PIC16C57 Based Code Hopping Security System PINOUT. Learn

Transcription

1 PI657 Based ode Hopping Security System Author: OVERVIEW This document describes a PI657 based code hopping automotive security system. The security system implements all the basic features found on security systems and can be changed to modify or add features as required. The code can also be moved to a higher functionality PImicro microcontroller for more I/O or code space. FEATURES Kobus Marneweck Microchip Technology Inc. PIUT T0KI VDD N VSS N DIO LK S RFIN IMMO SIREN PLIGHT N LOK U PI MLR OS OS N4 N N OVR LEARN DOOR TRIG IGN TRUNK UNLOK ode hopping alarm system System can handle up to six transmitters ing of new transmitters Arm/Disarm Trunk release ar finder Panic Locking/unlocking of doors Door and shock sensor trigger inputs REOMMENDED READING If the reader is unfamiliar with KEELOQ ode Hopping it would be helpful to read Introduction to KEELOQ (DS900). This and other KEELOQ literature can be found on Microchip s Web site or from a Microchip field application engineer. The software described in this application note is available on a diskette from Microchip by ordering DS4049. A complete list of KEELOQ literature can be found at the end of the application note. BLOK DIAGRAM Power Supply Switch Inputs Ignition Doors Trigger RF Receiver PI657 Outputs Parking Lights Lock Unlock Trunk Immob Siren KEELOQ is a registered trademark of Microchip Technology, Inc. PIMicro is a trademark of Microchip Technology, Inc. Microchip s Secure Data Products are covered by some or all of the following patents: ode hopping encoder patents issued in Europe, U.S.A., and R.S.A. U.S.A.: 5,57,87; Europe: ; R.S.A.: ZA9/476 Secure learning patents issued in the U.S.A. and R.S.A. U.S.A.: 5,686,904; R.S.A.: 95/ Microchip Technology Inc. DS00645B-page

2 MEMORY MAP EEPROM (6 BIT WORDS) Address Address 00h USER0 0h NT0 0h LRN_PTR h NT 0h BSTATUS h SER0 0h SSTATUS h SER 04h TMPNT 4h KEY0 05h USER 5h KEY 06h USER 6h KEY 07h USER 7h KEY 08h USER4 8h NT0 09h USER5 9h NT 0Ah DIS0 Ah SER0 0Bh DIS Bh SER 0h DIS h KEY0 0Dh DIS Dh KEY 0Eh DIS4 Eh KEY 0Fh DIS5 Fh KEY 0h NT00 0h NT40 h NT0 h NT4 h SER00 h SER40 h SER0 h SER4 4h KEY00 4h KEY40 5h KEY0 5h KEY4 6h KEY0 6h KEY4 7h KEY0 7h KEY4 8h NT0 8h NT50 9h NT 9h NT5 Ah SER0 Ah SER50 Bh SER Bh SER5 h KEY0 h KEY50 Dh KEY Dh KEY5 Eh KEY Eh KEY5 Fh KEY Fh KEY5 LRN_PTR SSTATUS BSTATUS TMPNT indicator points to the next available learn position. Stores the system status. Backup copy of system status. Stores the temporary counter for resynchronization. DS00645B-page 998 Microchip Technology Inc.

3 FIGURE : ALARM STATE DIAGRAM State == State ==Immob Reset State == Remote State == 0s Time-out Trigger Remote request Remote Remote Immob 0s & IGN off IGN on request request complete or 0s time-out return to previous 998 Microchip Technology Inc. DS00645B-page

