NM95HS01/NM95HS02 HiSeC TM High Security Rolling Code Generator General Description Features The NM95HS01/02 HiSeC Rolling Code Generator is a small footprint, monolithic CMOS device designed to provide a complete, low-cost, high security solution to the problem of generating encrypted signals for remote keyless entry (RKE) applications. The NM95HS01/02 generates a fully encoded bit stream each time one of (up to) 4 switch inputs is activated. The patented* coding scheme utilizes 248 possible user-programmable coding combinations, and features high linear complexity and correlation immunity. High security is guaranteed by generating a unique (rolling) code for each transmission, and can be further enhanced by creating customized algorithms for individual customers. With this product, each key can be designed to be both unique and highly secure. The NM95HS01/02 supports either an IR or RF signal transmitter, and can be clocked with either an RC clock (NM95HS01) or a crystal oscillator (NM95HS02). The device operates over a voltage range of 2.2V to 6.5V, and offers a low power standby mode (k1 mA) for battery applications. The product is available in both 8-pin and 14-pin SO packages with 2 or 4 key switch inputs that can be used for customer presets such as seat positions, and vehicle operating functions such as car door locking/unlocking. Y Y Y Y Y Y Y Y Y Y Y Y High security coding scheme with 248 combinations High linear complexity and correlation immunity 2.2V to 6.5V operation Less than 1 mA standby current Full resynchronization capability Unique customized algorithm option 13 bytes on-chip non-volatile configuration memory RC or XTAL clock options for to 4.1 MHz operation Supports both IR and RF signal transmission Selection of bit coding and transmission frame formats Space saving narrow body SO8 or SO14 packages Up to 4 key switch inputs on SO14 package Applications Y Y Y Y Remote Keyless Entry (RKE) applications Burglar alarms/garage door openers Individualized recognition/transmission systems Personalized consumer automotive applications Relevant Documents Y Y Y MM57HS01 datasheet Designing and Programming a Complete HiSeCTM based RKE System AN-985 HiSeC Remote Keyless Entry Solution Encoder/Decoder Chip Set User’s Manual AN-355 *Patents Pending Functional Block Diagram TL/D/12302 – 1 Note: Signals shown are internal logic signals. FIGURE 1 HiSeCTM and MICROWIRETM are trademarks of National Semiconductor Corporation. C1996 National Semiconductor Corporation TL/D/12302 RRD-B30M66/Printed in U. S. A. NM95HS01/NM95HS02 HiSeC High Security Rolling Code Generator February 1996 The 24-bit key ID register can be used to configure a large number of unique keys, each of which will produce a unique encoded output bit stream. The 24 bits in the code generator block are mixed with coded data. General Characteristics The NM95HS01/02HiSeC Generator was developed to meet existing standards for rolling code-based security systems. The output of this block is then fed into the 24-/36-bit buffer register, where the 40 bits are recombined to produce a 24or 36-bit output (a user option). The 8-bit sync field register can be configured by the user to provide a pattern to facilitate synchronization between the transmitter and receiver. The details of the code block are available to customers, and exclusive algorithms are available and under contract with National. Call your local sales office for details. The HiSeC Generator is shipped with a standard algorithm as a standard product, with the configuration shown. Theft prevention systems typically involve user identification and transmission of information at various distances from the vehicle. These Remote Keyless Entry (RKE) systems are generally implemented with IR transmitters for short distances, or RF transmitters for longer distances. RF transmission has become state of the art; however the longer distances involved require a much higher degree of security, since the possibility of signal interception is greatly increased. These applications are ideally served by the NM95HS01/02. This generator is a small footprint, low current solution that supports both IR and RF transmission. The device is available in an 8-pin SO package with 2 key switch inputs, or a 14-pin SO package with 4 key switch inputs. The proprietary coding scheme used generates a rolling code based on 248 possible user combinations, and ensures a high level of coding security for any RKE application. The NM95HS01 can be clocked with an RC circuit, while the NM95HS02 can be clocked with a crystal oscillator. Figure 2 shows a general operational block diagram of the NM95HS01/02 HiSeC Generator. The 4 key switch inputs shown use internal pull-up resistors, and are suitable for normally open, single pole input switches connected to ground. The inputs are buffered by debounce logic which repeatedly polls the inputs to determine if a key switch has been asserted. If any key switch input is seen as low for four continuous 10 ms samples, its associated output is set high, the HiSeC control logic is activated, and a security code is generated and transmitted. The timer block is used to set the key debounce time and the IR or RF clock times. These clock times are used as the time base for the chosen bit coding format. The timer block is also used to generate the interframe pause time, and the timeout delay, if these are enabled. These parameters are configured by the user in the 13-byte on-chip EEPROM array. The NM95HS01 version of the device uses an RC network to clock the CKI input pin. The CKO/LED pin is not required for clocking, but may be used for a visual indicator LED. If the NM95HS02 crystal oscillator version is used, the device is clocked using both the CKI and CKO pins. If an LED is used with this device, it may be grounded through the RFEN/LED pin. Either the CKO/LED or the RFEN/LED output pins can provide the sink current needed to drive an indicator LED. The RFEN pin is active low during signal transmission, and is used to provide power to the RF circuit only during transmission to increase battery life. The transmit output (TX) pin is a configurable logic level output, and is used to transmit the encoded bit stream. An on-chip power-on reset circuit is used to initialize the device during power-up. General Device Operation The Functional Block Diagram (Figure 1) shows the internal elements of the code generating logic and program registers. The NM95HS01/02 HiSeC Generator achieves its high security level by combining the contents of several dynamic data registers