 |
|
| If you can't view the Datasheet, Please click here to try to view without PDF Reader . |
|
|
|
| If you can't view the Datasheet, Please click here to try to view without PDF Reader . |
|
|
| Datasheet File OCR Text: |
| ? 2001 microchip technology inc. preliminary ds00744a-page 1 m AN744 overview this application note describes a k ee l oq code hop- ping decoder implemented on a microchip mid-range enhanced flash mcu (pic16f872). the software has been designed as a group of independent modules (standard c source files "c" ). for clarity and ease of maintenance, each module cov- ers a single function. each module can be modified to accommodate a different behavior, support a different mcu, and/or a different set of peripherals (memories, timers, etc.). key features the set of modules presented in this application note implement the following features: ? source compatible with hitech and ccs c compilers pin out compatible with picdem-2 board normal learn mode learn up to 8 transmitters, using the internal eeprom memory of pic16f872 interrupt driven radio receive (pwm) routine compatible with all existing k ee l oq hopping code encoders with pwm transmission format selected, operating in "slow mode" (t e = 400 s) automatic synchronization during receive, using a 4 mhz rc oscillator figure 1: decoder pin out table 1: functional inputs and outputs notice: this is a non-restricted version of application note an745 which is available under the k ee l oq license agreement. the license agreement can be ordered from the microchip literature center as ds40149. author: lucio di jasio microchip technology inc. pin name pin number input/ output function rfin 3 i demodulated pwm signal from rf receiver learn 6 i input to enter learn mode learn- out 25 o output to show the status of the learn process out0..3 21,22,2 3, 24 o function outputs, correspond to encoder input pin v low 26 o low battery indica- tor, as transmitted by the encoder v dd 20 pwr 5v power supply v ss 19, 8 gnd common ground note: all nu pins are tristate 1 2 3 4 5 6 7 8 9 28 27 26 25 24 23 22 21 20 mclr lrnout rf in nu nu learn nu v ss oscin nu nu v low learnout out3 out2 out1 out0 v dd 10 11 12 13 14 19 16 17 18 15 oscout nu nu nu nu v ss nu nu nu nu modular mid-range picmicro ? k ee l oq ? decoder in c
AN744 ds00744a-page 2 preliminary ? 2001 microchip technology inc. design objectives each module has been designed for maximum simplic- ity and maintainability. whenever possible, we favored clarity of design over efficiency in order to show the basic concepts of the design of a k ee l oq decoder with- out the constraints of previous pic16c5x implementa- tions such as limited ram, stack, or other resources. to achieve maximum ease in maintenance, we adopted "modern" c language programming tech- niques, specifically: all pin assignments are mapped through #define directives. this results in almost com- plete code independence from the specific pin out chosen drivers to peripherals that are specific to a given processor type (such as pic16f872) have been encapsulated in more generic modules function input and output values are documented pseudo-graphical representation of the data structures used and program flow is commented whenever possible although the code can be compiled in a set of indepen- dent object files and then linked together to build the actual application, we kept all the modules included in line with the main module to retain compatibility with compilers that have no linker such as ccs pic c. modules overview the code presented in this application note is com- posed of the following basic modules: rxi.c interrupt driven receiver keygen.c k ee l oq key generation routines imple- menting normal mode fastdec.c k ee l oq decrypt routine mem-87x.c pic16f87x eeprom driver table.c transmitters table memory manage- ment (linear list) main.c the actual initialization and main loop figure 2: modules overview timer0 rxi.c 1st buffer rf_full flag radio receiver receive buffer main.c main loop interrupt learn out s0 out s3 learnout v low keygen.c - normal keygen - load manufacturer code fastdec.c - decrypt table.c - insert - search mem-87x.c - rdword - wrword eeprom k ee l oq ? - idwrite - hopupdate - clearmem - decchk - hopchk x x pic16f872 ? 2001 microchip technology inc. preliminary ds00744a-page 3 AN744 receiver module the receiver module has been developed around a fast and independent interrupt service routine (isr). the whole receiving routine is implemented as a simple state machine that operates on a fixed time base. this can be used to produce a number of virtual timers. the operation of this routine is completely transparent to the main program and similar to a uart. in fact, the interrupt routine consumes only 30% of the computa- tional power of the mcu working in the background . after a complete code-word of 66 bits has been prop- erly received and stored in a 9 bytes buffer, a status flag ( rf_full ) is set and the receiver becomes idle. it is the responsibility of the main program to make use of the data in the buffer and to clear the flag to enable the receiving of a new code-word. in order to be compatible with all k ee l oq encoders, with or without oscillator tuning capabilities, the receiver routine constantly attempts to resynchronize with the first rising edge of every bit in the incoming code-word. this allows the decoder to operate from an inexpensive (uncalibrated) rc clock. in doing so, the last rising edge/bit of every code-word is lost (resulting in an effective receive buffer capacity of 65-bit). for hcs20x and hcs30x encoders this implies that the repeat bit (being the 66th) cannot be captured. while for advanced encoders like the hcs36x or hcs4xx, the reader can easily modify the definition of the constant bit_num to 68 to receive all bits trans- mitted with exception of the last queue bit q1 (being the 69th), again rarely used. the only resource/peripheral used by this routine is timer0 and the associated overflow interrupt. this is available on every mid-range picmicro microcontroller. timer0 is reloaded on overflow, creating a time base (of about 1/3 t e = 138 s). the same interrupt service rou- tine also provides a virtual 16-bit timer, derived from the same base period, called xtmr . figure 3: code-word transmission format figure 4: code-word organization logic ? 