4 OPERATION Reset Reset initializes the I/O ports, variables, and flags. The system status is read from EEPROM and the status is restored. When the system enters armed state, the doors are locked (activate LOK) and the SIREN and PLIGHT are activated for 50 ms. The changes to a slow flash rate. If a trigger is detected (IGN, DOOR or TRIG- GER) the system changes to the alarm state. Actions upon entry:. Flash parking lights for 50 ms.. hirp siren for 50 ms.. Lock doors for 500 ms. 4. Update system status. 5. flash. 6. Disable start. TABLE : STATE HANGE TABLE ondition IGN high TRIG high DOOR high Panic (any button activated for seconds) Remote function Remote function (trunk release) Remote function (car finder) LEARN high Next State state is entered whenever a trigger is detected in armed state. SIREN is activated and PLIGHT is turned on and off at a Hz rate. If a remote is detected in this state, the system changes to drive state. After a 0-second delay, SIREN and PLIGHT will be deactivated and the system returned to armed state. Actions upon entry:. Flash parking lights.. Siren on.. flash. 4. Update system status. 5. Disable start. TABLE : STATE HANGE TABLE ondition Panic (any button activated for seconds) Remote function Remote function (trunk release) 0-second timeout Next state When the system enters drive state, the doors are unlocked (activate UNLOK), and the SIREN and PLIGHT are activated twice for 50 ms.the IMMOB output is activated to enable the starting of the vehicle and is turned off. A remote signal will return the system to armed state. Actions upon entry:. Flash parking lights for 50 ms.. hirp siren for 50 ms.. Unlock doors for 500 ms. 4. Flash parking lights for 50 ms. 5. hirp siren for 50 ms. 6. Update system status. 7. off. 8. Enable start. TABLE : Immob STATE HANGE TABLE ondition Panic (any button activated for seconds) Remote function & IGN low Remote function & IGN high Remote function (trunk release) Remote function (car finder) 0-second timeout & IGN off LEARN high Next State Immob If the IGN is turned off for more than 0 seconds, the system will immobilize. The IMMOB output is turned off, and the is turned on. A remote signal only will change the state to armed, and a remote signal with the IGN on will return to drive state. Actions upon entry:. Update system status.. off.. Disable start. TABLE 4: STATE HANGE TABLE ondition Panic (any button activated for seconds) Remote function & IGN low Remote function & IGN high Remote function (trunk release) Remote function (car finder) LEARN high Next State Immob Immob DS00645B-page Microchip Technology Inc.

5 A LEARN input in any state will put the system in learn mode. After learn is completed or timed out the system returns to the previous state. Actions upon entry:. Update system status set PASS.. on. After first transmission:. Update system status set PASS.. off. After second transmission:. Update system status set RMAL.. on for second.. Return to previous state. TABLE 5: ondition Remote first operation Remote second operation LEARN high for 8 seconds STATE HANGE TABLE Next State Pass Return to previous state Erase all transmitters FUNTIONAL MODULES Reception The reception routine is based on reliable algorithms used in previous implementations of KEELOQ decoders. Automatic baud rate detection is used to compensate for variations in baud rate from different encoders of a specific type as well as the difference in baud rate between different encoders (HS00, HS00, HS0, HS60, HS6, and HS40). The reception routine will be able to handle 56- and 66-bit transmissions. The reception routine will determine the type of transmission by the number of bits in the transmission. This routine will be the same for all implementations. Key Generation and Decryption Decryption is done in software in the implementation. The decryption and key generation algorithms is implemented in software. The manufacturer s code is stored in program memory and code protected to securely store the key. Validation Validation consists of the following steps:. hecking the serial number (4 or 8 bits) against the stored transmitters.. omparing the discrimination value ( bits) against the stored discrimination value.. hecking that the synchronization counter falls within the first synchronization window. 4. hecking if the synchronization counter falls within the second synchronization window. 5. If found to be correct, updating the synchronization counter. Function Interpretation Transmitter Button Function ode System Function 000 Arm/Disarm 000 Trunk release 00 ar finder, or for seconds 00XX Panic The LEARN input is active high. ing is initiated by momentarily pressing the LEARN button. The decoder uses the current learning position as a scratch pad area. This means that an unsuccessful learn will delete the information stored at that learn position. The learn indicator will not be incremented if the learn was unsuccessful. The flow chart (Figure ) shows the learning operation. 998 Microchip Technology Inc. DS00645B-page 5

6 FIGURE : LEARN OPERATION LEARN MODE Press Button on solid Button still pressed? First code received? Time greater than.6 sec.? off Time greater than 8.4 sec.? Second code received? Erase memory Time greater than.6 sec.? ode Validated? new transmitter on solid for second on solid for 0. second Exit Turn off END DS00645B-page Microchip Technology Inc.