in a non-linear manner to generate an encoded output. Data in the registers is comprised of a mixture of user programmable data, factory programmable data, and randomized data. This inherently random and separate data is encrypted by clocking it through a non-linear logic block, and feeding part of the output back to produce a final coded output with a high degree of linear complexity and correlation immunity. The NM95HS01/02 incorporates 13 bytes of non-volatile EEPROM memory which can be used to configure the device registers. This memory is accessible to the user, and can be configured to the desired configuration, then writedisabled to prevent tampering. User programmable data includes 24 bits of the code block, a 24-bit key ID register, and an 8-bit sync field register. http://www.national.com 2 Connection Diagrams 8-Pin SO Package (M8) Pin Names Pin Description KEYn Key Input RFEN/LED RF Enable/LED CKO/LED XTAL Clock/LED TX Data Transmit Top View CKI RC Clock Input See NS Package Number M08A (M8) or N08E (N) GND Ground VCC Supply Voltage TL/D/12302–4 14-Pin SO Package (M14) and 14-Pin Dual-In-Line Package (N14) 14-Pin TSSOP Package (MT14) TL/D/12302 – 5 Top View See NS Package Number M14A (M), MTC14 (MT14) or N14A (N14) Ordering Information Commercial Temperature Range (0§ C to a 70§ C) Order Number NM95HS01M8/NM95HS02M8 NM95HS01N/NM95HS02N NM95HS01M/NM95HS02M NM95HS01MT14/NM95HS02MT14 NM95HS01N14/NM95HS02N14 Extended Temperature Range (b40§ C to a 85§ C) Order Number NM95HS01EM8/NM95HS02EM8 NM95HS01EN/NM95HS02EN NM95HS01EM/NM95HS02EM NM95HS01EN14/NM95HS02EN14 TL/D/12302 – 2 *Note: Keys 3 and 4 available in 14-pin packages. FlGURE 2. Operational Block Diagram of the NM95HS01/02 HiSeC Generator 3 http://www.national.com General Transmitter Circuit Configurations Figure 3 shows several typical circuit configurations for a HiSeC based RKE system transmitter. Note that all circuits require few external components beyond a battery and transmitter stage. IR and RF bit timing may be optimized through the timer block settings in the EEPR0M array, which allows flexibility in selecting the smallest and least expensive clock components in the chosen design range. The first two circuits are examples of RF transmitter applications, with both RC and crystal (XTAL) oscillator clocks; the third circuit is an example of an IR transmitter application. Two circuits are configured for an LED. Note that the LED pin refers to a visual indicator LED, and not the IR LED which might be used in an IR transmitter circuit. The LEDSEL bit in the EEPROM array determines whether the RFEN/LED or CKO/LED pins are dedicated to the LED for a particular circuit configuration. LED pin select options are detailed in Table I. Design considerations for selecting and optimizing clock component values are detailed in the Generator Clock Design Parameters section. General Receiver Circuit Configurations The NM95HS01/02 HiSeC Generator with the standard customer algorithm is matched to a companion partÐthe MM57HS HiSeC Decoder. For applications requiring more extensive receiver design and decoder programming, a COPS8xxx/NM93Cx6 package is recommended. A complete discussion of receiver oonfigurations and considerations can be found in the National Semiconductor Application Note: How to Design and Program a HiSeC RKE Receiver using an 8-Bit Microcontroller. TL/D/12302 – 3 FIGURE 3. Typical Transmitter Circuit Configurations TABLE I. LED Pin Select Options Clock LEDSEL RFEN/LED CKO/LED Function RC X RFEN LED RF Mode with LED XTAL 0 LED CKO RF Mode w/o LED XTAL 1 RFEN CKO IR mode with LED Either the LED or RFEN outputs of the NM95HS01/02 can be used to indicate device transmission. The LED output is active during a pause, whereas the RFEN output is active during frame transmission. The IR Drive Current is 10 mA so an amplifier stage may be needed. http://www.national.com 4 Bit Coding Formats IR bit coding formats all follow the same general pattern. In this mode, a logic ‘‘1’’ is always two periods long, and a ‘‘0’’ is always three periods long. This may be an important consideration when considering preamble and sync timing. Waveform diagrams for all available RF and IR bit transmission coding formats are shown below. The NM95HS01/02 HiSeC Generator supports eleven-bit coding formats which may be used for IR and RF transmission. Seven-bit formats are available for RF applications, and four are available for IR applications. One-bit format is reserved for future use. Bit coding formats are selected by configuring four bits in the EEPROM array: IRSEL, PRSEL2, PRSEL1 and PRSEL0. Table II shows the possible bit coding options available. Each bit coding format has a distinction which may be advantageous for a particular application. RF bit coding format 0 is the simplest bit coding scheme, and data may be easily recovered from a transmission by exclusive OR-ing the data and clock stream. Both RF bit coding formats 0 and 2 have a DC level that is independent of the data. RF format 4, and the IR modes operate with a constant transmission energy per message, and RF coding formats 1, 3, 5 and 7 are pulse-width modulated (PWM) formats which are relatively easy to decode. RF coding format 7 has a low duty cycle. The IR bit coding formats are modulated versions of RF coding format 4, and are all suitable for IR applications. The duty cycle and number of pulses are variable among these four to allow the user to fine tune the IR circuit power curve. TABLE II. Transmission Bit Coding Options IRSEL PRSEL2 PRSEL1 PRSEL0 0 0 0 0 0 0 0 0 1 1 1 1 1 0 0 0 0 1 1 1 1 0 0 0 0 1 0 0 1 1 0 0 1 1 0 0 1 1 X 0 1 0 1 0 1 0 1 0 1 0 1 X Function RF Bit Coding Format 0 RF Bit Coding Format 1 RF Bit Coding Format 2 RF Bit Coding Format 3 RF Bit Coding Format 4 RF Bit Coding Format 5 Reserved RF Bit Coding Format 7 IR Bit Coding Format 1 IR Bit Coding Format 2 IR Bit Coding Format 3 IR Bit Coding Format 4 Reserved Bit Transmission Coding Formats RF Bit Coding Format 0 (Manchester Code) RF Bit Coding Format 1 (33%/66% Ð End High) TL/D/12302 – 6 TL/D/12302 – 7 RF Bit Coding Format 2 (50% Duty Cycle) RF Bit Coding Format 3 (25%/50% Ð Start High) TL/D/12302 – 8 TL/D/12302 – 9 RF Bit Coding Format 4 (IR Style) RF Bit Coding Format 5 (33%/66% Ð Start High) TL/D/12302 – 10 TL/D/12302 – 11 5 http://www.national.com Bit Transmission Coding Formats (Continued) RF Bit Coding Format 7 (Low Duty Cycle Ð 1:16/2:16) TL/D/12302 – 12 IR Bit Coding Format 1 (5 Pulses Ð 33% Duty Cycle) TL/D/12302 – 13 IR Bit Coding Format 2 (8 Pulses Ð 33% Duty Cycle) TL/D/12302 – 14 IR Bit