 30H st0 st1st2

"N" 81H 30H e0 e1e2

“C” 82H 30H

Positive response

Negative response



Command

Positive response

Negative response

The mode and pin statusMode

Pin Status

0 0 Anti-fishing pin is not activated，Pin is not up (Irregular)0 1 Anti-fishing pin is not activated, pin is up (correctly) 1 0 Anti-fishing pin is activated, pin is not up (correctly)1 1 Anti-fishing pin is activated, pin is up (Irregular)

Notes: The anti-fishing control only available on E/F beze

9.14.3.2 Anti-fishing work mode setting

Command

“C” 82H 30H st0 st1 st2 Mode Pin

“N” 82H 30H e0 e1 e2

“C” 82H 31H Mode



Positive response

Negative response

Setting work mode:Mode=30H Disable (Default)

Anti-fishing pin will not be up automatically when error happened

Mode=31H Enable

Anti-fishing pin will be up automatically when error happened

Notes: Pin will be up automatically when following error occur.

a: e1,e2= “10”: Card jam

b: e1,e2 =“11”: Shutter failure

9.14.3.3 Anti-fishing pin control

Command

“C” 82H 31H st0 st1 st2 Mode Pin

“N” 82H 31H e0 e1 e2

“C” 82H 32H Mode



Positive response

Negative response

Up and release operation

Mode=30H Pin will be up

Mode=31H Pin will be release

Notes: 1. Pin fails to be up, ICRW returns error e1,e2=’54’

2. Anti-fishing pin release failure, ICRW returns error e1,e2=’54’

3. When receiving the command after execution of this command, ICRW returns error e1,e2=’55’

4. In Enable mode of anti-fishing, if the pin is up because card jam or error happens, Host must

execute this command is to release the pin. After executing this command, ICRW needs

initialize command to clear error (Card jam/shutter error)

9.15 Components of CRT-591 Omitted

“C” 63H 32H st0 st1 st2

“N” 63H 32H st0 st1 st2





9.16 Read Serial Number of CRT-5919.16.1 Read serial number

Command

Positive response

Negative response

RF Sleep / wake-up operation

Set=30H Sleep operation

Set=31H Wake-up operation

Len: read length of CRT-591serial number (0byte-18byte)

ICRW_SN: CRT-591 serial number

9.16.2 Write Serial Number of CRT-591Command

Positive response

Negative response

Len: The length of serial number

ICRW_SN: Cotents of serial number

“C” A2H 30H

“P” A2H 30H st0 st1 st2 len ICRW_SN

“N” A2H 30H e0 e1 e2

“C” A2H 31H len ICRW_SN

“P” A2H 31H st0 st1 st2

“N” A2H 31H e0 e1 e2



9.17 Read CRT-591 configurationCommand

Positive response

Negative response

CRT-591 configuration specification：ICRW_Config: Read machine configuration informationAddress Name Value Description00H S1 CRT Reader Type option

“9” S1 =“9”01H~03H S2/

S3/S4(3

Byte)

User Code option“V10” CRT version

04H S5 Card r/w type option“I” IC card r/w“C” RF card r/w“M” Mag card r/w“P” Mag card r/w“E” IC + RF card r/w “F” Mag + RF card r/w“G” Mag + IC card r/w“H” Mag + IC + RF card r/w

05H S6 Interface type option“R” RS-232Interface type“U” USB Interface type

06H S7 Mag card write type“R” Mag card read only“L” Low-Co mag card write“H” High-Co mag card write

07H S8 Shutter type option“0” Not Shutter“D” “D”type Shutter“E” “E”type Shutter“F” “F”type Shutter

08H S9 SAM option“0” Not SAM“1” SAM 1“2” SAM 2“3” SAM 3“4” SAM 4“5” SAM 5

“C” A3H 30H

“P” A3H 30H st0 st1 st2 ICRW_Config

“N” A3H 30H e1 e0



9.18 Read CRT-591 version informationCommand

Positive response

Negative response

Read information of CRT-591 version.

Pm=30H Read machine software information

Ex: Rev =“C591_V1.00_A_090910”

9.12 Error-card Bin Counter Control

“C” A4H Pm

“P” A4H 30H st0 st1 st2 Rev

“N” A4H 30H e0 e1 e2



9.14.1 Read error-card bin counterCommand

Positive response

Negative response

After reset error-card bin counter, Capture on card, counter one plus

Count= “000” ~ “999”

Counter overflow will return machine status (e1,e0=“50”)

9.14.2 Set initial value of error-card binCommand

Positive response

Negative response

Set initial value of error-card bin.

Count= “000” ~ “999”

Count value range (0-999)

“C” A5H 30H

“P” A5H 30H st0 st1 st2 Count(3 byte)

“N” A5H 30H e0 e1 e2

“C” A5H 31H Count(3 byte)

“P” A5H 31H st0 st1 st2

“N” A5H 31H e0 e1 e2

Documents

CRT-571带卡读写的收发卡机产品说明书sensis.kz/files/CRT-591-V1[1].0 Specification.doc · Web viewMifare 1 card control 72 9.13.4 Key verification 72 9.13.4.2 Verify key