0 ? logic ? 1 ? bit period preamble header encrypted portion of transmission fixed portion of transmission guard time t p t h t hop t fix t g t e 16-bit discrimination bits (10 bits) overflow bits (2 bits) button status (4 bits) transmission direction 32 bits of encrypted data encrypted using b lock c ipher algorithm encrypted code data sync value 28-bit serial number button status (4 bits) + + v low and repeat status (2 bits) serial number and button 2 bits of status fixed code data status (32 bits) AN744 ds00744a-page 4 preliminary ? 2001 microchip technology inc. since the radio input is polled (for 1 s) on multiples of the base period (138 s), the chance of a glitch (short noise pulse) disturbing the receiver is reduced. further, since the time base produced is constant, the same interrupt service routine could easily be extended to implement a second uart as a separate state machine for full duplex asynchronous communication up to 1,200 baud at 4 mhz. note: this would also require the main oscillator to be crystal based. other implementations of the same receiver module can be obtained using other peripherals and detection techniques. these include: using the int pin and selectable edge interrupt source using the timer1 and ccp module in capture mode using comparator inputs interrupt all of these techniques pose different constraints on the pin out, or the picmicro mcu, that can be used. this would lead to different performances in terms of achievable immunity from noise and or cpu overhead, etc. fast decryption module this module contains an implementation of the k ee l oq decryption algorithm that has been optimized for speed on a mid-range picmicro microcontroller. it allows fast decryption times for maximum responsiveness of the system even at 4 mhz clock. the decryption function is also used in all learning schemes and represents the fundamental building block of all k ee l oq decoders. key generation module this module shows a simple and linear implementation of the normal learn key generation . this module uses the k ee l oq decrypt routine from the fast decryption module to generate the key at every received code-word instead of generating it during the learn phase and storing it in memory. the advantage is a smaller transmitter record of 8 bytes instead of 16 bytes (see table 2). this translates in a double number of transmitters that can be learned using the 64 byte internal eeprom available inside the pic16f872. this space reduction comes at the expense of more computational power required to process every code- word. when a new code-word is received, the key gen- eration algorithm is applied (normal learn) and the resulting description key is placed in the array dkey[ 0..7 ] . during a continous transmission (the user is holding the button on the transmitter), the key generation is not repeated, to save time, the last com- puted decryption key value is used safely instead (the serial number being the same). due to double buffering of the receiver and the picmicro mcu execution speed and efficiency (even running at 4 mhz only), it is possible to receive and decrypt, at the same time, each and every incoming code-word. for an overview of some of the different security levels that can be obtained through the use of different key generation/management schemes, refer to the "secure data products handbook" [ds40168] (section 1, k ee l oq comparison chart, security level summary). a detailed description of the normal learn key gener- ation scheme can be found in technical brief tb003 "an introduction to k ee l oq code hopping" [ds91002]. more advanced key generation schemes can be implemented replacing this module with the techniques described in technical brief tb001 "secure learning rke systems using k ee l oq encoders" [ds91000]. table module one of the major tasks of a decoder is to properly main- tain a database that contains all the unique id ? s (serial numbers) of the learned transmitters. in most cases, the database can be as simple as a single table, which associates those serial numbers to the synchronization counters (that are at the heart of the hopping code technology). this module implements the easiest of all methods, a simple "linear list" of records. each transmitter learned is assigned a record of 8 bytes (shown in table 2), where all the relevant infor- mation is stored and regularly updated. table 2: transmitter record offset data description +0 fcode function code (4 bits) and upper 4 serial number bits [24..28] +1 idlo serial number bits [0..7] +2 idhi serial number bits [8..15] +3 idmi serial number bits [16..23] +4 synch sync counter 8 msb +5 syncl sync counter 8 lsb +6 synch2 second copy of synch +7 syncl2 second copy of syncl ? 2001 microchip technology inc. preliminary ds00744a-page 5 AN744 the 16-bit synchronization counter value is stored in memory twice because it is the most valuable piece of information in this record. it is continuously updated at every button press on the remote. when reading the two stored synchronous values, the decoder should verify that the two copies match. if not, it can adopt any safe resync or disable technique required depending on the desired system security level . the current implementation limits the maximum num- ber of transmitters that can be learned to eight. this is due to the size of the internal eeprom of the pic16f872. this number can be changed to accommodate different picmicro models and memory sizes by modifying the value of the constant max_user . the simple "linear list" method employed can be scaled up to some tens of users. but due to its simplicity, the time required to recognize a learned transmitter grows linearly with the length of the table. it is possible to reach table sizes of thousands of trans- mitters by replacing this module with another module that implements a more sophisticated data structure like a ? hash table ? or other indexing