Coding Format 3 (5 Pulses Ð 25% Duty Cycle) TL/D/12302 – 15 IR Bit Coding Format 4 (8 Pulses Ð 25% Duty Cycle) TL/D/12302 – 16 http://www.national.com 6 The sync frame format contains both start code and a fixed 4-bit sync code of 0000. This sync code replaces the key application data in the data field, and is used to confirm HiSeC sync mode to the decoder. Programmable Signal Output Polarity The transmit (TX) output pin signal polarity and quiescent state output is controlled by the TxPol bit, which may be configured in EEPR0M. If TxPol e 0, the TX output pin will be at a logic low when no frame is transmitted, or when a ‘‘0’’ appears as data in a frame. Conversely, if TxPoI e 1, the TX output pin will be at a logic high when no frame is transmitted, or when a ‘‘1’’ appears as data in a frame. This option allows the designer to choose between a configuration where a logic ‘‘1’’ represents power transmission (for example, when an RF stage is activated by driving the base of an NPN transistor), and a configuration where a logic ‘‘0’’ represents power transmission (for example, when an IR LED is connected between VCC and the TX output). Sync mode is built into the generator to allow resynchronization of the device under certain conditions as a convenience to the end user. If the designer wishes to preclude any possible resynchronization, the presence of the sync code allows the decoder to detect any synchronization attempt. Since the length of several fields is adjustable, there are several possibilities for the length of a sync frame. The shortest possible sync frame is 45 bits, and the longest possible sync frame is 96 bits. 40 bits of start code, 4 bits of sync code, and 1 stop bit are always present. The composition of a sync frame is shown in Figure 5. Data Frames 0/11 bits The NM95HS01/02 HiSeC Generator transmits the encrypted data it generates as data frames. These frames are transmitted through an IR or RF transmitter stage using the bit coding format selected. The NM95HS01/02 transmits two types of data frames: a normal data frame, and a synchronization (sync) frame. The format of each frame is similar, but there are slight differences to suit the purposes of each. Normal data frames are used to transmit encoded data in general operation. Sync frames are used to synchronize (or initialize) the HiSeC to its decoder. Data frames are comprised of a number of different fields. Each field occupies a fixed position in the data frame, and serves a specific purpose. Most data fields are user-configurable to some extent. The user may enable/disable the presence of a field, control its length, or modify its format. The user also has several options available to tailor the data frame transmission format, such as pause time between frames, and time-out time. Options are configured by programming the on-chip EEPR0M array. The content and format of each of the fields is discussed below. Preamble 0/8 bits 0/20/24 bits 4 bits 24/36 bits 0/8 bits 1 bit Sync Key ID Data Dynamic Parity Stop Field Field Field Code Field Bit FIGURE 4. Normal Data Frame Configuration 0/11 bits Preamble 0/8 bits 0/20/24 bits 4 bits 40 bits 0/8 bits 1 bit Sync Key ID Sync Start Parity Stop Field Field Code Code Field Bit FIGURE 5. Sync Frame Configuration Data Frame Fields Data frames are comprised of a number of data fields. Each field occupies a fixed position in the data frame, and serves a specific purpose. Most data fields are user-configurable by programming the on-chip EEPROM array. The content and format of each field is discussed below, as well as the EEPROM options available. All data frame fields are transmitted Most Significant Bit first. THE PREAMBLE The user has the option of allowing a preamble to be transmitted as the first frame of either a normal data frame or a sync frame. This option is enabled/disabled by setting the PreamblePresent bit in the EEPROM array. PreamblePresent e 0 means no preamble is transmitted. PreamblePresent e 1 means an 11-bit preamble is transmitted as described below. The purpose of the preamble is to generate a relatively long, clearly recognizable bit pattern to give the decoder a chance to ‘‘wake up’’ and configure its logic circuits and registers. This allows the receiver to be placed in a standby mode to conserve power for battery applications. The preamble is only transmitted once as the first frame of a data transmission, regardless of how long the key is held down, although the remaining frames of the data transmission (including any inter-frame pauses) will continue to repeat as long as the key remains depressed. NORMAL DATA FRAME The NM95HS01/02 HiSeC Generator transmits normal data frames in general operating mode. Frame transmission begins each time a key switch is asserted, and continues as long as the key is held down. The device has an option to terminate transmitting data frames, and go into halt mode, if a key is held down for more than 80 seconds (if the TlMEOUTEN feature has been enabled). The normal data frame format contains both dynamic code and key application data (in the data field). Since the length of several fields is adjustable, there are several possibilities for the length of the data frame. The shortest possible normal data frame is 29 bits, and the longest possible normal data frame is 92 bits. 24 bits of dynamic code, 4 bits of key application data, and 1 stop bit are always present. The composition of a normal data frame is shown in Figure 4. SYNC FRAME The NM95HS01/02 HiSeC Generator transmits sync frames only in sync mode so that it can synchronize itself with its decoder. This mode occurs only during initialization of the device, or after holding a key down for more than 10 seconds (if the AutoResync feature has been enabled). 