NM95HS01M

NM95HS01 NM95HS02 HiSeC High Security Rolling Code Generator February 1996 NM95HS01 NM95HS02 HiSeC TM High Security Rolling Code Generator General Description The NM95HS01 02 HiSeC Rolling Code Generator is a small footprint monolithic CMOS device designed to provide a complete low-cost high security solution to the problem of generating encrypted signals for remote keyless entry (RKE) applications The NM95HS01 02 generates a fully encoded bit stream each time one of (up to) 4 switch inputs is activated The patented coding scheme utilizes 248 possible user-programmable coding combinations and features high linear complexity and correlation immunity High security is guaranteed by generating a unique (rolling) code for each transmission and can be further enhanced by creating customized algorithms for individual customers With this product each key can be designed to be both unique and highly secure The NM95HS01 02 supports either an IR or RF signal transmitter and can be clocked with either an RC clock (NM95HS01) or a crystal oscillator (NM95HS02) The device operates over a voltage range of 2 2V to 6 5V and offers a low power standby mode (k1 mA) for battery applications The product is available in both 8-pin and 14-pin SO packages with 2 or 4 key switch inputs that can be used for customer presets such as seat positions and vehicle operating functions such as car door locking unlocking Features Y Y Y Y Y Y Y Y Y Y Y Y High security coding scheme with 248 combinations High linear complexity and correlation immunity 2 2V to 6 5V operation Less than 1 mA standby current Full resynchronization capability Unique customized algorithm option 13 bytes on-chip non-volatile configuration memory RC or XTAL clock options for to 4 1 MHz operation Supports both IR and RF signal transmission Selection of bit coding and transmission frame formats Space saving narrow body SO8 or SO14 packages Up to 4 key switch inputs on SO14 package Applications Y Y Y Y Remote Keyless Entry (RKE) applications Burglar alarms garage door openers Individualized recognition transmission systems Personalized consumer automotive applications Relevant Documents Y Y Y MM57HS01 datasheet Designing and Programming a Complete HiSeCTM based RKE System AN-985 HiSeC Remote Keyless Entry Solution Encoder Decoder Chip Set User’s Manual AN-355 Patents Pending Functional Block Diagram TL D 12302 – 1 Note Signals shown are internal logic signals FIGURE 1 HiSeCTM and MICROWIRETM are trademarks of National Semiconductor Corporation C1996 National Semiconductor Corporation TL D 12302 RRD-B30M66 Printed in U S A General Characteristics The NM95HS01 02HiSeC Generator was developed to meet existing standards for rolling code-based security systems Theft prevention systems typically involve user identification and transmission of information at various distances from the vehicle These Remote Keyless Entry (RKE) systems are generally implemented with IR transmitters for short distances or RF transmitters for longer distances RF transmission has become state of the art however the longer distances involved require a much higher degree of security since the possibility of signal interception is greatly increased These applications are ideally served by the NM95HS01 02 This generator is a small footprint low current solution that supports both IR and RF transmission The device is available in an 8-pin SO package with 2 key switch inputs or a 14-pin SO package with 4 key switch inputs The proprietary coding scheme used generates a rolling code based on 248 possible user combinations and ensures a high level of coding security for any RKE application The NM95HS01 can be clocked with an RC circuit while the NM95HS02 can be clocked with a crystal oscillator The 24-bit key ID register can be used to configure a large number of unique keys each of which will produce a unique encoded output bit stream The 24 bits in the code generator block are mixed with coded data The output of this block is then fed into the 24- 36-bit buffer register where the 40 bits are recombined to produce a 24or 36-bit output (a user option) The 8-bit sync field register can be configured by the user to provide a pattern to facilitate synchronization between the transmitter and receiver The details of the code block are available to customers and exclusive algorithms are available and under contract with National Call your local sales office for details The HiSeC Generator is shipped with a standard algorithm as a standard product with the configuration shown General Device Operation The Functional Block Diagram (Figure 1) shows the internal elements of the code generating logic and program registers The NM95HS01 02 