AN645

PIC16C57 Based Code Hopping Security System

Author: Kobus Marneweck Microchip Technology Inc.

PINOUT
T0CKI VDD NC VSS NC DIO CLK CS RFIN IMMO SIREN PLIGHT NC1 LOCK U1 1 2 3 4 5 6 7 8 9 10 11 12 13 14 28 27 26 25 24 23 22 21 20 19 18 17 16 15 MCLR OSC1 OSC2 NC4 NC3 NC2 OVR LEARN DOOR TRIG IGN LED TRUNK UNLOCK

OVERVIEW
This document describes a PIC16C57 based code hopping automotive security system. The security system implements all the basic features found on security systems and can be changed to modify or add features as required. The code can also be moved to a higher functionality PICmicro microcontroller for more I/O or code space.

PIC16C57

FEATURES
Code hopping alarm system System can handle up to six transmitters Learning of new transmitters Arm/Disarm Trunk release Car nder Panic Locking/unlocking of doors Door and shock sensor trigger inputs

BLOCK DIAGRAM

Power Supply Switch Inputs

RF Receiver LED Outputs LED Parking Lights Lock Unlock Trunk Immob Siren

RECOMMENDED READING
If the reader is unfamiliar with KEELOQ Code Hopping it would be helpful to read Introduction to KEELOQ (DS91002). This and other KEELOQ literature can be found on Microchips Web site or from a Microchip eld application engineer. The software described in this application note is available on a diskette from Microchip by ordering DS40149. A complete list of KEELOQ literature can be found at the end of the application note.

Ignition PIC16C57 Doors Trigger Learn

KEELOQ is a registered trademark of Microchip Technology, Inc. PICMicro is a trademark of Microchip Technology, Inc. Microchips Secure Data Products are covered by some or all of the following patents: Code hopping encoder patents issued in Europe, U.S.A., and R.S.A. U.S.A.: 5,517,187; Europe: 0459781; R.S.A.: ZA93/4726 Secure learning patents issued in the U.S.A. and R.S.A. U.S.A.: 5,686,904; R.S.A.: 95/5429

1998 Microchip Technology Inc.

DS00645B-page 1

AN645
MEMORY MAP EEPROM (16 BIT WORDS)
Address 00h 01h 02h 03h 04h 05h 06h 07h 08h 09h 0Ah 0Bh 0Ch 0Dh 0Eh 0Fh 10h 11h 12h 13h 14h 15h 16h 17h 18h 19h 1Ah 1Bh 1Ch 1Dh 1Eh 1Fh LRN_PTR SSTATUS BSTATUS TMPCNT USER0 LRN_PTR BSTATUS SSTATUS TMPCNT USER1 USER2 USER3 USER4 USER5 DIS0 DIS1 DIS2 DIS3 DIS4 DIS5 CNT00 CNT01 SER00 SER01 KEY00 KEY01 KEY02 KEY03 CNT10 CNT11 SER10 SER11 KEY10 KEY11 KEY12 KEY13 Address 20h 21h 22h 23h 24h 25h 26h 27h 28h 29h 2Ah 2Bh 2Ch 2Dh 2Eh 2Fh 30h 33h 32h 33h 34h 35h 36h 37h 38h 39h 3Ah 3Bh 3Ch 3Dh 3Eh 3Fh CNT20 CNT21 SER20 SER21 KEY20 KEY21 KEY22 KEY23 CNT30 CNT31 SER30 SER31 KEY30 KEY31 KEY32 KEY33 CNT40 CNT41 SER40 SER41 KEY40 KEY41 KEY42 KEY43 CNT50 CNT51 SER50 SER51 KEY50 KEY51 KEY52 KEY53

Learn indicator points to the next available learn position. Stores the system status. Backup copy of system status. Stores the temporary counter for resynchronization.

DS00645B-page 2

1998 Microchip Technology Inc.

AN645
FIGURE 1: ALARM STATE DIAGRAM

State == Alarm State ==Immob Reset State == Drive Alarm Remote

State == Armed

30s Time-out

Trigger Remote Armed

Learn request Remote Immob Remote 30s & IGN off Drive IGN on

Learn request Learn request Learn complete or 30s time-out return to previous

Learn

1998 Microchip Technology Inc.

DS00645B-page 3

AN645
OPERATION
Reset
Reset initializes the I/O ports, variables, and ags. The system status is read from EEPROM and the status is restored.