7 http://www.national.com Data Frame Fields (Continued) The sync field data is programmable, and can be encoded with any user-selected bit coding format, or with an NRZ (unencoded binary) bit format. The option to select between a user bit coding format and NRZ format is set by configuring the SyncType bit in the EEPROM array. If SyncType e 0, sync field data is sent according to the user-selected IR or RF bit coding format. If SyncType e 1, the information is sent in NRZ format with the bit length determined by the chosen IR or RF bit coding format. For NRZ bit coding, both high and low bit times are the same as the IR or RF bit coding time. For bit coding modes where the ‘‘1’’s and ‘‘0’’s have different bit lengths Ð all IR modes for example Ð the length of the NRZ ‘‘1’’ and ‘‘0’’ bits have correspondingly different bit lengths. RF bit coding format 7 is a special case. As in the other formats, if SyncType e 0, information is sent according to the user-set IR or RF bit coding format. However, if SyncType e 1, a ‘‘0’’ is sent using the bit coding determined by the IR or RF coding format, and a ‘‘1’’ is sent as an NRZ zero. This is to maintain the ‘‘spirit’’ of the low duty cycle arrangement for RF format 7. The preamble has a fixed format of two bit times at system logic high, then one-bit time at system logic low, then eight zeroes using the user-selected bit coding format. This arrangement is clearly shown in Figure 6 for several bit coding formats. If desired, a preamble may be isolated from the frame by eight-bit times at logic low during a frame transmission. This can be achieved by enabling the sync field in NRZ mode with the byte 0h. SYNC FIELD If enabled, the sync field is transmitted in every normal data frame or sync frame to provide a bit timing reference for the rest of the frame. This allows the decoder to determine the proper bit coding format the generator is using, and to synchronize to it. The sync field option is set with the SyncPresent bit in the EEPROM array. If SyncPresent e 0, no sync field is sent. If SyncPresent e 1 an 8-bit sync field is included in the data transmission. This 8-bit field is transmitted Most Significant Bit first. Figure 7 shows sync field examples for several bit coding formats. TL/D/12302 – 17 FIGURE 6. Preamble Format Examples TL/D/12302 – 18 FIGURE 7. Sync Field ExampIes for Data Byte 03h http://www.national.com 8 Data Frame Fields (Continued) DYNAMIC CODE FIELD KEY ID FIELD The key ID field is another user option. Both its presence and the length of its field can be configured in EEPROM. If FixPresent e 0, no key ID field will be transmitted with the frame. If FixPresent e 1, a 24-bit field will be transmitted. The contents of the key ID field are programmable by the user. Its purpose is to provide a unique identification code for each user key to allow a decoder to identify a particular key in applications where a decoder may be configured for multiple keys. Since the key ID register allows 24 bits, there are 224 possible key combinations. Each user key will be unique, and take full advantage of the HiSeC Generator’s high security coding scheme. The field size is selected with the FixSize bit. If FixSize e 1, the 24-bit field is selected. If FixSize e 0, the 20-bit field is selected. Since a full 24 bits are allowed in the Key ID register, the NM95HS01/02 will transmit the most significant 20 bits if FixSize e 0. The field is transmitted in the user-selected bit coding format. The dynamic code field is transmitted with every frame, and its length is programmable. If DynSize e 0, a 24-bit field is sent; if DynSize e 1, a 36-bit field is sent. Its function is to provide a secure dynamic code which changes with each new transmission. The field is the result of combining the 11-, 13-, and 16-bit CRC registers using non-linear logic and feedback. The result of this process is stored in the 24-/36-bit buffer register. If DynSize e 0, 24 of the possible 36 bits are transmitted in the field. Increasing the field length provides additional security. The start code field in a sync frame is a special case of the dynamic code field. In sync mode, 40 bits of data are sent regardless of the setting of the DynSize bit. PARITY FIELD The parity field is an 8-bit field that is transmitted with every frame to ensure data integrity. It is a user option that is enabled by setting ParityPresent e 1. The parity check is a bytewise exclusive OR-ing of all the bytes in the data frame from the sync field to the dynamic code field. The preamble, parity field and stop bit are not included. In practice, the parity process works as follows: bit m of the 8-bit parity field is a modulo 2 addition of the data frame bits m, m a 8, m a 16, . . . to the end of the frame. If the addition of the ‘‘1’’s in these bits is odd, bit m of the parity field is set to ‘‘1’’. If the addition is even, bit m is set to ‘‘0’’. This process is continued for all 8 parity bits. If the frame is not byte aligned, the parity field is calculated by zero extending the last four bits, calculating the bytewise exclusive OR-ing of all the bytes as described above, then swapping the higher and lower nibbles to give the correct parity. DATA FIELD The data field is transmitted with every frame. It has several uses, which are discussed here. The primary use of the data field is to indicate which key switch has been pressed. Since each key switch input can be associated with a particular application, the decoder can determine which function to initiate. The data field is 4 bits long, and each key switch input is associated with a particular bit in the field. If any key switch is pressed, its corresponding bit in the data field will be seen as a ‘‘1’’. Any key switch not pressed is seen as a default ‘‘0’’. Key bits are transmitted in the order: K1, K2, K3, K4. The sync code field in the sync frame is a special case of the data field, and is found in the same position in the data frame. In any sync frame, the sync code is always 0000, so the decoder can always distinguish between a normal data frame and a sync frame. Since each bit represents a key, and a data frame is initiated as a result of pressing a key, it is not possible to have all zeroes in a normal data frame. The data field can also serve as a low battery indicator. This is an option which can be enabled by setting the CompareEnable bit. If CompareEnable e 1, and the NM95HS01/02 detects a low battery level, the device will signal that fact by alternating between transmitting normal data frames with the correct key usage information, and transmitting normal data frames with a data field of 1111. In the first data frame, the data field will represent the true state of the four key inputs. In the next frame, this field will be all ones. This sequence will be repeated as long as frames are being transmitted. For sync frames, this field will not alternate, and the data will remain 0000 regardless of the battery level. Setting CompareEnable e 0 disables the low battery detect option. STOP BIT The stop bit is present in all frames. It is used to delimit the end of the frame for bit formats that require a definite end. It is necessary for formats that end with a long zero pulse. IR modes require a stop bit to distinguish between a ‘‘0’’ and a ‘‘1’’ in the next-to-last bit of a frame. The stop bit is read as a ‘‘1’’, and is added for all modes. DATA FRAME