algorithms. again due to the simplicity of the current solution, it is not possible to selectively delete a transmitter from memory. the only delete function available is a bulk erase (complete erase of all the memory contents) that happens when the user presses the learn button for up to 10 seconds. (the led will switch off. at the release of the button, it will flash once to acknowledge the delete command). to allow for selective transmitter removal from memory, more sophisticated techniques will be analyzed in future application notes, by simply replacing/updating this module. mem-87x module this module is optimized to drive the internal eeprom of the pic16f87x device. the module make the memory generically accessible by means of two routines rdword and wrword that respectively read and write a 16-bit value out of an even address specified in parameter ind. replacing this module with the appropriate drivers, (and adapting the pin out) make possible the use of any kind of nonvolatile memory. this includes internal and external serial eeproms (microwire ? , spi ? or i 2 c ? bus) of any size up to 64 kbytes. the main program the main program is reduced to a few pages of code. the behavior is designed to mimic the basic behavior of the hcs512 integrated decoder, although just the parallel output is provided (no serial interface). most of the time, the main loop goes idle waiting for the receiver to complete reception a full code-word. double buffering of the receiver is done in ram, in order to immediately re-enable the reception of new codes and increase responsiveness and perceived range. conclusion the c language source increases the readability of the program structure and eases the maintenance. this benefit has come at the cost of the program size. that in terms of memory words, has considerably increased over the equivalent code written in assembly (more than 30% larger). selecting a flash picmicro microcontroller from the mid-range family as the target mcu allows us to make the code simpler and cleaner. it also provides larger ram memory space and a deeper hardware stack. interrupts have been used to "virtualize" the receiving routine as a software peripheral and to free the design of the hard real time constraint that it usually poses. still, many of the resources available on the pic16f872 are left unused and available to the designer. these include: timer1, a 16-bit timer timer1 oscillator, a low power oscillator for real time clock ccp module, capable of capture, compare and pwm generation timer2, an 8-bit timer, with auto reload 10-bit a/d converter with a 5 channel input multiplexer we resisted introducing extra features and optimiza- tions in favor of clarity. for example: speed optimizations and code compacting more complex key generation schemes multiple manufacturer codes co-processor functionality advanced user entry and deletion commands large memory tables (up to 8,000 users) serial interface to pdas and/or terminals for memory management and logging these are left as exercises to the advanced reader/ designer or as suggestions for further application notes. AN744 ds00744a-page 6 preliminary ? 2001 microchip technology inc. memory usage function headers compiling with hitech 7.86r3 memory usage map: ccs pcw c compiler, version 2.535, 4511 filename: d:\work\smad\an\decc\main.lst rom used: 1155 (28%) 1155 (28%) including unused fragments ram used: 71 (37%) at main () level 84 (44%) worst case stack: 4 worst case (3 in main +1 for interrupts) references program rom $0000 - $00a8 $00a9 ( 169) words program rom $04af - $07ff $0351 ( 849) words program rom $2000 - $2005 $0006 ( 6) words program rom $2007 - $2007 $0001 ( 1) words $0401 ( 1025) words total program rom bank 0 ram $0021 - $006d $004d ( 77) bytes bank 0 ram $0070 - $0074 $0005 ( 5) bytes $0052 ( 82) bytes total bank 0 ram bank 0 bits $0100 - $0105 $0006 ( 6) bits total bank 0 bits k ee l oq code hopping decoder on a pic16c56 an642 ds00642 converting ntq105/106 designs to hcs200/300s an644 ds00644 code hopping security system on a pic16c57 an645 ds00645 secure learn code hopping decoder on a pic16c56 an652 ds00652 k ee l oq simple code hopping decoder an659 ds00659 k ee l oq code hopping decoder on a pic16c56 (public version) an661 ds00661 secure learn code hopping decoder on a pic16c56 (public version) an662 ds00662 k ee l oq simple code hopping decoder (public version) an663 ds00663 using k ee l oq to generate hopping passwords an665 ds00665 picmicro mid-range mcu code hopping decoder an662 ds00672 hcs410 transponder decoder using a pic16c56 an675 ds00675 modular picmicro mid-range mcu code hopping decoder an742 ds00742 secure learning rke systems using k ee l oq encoders tb001 ds91000 an introduction to k ee l oq code hopping tb003 ds91002 a guide to designing for eurohomelink compatibility tb021 ds91021 k ee l oq decryption & iff algorithms tb030 ds91030 k ee l oq decryption routines in c tb041 ds91041 interfacing a k ee l oq encoder to a pll circuit tb042 ds91042 k ee l oq crc verification rou- tines tb043 ds91043 ? 2001 microchip technology inc. preliminary ds00744a-page 7 AN744 appendix a: dechit h source code // module dechit.h // // include this file when using the hitech c compiler // #define hitech #include AN744 ds00744a-page 8 preliminary ? 2001 microchip technology inc. appendix b: decccs h source code // module decccs.h // // include this file when using the ccs c compiler // #define ccs #device pic16c63 typedef short bit; // one bit typedef unsigned int byte; // one byte unsigned typedef signed int sbyte; // one byte signed typedef signed long word; // one word signed // un-supported directives #define static #define volatile #define interrupt #define true 1 #define false 0 #define on 1 #define off 0 // // f872 special function registers // #byte tmr0 = 0x01 // timer 0 #bit t0if = 0x0b.2 // timer 0 interrupt flag #bit t0ie = 0x0b.5 // timer 0 interrupt enable #bit gie = 0x0b.7 // global interrupt enable #byte option = 0x81 // prescaler timer0 control #byte adcon1 = 0x9f // a/d converter control #byte trisa = 0x85 // port a #byte porta = 0x05 #bit ra0 = 0x05.0 #bit ra1 = 0x05.1 #bit ra2 = 0x05.2 #bit ra3 = 0x05.3 #bit ra4 = 0x05.4 #bit ra5 = 0x05.5 #byte trisb = 0x86 // port b #byte portb = 0x06 #bit rb0 = 0x06.0 #bit rb1 = 0x06.1 #bit rb2 = 0x06.2 #bit rb3 = 0x06.3 #bit rb4 = 0x06.4 #bit rb5 = 0x06.5 #bit rb6 = 0x06.6 #bit rb7 = 0x06.7 #byte trisc = 0x87 // port c #byte portc = 0x07 // internal eeprom access #byte eeadr = 0x10d #byte eedata = 0x10c #byte eecon1 = 0x18c #byte eecon2 = 0x18d #bit wr = 0x18c.1 ? 