7 The following checks will be performed on the received codes to determine if the transmitter is valid:. The first code that is received is checked for bit integrity.. The stored serial numbers are searched to check if a transmitter is relearned. If a relearn is taking place, that position is used. Otherwise, the position pointed to by the learn indicator will be used.. The serial number is stored in the current learn position and used to generate a key. 4. The hop code is decrypted and the result stored temporarily. 5. The serial number of the second code that is received will be compared to the first received serial number. 6. The second hop code is decrypted and the discrimination values compared. 7. The synchronization counters of the decrypted codes will be compared to check that they are sequential codes. 8. If all the checks pass the learn were successful, the learn indicator is incremented. Otherwise, the position is erased. Operation. Press and release the LEARN button. Indicator will turn on to indicate learn mode.. Press transmitter button. The will turn off.. Press transmitter a second time. The will turn on for second to indicate that the transmitter was learned successfully. 4. Repeat steps - to learn up to six transmitters. The seventh transmitter will overwrite the first transmitter that was learned. 5. will be terminated if two nonsequential codes were received or if two acceptable codes were not decoded within.6 seconds. A valid learn will be indicated by the turning on solid for second. 6. Erasing all the transmitters is accomplished by pressing and holding the LEARN button for 8.4 seconds. The will turn off at the end of the 8.4 seconds to indicate that the transmitters were erased. The learn indicator will be reset to the first position. 998 Microchip Technology Inc. DS00645B-page 7

8 TABLE 6: DEVIE PIUT PIN PI657 Function Function PIN PI657 Function Function RT APP select 8 MLR RESET VDD +5V supply 7 Osc In R osc (4 MHz) N 6 Osc Out 4 GND Ground 5 Port Bit 7 N 5 N 4 Port Bit 6 N 6 Port A Bit 0 EEPROM DIO(+4) Port Bit 5 N 7 Port A Bit EEPROM LK () Port Bit 4 OVR 8 Port A Bit EEPROM S () Port Bit LEARN 9 Port A Bit RFIN 0 Port Bit DOOR 0 Port B Bit 0 IMMOB 9 Port Bit TRIG Port B Bit SIREN 8 Port Bit 0 IGN Port B Bit PLIGHT 7 Port B Bit 7 Port B Bit N 6 Port B Bit 6 TRUNK 4 Port B Bit 4 LOK 5 Port B Bit 5 UNLOK TABLE 7: TIMING PARAMETERS Parameter Typical Unit flash rate per second Siren time-out second time-out second time-out second All erase 8 second LOK, UNLOK, TRUNK activation 500 ms Siren chirp (arm & disarm) 50 ms Parking light (arm & disarm) 50 ms Parking light flash rate (siren) per second Panic seconds DS00645B-page Microchip Technology Inc.

9 FIGURE : IRUIT DIAGRAM J ON D5 n4004/7 00 µf Receiver RX RR V G ND A NT G ND 7 V 0 G ND V T ES T O UT V 4 5 Telecontrolli RR - 4 U LM7805 VI G ND VO V V 00 µf U VSS DO 4 TEST TEST V 9L46B DI LK S RA k LS D Buzzer 4 00 nf k 5 RB k D U T0ckI VDD N VSS N DIO MLR 8 OS 7 OS 6 N4 5 N 4 N LK S OVR LEARN RFIN DOOR 0 IMMO TRIG 9 SIREN IGN 8 PLIGHT 7 N TRUNK 6 LOK UNLOK 5 R k KLQ_SE D V U V OUT GND Power Supply Supervision 4 RD k 5 RE k D4 D5 6 RF k D6 R 0k 0 pf S SW PB S SW PB RP RP9P8R 0K S SW PB V S SW PB 998 Microchip Technology Inc. DS00645B-page 9

10 LIST OF HANGES Date Version Page Paragraph hange 08/6/96.0 Original 0/0/98.0 EEPROM hanged from 946 to 9L46B, adding a series resistor on DIO DS00645B-page Microchip Technology Inc.