HiSeC Generator achieves its high security level by combining the contents of several dynamic data registers in a non-linear manner to generate an encoded output Data in the registers is comprised of a mixture of user programmable data factory programmable data and randomized data This inherently random and separate data is encrypted by clocking it through a non-linear logic block and feeding part of the output back to produce a final coded output with a high degree of linear complexity and correlation immunity The NM95HS01 02 incorporates 13 bytes of non-volatile EEPROM memory which can be used to configure the device registers This memory is accessible to the user and can be configured to the desired configuration then writedisabled to prevent tampering User programmable data includes 24 bits of the code block a 24-bit key ID register and an 8-bit sync field register Figure 2 shows a general operational block diagram of the NM95HS01 02 HiSeC Generator The 4 key switch inputs shown use internal pull-up resistors and are suitable for normally open single pole input switches connected to ground The inputs are buffered by debounce logic which repeatedly polls the inputs to determine if a key switch has been asserted If any key switch input is seen as low for four continuous 10 ms samples its associated output is set high the HiSeC control logic is activated and a security code is generated and transmitted The timer block is used to set the key debounce time and the IR or RF clock times These clock times are used as the time base for the chosen bit coding format The timer block is also used to generate the interframe pause time and the timeout delay if these are enabled These parameters are configured by the user in the 13-byte on-chip EEPROM array The NM95HS01 version of the device uses an RC network to clock the CKI input pin The CKO LED pin is not required for clocking but may be used for a visual indicator LED If the NM95HS02 crystal oscillator version is used the device is clocked using both the CKI and CKO pins If an LED is used with this device it may be grounded through the RFEN LED pin Either the CKO LED or the RFEN LED output pins can provide the sink current needed to drive an indicator LED The RFEN pin is active low during signal transmission and is used to provide power to the RF circuit only during transmission to increase battery life The transmit output (TX) pin is a configurable logic level output and is used to transmit the encoded bit stream An on-chip power-on reset circuit is used to initialize the device during power-up http www national com 2 Connection Diagrams 8-Pin SO Package (M8) Pin KEYn RFEN LED CKO LED TL D 12302–4 Pin Names Description Key Input RF Enable LED XTAL Clock LED Data Transmit RC Clock Input Ground 14-Pin SO Package (M14) and 14-Pin Dual-In-Line Package (N14) 14-Pin TSSOP Package (MT14) TX CKI GND VCC Top View See NS Package Number M08A (M8) or N08E (N) TL D 12302 – 5 Supply Voltage Top View See NS Package Number M14A (M) MTC14 (MT14) or N14A (N14) Ordering Information Commercial Temperature Range (0 C to a 70 C) Order Number NM95HS01M8 NM95HS02M8 NM95HS01N NM95HS02N NM95HS01M NM95HS02M NM95HS01MT14 NM95HS02MT14 NM95HS01N14 NM95HS02N14 Extended Temperature Range (b40 C to a 85 C) Order Number NM95HS01EM8 NM95HS02EM8 NM95HS01EN NM95HS02EN NM95HS01EM NM95HS02EM NM95HS01EN14 NM95HS02EN14 TL D 12302 – 2 Note Keys 3 and 4 available in 14-pin packages FlGURE 2 Operational Block Diagram of the NM95HS01 02 HiSeC Generator 3 http www national com General Transmitter Circuit Configurations Figure 3 shows several typical circuit configurations for a HiSeC based RKE system transmitter Note that all circuits require few external components beyond a battery and transmitter stage IR and RF bit timing may be optimized through the timer block settings in the EEPR0M array which allows flexibility in selecting the smallest and least expensive clock components in the chosen design range The first two circuits are examples of RF transmitter applications with both RC and crystal (XTAL) oscillator clocks the third circuit is an example of an IR transmitter application Two circuits are configured for an LED Note that the LED pin refers to a visual indicator LED and not the IR LED which might be used in an IR transmitter circuit The LEDSEL bit in the EEPROM array determines whether the RFEN LED or CKO LED pins are dedicated to the LED for a particular circuit configuration LED pin select options are detailed in Table I Design considerations for selecting and optimizing clock component values are detailed in the Generator Clock Design Parameters section General Receiver Circuit Configurations The NM95HS01 02 HiSeC Generator