Drive
When the system enters drive state, the doors are unlocked (activate UNLOCK), and the SIREN and PLIGHT are activated twice for 50 ms.The IMMOB output is activated to enable the starting of the vehicle and LED is turned off. A remote signal will return the system to armed state. Actions upon entry: 1. 2. 3. 4. 5. 6. 7. 8. Flash parking lights for 50 ms. Chirp siren for 50 ms. Unlock doors for 500 ms. Flash parking lights for 50 ms. Chirp siren for 50 ms. Update system status. LED off. Enable start.

Armed
When the system enters armed state, the doors are locked (activate LOCK) and the SIREN and PLIGHT are activated for 50 ms. The LED changes to a slow ash rate. If a trigger is detected (IGN, DOOR or TRIGGER) the system changes to the alarm state. Actions upon entry: 1. 2. 3. 4. 5. 6. Flash parking lights for 50 ms. Chirp siren for 50 ms. Lock doors for 500 ms. Update system status. LED ash. Disable start.

TABLE 3:

STATE CHANGE TABLE

Condition Next State Alarm Armed Drive Drive Drive Immob Learn

TABLE 1:

STATE CHANGE TABLE

Condition Next State Alarm Alarm Alarm Alarm Drive Armed Armed Learn

IGN high TRIG high DOOR high Panic (any button activated for 2 seconds) Remote function 1 Remote function 2 (trunk release) Remote function 3 (car nder) LEARN high

Panic (any button activated for 2 seconds) Remote function 1 & IGN low Remote function 1 & IGN high Remote function 2 (trunk release) Remote function 3 (car nder) 30-second timeout & IGN off LEARN high

Immob
If the IGN is turned off for more than 30 seconds, the system will immobilize. The IMMOB output is turned off, and the LED is turned on. A remote signal only will change the state to armed, and a remote signal with the IGN on will return to drive state. Actions upon entry: 1. 2. 3. Update system status. LED off. Disable start.

Alarm
Alarm state is entered whenever a trigger is detected in armed state. SIREN is activated and PLIGHT is turned on and off at a 1 Hz rate. If a remote is detected in this state, the system changes to drive state. After a 30-second delay, SIREN and PLIGHT will be deactivated and the system returned to armed state. Actions upon entry: 1. 2. 3. 4. 5. Flash parking lights. Siren on. LED ash. Update system status. Disable start.

TABLE 4:

STATE CHANGE TABLE

Condition Next State Alarm Armed Drive Immob Immob Learn

TABLE 2:

STATE CHANGE TABLE

Condition Next state Alarm Drive Armed Drive

Panic (any button activated for 2 seconds) Remote function 1 & IGN low Remote function 1 & IGN high Remote function 2 (trunk release) Remote function 3 (car nder) LEARN high

Panic (any button activated for 2 seconds) Remote function 1 Remote function 2 (trunk release) 30-second timeout

DS00645B-page 4

1998 Microchip Technology Inc.

AN645
Learn
A LEARN input in any state will put the system in learn mode. After learn is completed or timed out the system returns to the previous state. Actions upon entry: 1. 2. 1. 2. Update system statusset PASS1. LED on. Update system statusset PASS2. LED off.

FUNCTIONAL MODULES
Reception
The reception routine is based on reliable algorithms used in previous implementations of KEELOQ decoders. Automatic baud rate detection is used to compensate for variations in baud rate from different encoders of a specic type as well as the difference in baud rate between different encoders (HCS200, HCS300, HCS301, HCS360, HCS361, and HCS410). The reception routine will be able to handle 56- and 66-bit transmissions. The reception routine will determine the type of transmission by the number of bits in the transmission. This routine will be the same for all implementations.

After rst transmission:

After second transmission: 1. 2. 3. Update system statusset NORMAL. LED on for 1 second. Return to previous state.

Key Generation and Decryption

Decryption is done in software in the implementation. The decryption and key generation algorithms is implemented in software. The manufacturers code is stored in program memory and code protected to securely store the key.

TABLE 5:

STATE CHANGE TABLE

Next State Pass2 Return to previous state Erase all transmitters

Condition Remote rst operation Remote second operation LEARN high for 8 seconds

Validation
Validation consists of the following steps: 1. 2. 3. 4. 5. Checking the serial number (24 or 28 bits) against the stored transmitters. Comparing the discrimination value (12 bits) against the stored discrimination value. Checking that the synchronization counter falls within the rst synchronization window. Checking if the synchronization counter falls within the second synchronization window. If found to be correct, updating the synchronization counter.