SEQUENCING AND TRANSMISSION The NM95HS01/02 becomes operational any time a key is pressed. When this happens, the code generator logic is clocked to randomize the data and generate a new rolling code. Once the code is generated, data frames using this new code are repeatedly transmitted over the TX output pin as long as the key remains pressed. These data frames are separated by a pause whose length is programmable. The transmission sequence is always begun by a preamble if this option is enabled. The preamble is only transmitted once, since its function is to wake the decoder from sleep mode if it is powered down for battery conservation. The preamble is then followed by a data frame, pause, data frame, pause, . . . etc. 9 http://www.national.com Data Frame Fields (Continued) HiSeC GENERATOR TIMER BLOCK TRANSMISSION INDICATION Both the LED and RFEN signals can be used to indicate HiSeC rolling code transmission. The LED output is active low during the transmission of a pause, whereas the RFEN output is active low during transmission of either a frame or a pause. Either output may be used to provide a visual indication of transmission by connecting an LED between VCC and LED or RFEN. If the low battery detect option is enabled, and the battery is low, the LED output is active only during the pause following the first frame of a new code transmission. It is not active on successive pauses, in order to conserve power. Bit timing and several function operating times are set in the generator through a user programmable timer block. This timer block is used to provide IR and RF bit timing signals, the interframe pause time, the AutoResync timing period, and the time-out delay. The NM95HS01/02 timer block consists of three programmable 6-bit prescalers and a fixed 16-bit prescaler. The input to Prescaler1 is (/4 of the frequency of CKI. The output is the IR clock. This signal becomes the input to Prescaler2. The output from Prescaler2 is the RF clock. This signal then becomes the input to Prescaler3. The output from Prescaler3 is a target value of 2.5 ms. Finally. this 2.5 ms timing signal becomes the input to the fixed 16-bit prescaler. There are several outputs from this prescaler. The 2.5 ms is divided by 4, 4096 and 32768, and these times are used to set the key debounce time (10 ms), the AutoResync time (l10 sec), and the generator time-out period (l80 sec), respectively. The NM95HS01/02 timer block is shown in Figure 8. Operational Timing Issues DATA FRAME PAUSE LENGTH After the complete transmission of a data frame, a pause is inserted before the next data frame is transmitted. The pause length can be modifed by configuring the 2-bit PauseLength parameter in EEPR0M. PauseLength is broken down into two single bit parameters, Pause1 and Pause0. Available configuration options are shown in Table III. The purpose of the prescalers is to provide various timing signals to the state machines in the generator. The IR clock is used as a time base for the various IR bit coding formats. The RF clock is used for RF bit coding formats. A programmable bit called SCLK determines whether the IR clock (SCLK e 0) or the RF clock (SCLK e 1) is used as the bit timing time base. In addition to SCLK, the system designer can program Prescaler1, Prescaler2 and Prescaler3 separately to set the necessary division factors. Since each of these prescalers is 6 bits, permissible values range from 2 to 64. The system designer must set the programmable prescalers to meet the necessary timing requirements for all the functions discussed above. All of these timings are interdependent. TABLE III. Pause Length Select Options PAUSE1 PAUSE0 0 0 1 1 0 1 0 1 Function 0 8 20 50 Pause Time c P3 Output c P3 Output c P3 Output c P3 Output No Pause 20 ms 50 ms 100 ms HiSeC GENERATOR TIME-OUT If the NM95HS01/02 time-out option is enabled (TIMEOUTEN e 1), the device will enter halt mode 80 seconds after a key is first activated, regardless of whether the key is still being pressed. This option guards against the condition that a key may be stuck low, which could drain the battery. If TIMEOUTEN e 0, the generator will continue to transmit data frames as long as a key is pressed. Figure 9 provides the basis for an example in calculating the necessary timing for these functions, and setting the timer block appropriately. TL/D/12302 – 19 FIGURE 8. The NM95HS01/02 Timer Block TL/D/12302 – 20 FIGURE 9. NM95HS01/02 Timer Block Example http://www.national.com 10 Operational Timing Issues (Continued) tor assumes a 6V battery, and sets the low battery detect region to approximately 4.4V to 4.8V. If BatteryType e 0, the comparator assumes a 3V battery, and sets the low battery detect region to approximately 2.2V to 2.4V. Data output signals are sampled for low voltage at the start of the data field during frame transmission. If a low battery voltage level is detected, and the detect option is enabled, the LED will signal the condition by flashing at the first pause in the data frame transmission, and alternating normal data field data with a data field containing all ones. This procedure is explained more fully in the Data Field section. As an example, consider the following situation. A designer wishes to design an RF data transmitter using RF bit coding format 5 with a bit time of 1 ms. The designer also wishes to use a 3 MHz crystal oscillator as the system clock. The required bit time of 1 ms encompasses three RF clock periods for RF bit coding format 5. Therefore, the RF clock time needs to be (/3 of 1 ms ( e 333 ms). The timer block has a target value of 2.5 ms (2500 ms) as the output of Prescaler3. Since the RF clock signal is divided by Prescaler3, Prescaler3 divides the signal by 2500/333 e 7.5. This figure is rounded off to become 8. One point of possible confusion should be clarified here. Whenever a division value is calculated for any of the 3 prescalers, the prescaler should be configured with one unit less than that division value. For example, in this case, we calculated a division value of 8 (after rounding) for Prescaler3. Therefore, Prescaler3 should be programmed with 8 b 1 e 7. Next we calculate values for Prescaler1 and Prescaler2. Although the crystal oscillator uses both the CKI and CKO pins, only the CKI input is relevant here. The CKI input frequency is 3 MHz, and (/4 of that is 0.75 MHz. This is the input frequency to the HiSeC timer block, and the corresponding timing signal is 1.33 ms. Since the RF clock must be 333 ms, Prescalers1 and 2 together must divide by 333/1.33 e 250. A convenient choice would be