2001 microchip technology inc. preliminary ds00744a-page 9 AN744 #bit rd = 0x18c.0 #bit wren = 0x18c.2 #bit eepgd =0x18c.7 // macro versions of eeprom write and read #defineeeprom_write(addr, value) while(wr)con- tinue;eeadr=(addr);eedata=(value);eepgd=0;gie=0;wren=1;\ eecon2=0x55;eecon2=0xaa;wr=1;wren=0 #defineeeprom_read(addr) ((eeadr=(addr)),(eepgd=0),(rd=1),eedata) // configuration and id locations #fuses rc, nowdt, noprotect, brownout #id 0x1234 AN744 ds00744a-page 10 preliminary ? 2001 microchip technology inc. appendix c: main c source code // ********************************************************************* // filename: main.c // ********************************************************************* // author: lucio di jasio // company: microchip technology // revision: rev 1.00 // date: 08/07/00 // // keeloq normal learn decoder on a mid range pic // full source in c // // compiled using hitech pic c compiler v.7.93 // compiled using ccs pic c compiler v. 2.535 // ******************************************************************** //#include "decccs.h" // uncomment for ccs compiler #include "dechit.h" // uncomment for hitech compiler // //--------------------------------------------------------------------- // i/o definitions for pic16f872 // compatible with picdem-2 demo board // // +-------- -------+ // reset -|mclr o rb7|- nu(icd data) // (pot) -|ra0 rb6|- nu(icd clock) // rfin -|ra1 rb5|- vlow(led) // nu -|ra2 rb4|- learnout(led) // nu -|ra3 prg/rb3|- out3(led) // learn -|ra4/t0cki rb2|- out2(led) // nu -|ra5 rb1|- out1(led) // gnd -|vss int/rb0|- out0(led) // xtal -|oscin vdd|- +5v // xtal -|oscout vss|- gnd // nu -|rc0 rx/rc7|- nu(rs232) // nu -|rc1 tx/rc6|- nu(rs232) // nu(sw3) -|rc2/ccp1 rc5|- nu // nu -|rc3/scl sda/rc4|- nu // +----------------+ // #define rfin ra1 // i radio signal input #define learn ra4 // i learn button #define out0 rb0 // o s0 output #define out1 rb1 // o s1 output #define out2 rb2 // o s2 output #define out3 rb3 // o s3 output #define led rb4 // o learnout led #define vlow rb5 // o low battery #define maskpa 0xff // port a i/o config (all input) #define maskpb 0xc0 // port b i/o config (6 outputs) #define maskpc 0xff // port c i/o config (nu) // -----------------global variables --------------------------- byte buffer[9]; // receive buffer //--------------------------------------------------------------- // ? 2001 microchip technology inc. preliminary ds00744a-page 11 AN744 // keeloq receive buffer map // // | plain text | encrypted // rv000000.kkkkiiii.iiiiiiii.iiiiiiii.iiiiiiii.kkkkoodd.dddddddd.ssssssss.ssssssss // 8 7 6 5 4 3 2 1 0 // // i=s/n -> serial number (28 bit) // k=key -> buttons encoding (4 bit) // s=sync -> sync counter (16 bit) // d=disc -> discrimination bits (10 bit) // r=rept -> repeat/first (1 bit) // v=vlow -> low battery (1 bit) // //-- alias ------------------------------------------------------------- // #define hoplo buffer[0] //sync counter #define hophi buffer[1] // #define dislo buffer[2] //discrimination bits lsb #define dok buffer[3] //disc. msb + ovf + key #define idlo buffer[4] //s/n lsb #define idmi buffer[5] //s/n #define idhi buffer[6] //s/n msb #define s0 5 // buffer[3] function codes #define s1 6 // buffer[3] function codes #define s2 7 // buffer[3] function codes #define s3 4 // buffer[3] function codes #define vflag 7// buffer[8] low battery flag //----------------- flags defines ------------------------------------ bit fhopok; // hopping code verified ok bit fsame; // same code as previous bit flearn; // learn mode active bit f2chance; // resync required //-------------------------------------------------------------------- // timings // #define tout 5 // 5 * 71ms = 350ms output delay #define tflash 2 // 4 * 71ms = 280ms half period #define tlearn 255 // 255 * 71ms = 18s learn timeout //byte flags; // various flags byte clearn, ctlearn; // learn timers and counter byte cflash, ctflash; // led flashing timer and counter byte cout; // output timer byte fcode; // function codes and upper nibble of serial number word dato; // temp storage for read and write to mem. word ind; // address pointer to record in mem. word hop; // hopping code sync counter word ehop; // last value of sync counter (from eeprom) word etemp; // second copy of sync counter // // interrupt receiver // #include "rxim.c" // // external modules // #include "mem-87x.c" // eeprom i2c routines AN744 ds00744a-page 12 preliminary ? 2001 microchip technology inc. #include "table.c" // table management #include "keygen.c" // keeloq decrypt and normal keygen // // prototypes // void remote( void); // // main // // main program loop, i/o polling and timing // void main () { // init adcon1 = 0x7; // disable analog inputs trisa = maskpa; // set i/o config. trisb = maskpb; trisc = maskpc; porta = 0; // init all outputs portb = 0; portc = 0; option = 0x8f; // prescaler assigned to wdt, // tmr0 clock/4, no pull ups ctlearn = 0; // learn debounce clearn = 0; // learn timer cout = 0; // output timer cflash = 0; // flash counter ctflash = 0; // flash timer flearn = false; // start in normal mode f2chance = false; // no resynchronization required initreceiver(); // enable and init the receiver state machine // main loop while ( true) { if ( rffull) // buffer contains a message remote(); // loop waiting 512* period = 72ms if ( xtmr < 512) continue; // main loop // once every 72ms xtmr=0; // re-init fundamental registers adcon1 = 0x7; // disable analog inputs trisa = maskpa; // set i/o config. trisb = maskpb; trisc = maskpc; option = 0x0f; // prescaler assigned to wdt, tmr0 clock/4, pull up t0ie = 1; gie = 1; // poll learn if ( !learn) // low -> button pressed { clearn++; ? 