Decoder Hoping Code
Decoder Hoping Code
KEY FEATURES
PIC16C54 Stand alone decoder Compatible with Microchip HCS200, HCS300, HCS301, HCS360, HCS361 and HCS410 encoders Automatic bit rate detection Automatic encoder type detection Four function outputs Up to 15 learnable transmitters RC Oscillator Single press learn
OVERVIEW
This application note fully describes the working of a code hopping decoder implemented on a Microchip PIC16C54 microcontroller. The PIC16C54 is smaller than the PIC16C56 used in the normal decoder (AN642) or the secure learn decoder (AN652). A simplified learning scheme with all encoders sharing a common key and a simplified counter synchronization scheme has been used to reduce the code space requirements. The use of a common key reduces the security of the system. The simple decoder can learn up to 15 encoders. This application note describes the various KEELOQ code hopping encoders that can be used with the decoder, the decoder hardware, and the various software modules comprising the system. The software can be used to implement a stand alone decoder or integrated with full function security systems. The decoder supports the Microchip HCS200, HCS300, HCS301, HCS360, HCS361 and HCS410 KEELOQ Code Hopping Encoders.
FIGURE 1:
LEARN INIT LEARN IND Vcc MCLR GND S0 S1 S2 S3
PIC16C54 DECODER
1 2 3 PIC16C54 Simple Decoder 4 5 6 7 8 9 18 17 16 15 14 13 12 11 10 RFIN NC OSC OUT OSC IN Vcc NC EE CS EE CK EE DIO
Notice: This is a non-restricted version of Application Note AN659 which is available under the KEELOQ License Agreement. The license agreement can be ordered from the Microchip Literature Center as DS40149.
DS00663C-page 1
AN663
INTRODUCTION TO KEELOQ ENCODERS
All KEELOQ encoders use the KEELOQ code hopping technology to make each transmission by an encoder unique. The encoder transmissions have two parts. The first part changes each time the encoder is activated and is called the hopping code part and is encrypted. The second part is the unencrypted part of the transmission, principally containing the encoders serial number identifying it to a decoder. Refer to DS91002, Introduction to KEELOQ.
Synchronization Counters
The transmitted word contains a 16-bit synchronization counter. The synchronization information is used at the decoder to determine whether a transmission is valid or is a repetition of a previous transmission. Previous codes are rejected to safeguard against code grabbers. The HCS300 and HCS301 encoders transmit two overflow bits which may be used to extend the range of the synchronization counter from 65,536 to 196,608 button operations. The HCS360 and HCS361 encoders transmit one overflow bit which can be used to extend the range of the synchronization counter from 65,536 to 131,071 button operations.
Hopping Code
The hopping code contains function information, a discrimination value, and a synchronization counter. This information is encrypted by an encryption algorithm before being transmitted. A 64-bit encryption key is used by the encryption algorithm. If one bit in the data that is encrypted changes, the result is that an average of half the bits in the output will change. As a result, the hopping code changes dramatically for each transmission and can not be predicted.
Function Information
The encoder transmits up to four bits of function information. Up to 15 different functions are available.
Discrimination Value
Stored in the encoder EEPROM, this information can be used to check integrity of decryption operation by a decoder. If known information is inserted into the transmitted string before encryption, the same information can be used at the decoder to check whether the information has been decrypted correctly. In the Microchip HCS encoders, up to 12 bits (including overflow bits) are available.