11 TES: 998 Microchip Technology Inc. DS00645B-page

12 Note the following details of the code protection feature on PImicro MUs. The PImicro family meets the specifications contained in the Microchip Data Sheet. Microchip believes that its family of PImicro microcontrollers is one of the most secure products of its kind on the market today, when used in the intended manner and under normal conditions. There are dishonest and possibly illegal methods used to breach the code protection feature. All of these methods, to our knowledge, require using the PImicro microcontroller in a manner outside the operating specifications contained in the data sheet. The person doing so may be engaged in theft of intellectual property. Microchip is willing to work with the customer who is concerned about the integrity of their code. Neither Microchip nor any other semiconductor manufacturer can guarantee the security of their code. ode protection does not mean that we are guaranteeing the product as unbreakable. ode protection is constantly evolving. We at Microchip are committed to continuously improving the code protection features of our product. If you have any further questions about this matter, please contact the local sales office nearest to you. Information contained in this publication regarding device applications and the like is intended through suggestion only and may be superseded by updates. It is your responsibility to ensure that your application meets with your specifications. No representation or warranty is given and no liability is assumed by Microchip Technology Incorporated with respect to the accuracy or use of such information, or infringement of patents or other intellectual property rights arising from such use or otherwise. Use of Microchip s products as critical components in life support systems is not authorized except with express written approval by Microchip. No licenses are conveyed, implicitly or otherwise, under any intellectual property rights. Trademarks The Microchip name and logo, the Microchip logo, FilterLab, KEELOQ, microid, MPLAB, PI, PImicro, PIMASTER, PISTART, PRO MATE, SEEVAL and The Embedded ontrol Solutions ompany are registered trademarks of Microchip Technology Incorporated in the U.S.A. and other countries. dspi, EOMONITOR, FanSense, FlexROM, fuzzylab, In-ircuit Serial Programming, ISP, IEPI, microport, Migratable Memory, MPASM, MPLIB, MPLINK, MPSIM, MXDEV, PI, PIDEM, PIDEM.net, rfpi, Select Mode and Total Endurance are trademarks of Microchip Technology Incorporated in the U.S.A. Serialized Quick Turn Programming (SQTP) is a service mark of Microchip Technology Incorporated in the U.S.A. All other trademarks mentioned herein are property of their respective companies. 00, Microchip Technology Incorporated, Printed in the U.S.A., All Rights Reserved. Printed on recycled paper. Microchip received QS-9000 quality system certification for its worldwide headquarters, design and wafer fabrication facilities in handler and Tempe, Arizona in July 999. The ompany s quality system processes and procedures are QS-9000 compliant for its PImicro 8-bit MUs, KEELOQ code hopping devices, Serial EEPROMs and microperipheral products. In addition, Microchip s quality system for the design and manufacture of development systems is ISO 900 certified. 00 Microchip Technology Inc.