to make Prescaler1 divide by 10 and Prescaler2 divide by 25. Therefore, load Prescaler1 with 10 b 1 e 9, and Prescaler2 with 25 b 1 e 24. Security Aspects The basis of the HiSeC Generator is to provide a means of communicating information between the device and its decoder across some distance. Since data is transmitted at a distance, there is a possibility of signal interception and unauthorized use of the data by a third party. The NM95HS01/02 has been designed to provide such a high level of complexity and correlation immunity that intercepting the signal is immaterial. INITIALIZATION/SYNCHRONIZATION Initialization is the process of synchronizing the generator with its decoder for the first time. The NM95HS01/02 uses the following procedure to initialize the device. The user inserts a new battery into the HiSeC-based device, which causes the LED to light. The LED also has a secondary function for synchronization and initialization procedures. It will light to prompt the end user that it expects some action, and therefore serves as a guide. When the LED lights, the user presses a key. The LED will go off as the generator begins randomizing its registers, and configuring its internal logic. When the user releases the key, the LED will light a second time. This is a signal for the user to press a key again. This second action shifts the generator into sync mode. This causes the NM95HS01/02 to transmit at least four sync frames, allowing the decoder to synchronize to the generator. The generator then exits sync mode, and is ready tor normal operation. DEBOUNCE LOGIC The key switch input signals are connected to the debounce logic block, which continuously polls the inputs to determine if a key switch has been asserted. If a key switch has been asserted, its normally high input will be seen as a low. lf the input is seen low for four continuous debounce strobe signals, it is considered to be a stable signal, and its associated output from the debounce logic block is set high. This enables the generator control logic, and a code is generated and transmitted. This debounced output signal is deasserted as soon as the key is released and its signal goes high again. This assumes normal operation. However, if a key remained pressed for a long time, the generator might time-out before seeing the signal go high again (if TIMEOUTEN e 1). The generator would then enter halt mode even if the key remained pressed. The generator would come out of halt mode when it saw the falling edge of another key input, which would occur when another key is pressed. RESYNCHRONIZATION If synchronization is lost between the generator and its decoder, resynchronization is accomplished using a sync frame. A sync frame is generated in two cases: when the battery is removed and replaced, or the user initiates an initialization procedure by holding Key Switch 1 and Key Switch 2 simultaneously for 5 seconds. A sync frame provides the decoder with enough information to ‘‘learn’’ the key and synchronize to it. For the highest possible security protection, resynchronization can be completely excluded by configuring the decoder to recognize, and refuse to act upon, the transmission of a sync frame. The sync frame format is discussed more fully elsewhere, but briefly, it can be recognized by the presence of all zeroes in the data field. In this case, if synchronization is lost between the generator and decoder, they could not be made to function together. LOW BATTERY DETECT OPTION The NM95HS01/02 contains an internal comparator circuit that detects low battery voltage, and indicates this condition to the data frame generator. The CompareEnable parameter in EEPROM enables this function (CompareEnable e 1). During halt mode, the comparator is switched off completely to minimize power consumption. The BatteryType parameter in EEPROM selects the threshold voltage range for the comparator. If BatteryType e 1, the compara- 11 http://www.national.com Security Aspects Generator Clock Design Parameters NORMAL OPERATION Tables IV, V, and VI provide a basis for selecting component values for both the RC clocked generator (NM95HS01) and the crystal (XTAL) oscillator clocked generator (NM95HS02). The component values shown in the tables have been chosen for low cost, general availability, and reliable operation. Components are referenced to the circuit schematics shown in Figure 3. Though there is some flexibility in selecting alternate values, there are constraints on permissible component values. All resistors and capacitors should be kept within the following ranges; 3 kX s Rx s 200 kX and 50 pF s Cx s 200 pF. Once the NM95HS01/02 has been initialized, the device will generate and transmit a new code each time a key is pressed. If a key is held down, the same frame (plus any pauses between frames) is transmitted repeatedly. If the key is held down for longer than 80 seconds, the generator will go into halt mode to conserve battery power, and will stop transmitting data frames (if the TIMEOUTEN option is enabled). Another option available during normal generator operation is the ability to generate a resync after a key has been pressed for more than 10 seconds (if the AutoResync option is enabled). This option allows the end user to resynchronize the generator if necessary, without having to remove and replace the battery. TABLE IV. RC Clock Components, TA e 25§ C, VCC e 5V – 6.5V FORWARD CALCULATION AND CODE WINDOWS Aside from using a sync frame, there is another way to ensure the NM95HS01/02 remains in sync with its decoder during normal operation. The decoder can perform a forward calculation to predict what the next generator codes will be. This is an important point, and should be considered carefully in designing the decoding system. In a well-designed system, the decoder should be able to calculate forward for some reasonable number of codes, and store the results for future reference. This allows the decoder to remain in sync even if it misses one or more codes from the generator. This could occur if the receiver did not receive a transmission clearly, or if someone activated the keys outside the range of the receiver. Increasing the depth of this code window would allow the decoder to miss a greater number of codes from the generator, and still remain in sync. One method for implementing a code window is to include a MICROWIRETM EEPROM (such as the NM93Cx6) in the decoder design, and store the codes in memory. This becomes even more important if the decoder is designed to accomodate several HiSeC generator devices. In this