Function Interpretation
Transmitter Button 1 2 3 1, 2 or 3 for 2 seconds Function Code 0001 0010 0011 00XX System Function Arm/Disarm Trunk release Car nder Panic

Learn
The LEARN input is active high. Learning is initiated by momentarily pressing the LEARN button. The decoder uses the current learning position as a scratch pad area. This means that an unsuccessful learn will delete the information stored at that learn position. The learn indicator will not be incremented if the learn was unsuccessful. The ow chart (Figure 1) shows the learning operation.

1998 Microchip Technology Inc.

DS00645B-page 5

AN645
FIGURE 2: LEARN OPERATION

LEARN MODE

Press Learn Button

LED on solid

Button still pressed ? NO

YES

NO

First code received? YES

NO

Time greater than 33.6 sec.?

YES LED off

Time greater than 8.4 sec.? YES

NO

NO

Second code received? YES

Erase memory

NO

Time greater than 33.6 sec.?

YES Code Validated? YES Learn new transmitter LED on solid for 1 second LED on solid for 0.1 second NO

Exit Learn Turn LED off

END

DS00645B-page 6

1998 Microchip Technology Inc.

AN645
The following checks will be performed on the received codes to determine if the transmitter is valid: 1. 2. The rst code that is received is checked for bit integrity. The stored serial numbers are searched to check if a transmitter is relearned. If a relearn is taking place, that position is used. Otherwise, the position pointed to by the learn indicator will be used. The serial number is stored in the current learn position and used to generate a key. The hop code is decrypted and the result stored temporarily. The serial number of the second code that is received will be compared to the rst received serial number. The second hop code is decrypted and the discrimination values compared. The synchronization counters of the decrypted codes will be compared to check that they are sequential codes. If all the checks pass the learn were successful, the learn indicator is incremented. Otherwise, the position is erased.

3. 4. 5.

6. 7.

8.

Operation
1. 2. 3. Press and release the LEARN button. Indicator LED will turn on to indicate learn mode. Press transmitter button. The LED will turn off. Press transmitter a second time. The LED will turn on for 1 second to indicate that the transmitter was learned successfully. Repeat steps 1-3 to learn up to six transmitters. The seventh transmitter will overwrite the rst transmitter that was learned. Learn will be terminated if two nonsequential codes were received or if two acceptable codes were not decoded within 33.6 seconds. A valid learn will be indicated by the LED turning on solid for 1 second. Erasing all the transmitters is accomplished by pressing and holding the LEARN button for 8.4 seconds. The LED will turn off at the end of the 8.4 seconds to indicate that the transmitters were erased. The learn indicator will be reset to the rst position.

4.

5.

6.

1998 Microchip Technology Inc.

DS00645B-page 7

AN645
TABLE 6:
PIN 1 2 3 4 5 6 7 8 9 10 11 12 13 14

DEVICE PINOUT
PIC16C57 Function RTCC VDD NC GND NC Port A Bit 0 Port A Bit 1 Port A Bit 2 Port A Bit 3 Port B Bit 0 Port B Bit 1 Port B Bit 2 Port B Bit 3 Port B Bit 4 EEPROM DIO(3+4) EEPROM CLK (2) EEPROM CS (1) RFIN IMMOB SIREN PLIGHT NC LOCK Ground Alarm Function APP select +5V supply PIN 28 27 26 25 24 23 22 21 20 19 18 17 16 15 PIC16C57 Function MCLR Osc In Osc Out Port C Bit 7 Port C Bit 6 Port C Bit 5 Port C Bit 4 Port C Bit 3 Port C Bit 2 Port C Bit 1 Port C Bit 0 Port B Bit 7 Port B Bit 6 Port B Bit 5 NC NC NC OVR LEARN DOOR TRIG IGN LED TRUNK UNLOCK Alarm Function RESET RC osc (4 MHz)

TABLE 7:

TIMING PARAMETERS
Parameter Typical 1 33 33 33 8 500 50 50 1 2 Unit per second second second second second ms ms ms per second seconds