DS00663C-page 2
AN663
FIGURE 2: DECODER BLOCK DIAGRAM
RF Receiver
RFIN
S0 S1 S2 S3 PIC16C54
EEPROM
CS CLK DIO
TABLE 1:
Total Transmission Length Code Hopping Portion Sync Counter Discrimination bits User Bits Overflow Bits Independent Mode Function Code Fixed Portion Serial number Function Code Low Voltage Indicator Repeat Bit CRC Queue Bits
66 32 16 12 0 0 0 4 34 28 4 1 1 0 0
DS00663C-page 3
AN663
TABLE 2: HCS200/201 AND HCS300/301 CODE HOPPING TRANSMISSION FORMAT
Code Hopping Portion Sync Counter Discrimination Func Fixed Portion Serial Number Fund VLOW REPT
TABLE 3:
TABLE 4:
Sync Counter
TABLE 5:
TABLE 6:
Sync Counter
TABLE 7:
DS00663C-page 4
AN663
PWM Format
In general, all KEELOQ encoders share a common transmission format: A preamble to improve biasing of decision thresholds in super-regenerative receivers. The preamble consists of alternate on and off periods, each lasting as long as a single elemental period. A calibration header consisting of a low period of 10 elemental periods. Calibration actions should be performed on the low period of the header to ensure correct operation with header chopping. A string of pulse-width modulated bits, each consisting of three elements. The first element is high, the second contains the data transmitted and is either high or low, the third element is always low. A guard period is usually left between the transmissions. During this period nothing is transmitted by the encoder. Figure 3 shows the sampling points when sampling the data bits. The first and last elements are used exclusively to verify the integrity of the received symbol. The first element (sample point A) is always high, the second (sample point B) is the complement of the data bit being sent, and the final element (sample point C) is always low. Because the period between the low portion of a bit (sample point C) and the rising edge of the following bit (sample point X) can vary, the rising edge of the first element (sample point X) is used to resynchronize the receiving routine to each incoming bit. If random noise is being received, the probability of a set of three samples producing a valid combination is only 2-2 = 1/4. For a string of 66 bits, the corresponding figure is 2-134. Integrity checking on incoming signals is important. Code hopping signals require significant processing, as well as EEPROM access, to decrypt. Unnecessary processing can be avoided by not attempting to decrypt incoming codes that have bit errors.
FIGURE 3:
Data
Bit Format I
0 2 te te 2 te 4 te
1 1 te 2 te te 5 te
DS00663C-page 5
AN663
DECODER IMPLEMENTATION
The decoder is implemented on a PIC16C54 RISC microcontroller and a 93LC46B EEPROM as shown in the decoder schematic in Figure 9. However, this solution can be implemented in any PIC microcontroller with at least 500 words of program memory. The operating frequency of the controller is 4 MHz. The microcontroller is used to capture transmissions from the various encoders, decrypt transmissions captured, and check the validity of the transmission based on the information in the decrypted transmission and information stored in the EEPROM. If a transmission from a valid encoder is received, the decoder activates the outputs dictated by the transmission. Encoder information, such as serial number and synchronization information is stored externally in an EEPROM. The EEPROM used is a Microchip 93LC46B Microwire Serial EEPROM. The information stored in the EEPROM is encrypted to protect the contents. The EEPROM encryption is less secure than the KEELOQ code hopping algorithm. As can be seen from the section on encoder transmissions there are differences in the transmission formats of the different encoders that can be used with the decoder. The following section summarizes how the differences in transmitted data are dealt with by the decoder. As the serial number information follows after the code hopping portion of the transmission, any number of serial number bits can be received and processed. In the Microchip decoder described, the complete serial number (28 bits) is stored. After matching the received and stored serial number, validation of a received transmission consists of two steps. The first includes checking the integrity of the decryption operation. Here the decoder compares the least significant 8-bits of the discrimination value received with the least significant 8-bits of the serial number. The discrimination value stored with the HCS300/301/360/361 includes overflow bits and user bits. he second portion of validation involves checking synchronization information for that particular encoder. The synchronization counter transmitted by all encoders is 16 bits long. Two copies of the full synchronization counter are stored for all valid encoders. The storing of two copies of the synchronization information protects the decoder from loosing synchronization with an encoder if one of the counters is corrupted.