with the standard customer algorithm is matched to a companion part the MM57HS HiSeC Decoder For applications requiring more extensive receiver design and decoder programming a COPS8xxx NM93Cx6 package is recommended A complete discussion of receiver oonfigurations and considerations can be found in the National Semiconductor Application Note How to Design and Program a HiSeC RKE Receiver using an 8-Bit Microcontroller TL D 12302 – 3 FIGURE 3 Typical Transmitter Circuit Configurations TABLE I LED Pin Select Options Clock RC XTAL XTAL LEDSEL X 0 1 RFEN LED RFEN LED RFEN CKO LED LED CKO CKO Function RF Mode with LED RF Mode w o LED IR mode with LED Either the LED or RFEN outputs of the NM95HS01 02 can be used to indicate device transmission The LED output is active during a pause whereas the RFEN output is active during frame transmission The IR Drive Current is 10 mA so an amplifier stage may be needed http www national com 4 Bit Coding Formats The NM95HS01 02 HiSeC Generator supports eleven-bit coding formats which may be used for IR and RF transmission Seven-bit formats are available for RF applications and four are available for IR applications One-bit format is reserved for future use Bit coding formats are selected by configuring four bits in the EEPROM array IRSEL PRSEL2 PRSEL1 and PRSEL0 Table II shows the possible bit coding options available Each bit coding format has a distinction which may be advantageous for a particular application RF bit coding format 0 is the simplest bit coding scheme and data may be easily recovered from a transmission by exclusive OR-ing the data and clock stream Both RF bit coding formats 0 and 2 have a DC level that is independent of the data RF format 4 and the IR modes operate with a constant transmission energy per message and RF coding formats 1 3 5 and 7 are pulse-width modulated (PWM) formats which are relatively easy to decode RF coding format 7 has a low duty cycle The IR bit coding formats are modulated versions of RF coding format 4 and are all suitable for IR applications The duty cycle and number of pulses are variable among these four to allow the user to fine tune the IR circuit power curve IR bit coding formats all follow the same general pattern In this mode a logic ‘‘1’’ is always two periods long and a ‘‘0’’ is always three periods long This may be an important consideration when considering preamble and sync timing Waveform diagrams for all available RF and IR bit transmission coding formats are shown below TABLE II Transmission Bit Coding Options IRSEL PRSEL2 PRSEL1 PRSEL0 0 0 0 0 0 0 0 0 1 1 1 1 1 0 0 0 0 1 1 1 1 0 0 0 0 1 0 0 1 1 0 0 1 1 0 0 1 1 X 0 1 0 1 0 1 0 1 0 1 0 1 X Function RF Bit Coding Format 0 RF Bit Coding Format 1 RF Bit Coding Format 2 RF Bit Coding Format 3 RF Bit Coding Format 4 RF Bit Coding Format 5 Reserved RF Bit Coding Format 7 IR Bit Coding Format 1 IR Bit Coding Format 2 IR Bit Coding Format 3 IR Bit Coding Format 4 Reserved Bit Transmission Coding Formats RF Bit Coding Format 0 (Manchester Code) RF Bit Coding Format 1 (33% 66% End High) TL D 12302 – 6 TL D 12302 – 7 RF Bit Coding Format 2 (50% Duty Cycle) RF Bit Coding Format 3 (25% 50% Start High) TL D 12302 – 8 TL D 12302 – 9 RF Bit Coding Format 4 (IR Style) RF Bit Coding Format 5 (33% 66% Start High) TL D 12302 – 10 TL D 12302 – 11 5 http www national com Bit Transmission Coding Formats (Continued) RF Bit Coding Format 7 (Low Duty Cycle 1 16 2 16) TL D 12302 – 12 IR Bit Coding Format 1 (5 Pulses 33% Duty Cycle) TL D 12302 – 13 IR Bit Coding Format 2 (8 Pulses 33% Duty Cycle) TL D 12302 – 14 IR Bit Coding Format 3 (5 Pulses 25% Duty Cycle) TL D 12302 – 15 IR Bit Coding Format 4 (8 Pulses 25% Duty Cycle) TL D 12302 – 16 http www national com 6 Programmable Signal Output Polarity The transmit (TX) output pin signal polarity and quiescent state output is controlled by the TxPol bit which may be configured in EEPR0M If TxPol e 0 the TX output pin will be at a logic low when no frame is transmitted or when a ‘‘0’’ appears as data in a frame Conversely if TxPoI e 1 the TX output pin will be at a logic high when no frame is transmitted or when a ‘‘1’’ appears as data in a frame This option allows the designer to choose between a configuration where a logic ‘‘1’’ represents power transmission (for example when an RF stage is activated by driving the base of an NPN transistor) and a configuration where a logic ‘‘0’’ represents power transmission (for example when an IR LED is connected between VCC and the TX output) The sync frame format contains both start code and a fixed 4-bit sync code of 0000 This sync code replaces the key application data in the data field and is used to confirm HiSeC sync mode to the