13 M WORLDWIDE SALES AND SERVIE AMERIAS orporate Office 55 West handler Blvd. handler, AZ Tel: Fax: Technical Support: Web Address: Rocky Mountain 55 West handler Blvd. handler, AZ Tel: Fax: Atlanta 500 Sugar Mill Road, Suite 00B Atlanta, GA 050 Tel: Fax: Boston Lan, Suite 0 Westford, MA 0886 Tel: Fax: hicago Pierce Road, Suite 80 Itasca, IL 604 Tel: Fax: Dallas 4570 Westgrove, Suite 60 Addison, TX 7500 Tel: Fax: Detroit Tri-Atria Office Building 55 Northwestern Highway, Suite 90 Farmington Hills, MI 484 Tel: Fax: Kokomo 767 S. Albright Road Kokomo, Indiana 4690 Tel: Fax: Los Angeles 80 Von Karman, Suite 090 Irvine, A 96 Tel: Fax: New York 50 Motor Parkway, Suite 0 Hauppauge, NY 788 Tel: Fax: San Jose Microchip Technology Inc. 07 North First Street, Suite 590 San Jose, A 95 Tel: Fax: Toronto 685 Northam, Suite 08 Mississauga, Ontario L4V X5, anada Tel: Fax: ASIA/PAIFI Australia Microchip Technology Australia Pty Ltd Suite, 4 Rawson Street Epping, NSW Australia Tel: Fax: hina - Beijing Microchip Technology onsulting (Shanghai) o., Ltd., Beijing Liaison Office Unit 95 Bei Hai Wan Tai Bldg. No. 6 haoyangmen Beidajie Beijing, 0007, No. hina Tel: Fax: hina - hengdu Microchip Technology onsulting (Shanghai) o., Ltd., hengdu Liaison Office Rm. 40, 4th Floor, Ming Xing Financial Tower No. 88 TIDU Street hengdu 6006, hina Tel: Fax: hina - Fuzhou Microchip Technology onsulting (Shanghai) o., Ltd., Fuzhou Liaison Office Unit 8F, World Trade Plaza No. 7 Wusi Road Fuzhou 5000, hina Tel: Fax: hina - Shanghai Microchip Technology onsulting (Shanghai) o., Ltd. Room 70, Bldg. B Far East International Plaza No. 7 Xian Xia Road Shanghai, 0005 Tel: Fax: hina - Shenzhen Microchip Technology onsulting (Shanghai) o., Ltd., Shenzhen Liaison Office Rm. 5, /F, Shenzhen Kerry entre, Renminnan Lu Shenzhen 5800, hina Tel: Fax: Hong Kong Microchip Technology Hongkong Ltd. Unit 90-6, Tower, Metroplaza Hing Fong Road Kwai Fong, N.T., Hong Kong Tel: Fax: India Microchip Technology Inc. India Liaison Office Divyasree hambers Floor, Wing A (A/A4) No., O Shaugnessey Road Bangalore, , India Tel: Fax: Japan Microchip Technology Japan K.K. Benex S- 6F -8-0, Shinyokohama Kohoku-Ku, Yokohama-shi Kanagawa, -00, Japan Tel: Fax: Korea Microchip Technology Korea 68-, Youngbo Bldg. Floor Samsung-Dong, Kangnam-Ku Seoul, Korea 5-88 Tel: Fax: Singapore Microchip Technology Singapore Pte Ltd. 00 Middle Road #07-0 Prime entre Singapore, Tel: Fax: Taiwan Microchip Technology Taiwan F-, No. 07 Tung Hua North Road Taipei, 05, Taiwan Tel: Fax: EUROPE Denmark Microchip Technology Nordic ApS Regus Business entre Lautrup hoj - Ballerup DK-750 Denmark Tel: Fax: France Microchip Technology SARL Parc d Activite du Moulin de Massy 4 Rue du Saule Trapu Batiment A - ler Etage 900 Massy, France Tel: Fax: Germany Microchip Technology GmbH Gustav-Heinemann Ring 5 D-879 Munich, Germany Tel: Fax: Italy Microchip Technology SRL entro Direzionale olleoni Palazzo Taurus V. Le olleoni 004 Agrate Brianza Milan, Italy Tel: Fax: United Kingdom Arizona Microchip Technology Ltd. 505 Eskdale Road Winnersh Triangle Wokingham Berkshire, England RG4 5TU Tel: Fax: /8/0 00 Microchip Technology Inc.