T
TABLE 8:
Mnemonic RF IN
1 2
I O
6, 7, 8, 9
DS00663C-page 6
AN663
PROGRAM FLOW
The software for the Microchip decoder has been written for the PIC16C54 microcontroller. The compiler used is MPASM version 01.30.01. The operating frequency of the PIC16C54 is 4 MHz. The clock speed should be kept as close as possible to 4 MHz as the reception routine (RECEIVE) is dependent on the 4 MHz clock for correct functioning. Other decoder functions that rely on a 4 MHz clock speed are the hold times of the various outputs and time-outs. The main program flow is described here. Detailed descriptions of individual functions can be found further in the application note. After startup, the encoder enters the main loop where it spends most of its time. The main loop checks to see if the learn button is being activated. If so, the decoder enters the learn mode described in the Learn in AN659. If learn has not been initiated, the microcontroller checks for transmissions from encoders (RECEIVE). If a transmission from an encoder has successfully been received, the microcontroller validates the transmission received as described in the Transmission Validation section in AN659. If the transmission received is a valid transmission from an encoder learned into the system, the system sets the appropriate outputs (M_OUTPUT).
FIGURE 4:
Reset RESET
YES
NO
NO
DS00663C-page 7
AN663
FUNCTIONAL MODULES
Reception
The reception routine (RECEIVE) is based on a reliable algorithm which has successfully been used in previous implementations of KEELOQ decoders. Automatic bit rate detection is used to compensate for variations in bit rate of different encoders of a specific type, as well as the differences in bit rate between different encoders (HCS200, HCS300, and HCS360). The reception routine is able to receive 64-bit transmissions. This can easily be extended to receive more bits. The decoder only uses the first 60 bits received. The remaining bits are ignored. The reception algorithm performs a number of functions when an output is detected from the receiver. Figure 5 gives all the major sampling points in the reception algorithm. The reception algorithm calibrates on the low period of the header to determine the actual elemental period for the transmission being received. The required elemental period is 10% of the low header period. In Figure 5 the header calibration sample points are marked 1 through 3. The calibration flow chart (Figure 6) shows at what points in the program samples 1, 2, and 3 are taken. Elemental periods outside the capture range of the algorithm (either too long or too short) are rejected, since they are due either to noise or to reception of an incomplete signal. Using the determined elemental period, three samples after the first rising edge (sample 3) following the header are taken. The first sample is taken half an elemental period after the rising edge (Sample 4); the second, one elemental period later (Sample 5), and the third, another one elemental period later (Sample 6). The first sample must be high, the second could be either high or low, and the third sample must be low. If either the first or the third sample is not as expected, the attempt at capturing a transmission is abandoned. In Figure 5, the data sample points are points 4 through 6. The flow chart describing data reception (Figure 7) shows where in the code the samples are taken. If all 64 bits have been captured, each with the correct first and third elements, the transmission can be assumed to be correct, and decryption can commence. The receiving routine should be called often enough to ensure that the high portion in the header is not missed (Sample 1, Figure 5).
FIGURE 5:
Preamble
12
3 4
6 74
In systems where the reception routine is called to check if there is activity on the receiver input, the routine should poll the input for a valid transmission for at least the time taken to complete one transmission if activity is detected on the input line. This makes provision for the reception routine being called while a transmission is in progress. Having missed the first header, the first transmission will be invalid and be discarded. The decoder should continue sampling the input through the guard time in order to catch the next header and transmission (i.e., for a decoder designed to capture HCS300 transmissions the time spent polling for a valid transmission should be at least 100 ms if activity is detected in the input line).
DS00663C-page 8
AN663
FIGURE 6: CALIBRATION FLOW CHART
Calibrate
RECEIVE
Input?
LOW
Invalid Header
RMT_0
1
HIGH
NO
Input?
HIGH
RCV1
2
Time-Out?
LOW
YES
RCV2
NO
Input?
LOW
Too Long?
RCV3
3
RCV4
YES
RCV6
Too Short?
YES
Invalid Header
RCV6
RMT_0
RCV7
Receive Data
DL1
DS00663C-page 9
AN663
FIGURE 7: DATA RECEPTION FLOW CHART
Receive Data RCV7
3
Input SAMPLE1
LOW
HIGH
Input SAMPLE2
HIGH
LOW
Data = 0 Data = 1
Input SAMPLE3
HIGH
LOW
LOW
Time-out?
NO
Last Bit?