decoder Sync mode is built into the generator to allow resynchronization of the device under certain conditions as a convenience to the end user If the designer wishes to preclude any possible resynchronization the presence of the sync code allows the decoder to detect any synchronization attempt Since the length of several fields is adjustable there are several possibilities for the length of a sync frame The shortest possible sync frame is 45 bits and the longest possible sync frame is 96 bits 40 bits of start code 4 bits of sync code and 1 stop bit are always present The composition of a sync frame is shown in Figure 5 0 11 bits Preamble 0 8 bits Sync Field 0 20 24 bits Key ID Field 4 bits Data Field 24 36 bits Dynamic Code 0 8 bits Parity Field 1 bit Stop Bit Data Frames The NM95HS01 02 HiSeC Generator transmits the encrypted data it generates as data frames These frames are transmitted through an IR or RF transmitter stage using the bit coding format selected The NM95HS01 02 transmits two types of data frames a normal data frame and a synchronization (sync) frame The format of each frame is similar but there are slight differences to suit the purposes of each Normal data frames are used to transmit encoded data in general operation Sync frames are used to synchronize (or initialize) the HiSeC to its decoder Data frames are comprised of a number of different fields Each field occupies a fixed position in the data frame and serves a specific purpose Most data fields are user-configurable to some extent The user may enable disable the presence of a field control its length or modify its format The user also has several options available to tailor the data frame transmission format such as pause time between frames and time-out time Options are configured by programming the on-chip EEPR0M array The content and format of each of the fields is discussed below NORMAL DATA FRAME The NM95HS01 02 HiSeC Generator transmits normal data frames in general operating mode Frame transmission begins each time a key switch is asserted and continues as long as the key is held down The device has an option to terminate transmitting data frames and go into halt mode if a key is held down for more than 80 seconds (if the TlMEOUTEN feature has been enabled) The normal data frame format contains both dynamic code and key application data (in the data field) Since the length of several fields is adjustable there are several possibilities for the length of the data frame The shortest possible normal data frame is 29 bits and the longest possible normal data frame is 92 bits 24 bits of dynamic code 4 bits of key application data and 1 stop bit are always present The composition of a normal data frame is shown in Figure 4 SYNC FRAME The NM95HS01 02 HiSeC Generator transmits sync frames only in sync mode so that it can synchronize itself with its decoder This mode occurs only during initialization of the device or after holding a key down for more than 10 seconds (if the AutoResync feature has been enabled) FIGURE 4 Normal Data Frame Configuration 0 11 bits Preamble 0 8 bits Sync Field 0 20 24 bits Key ID Field 4 bits Sync Code 40 bits Start Code 0 8 bits Parity Field 1 bit Stop Bit FIGURE 5 Sync Frame Configuration Data Frame Fields Data frames are comprised of a number of data fields Each field occupies a fixed position in the data frame and serves a specific purpose Most data fields are user-configurable by programming the on-chip EEPROM array The content and format of each field is discussed below as well as the EEPROM options available All data frame fields are transmitted Most Significant Bit first THE PREAMBLE The user has the option of allowing a preamble to be transmitted as the first frame of either a normal data frame or a sync frame This option is enabled disabled by setting the PreamblePresent bit in the EEPROM array PreamblePresent e 0 means no preamble is transmitted PreamblePresent e 1 means an 11-bit preamble is transmitted as described below The purpose of the preamble is to generate a relatively long clearly recognizable bit pattern to give the decoder a chance to ‘‘wake up’’ and configure its logic circuits and registers This allows the receiver to be placed in a standby mode to conserve power for battery applications The preamble is only transmitted once as the first frame of a data transmission regardless of how long the key is held down although the remaining frames of the data transmission (including any inter-frame pauses) will continue to repeat as long as the key remains depressed 7 http www national com Data Frame Fields (Continued) The preamble has a fixed format of two bit times at system logic high then one-bit time at system logic