In general terms, 

• When the device is connected, the light is on.
• When applets are processing, the light is off.
• When applets are done, the light is back on.
• Blinking is usually for quick commands (fast on/off).
• Visible off is typically a slower command, like pulling a tokencode.

The connection/activity light is not required by the USB protocol. The light is used whenever a command is sent to the USB firmware that requires processing by an applet. Then the light is turned off, the applet processes the command, and then the USB firmware turns the light back on.

The long duration commands are:

• Getting a tokencode (max ~ 2 seconds)
• Generating a keypair (max ~ 7 seconds)
• Deleting a certificate (if there are many certificates present on the card)

In terms of getting a tokencode:

1. The light is on when connected/ready.
2. The token will blink quickly for any quick commands (the token may be in use for other reasons).  This includes perhaps two quick commands in prep for pulling a tokencode.
3. The light will turn off while the tokencode is being pulled.
4. The light will turn back on once the tokencode has been given to the client via the middleware (slower command, hence the longer blink).