YES
YES
Invalid
NO
Cleanup RMT2
DS00663C-page 10
AN663
VALIDATION SYNCHRONIZATION FUNCTION INTERPRETATION OUTPUT ACTIVATION KEY GENERATION DECRYPTION LEARN ROM MEMORY MAP EEPROM MEMORY MAP RAM MEMORY MAP
The confidential and proprietary information contained in this section of AN659 has been removed. The full application note is available under a license agreement and can be ordered as DS40149 from Microchip Technology Inc.
DS00663C-page 11
AN663
DEVICE PINOUTS
The device used in the application note is a PIC16C54 PDIP or SOIC.
TABLE 9:
PIN 1 2 3 4 5 6 7 8 9
DEVICE PINOUTS
PIC16C54 Function Port A Bit 2 Port A Bit 3 TIMER0 MCLR GND Port B Bit 0 Port B Bit 1 Port B Bit 2 Port B Bit 3 Decoder Function LEARN Input LEARN Indicator Connect to VDD Brown out detect Ground S0 S1 S2 S3 PIN 18 17 16 15 14 13 12 11 10 PIC16C54 Function Port A Bit 1 Port A Bit 0 Osc In Osc Out VDD Port B Bit 7 Port B Bit 6 Port B Bit 5 Port B Bit 4 Decoder Function RF Input Not used RC osc (4 MHz) +5V supply Not Used CS (93LC46B, pin 1)) CLK (93LC46B, pin 2) DIO (93LC46B, pin 3 & 4)
TIMING PARAMETERS
TABLE 10: TIMING PARAMETERS
Parameter Output activation duration Output pause if new function code received Erase all duration Learn mode time-out Learn failure LED on duration Typical 524 131 8.4 33.6 1 Unit ms ms s s s
TABLE 11:
Function Name
DECRYPT Decryption routine for Hop Code. EEREAD The data in the EEPROM at ADDRESS is read to TMP1 and TMP2 (Note). EEWRITE The data in TMP1, and TMP2 is written to the EEPROM at ADDRESS (Note). M_DIS Check discrimination value. M_CNT Check synchronization (counter) values. RECEIVE Start of the RF reception routine. LEARN Learn mode. TST_RTCC Check Timer0 and update CNT_LW and CNT_HI. TST_TIMER Check CNT_LW and CNT_HI and do whatever real-time tasks that are required. Note: TMP1, TMP2 and ADDRESS are user defined registers.
DS00663C-page 12
FIGURE 8:
APPENDIX A:
J1 1 2 3
U2 LM7805 VI G N D
VCC
D1 R5 R6 R7 R9 D3 D4 D2 D7
S0 S1 S2 S3 BUT LRNT
SCHEMATIC DIAGRAMS
17 RA0 18 RA1 1 RA2 2 RA3 RB0 6 RB1 7 8 RB2 9 RB3 10 RB4 11 RB5 12 RB6 13 RB7
DS00663C-page 13
AN663
SERIAL EEPROM
FIGURE 9:
VCC 12V MOTOR CONTROL OUT C3 100uF D8 1N4004/7 Power Supply S0 Q1 NPN RELAY SPST K2 J2 1 CON1
12V
AN663
DS00663C-page 14
U2 LM7805 VI G VO N C2 100uF D Door Motor Vcc ANTENNA L1 GARAGE LIGHT U5 17 18 1 2 RF INPUT RF RECEIVER MODULE D9 1N4004/7 VCC 8 7 6 5 S1 D6 R6 100R 1N4004/7 C5 10F Garage light R7 1M RELAY SPST Q2 NPN S0 S1 J3 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 12V K1 V1 110V AC 6 7 8 9 10 11 12 13 1 2 3 4 1K R4 1K D10 LEARN S1 LEARN INIT 1 2 R2 47K SERIAL EEPROM VCC U1 CS VCC SK NC DI NC DO GND 93LC46B
12V
D5
J1 1 2 GND 3 CON3
1N4004/7
VCC
R1 10K
C1 10pF
1 4 MCLR V RA0 RA1 3 RTCC C C RA2 RA3 16 OSC1 15 CLKOUT RB0 RB1 RB2 RB3 G RB4 RB5 N RB6 D RB7 PIC16C54 5
FIGURE 10:
Vcc
S1
S2
BT1 6V
C1 100 nF
DS00663C-page 15
AN663
AN663
ADDITIONAL INFORMATION
Microchips Secure Data Products are covered by some or all of the following: Code hopping encoder patents issued in European countries and U.S.A. Secure learning patents issued in European countries, U.S.A. and R.S.A.