Armed LED ash rate Siren time-out Drive time-out Learn time-out All erase LOCK, UNLOCK, TRUNK activation Siren chirp (arm & disarm) Parking light (arm & disarm) Parking light ash rate (siren) Panic

DS00645B-page 8

1998 Microchip Technology Inc.

FIGURE 3:

VCC

D5 VO C3 100 F C4 100 nF VCC

J1 1 2 3 C2 100 F

1n4004/7

U2 LM7805 VI G N D

1998 Microchip Technology Inc.

2 1 3 MCLR OSC 1 OSC 2 NC4 NC3 NC2 OVR LEARN DOOR TRIG IGN LED TRUNK UNLOCK 18 17 16 15 4 5 R2D 1k 1 3 1 1 4 1 D2 LED 2 2 D3 LED 2 D4 LED 2 6 R2E 1k 1 2 1 D5 LED 2 9 87 65 4 32 1 RP1 RP9P8R 10K 19 20 21 22 1 23 24 2 2 S1 SW PB 2 S1 SW PB 1 2 S2 SW PB 1 S3 SW PB 1 25 26 Supervision C1 10 pF VCC 27 Power Supply 28 R1 10k 1 2 VDD NC VSS NC DIO CLK CS RFIN IMMO SIREN PLIGHT NC1 LOCK 3 4 5 DO DI CLK 1 8 9 10 11 12 13 14 1 R2A 1k LS1 1 5 1 R2B 1k R2C 1k 2 3 2 7 3 6 6 TEST TEST CS VCC 93LC46B VCC 7 8 U2 VSS 4 1k 5 U1 T0ckI U3 VCC OUT GND KLQ_SEC2 R2F 1k 1 1 1 D6 LED 1 6 1 D1 LED 2 Buzzer

CON3

CIRCUIT DIAGRAM

Receiver

RX1 RR1

V GA C NN C DT

G N D

T V GV EOV C N C SU C C DC TT C

12 3

1 1 11 11 0 1 23 45

Telecontrolli RR3 - 433

AN645

DS00645B-page 9

AN645
LIST OF CHANGES
Date 08/16/96 10/20/98 Version 1.0 2.0 Page Paragraph Change Original EEPROM Changed from 93C46 to 93LC46B, adding a series resistor on DIO

DS00645B-page 10

1998 Microchip Technology Inc.

AN645
NOTES:

1998 Microchip Technology Inc.

DS00645B-page 11

WORLDWIDE SALES AND SERVICE

AMERICAS
Corporate Office
Microchip Technology Inc. 2355 West Chandler Blvd. Chandler, AZ 85224-6199 Tel: 480-786-7200 Fax: 480-786-7277 Technical Support: 480-786-7627 Web Address: http://www.microchip.com

AMERICAS (continued)
Toronto
Microchip Technology Inc. 5925 Airport Road, Suite 200 Mississauga, Ontario L4V 1W1, Canada Tel: 905-405-6279 Fax: 905-405-6253

ASIA/PACIFIC (continued)
Singapore
Microchip Technology Singapore Pte Ltd. 200 Middle Road #07-02 Prime Centre Singapore 188980 Tel: 65-334-8870 Fax: 65-334-8850

ASIA/PACIFIC
Hong Kong
Microchip Asia Pacific Unit 2101, Tower 2 Metroplaza 223 Hing Fong Road Kwai Fong, N.T., Hong Kong Tel: 852-2-401-1200 Fax: 852-2-401-3431

Taiwan, R.O.C
Microchip Technology Taiwan 10F-1C 207 Tung Hua North Road Taipei, Taiwan, ROC Tel: 886-2-2717-7175 Fax: 886-2-2545-0139

Atlanta
Microchip Technology Inc. 500 Sugar Mill Road, Suite 200B Atlanta, GA 30350 Tel: 770-640-0034 Fax: 770-640-0307

Boston
Microchip Technology Inc. 5 Mount Royal Avenue Marlborough, MA 01752 Tel: 508-480-9990 Fax: 508-480-8575

EUROPE
United Kingdom
Arizona Microchip Technology Ltd. 505 Eskdale Road Winnersh Triangle Wokingham Berkshire, England RG41 5TU Tel: 44 118 921 5858 Fax: 44-118 921-5835

Beijing
Microchip Technology, Beijing Unit 915, 6 Chaoyangmen Bei Dajie Dong Erhuan Road, Dongcheng District New China Hong Kong Manhattan Building Beijing 100027 PRC Tel: 86-10-85282100 Fax: 86-10-85282104