2001 microchip technology inc. preliminary ds00744a-page 13 AN744 // pressing learn button for more than 10s -> erase all if (clearn == 128) // 128 * 72 ms = 10s { led = off; // switch off learn led while( !learn); // wait for button release led = on; // signal led on clearmem(); // erase all comand! cout = tout; // single lomg flash pulse time // timer will switch off led clearn = 0; // reset learn debounce flearn = false; // exit learn mode } // normal learn button debounce if (clearn == 4) // 250ms debounce { flearn = true; // enter learn mode comand! ctlearn = tlearn; // load timout value led = on; // turn led on } } else clearn=0; // reset counter // outputs timing if ( cout > 0) // if timer running { cout--; if ( cout == 0) // when it reach 0 { led = off; // all outputs off out0 = off; out1 = off; out2 = off; out3 = off; vlow = off; } } // learn mode timout after 18s (tlearn * 72ms) if ( ctlearn > 0) { ctlearn--; // count down if ( ctlearn == 0) // if timed out { led = off; // exit learn mode flearn = false; } } // led flashing if ( cflash > 0) { ctflash--; // count down if ( ctflash == 0) // if timed out { ctflash = tflash; // reload timer cflash--; // count one flash led = off; // toggle led if ( cflash & 1) led = on; } } } // main loop } // main AN744 ds00744a-page 14 preliminary ? 2001 microchip technology inc. // // remote routine // // decrypts and interprets receive codes // does normal operation and learn mode // // input: buffer contains the received code word // // output: s0..s3 and learnout // void remote() { // a frame was received and is stored in the receive buffer // move it to decryption buffer, and restart receiving memcpy( buffer, b, 9); rffull = false; // ready to receive a new frame // decoding normalkeygen(); // compute the decryption key decrypt(); // decrypt the hopping code portion if ( decchk() == false) // decription failed return; if ( flearn) { // learn mode if ( find()== false) // could not find the serial number in memory { if ( !insert()) // look for new space return; // fail if no memory available } // assert ind is pointing to a valid memory location idwrite(); // write serial number in memory fhopok = true; // enable updating hopping code hopupdate(); // write hoping code in memory cflash = 32; // request led flashing ctflash = tflash; // load period timer led = true; // start with led on flearn = false; // terminate successfully learn } // learn else // normal mode of operation { if ( find()== false) return; if ( !hopchk()) // check hopping code integrity return; if ( fsame) // identified same code as last memorized { if ( cout >0) // if output is still active cout = tout; // reload timer to keep active else return; // else discard } else // hopping code incrementing properly { ? 2001 microchip technology inc. preliminary ds00744a-page 15 AN744 hopupdate(); // update memory // set outputs according to function code if ( bit_test(buffer[3],s0)) out0 = on; if ( bit_test(buffer[3],s1)) out1 = on; if ( bit_test(buffer[3],s2)) out2 = on; if ( bit_test(buffer[3],s3)) out3 = on; // set low battery flag if necessary if ( bit_test(buffer[8],vflag)) vlow = on; // check against learned function code if ( (( buffer[7] ^ fcode) & 0xf0) == 0) led = on; // init output timer cout = tout; }// recognized } // normal mode } // remote AN744 ds00744a-page 16 preliminary ? 2001 microchip technology inc. appendix d: rxi c source code // ********************************************************************** // filename: rxi.c // ********************************************************************* // author: lucio di jasio // company: microchip technology // revision: rev 1.00 // date: 08/07/00 // // interrupt based receive routine // // compiled using hitech pic c compiler v.7.93 // compiled using ccs pic c compiler v.2.535 // ******************************************************************** #define clock 4 // mhz #define te 400 // us #define oversampling 3 #define period te/oversampling*4/clock #define nbit 65 // number of bit to receive -1 byte b[9]; // receive buffer static byte rfstate; // receiver state static sbyte rfcount; // timer counter static byte bptr; // receive buffer pointer static byte bitcount; // received bits counter word xtmr; // 16 bit extended timer volatile bit rffull; // buffer full volatile bit rfbit; // sampled rf signal #define trfreset 0 #define trfsync 1 #define trfuno 2 #define trfzero 3 #define high_to -10 // longest high te #define low_to 10 // longest low te #define short_head 20 // shortest thead accepted 2,7ms #define long_head 45 // longest thead accepted 6,2ms #pragma int_rtcc // install as interrupt handler (comment for hitech!) interrupt rxi() { // this routine gets called every time tmr0 overflows rfbit = rfin; // sampling rf pin verify!!! tmr0 -= period; // reload t0if = 0; xtmr++; // extended 16 long timer update if (rffull) // avoid overrun return; switch( rfstate) // state machine main switch { case trfuno: if ( rfbit == 0) { // falling edge detected ----+ // | ? 2001 microchip technology inc. preliminary ds00744a-page 17 AN744 // +---- rfstate= trfzero; } else { // while high rfcount--; if ( rfcount < high_to) rfstate = trfreset; // reset if too long } break; case trfzero: if ( rfbit) { // rising edge detected +---- // | // ----+ rfstate= trfuno; b[bptr] >>= 1; // rotate if ( rfcount >= 0) { b[bptr]+=0x80; // shift in bit } rfcount = 0; // reset length counter if ( ( ++bitcount & 7) == 0) bptr++; // advance one byte if (bitcount == nbit) { rfstate = trfreset; // finished receiving rffull = true; } } else { // still low rfcount++; if ( rfcount >= low_to) // too long low { rfstate = trfsync; // fall back into rfsync state bptr = 0; // reset pointers, while keep counting on bitcount = 0; } } break; case trfsync: if ( rfbit) { // rising edge detected +---+ +---.. // | | <-theader-> | // +----------------+ if ( ( rfcount < short_head) || ( rfcount >= long_head)) { rfstate = trfreset; break; // too short/long, no header } else { rfcount =0; // restart counter rfstate= trfuno; } } else { // still low rfcount++; } break; AN744 ds00744a-page 18 preliminary ? 