REVISION HISTORY
Revision C (May 2011)
Added new section Additional Information Minor formatting and text changes were incorporated throughout the document
DS00663C-page 16
Note the following details of the code protection feature on Microchip devices: Microchip products meet the specification contained in their particular Microchip Data Sheet. Microchip believes that its family of products is one of the most secure families of its kind on the market today, when used in the intended manner and under normal conditions. There are dishonest and possibly illegal methods used to breach the code protection feature. All of these methods, to our knowledge, require using the Microchip products in a manner outside the operating specifications contained in Microchips Data Sheets. Most likely, the person doing so is engaged in theft of intellectual property. Microchip is willing to work with the customer who is concerned about the integrity of their code. Neither Microchip nor any other semiconductor manufacturer can guarantee the security of their code. Code protection does not mean that we are guaranteeing the product as unbreakable.
Code protection is constantly evolving. We at Microchip are committed to continuously improving the code protection features of our products. Attempts to break Microchips code protection feature may be a violation of the Digital Millennium Copyright Act. If such acts allow unauthorized access to your software or other copyrighted work, you may have a right to sue for relief under that Act.
Information contained in this publication regarding device applications and the like is provided only for your convenience and may be superseded by updates. It is your responsibility to ensure that your application meets with your specifications. MICROCHIP MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND WHETHER EXPRESS OR IMPLIED, WRITTEN OR ORAL, STATUTORY OR OTHERWISE, RELATED TO THE INFORMATION, INCLUDING BUT NOT LIMITED TO ITS CONDITION, QUALITY, PERFORMANCE, MERCHANTABILITY OR FITNESS FOR PURPOSE. Microchip disclaims all liability arising from this information and its use. Use of Microchip devices in life support and/or safety applications is entirely at the buyers risk, and the buyer agrees to defend, indemnify and hold harmless Microchip from any and all damages, claims, suits, or expenses resulting from such use. No licenses are conveyed, implicitly or otherwise, under any Microchip intellectual property rights.
Trademarks The Microchip name and logo, the Microchip logo, dsPIC, KEELOQ, KEELOQ logo, MPLAB, PIC, PICmicro, PICSTART, PIC32 logo, rfPIC and UNI/O are registered trademarks of Microchip Technology Incorporated in the U.S.A. and other countries. FilterLab, Hampshire, HI-TECH C, Linear Active Thermistor, MXDEV, MXLAB, SEEVAL and The Embedded Control Solutions Company are registered trademarks of Microchip Technology Incorporated in the U.S.A. Analog-for-the-Digital Age, Application Maestro, CodeGuard, dsPICDEM, dsPICDEM.net, dsPICworks, dsSPEAK, ECAN, ECONOMONITOR, FanSense, HI-TIDE, In-Circuit Serial Programming, ICSP, Mindi, MiWi, MPASM, MPLAB Certified logo, MPLIB, MPLINK, mTouch, Omniscient Code Generation, PICC, PICC-18, PICDEM, PICDEM.net, PICkit, PICtail, REAL ICE, rfLAB, Select Mode, Total Endurance, TSHARC, UniWinDriver, WiperLock and ZENA are trademarks of Microchip Technology Incorporated in the U.S.A. and other countries. SQTP is a service mark of Microchip Technology Incorporated in the U.S.A. All other trademarks mentioned herein are property of their respective companies. 2011, Microchip Technology Incorporated, Printed in the U.S.A., All Rights Reserved. Printed on recycled paper.