Chicago
Microchip Technology Inc. 333 Pierce Road, Suite 180 Itasca, IL 60143 Tel: 630-285-0071 Fax: 630-285-0075

India
Microchip Technology Inc. India Liaison Office No. 6, Legacy, Convent Road Bangalore 560 025, India Tel: 91-80-229-0061 Fax: 91-80-229-0062

Denmark
Microchip Technology Denmark ApS Regus Business Centre Lautrup hoj 1-3 Ballerup DK-2750 Denmark Tel: 45 4420 9895 Fax: 45 4420 9910

Dallas
Microchip Technology Inc. 4570 Westgrove Drive, Suite 160 Addison, TX 75248 Tel: 972-818-7423 Fax: 972-818-2924

Japan
Microchip Technology Intl. Inc. Benex S-1 6F 3-18-20, Shinyokohama Kohoku-Ku, Yokohama-shi Kanagawa 222-0033 Japan Tel: 81-45-471- 6166 Fax: 81-45-471-6122

France
Arizona Microchip Technology SARL Parc dActivite du Moulin de Massy 43 Rue du Saule Trapu Batiment A - ler Etage 91300 Massy, France Tel: 33-1-69-53-63-20 Fax: 33-1-69-30-90-79

Dayton
Microchip Technology Inc. Two Prestige Place, Suite 150 Miamisburg, OH 45342 Tel: 937-291-1654 Fax: 937-291-9175

Detroit
Microchip Technology Inc. Tri-Atria Office Building 32255 Northwestern Highway, Suite 190 Farmington Hills, MI 48334 Tel: 248-538-2250 Fax: 248-538-2260

Korea
Microchip Technology Korea 168-1, Youngbo Bldg. 3 Floor Samsung-Dong, Kangnam-Ku Seoul, Korea Tel: 82-2-554-7200 Fax: 82-2-558-5934

Germany
Arizona Microchip Technology GmbH Gustav-Heinemann-Ring 125 D-81739 Mnchen, Germany Tel: 49-89-627-144 0 Fax: 49-89-627-144-44

Los Angeles
Microchip Technology Inc. 18201 Von Karman, Suite 1090 Irvine, CA 92612 Tel: 949-263-1888 Fax: 949-263-1338

Italy
Arizona Microchip Technology SRL Centro Direzionale Colleoni Palazzo Taurus 1 V. Le Colleoni 1 20041 Agrate Brianza Milan, Italy Tel: 39-039-65791-1 Fax: 39-039-6899883
11/15/99

Shanghai
Microchip Technology RM 406 Shanghai Golden Bridge Bldg. 2077 Yanan Road West, Hong Qiao District Shanghai, PRC 200335 Tel: 86-21-6275-5700 Fax: 86 21-6275-5060

New York
Microchip Technology Inc. 150 Motor Parkway, Suite 202 Hauppauge, NY 11788 Tel: 631-273-5305 Fax: 631-273-5335

San Jose
Microchip Technology Inc. 2107 North First Street, Suite 590 San Jose, CA 95131 Tel: 408-436-7950 Fax: 408-436-7955

Microchip received QS-9000 quality system certification for its worldwide headquarters, design and wafer fabrication facilities in Chandler and Tempe, Arizona in July 1999. The Companys quality system processes and procedures are QS-9000 compliant for its PICmicro 8-bit MCUs, KEELOQ code hopping devices, Serial EEPROMs and microperipheral products. In addition, Microchips quality system for the design and manufacture of development systems is ISO 9001 certified.

All rights reserved. 1999 Microchip Technology Incorporated. Printed in the USA. 11/99

Printed on recycled paper.

Information contained in this publication regarding device applications and the like is intended for suggestion only and may be superseded by updates. No representation or warranty is given and no liability is assumed by Microchip Technology Incorporated with respect to the accuracy or use of such information, or infringement of patents or other intellectual property rights arising from such use or otherwise. Use of Microchips products as critical components in life support systems is not authorized except with express written approval by Microchip. No licenses are conveyed, implicitly or otherwise, under any intellectual property rights. The Microchip logo and name are registered trademarks of Microchip Technology Inc. in the U.S.A. and other countries. All rights reserved. All other trademarks mentioned herein are the property of their respective companies.

1999 Microchip Technology Inc.