low then eight zeroes using the user-selected bit coding format This arrangement is clearly shown in Figure 6 for several bit coding formats If desired a preamble may be isolated from the frame by eight-bit times at logic low during a frame transmission This can be achieved by enabling the sync field in NRZ mode with the byte 0h SYNC FIELD If enabled the sync field is transmitted in every normal data frame or sync frame to provide a bit timing reference for the rest of the frame This allows the decoder to determine the proper bit coding format the generator is using and to synchronize to it The sync field option is set with the SyncPresent bit in the EEPROM array If SyncPresent e 0 no sync field is sent If SyncPresent e 1 an 8-bit sync field is included in the data transmission This 8-bit field is transmitted Most Significant Bit first The sync field data is programmable and can be encoded with any user-selected bit coding format or with an NRZ (unencoded binary) bit format The option to select between a user bit coding format and NRZ format is set by configuring the SyncType bit in the EEPROM array If SyncType e 0 sync field data is sent according to the user-selected IR or RF bit coding format If SyncType e 1 the information is sent in NRZ format with the bit length determined by the chosen IR or RF bit coding format For NRZ bit coding both high and low bit times are the same as the IR or RF bit coding time For bit coding modes where the ‘‘1’’s and ‘‘0’’s have different bit lengths all IR modes for example the length of the NRZ ‘‘1’’ and ‘‘0’’ bits have correspondingly different bit lengths RF bit coding format 7 is a special case As in the other formats if SyncType e 0 information is sent according to the user-set IR or RF bit coding format However if SyncType e 1 a ‘‘0’’ is sent using the bit coding determined by the IR or RF coding format and a ‘‘1’’ is sent as an NRZ zero This is to maintain the ‘‘spirit’’ of the low duty cycle arrangement for RF format 7 Figure 7 shows sync field examples for several bit coding formats TL D 12302 – 17 FIGURE 6 Preamble Format Examples TL D 12302 – 18 FIGURE 7 Sync Field ExampIes for Data Byte 03h http www national com 8 Data Frame Fields (Continued) KEY ID FIELD The key ID field is another user option Both its presence and the length of its field can be configured in EEPROM If FixPresent e 0 no key ID field will be transmitted with the frame If FixPresent e 1 a 24-bit field will be transmitted The contents of the key ID field are programmable by the user Its purpose is to provide a unique identification code for each user key to allow a decoder to identify a particular key in applications where a decoder may be configured for multiple keys Since the key ID register allows 24 bits there are 224 possible key combinations Each user key will be unique and take full advantage of the HiSeC Generator’s high security coding scheme The field size is selected with the FixSize bit If FixSize e 1 the 24-bit field is selected If FixSize e 0 the 20-bit field is selected Since a full 24 bits are allowed in the Key ID register the NM95HS01 02 will transmit the most significant 20 bits if FixSize e 0 The field is transmitted in the user-selected bit coding format DATA FIELD The data field is transmitted with every frame It has several uses which are discussed here The primary use of the data field is to indicate which key switch has been pressed Since each key switch input can be associated with a particular application the decoder can determine which function to initiate The data field is 4 bits long and each key switch input is associated with a particular bit in the field If any key switch is pressed its corresponding bit in the data field will be seen as a ‘‘1’’ Any key switch not pressed is seen as a default ‘‘0’’ Key bits are transmitted in the order K1 K2 K3 K4 The sync code field in the sync frame is a special case of the data field and is found in the same position in the data frame In any sync frame the sync code is always 0000 so the decoder can always distinguish between a normal data frame and a sync frame Since each bit represents a key and a data frame is initiated as a result of pressing a key it is not possible to have all zeroes in a normal data frame The data field can also serve as a low battery indicator This is an option which can be enabled by setting the CompareEnable bit If CompareEnable e 1 and the NM95HS01 02 detects a low battery level the device will signal that fact by alternating between transmitting normal data frames with the correct key usage information and transmitting normal data frames with a data field of 1111 In the first data frame the data field will represent the true state