ISBN: 978-1-61341-165-0
Microchip received ISO/TS-16949:2002 certification for its worldwide headquarters, design and wafer fabrication facilities in Chandler and Tempe, Arizona; Gresham, Oregon and design centers in California and India. The Companys quality system processes and procedures are for its PIC MCUs and dsPIC DSCs, KEELOQ code hopping devices, Serial EEPROMs, microperipherals, nonvolatile memory and analog products. In addition, Microchips quality system for the design and manufacture of development systems is ISO 9001:2000 certified.
DS00663C-page 17
ASIA/PACIFIC
Asia Pacific Office Suites 3707-14, 37th Floor Tower 6, The Gateway Harbour City, Kowloon Hong Kong Tel: 852-2401-1200 Fax: 852-2401-3431 Australia - Sydney Tel: 61-2-9868-6733 Fax: 61-2-9868-6755 China - Beijing Tel: 86-10-8569-7000 Fax: 86-10-8528-2104 China - Chengdu Tel: 86-28-8665-5511 Fax: 86-28-8665-7889 China - Chongqing Tel: 86-23-8980-9588 Fax: 86-23-8980-9500 China - Hangzhou Tel: 86-571-2819-3180 Fax: 86-571-2819-3189 China - Hong Kong SAR Tel: 852-2401-1200 Fax: 852-2401-3431 China - Nanjing Tel: 86-25-8473-2460 Fax: 86-25-8473-2470 China - Qingdao Tel: 86-532-8502-7355 Fax: 86-532-8502-7205 China - Shanghai Tel: 86-21-5407-5533 Fax: 86-21-5407-5066 China - Shenyang Tel: 86-24-2334-2829 Fax: 86-24-2334-2393 China - Shenzhen Tel: 86-755-8203-2660 Fax: 86-755-8203-1760 China - Wuhan Tel: 86-27-5980-5300 Fax: 86-27-5980-5118 China - Xian Tel: 86-29-8833-7252 Fax: 86-29-8833-7256 China - Xiamen Tel: 86-592-2388138 Fax: 86-592-2388130 China - Zhuhai Tel: 86-756-3210040 Fax: 86-756-3210049
ASIA/PACIFIC
India - Bangalore Tel: 91-80-3090-4444 Fax: 91-80-3090-4123 India - New Delhi Tel: 91-11-4160-8631 Fax: 91-11-4160-8632 India - Pune Tel: 91-20-2566-1512 Fax: 91-20-2566-1513 Japan - Yokohama Tel: 81-45-471- 6166 Fax: 81-45-471-6122 Korea - Daegu Tel: 82-53-744-4301 Fax: 82-53-744-4302 Korea - Seoul Tel: 82-2-554-7200 Fax: 82-2-558-5932 or 82-2-558-5934 Malaysia - Kuala Lumpur Tel: 60-3-6201-9857 Fax: 60-3-6201-9859 Malaysia - Penang Tel: 60-4-227-8870 Fax: 60-4-227-4068 Philippines - Manila Tel: 63-2-634-9065 Fax: 63-2-634-9069 Singapore Tel: 65-6334-8870 Fax: 65-6334-8850 Taiwan - Hsin Chu Tel: 886-3-6578-300 Fax: 886-3-6578-370 Taiwan - Kaohsiung Tel: 886-7-213-7830 Fax: 886-7-330-9305 Taiwan - Taipei Tel: 886-2-2500-6610 Fax: 886-2-2508-0102 Thailand - Bangkok Tel: 66-2-694-1351 Fax: 66-2-694-1350
EUROPE
Austria - Wels Tel: 43-7242-2244-39 Fax: 43-7242-2244-393 Denmark - Copenhagen Tel: 45-4450-2828 Fax: 45-4485-2829 France - Paris Tel: 33-1-69-53-63-20 Fax: 33-1-69-30-90-79 Germany - Munich Tel: 49-89-627-144-0 Fax: 49-89-627-144-44 Italy - Milan Tel: 39-0331-742611 Fax: 39-0331-466781 Netherlands - Drunen Tel: 31-416-690399 Fax: 31-416-690340 Spain - Madrid Tel: 34-91-708-08-90 Fax: 34-91-708-08-91 UK - Wokingham Tel: 44-118-921-5869 Fax: 44-118-921-5820
05/02/11
DS00663C-page 18