case, the decoder should have a code window available for each device. http://www.national.com R (kX) C (pF) CKI (MHz) CKI (ns) 3.3 82 2.12 – 2.32 470 – 430 5.6 100 1.1 – 1.17 870 – 850 6.8 100 0.9 – 0.95 1100 – 1050 TABLE V. RC Clock Components, TA e 25§ C, VCC e 2.5V R (kX) C (pF) CKI (MHz) CKI (ns) 3.3 82 1.53 – 1.6 650 – 600 5.6 100 0.9 – 1 1100 – 1000 6.8 100 0.8 – 0.83 1250 – 1200 TABLE VI. XTAL Clock Components, TA e 25§ C, VCC e 2.5V – 6.5V 12 R1 (MX) C1 (pF) C2 (pF) CKI (MHz) CKI (ns) 1 30 30 –36 4 250 Generator Clock Design Parameters (Continued) TABLE VII. NM95HS01/02 EEPROM Array Configuration and Definitions Parameter Bits Address Function AutoResync 1 Byte 0, bit 7 Allows user to send a sync frame by holding a key down for l10 seconds LEDSEL 1 Byte 0, bit 6 Determines whether RFEN/LED or CKO/LED is the LED connect pin for the NM95HS02 BatteryType 1 Byte 0, bit 5 Selects between 3V and 6V battery voltage TIMEOUTEN 1 Byte 0, bit 4 Disables data transmission if key is depressed l80 seconds Pause Length (Pause0/Pause1) 2 Byte 0, bits 3–2 Sets the pause time between data frames during data transmission (0/20/50/100) ms FactoryDisableBit 1 Byte 0, bit 1 Disables ability to write to Byte 12 WriteDisableBit 1 Byte 0, bit 0 Enables/disables ability to write into EEPROM array PreamblePresent 1 Byte 1, bit 7 Enables/disables presence of preamble field SyncType 1 Byte 1, bit 6 Determines if sync field is sent in user-selected IR/RF format or default NRZ format SyncPresent 1 Byte 1, bit 5 Enables/disables presence of sync field FixSize 1 Byte 1, bit 4 Determines length of Key ID field (0/20/24 bits) FixPresent 1 Byte 1, bit 3 Enables/disables presence of Key ID field DynSize 1 Byte 1, bit 2 Determines length of Dynamic Code field (24/36 bits) ParityPresent 1 Byte 1, bit 1 Enables/disables presence of parity field CompareEnable 1 Byte 1, bit 0 Enables/disables low battery detect option BitTransmitFormat IRSel PRSeI2,1,0 1 3 Byte 2, bit 7 Byte 2, bits 6–4 Selects among the 12 possible IR/RF bit coding formats Selects between IR and RF bit coding formats Used with IRSeI to select particular bit coding format TxPol 1 Byte 2, bit 3 Sets the quiescent output state and data logic level on the TX output pin SCLK 1 Byte 2, bit 2 Determines whether the IR clock or RF clock is used as the bit timing time base Prescaler3 6 Byte 2, bits 1–0 Byte 3, bits 7–4 Sets interframe delay time and key debounce time (Also generates timeout delay time) Prescaler2 6 Byte 3, bits 3–0 Byte 4, bits 7–6 Sets RF Clock timing 6 Prescaler1 Byte 4, bits 5–0 Sets IR Clock timing DynamicCode 24 Bytes 5–7 Sets initial configuration of the Rolling Code registers KeyIDCode 24 Bytes 8–10 Sets user-configurable key identification register SyncFieldCode 8 Byte 11 Sets configuration of sync field register Reserved 8 Byte 12 Reserved for factory use Ð unique customized algorithm option Note: The first bit clocked into the device is Byte 0, bit 7. The seventh and eight bits are the chip disable bits. Once they are set, and VCC is removed, the chip will be disabled. 13 http://www.national.com Absolute Maximum Ratings (Note 1) Ambient Storage Temperature a 300§ C Lead Temperature (Soldering, 10 sec.) ESD Rating If Military/Aerospace specified devices are required, please contact the National Semiconductor Sales Office/Distributors for availability and specifications. Ambient Operating Temperature NM95HS01/NM95HS02 NM95HS01E/NM95HS02E b 65§ C to a 150§ C Input or Output Voltages with Respect to Ground b 0.5V to a 7V All except K1 or K2 b 0.5V to a 13V K1 or K2 2000V 0§ C to a 70§ C b 40§ C to a 85§ C Power Supply (VCC) Range 2.2V to 6.5V NM95HS01/02 DC and AC Electrical Characteristics 2.2V s VCC s 6.5V (unless otherwise specified) Min Typ Max Units VCC Symbol Supply Voltage Parameter Conditions 2.5 5.0 6.5 V VRW Read/Write Voltage 4.5 5.0 5.5 V VSV Supervoltage (Note 2) 11.5 12.0 12.5 V ICC Supply Current Halt Mode (3.0V) (Note 2) Halt Mode (6.0V) Normal Mode CKI e 0 MHz, VCC e 3.0V CKI e 0 MHz, VCC e 6.0V CKI e 4.1 MHz, VCC e 6V 0.1 0.5 1 1 2 3 mA mA mA VIH Input Voltage (High) CKI: Logic High All Others; Logic High VIL Input Voltage (Low) CKI: Logic Low All Others: Logic Low IP Pullup Current VCC e 6V, VIN e 0V IRF Leakage Current (RFEN) VCC e 6V, RFEN e 6V IOUT Output Current Source (Push-Pull) Sink (Push-Pull) VCC e 4.5V, VOH e 3.3V VCC e 4.5V, VOL e 0.4V 0.8 VCC 0.7 VCC V V 0.2 VCC 0.2 VCC 35 120 250 mA 1 mA 10 15 mA mA tPS Power Supply Rise Time IMP Max. Sink-Source Current per Pin VTH Comparator Threshold Voltage BattType e 0 (3V) BattType e 1 (6V) 2.2 4.4 tWW K1 Initiate Write Time tWW e tWHW a tWLW 40 ms tWHW Write Time High 20 ms tWLW Write Time Low 20 ms tSW K2 Setup Time 20 ms tHW K2 Hold Time 20 ms tPW Program Write Time 10 ms tCKIHSW Supervoltage Low to Clock High Time 10 ms tSVLW Clock Low to Supervolt High Time 10 ms tXW Exit Write Time tDSW Data Setup Time 100 tDHW Data Hold Time 100 tWR Initiate K1 Read Time tWHR Read Time High tWLR Read Time Low tCKIHSR Start Read Time http://www.national.com 1 ms V V 10 ms 10 tWR e tWHR a tWLR 10 14 10 ms 20 mA 2.4 4.8 V V ms ns ns 40 ms 20 ms 20 ms ms NM95HS01/02 DC and AC Electrical Characteristics 2.5V s VCC s 6.5V (unless otherwise specified) (Continued) Max Units tCKI Symbol Clock Period Time (Note 4) Parameter XTAL Clock RC Clock Conditions 2000 2000 Min Typ DC DC ns ns tCKIH Clock High Time (Note 4) XTAL Clock RC Clock 1000 1000 DC DC ns ns tCKIL Clock Low Time (Note 4) XTAL Clock RC Clock 1000 1000 DC DC ns ns tDAR Data Access Time tDAR e tCKIH a tDALR tDALR Data Access Time Low tENDR End Read Time 10 ms tSVLR K1 Supervoltage Low Time (Read) 10 ms tXR Exit Read Time 10 ms 1.1 ms 100 ns Note 1: Stresses above those listed under ‘‘Absolute Maximum Ratings’’ may cause permanent damage to the device. This is a stress rating only, and functional operation of the device at these or any other conditions above those indicated in the operational sections of the specification is not implied. Exposure to absolute maximum rating conditions for extended periods may affect device reliability. Note 2: The standby current of k 1 mA is tested at 3V. During HALT Mode only a very small current is required to maintain the code in the shift registers. HALT mode is exited by depressing one of the input keys. Note 3: The clock rate used to program the NM95HS01/02 is generally less than the normal operating mode clock rate, and should be temporarily reduced as necessary to meet the programming specifications shown here. For example, a generator might normally operate at 4 MHz, but should