2001 microchip technology inc. case trfreset: default: rfstate = trfsync; // reset state machine in all other cases rfcount = 0; bptr = 0; bitcount = 0; break; } // switch } // rxi void initreceiver() { t0if = 0; t0ie = 1; // tmr0 overflow interrupt gie = 1; // enable interrupts rfstate = trfreset; // reset state machine in all other cases rffull = 0; // start with buffer empty xtmr = 0; // start extended timer } ? 2001 microchip technology inc. preliminary ds00744a-page 19 AN744 appendix e: table c source code // ********************************************************************* // filename: table.c // ********************************************************************* // author: lucio di jasio // company: microchip technology // revision: rev 1.00 // date: 08/07/00 // // eeprom table management routines // simple "linear list" management method // // compiled using hitech c compiler v.7.93 // compiled using ccs pic c compiler v. 2.535 // ********************************************************************/ #define max_user 8 // max number of tx that can be learned #define el_size 8 // single record size in bytes // ------------------------------------------------------------ //table structure definition: // // the eeprom is filled with an array of max_user user records // starting at address 0000 // each record is el_size byte large and contains the following fields: // eeprom access is in 16 bit words for efficiency // // datohi datolo offset // +-------+-------+ // | fcode | idlo | 0 xf contains the function codes (buttons) used during learning // +-------+-------+ and the top 4 bit of serial number // | idhi | idmi | +2 idhi idmi idlo contain the 24 lsb of the serial number // +-------+-------+ // | hophi | hoplo | +4 sync counter // +-------+-------+ // | hophi2| hoplo2| +6 second copy of sync counter for integrity checking // +-------+-------+ // // note a function code of 0f0 (seed transmission) is considered // invalid during learning and is used here to a mark location free // // ----------------------------------------------------------- // find routine // // search through the whole table the given a record whose id match // // input: // idhi, idmi, idlo, serial number to search // // output: // ind address of record (if found) // ehop sync counter value // etemp second copy of sync counter // return: true if matching record found // byte find() { byte found; found = false; // init to not found for (ind=0; ind < (el_size * max_user); ind+=el_size) { rdword( ind); // read first word fcode = (dato>>8); AN744 ds00744a-page 20 preliminary ? 2001 microchip technology inc. // check if 1111xxxx if ( (fcode & 0xf0) == 0xf0) continue; // empty if (idlo != (dato & 0xff)) continue; // fails match rdnext(); // read next word if ( ( (dato & 0xff) == idmi) && ( (dato>>8) == idhi)) { found = true; // match break; } } // for if (found == true) { rdnext(); // read hophi/lo ehop = dato; rdnext(); // read hophi2/lo2 etemp= dato; } return found; } // ----------------------------------------------------------- //insert routine // //search through the whole table for an empty space // //input: // idhi, idmi, idlo, serial number to insert // //output: // ind address of empty record // //return: false if no empty space found // byte insert() { for (ind=0; ind < (el_size * max_user); ind+=el_size) { rdword(ind); // read first word fcode = (dato>>8); // check if 1111xxxx if ( (fcode & 0xf0) == 0xf0) return true; // insert point found } // for return false; // could not find any empty slot } // insert //----------------------------------------------------------- //function idwrite // store idhi,mi,lo + xf at current address ind //input: // ind point to record + offset 0 // idhi, idmi, idlo serial number // xf function code //output: // byte idwrite() { if (!flearn) ? 2001 microchip technology inc. preliminary ds00744a-page 21 AN744 return false; // guard statement: check if learn on dato = buffer[7]; dato = (dato<<8) + idlo; wrword(ind); // write first word dato = idhi; dato = (dato<<8) + idmi; wrword(ind+2); // write second word return true; } // idwrite //------------------------------------------------------------ //function hopupdate // update sync counter of user record at current location //input: // ind record + offset 0 // hop current sync counter //output: // none // byte hopupdate() { if (!fhopok) return false; // guard statement: check if hop update hop = ((word)hophi<<8) + hoplo; dato = hop; wrword(ind+4); // write at offset +4 dato = hop; wrword(ind+6); // back up copy at offset +6 fhopok = false; // for safety disable updating hopping code return true; } // hopupdate //----------------------------------------------------------- //function clearmem // mark all records free //input: //output: //uses: // byte clearmem() { for (ind=0; ind < (el_size * max_user); ind+=el_size) { dato = 0xffff; wrword( ind); } return true; } // clearmem AN744 ds00744a-page 22 preliminary ? 2001 microchip technology inc. appendix f: mem-87x c source code // ********************************************************************* // filename: mem-87x.c // ********************************************************************* // author: lucio di jasio // company: microchip technology // revision: rev 1.00 // date: 08/11/00 // // internal eeprom routines for pic16f87x // // compiled using hitech pic c compiler v.7.93 // compiled using ccs pic c compiler v. 2.535 // ********************************************************************* void rdword(word ind) { dato = eeprom_read( ind); dato += (word) eeprom_read( ind+1) <<8; } void rdnext() { // continue reading eeadr++; // note generate no carry dato = ((rd=1), eedata); eeadr++; dato += ((rd=1), eedata)<<8; } void wrword(word ind) { eeprom_write( ind, dato); gie = 1; // write and re-enable interrupt eeprom_write( ind+1, dato>>8); gie = 1; } ? 