of the four key inputs In the next frame this field will be all ones This sequence will be repeated as long as frames are being transmitted For sync frames this field will not alternate and the data will remain 0000 regardless of the battery level Setting CompareEnable e 0 disables the low battery detect option DYNAMIC CODE FIELD The dynamic code field is transmitted with every frame and its length is programmable If DynSize e 0 a 24-bit field is sent if DynSize e 1 a 36-bit field is sent Its function is to provide a secure dynamic code which changes with each new transmission The field is the result of combining the 11- 13- and 16-bit CRC registers using non-linear logic and feedback The result of this process is stored in the 24- 36-bit buffer register If DynSize e 0 24 of the possible 36 bits are transmitted in the field Increasing the field length provides additional security The start code field in a sync frame is a special case of the dynamic code field In sync mode 40 bits of data are sent regardless of the setting of the DynSize bit PARITY FIELD The parity field is an 8-bit field that is transmitted with every frame to ensure data integrity It is a user option that is enabled by setting ParityPresent e 1 The parity check is a bytewise exclusive OR-ing of all the bytes in the data frame from the sync field to the dynamic code field The preamble parity field and stop bit are not included In practice the parity process works as follows bit m of the 8-bit parity field is a modulo 2 addition of the data frame bits m m a 8 m a 16 to the end of the frame If the addition of the ‘‘1’’s in these bits is odd bit m of the parity field is set to ‘‘1’’ If the addition is even bit m is set to ‘‘0’’ This process is continued for all 8 parity bits If the frame is not byte aligned the parity field is calculated by zero extending the last four bits calculating the bytewise exclusive OR-ing of all the bytes as described above then swapping the higher and lower nibbles to give the correct parity STOP BIT The stop bit is present in all frames It is used to delimit the end of the frame for bit formats that require a definite end It is necessary for formats that end with a long zero pulse IR modes require a stop bit to distinguish between a ‘‘0’’ and a ‘‘1’’ in the next-to-last bit of a frame The stop bit is read as a ‘‘1’’ and is added for all modes DATA FRAME SEQUENCING AND TRANSMISSION The NM95HS01 02 becomes operational any time a key is pressed When this happens the code generator logic is clocked to randomize the data and generate a new rolling code Once the code is generated data frames using this new code are repeatedly transmitted over the TX output pin as long as the key remains pressed These data frames are separated by a pause whose length is programmable The transmission sequence is always begun by a preamble if this option is enabled The preamble is only transmitted once since its function is to wake the decoder from sleep mode if it is powered down for battery conservation The preamble is then followed by a data frame pause data frame pause etc 9 http www national com Data Frame Fields (Continued) TRANSMISSION INDICATION Both the LED and RFEN signals can be used to indicate HiSeC rolling code transmission The LED output is active low during the transmission of a pause whereas the RFEN output is active low during transmission of either a frame or a pause Either output may be used to provide a visual indication of transmission by connecting an LED between VCC and LED or RFEN If the low battery detect option is enabled and the battery is low the LED output is active only during the pause following the first frame of a new code transmission It is not active on successive pauses in order to conserve power HiSeC GENERATOR TIMER BLOCK Bit timing and several function operating times are set in the generator through a user programmable timer block This timer block is used to provide IR and RF bit timing signals the interframe pause time the AutoResync timing period and the time-out delay The NM95HS01 02 timer block consists of three programmable 6-bit prescalers and a fixed 16-bit prescaler The input to Prescaler1 is of the frequency of CKI The output is the IR clock This signal becomes the input to Prescaler2 The output from Prescaler2 is the RF clock This signal then becomes the input to Prescaler3 The output from Prescaler3 is a target value of 2 5 ms Finally this 2 5 ms timing signal becomes the input to the fixed 16-bit prescaler There are several outputs from this prescaler The 2 5 ms is divided by 4 4096 and 32768 and these times are used to set the key debounce time (10 ms) the AutoResync time (l10 sec) and the generator time-out period (l80 sec) respectively The NM95HS01 02 timer block is shown in Figure 8 The purpose of the prescalers is to provide various timing signals to the state machines in the generator The IR clock is used as a time base for the various IR bit coding formats The RF clock is used for RF bit coding formats A programmable bit called SCLK determines whether the IR clock (SCLK e 0) or the RF clock (SCLK e 1) is used as the bit timing time base In addition to SCLK the system designer can program Prescaler1 Prescaler2 and Prescaler3 separately to set the necessary division factors Since each of these prescalers is 6 bits permissible values range from 2 to 64 The system designer must set the programmable prescalers to meet the necessary timing requirements for all the functions discussed above All of these timings are interdependent Operational Timing Issues DATA FRAME PAUSE LENGTH After the complete transmission of a data frame a pause is inserted before the next data frame is transmitted The pause length can be modifed by configuring the 2-bit PauseLength parameter in EEPR0M PauseLength is broken down into two single bit parameters Pause1 and Pause0 Available configuration options are shown in Table III TABLE III Pause Length Select Options PAUSE1 0 0 1 1 PAUSE0 0 1 0 1 0 8 20 50 Function c P3 Output c P3 Output c P3 Output c P3 Output Pause Time No Pause 20 ms 50 ms 100 ms HiSeC GENERATOR TIME-OUT If the NM95HS01 02 time-out option is enabled (TIMEOUTEN e 1) the device will enter halt mode 80 seconds after a key is first activated regardless of whether the key is still being pressed This option guards against the condition that a key may be stuck low which could drain the battery If TIMEOUTEN e 0 the generator will continue to transmit data frames as long as a key is pressed Figure 9 provides the basis for an example in calculating the necessary timing for these functions and setting the timer block appropriately TL D 12302 – 19 FIGURE 8 The NM95HS01 02 Timer Block TL D 12302 – 20 FIGURE 9 NM95HS01 02 Timer Block Example http www national com 10 Operational Timing Issues (Continued) As an example consider the following situation A designer wishes to design an RF data transmitter using RF bit coding format 5 with a bit time of 1 ms The designer also wishes to use a 3 MHz crystal oscillator as the system clock The required bit time of 1 ms encompasses three RF clock periods for RF bit coding format 5 Therefore the RF clock time needs to be of 1 ms ( e 333 ms) The timer block has a target value of 2 5 ms (2500 ms) as the output of Prescaler3 Since the RF clock signal is divided by Prescaler3 Prescaler3 divides the signal by 2500 333 e 7 5 This figure is rounded off to become 8 One point of possible confusion should be clarified here Whenever a division value is calculated for any of the 3 prescalers the prescaler should be configured with one unit less than that division value For example in this case we calculated a division value of 8 (after rounding) for Prescaler3 Therefore Prescaler3 should be programmed with 8 b 1e7 Next we calculate values for Prescaler1 and Prescaler2 Although the crystal oscillator uses both the CKI and CKO pins only the CKI input is relevant here The CKI input frequency is 3 MHz and of that is 0 75 MHz This is the input frequency to the HiSeC timer block and the corresponding timing signal is 1 33 ms Since the RF clock must be 333 ms Prescalers1 and 2 together must divide by 333 1 33 e 250 A convenient choice would be to make Prescaler1 divide by 10 and Prescaler2 divide by 25 Therefore load Prescaler1 with 10 b 1 e 9 and Prescaler2 with 25 b 1 e 24 DEBOUNCE LOGIC The key switch input signals are connected to the debounce logic block which continuously polls the inputs to determine if a key switch has been asserted If a key switch has been asserted its normally high input will be seen as a low lf the input is seen low for four continuous debounce strobe signals it is considered to be a stable signal and its associated output from the debounce logic block is set high This enables the generator control logic and a code is generated and transmitted This debounced output signal is deasserted as soon as the key is released and its signal goes high again This assumes normal operation However if a key remained pressed for a long time the generator might time-out before seeing the signal go high again (if TIMEOUTEN e 1) The generator would then enter halt mode even if the key remained pressed The generator would come out of halt mode when it saw the falling edge of another key input which would occur when another key is pressed LOW BATTERY DETECT OPTION The NM95HS01 02 contains an internal comparator circuit that detects low battery