be programmed at s 0.5 MHz (2000 ns). Note 4: Parameter characterized but not 100% tested. Capacitance TA e a 25§ C, f e 1 MHz (Note 2) Test Max Units CIN Symbol Input Capacitance 7 pF COUT 0utput Capacitance 12 pF Typical Halt Mode Current (nA) vs Voltage over Temperature TL/D/12302 – 23 15 http://www.national.com Timing Diagrams Write Mode TL/D/12302 – 21 Read Mode TL/D/12302 – 22 http://www.national.com 16 pulses applied to CKI to initialize the part. (See Timing Diagram on pg. 16.) After this initialization, K2 is brought to supervoltage. K1 is then brought to supervoltage. Now K2 is brought back to VRW, then K1 is brought back to VRW. The NM95HS01/02 is now in Write mode. To program the first byte, set K1 back to supervoltage, and place the first byte of data (VIH and VIL pulses) onto K2 (starting with the Least Significant Bit). As each bit is placed on K2, clock the CKI pin to latch the bit. When all bits of the first byte have been latched in, set K1 to VRW, and poll the TX output pin for a logic low. This confirms the NM95HS01/02 has written the byte to memory. Repeat this sequence to program the remainder of the bytes. When all 13 bytes have been programmed, set K1 and K2 to 0V to end Write mode. Programming the NM95HS01/02 The NM95HS01/02 HiSeC Generator uses four pins to read and write the 13 bytes of on-chip EEPROM. These are the Key1 (K1), Key2 (K2), TX, and CKI pins. K1 functions as the chip select line, K2 functions as the data strobe, CKI serves as the serial clock, and TX acts as the data out pin. Three voltage levels are required to program the device: Supervoltage (VSV), Read/Write voltage (VRW), and Ground (0V). Supervoltage is used to select Read and Write modes in the device. These modes can only be entered by applying supervoltage to K1 and K2. This alleviates the risk of the device entering these modes during normal operation. The programming protocol for the NM95HS01/02 on-chip EEPROM array was designed to match National Semiconductor’s MICROWIRE format closely. However, there are several differences. One is the need to use a supervoltage to select modes. Another concerns the CKI clock input. Upon power-up, the NM95HS01/02 CKI input must be clocked a minimum of 1500 times to ensure the part is ready for programming. This allows the internal state machines and registers to perform their necessary power-on sequences. (See Table VII.) Read Mode The NM95HS01/02 HiSeC Generator can be placed in Read mode by applying supervoltage to K1. Upon powerup, both K1 and K2 must be set to VRW, and a minimum of 1500 clock pulses applied to CKI to initialize the part. (See Timing Diagram on pg. 16.) After this initialization, K1 is brought to supervoltage. Then K1 is brought back to VRW. The NM95HS01/02 is now in Read mode. To read the first byte, set K1 back to supervoltage, and clock the CKI pin 8 times, while polling TX. EEPROM data is sent Most Significant Bit first. Continue clocking CKI to read the remainder of the bytes. When all 13 bytes have been read, set K1 back to VRW. Set K1 and K2 to 0V to end Read mode. Write Mode The NM95HS01/02 HiSeC Generator can be placed in Write mode when supervoltage is applied to both K1 and K2 in a specific sequence. Upon power-up, both K1 and K2 must be set to VRW, and a minimum of 1500 clock Programmer Support for NM95HS01/02 Worldwide third party support is provided by: Vendor Contact Number Xeltek SuperPro-EM Universal Programmer Europe: 49-5722-203-125 (Germany) America: 408-524-1929 Asia: 65-296-6433 (Singapore) BBS: 408-245-7082 National Semiconductor NM95HS-PRO-X Americas: 800-272-9959 System General Turpro-1 Univeral Device Programmer Switzerland: 31-921-7844 America: 408-263-6667/800-967-4776 Taiwan: 886-2-917-3015 BBS: 408-262-6438 Hi-Lo ALL-07 Asia: 886-2764-0215 America: 510-623-3850 Evalutation kit support for NM95HS01/02. A demonstration kit for the HiSeC High Security Rolling Code Generator is available: National Semiconductor NM95HSEV NM95HSPRO HiSeC Evaluation Board HiSeC Single Site Programmer 17 http://www.national.com Physical Dimensions inches (millimeters) unless otherwise noted 8-Lead (0.150× Wide) Molded Small Outline Package, JEDEC Order Number NM95HS01M8 or NM95HS02M8 NS Package Number M08A 14-Lead (0.150× Wide) Molded Small Outline Package, JEDEC Order Number NM95HS01M14 or NM95HS02M14 NS Package Number M14A http://www.national.com 18 Physical Dimensions inches (millimeters) unless otherwise noted (Continued) 8-Lead Dual-In-Line Package Order Number NM95HS01N, NM95HS01EN, NM95HS02N or NM95HS02EN NS Package Number N08E 14-Lead (0.300× Wide) Molded Dual-In-Line Package Order Number NM95HS01N14 or NM95HS02N14 NS Package Number N14A 19 http://www.national.com NM95HS01/NM95HS02 HiSeC High Security Rolling Code Generator Physical Dimensions all dimensions are in millimeters (Continued) 14-Lead Molded Thin Shrink Small Outline Package, JEDEC Order Number NM95HS01MT14/NM95HS02MT14 NS Package Number MTC14 LIFE SUPPORT POLICY NATIONAL’S PRODUCTS ARE NOT AUTHORIZED FOR USE AS CRITICAL COMPONENTS IN LIFE SUPPORT DEVICES OR SYSTEMS WITHOUT THE EXPRESS WRITTEN APPROVAL OF THE PRESIDENT OF NATIONAL SEMICONDUCTOR CORPORATION. As used herein: 1. Life support devices or systems are devices or systems which, (a) are intended for surgical implant into the body, or (b) support or sustain life, and whose failure to perform, when properly used in accordance with instructions for use provided in the labeling, can be reasonably expected to result in a significant injury to the user. National Semiconductor Corporation 1111 West Bardin Road Arlington, TX 76017 Tel: 1(800) 272-9959 Fax: 1(800) 737-7018 http://www.national.com 2. A critical component is any component of a life support device or system whose failure to perform can be reasonably expected to cause the failure of the life support device or system, or to affect its safety or effectiveness. National Semiconductor Europe Fax: a49 (0) 180-530 85 86 Email: europe.support @ nsc.com Deutsch Tel: a49 (0) 180-530 85 85 English Tel: a49 (0) 180-532 78 32 Fran3ais Tel: a49 (0) 180-532 93 58 Italiano Tel: a49 (0) 180-534 16 80 National Semiconductor Hong Kong Ltd. 13th Floor, Straight Block, Ocean Centre, 5 Canton Rd. Tsimshatsui, Kowloon Hong Kong Tel: (852) 2737-1600 Fax: (852) 2736-9960 National Semiconductor Japan Ltd. Tel: 81-043-299-2308 Fax: 81-043-299-2408 National does not assume any responsibility for use of any circuitry described, no circuit patent licenses are implied and National reserves the right at any time without notice to change said circuitry and specifications.