2001 microchip technology inc. preliminary ds00744a-page 23 AN744 appendix g: key generation source code // ------------------------------------------------------------------------- // legal notice // // the information contained in this document is proprietary and // confidential information of microchip technology inc. therefore all // parties are required to sign a non-disclosure agreement before // receiving this document. // ------------------------------------------------------------------------- // // keeloq normal key generation and decryption // compiled using ccs pic c compiler v. 2.535 // compiled using hitech pic c compiler v. 7.93 // // version 1.00 08/07/2000 lucio di jasio // // ========================================================================= byte dkey[8]; // decryption key byte seed[4]; // seed value = serial number word nexthop; // resync value for 2 chance #ifdef hitech #include "fastdech.c" // for hitech optimized version #else #include "fastdecc.c" // for ccs optimized version #endif // ---------------------------------------------------------------------- void loadmanufcode() { dkey[0]=0xef; // dkey=0123456789abcdef dkey[1]=0xcd; dkey[2]=0xab; dkey[3]=0x89; dkey[4]=0x67; dkey[5]=0x45; dkey[6]=0x23; dkey[7]=0x01; } //---------------------------------------------------------------------- // // key generation routine // // normal learn algorithm // // input: serial number (buffer[4..7]) // manufacturer code // output: dkey[0..7] computed decryption key // void normalkeygen() { byte hoptemp[4]; // hop temp buffer byte skeytemp[4]; // temp decryption key // check if same serial number as last time while output active // it was stored in seed if (( seed[0] != buffer[4]) || ( seed[1] != buffer[5]) || ( seed[2] != buffer[6]) || ( seed[3] != (buffer[7] & 0x0f)) || AN744 ds00744a-page 24 preliminary ? 2001 microchip technology inc. (cout == 0)) { // no new keygen is needed memcpy( hoptemp, buffer, 4); // save hopping code to temp memcpy( seed, &buffer[4], 4); // make seed = serial number seed[3] &= 0x0f; // mask out function codes // compute lsb of decryption key first memcpy( buffer, seed, 4); // get seed in buffer[3] |= 0x20; // add constant 0x20 loadmanufcode(); decrypt(); memcpy( skeytemp, buffer, 4); // save result for later // compute msb of decryption key memcpy( buffer, seed, 4); // get seed in buffer[3] |= 0x60; // add constant 0x60 loadmanufcode(); decrypt(); memcpy( &dkey[4], buffer, 4); // move it into dkey msb memcpy( dkey, skeytemp, 4); // add lsb // ready for decrypt memcpy( buffer, hoptemp, 4); // restore hopping code } else // same serial number as last time... { // just keep on using same decription key } } // normal keygen //---------------------------------------------------------------------- // // valid decryption check // // input: serial number (buffer[4..7]) // hopping code (buffer[0..3]) // output: true if discrimination bits == lsb serial number // and decrypted function code == plain text function code byte decchk() { // verify discrimination bits if ( dislo != idlo) // compare low 8bit of serial number return false; if ( ( (buffer[3] ^ idmi) & 0x3)!= 0) // compare 9th and 10th bit of sn return false; // verify function code if ( ((buffer[3] ^ buffer[7]) & 0xf0)!= 0) return false; return true; } // decchk //---------------------------------------------------------------------- // // hopping code verification // // input: hopping code (buffer[0..3]) // and previous value stored in eeprom ehop // output: true if hopping code is incrementing and inside a safe window (16) // ? 2001 microchip technology inc. preliminary ds00744a-page 25 AN744 byte reqresync() { f2chance= true; // flag that a second (sequential) transmission nexthop = hop+1; // is needed to resynchronize receiver return false; // cannot accept for now } byte hopchk() { fhopok = false; // hopping code is not verified yet fsame = false; // hopping code is not the same as previous // make it a 16 bit signed integer hop = ((word)hophi << 8) + hoplo; if ( f2chance) if ( nexthop == hop) { f2chance = false; // resync success fhopok = true; return true; } // verify eeprom integrity if ( ehop != etemp) return reqresync(); // memory corrupted need a resync // main comparison etemp = hop - ehop; // subtract last value from new one if ( etemp < 0) // locked region return false; // fail else if ( etemp > 16) // resync region return reqresync(); else // 0>= etemp >16 ; open window { if ( etemp == 0) // same code (etemp == 0) fsame = true; // rise a flag fhopok = true; return true; } } // hopchk AN744 ds00744a-page 26 preliminary ? 2001 microchip technology inc. notes: ? 2001 microchip technology inc. preliminary ds00744a-page 27 AN744 ? all rights reserved. copyright ? 2001, microchip technology incorporated, usa. information contained in this publication regarding device applications and the like is intended through suggestion only and may be superseded by updates. no representation or warranty is given and no liability is assumed by microchip technology incorporated with respect to the accuracy or use of such information, or infringement of patents or other intellectual property rights arising from such use or otherwise. use of microchip ? s products as critical components in life support systems is not authorized except with express written approval by microchip. no licenses are conveyed, implicitly or otherwise, under any intellectual property rights. the microchip logo and name are registered trademarks of microchip technology inc. in the u.s.a. and other countries. all rights reserved. all other trademarks mentioned herein are the property of their respective companies. no licenses are conveyed, implicitly or otherwise, under any intellectual property rights. ? trademarks the microchip name, logo, pic, picmicro, picmaster, picstart, pro mate, k ee l oq , seeval, mplab and the embedded control solutions company are registered trademarks of microchip technology incorporated in the u.s.a. and other countries. total endurance, icsp, in-circuit serial programming, filterlab, mxdev, microid, flexrom, fuzzylab, mpasm, mplink, mplib, picdem, icepic, migratable memory, fansense, economonitor, selectmode and microport are trademarks of microchip technology incorporated in the u.s.a. serialized quick term programming (sqtp) is a service mark of microchip technology incorporated in the u.s.a. all other trademarks mentioned herein are property of their respective companies. ? 2001, microchip technology incorporated, printed in the u.s.a., all rights reserved. microchip received qs-9000 quality system certification for its worldwide headquarters, design and wafer fabrication facilities in chandler and tempe, arizona in july 1999. the company?s quality system processes and procedures are qs-9000 compliant for its picmicro ? 8-bit mcus, k ee l oq ? code hopping devices, serial eeproms and microperipheral products. in addition, microchip ? s quality system for the design and manufacture of development systems is iso 9001 certified. information contained in this publication regarding device applications and the like is intended through suggestion only and ma y be superseded by updates. it is your responsibility to ensure that your application meets with your specifications. no representation or warrant y is given and no liability is assumed by microchip technology incorporated with respect to the accuracy or use of such information, or infringement of patent s or other intellectual property rights arising from such use or otherwise. use of microchip ? s products as critical components in life support systems is not authorized except with express written approval by microchip. no licenses are conveyed, implicitly or otherwise, except as maybe explicitly expressed herein, under any intellec- tual property rights. the microchip logo and name are registered trademarks of microchip technology inc. in the u.s.a. and othe r countries. all rights reserved. all other trademarks mentioned herein are the property of their respective companies. ds00744a-page 28 preliminary ? 2001 microchip technology inc. all rights reserved. ? 2001 microchip technology incorporated. printed in the usa. 5/01 printed on recycled paper. m americas corporate office 2355 west chandler blvd. chandler, az 85224-6199 tel: 480-792-7200 fax: 480-792-7277 technical support: 480-792-7627 web address: http://www.microchip.com rocky mountain 2355 west chandler blvd. chandler, az 85224-6199 tel: 480-792-7966 fax: 480-792-7456 atlanta 500 sugar mill road, suite 200b atlanta, ga 30350 tel: 770-640-0034 fax: 770-640-0307 austin analog product sales 8303 mopac expressway north suite a-201 austin, tx 78759 tel: 512-345-2030 fax: 512-345-6085 boston 2 lan drive, suite 120 westford, ma 01886 tel: 978-692-3848 fax: 978-692-3821 boston analog product sales unit a-8-1 millbrook tarry condominium 97 lowell road concord, ma 01742 tel: 978-371-6400 fax: 978-371-0050 chicago 333 pierce road, suite 180 itasca, il 60143 tel: 630-285-0071 fax: 630-285-0075 dallas 4570 westgrove drive, suite 160 addison, tx 75001 tel: 972-818-7423 fax: 972-818-2924 dayton two prestige place, suite 130 miamisburg, oh 45342 tel: 937-291-1654 fax: 937-291-9175 detroit tri-atria office building 32255 northwestern highway, suite 190 farmington hills, mi 48334 tel: 248-538-2250 fax: 248-538-2260 los angeles 18201 von karman, suite 1090 irvine, ca 92612 tel: 949-263-1888 fax: 949-263-1338 mountain view analog product sales 1300 terra bella avenue mountain view, ca 94043-1836 tel: 650-968-9241 fax: 650-967-1590 new york 150 motor parkway, suite 202 hauppauge, ny 11788 tel: 631-273-5305 fax: 631-273-5335 san jose microchip technology inc. 2107 north first street, suite 590 san jose, ca 95131 tel: 408-436-7950 fax: 408-436-7955 toronto 6285 northam drive, suite 108 mississauga, ontario l4v 1x5, canada tel: 905-673-0699 fax: 905-673-6509 asia/pacific australia microchip technology australia pty ltd suite 22, 41 rawson street epping 2121, nsw australia tel: 61-2-9868-6733 fax: 61-2-9868-6755 china - beijing microchip technology beijing office unit 915 new china hong kong manhattan bldg. no. 6 chaoyangmen beidajie beijing, 100027, no. china tel: 86-10-85282100 fax: 86-10-85282104 china - shanghai microchip technology shanghai office room 701, bldg. b far east international plaza no. 317 xian xia road shanghai, 200051 tel: 86-21-6275-5700 fax: 86-21-6275-5060 hong kong microchip asia pacific rm 2101, tower 2, metroplaza 223 hing fong road kwai fong, n.t., hong kong tel: 852-2401-1200 fax: 852-2401-3431 india microchip technology inc. india liaison office divyasree chambers 1 floor, wing a (a3/a4) no. 11, o ? shaugnessey road bangalore, 560 025, india tel: 91-80-2290061 fax: 91-80-2290062 japan microchip technology intl. inc. benex s-1 6f 3-18-20, shinyokohama kohoku-ku, yokohama-shi kanagawa, 222-0033, japan tel: 81-45-471- 6166 fax: 81-45-471-6122 asia/pacific (continued) korea microchip technology korea 168-1, youngbo bldg. 3 floor samsung-dong, kangnam-ku seoul, korea tel: 82-2-554-7200 fax: 82-2-558-5934 singapore microchip technology singapore pte ltd. 200 middle road #07-02 prime centre singapore, 188980 tel: 65-334-8870 fax: 65-334-8850 taiwan microchip technology taiwan 11f-3, no. 207 tung hua north road taipei, 105, taiwan tel: 886-2-2717-7175 fax: 886-2-2545-0139 europe denmark microchip technology denmark aps regus business centre lautrup hoj 1-3 ballerup dk-2750 denmark tel: 45 4420 9895 fax: 45 4420 9910 france arizona microchip technology sarl parc d ? activite du moulin de massy 43 rue du saule trapu batiment a - ler etage 91300 massy, france tel: 33-1-69-53-63-20 fax: 33-1-69-30-90-79 germany arizona microchip technology gmbh gustav-heinemann ring 125 d-81739 munich, germany tel: 49-89-627-144 0 fax: 49-89-627-144-44 germany analog product sales lochhamer strasse 13 d-82152 martinsried, germany tel: 49-89-895650-0 fax: 49-89-895650-22 italy arizona microchip technology srl centro direzionale colleoni palazzo taurus 1 v. le colleoni 1 20041 agrate brianza milan, italy tel: 39-039-65791-1 fax: 39-039-6899883 united kingdom arizona microchip technology ltd. 505 eskdale road winnersh triangle wokingham berkshire, england rg41 5tu tel: 44 118 921 5869 fax: 44-118 921-5820 01/30/01 w orldwide s ales and s ervice |
Price & Availability of AN744
 |
|
|
|
|
All Rights Reserved © IC-ON-LINE 2003 - 2022 |
| [Add Bookmark] [Contact Us] [Link exchange] [Privacy policy] |
|
Mirror Sites : [www.datasheet.hk]
[www.maxim4u.com] [www.ic-on-line.cn]
[www.ic-on-line.com] [www.ic-on-line.net]
[www.alldatasheet.com.cn]
[www.gdcy.com]
[www.gdcy.net] |