voltage and indicates this condition to the data frame generator The CompareEnable parameter in EEPROM enables this function (CompareEnable e 1) During halt mode the comparator is switched off completely to minimize power consumption The BatteryType parameter in EEPROM selects the threshold voltage range for the comparator If BatteryType e 1 the comparator assumes a 6V battery and sets the low battery detect region to approximately 4 4V to 4 8V If BatteryType e 0 the comparator assumes a 3V battery and sets the low battery detect region to approximately 2 2V to 2 4V Data output signals are sampled for low voltage at the start of the data field during frame transmission If a low battery voltage level is detected and the detect option is enabled the LED will signal the condition by flashing at the first pause in the data frame transmission and alternating normal data field data with a data field containing all ones This procedure is explained more fully in the Data Field section Security Aspects The basis of the HiSeC Generator is to provide a means of communicating information between the device and its decoder across some distance Since data is transmitted at a distance there is a possibility of signal interception and unauthorized use of the data by a third party The NM95HS01 02 has been designed to provide such a high level of complexity and correlation immunity that intercepting the signal is immaterial INITIALIZATION SYNCHRONIZATION Initialization is the process of synchronizing the generator with its decoder for the first time The NM95HS01 02 uses the following procedure to initialize the device The user inserts a new battery into the HiSeC-based device which causes the LED to light The LED also has a secondary function for synchronization and initialization procedures It will light to prompt the end user that it expects some action and therefore serves as a guide When the LED lights the user presses a key The LED will go off as the generator begins randomizing its registers and configuring its internal logic When the user releases the key the LED will light a second time This is a signal for the user to press a key again This second action shifts the generator into sync mode This causes the NM95HS01 02 to transmit at least four sync frames allowing the decoder to synchronize to the generator The generator then exits sync mode and is ready tor normal operation RESYNCHRONIZATION If synchronization is lost between the generator and its decoder resynchronization is accomplished using a sync frame A sync frame is generated in two cases when the battery is removed and replaced or the user initiates an initialization procedure by holding Key Switch 1 and Key Switch 2 simultaneously for 5 seconds A sync frame provides the decoder with enough information to ‘‘learn’’ the key and synchronize to it For the highest possible security protection resynchronization can be completely excluded by configuring the decoder to recognize and refuse to act upon the transmission of a sync frame The sync frame format is discussed more fully elsewhere but briefly it can be recognized by the presence of all zeroes in the data field In this case if synchronization is lost between the generator and decoder they could not be made to function together 11 http www national com Security Aspects NORMAL OPERATION Once the NM95HS01 02 has been initialized the device will generate and transmit a new code each time a key is pressed If a key is held down the same frame (plus any pauses between frames) is transmitted repeatedly If the key is held down for longer than 80 seconds the generator will go into halt mode to conserve battery power and will stop transmitting data frames (if the TIMEOUTEN option is enabled) Another option available during normal generator operation is the ability to generate a resync after a key has been pressed for more than 10 seconds (if the AutoResync option is enabled) This option allows the end user to resynchronize the generator if necessary without having to remove and replace the battery FORWARD CALCULATION AND CODE WINDOWS Aside from using a sync frame there is another way to ensure the NM95HS01 02 remains in sync with its decoder during normal operation The decoder can perform a forward calculation to predict what the next generator codes will be This is an important point and should be considered carefully in designing the decoding system In a well-designed system the decoder should be able to calculate forward for some reasonable number of codes and store the results for future reference This allows the decoder to remain in sync even if it misses one or more codes from the generator This could occur if the receiver did not receive a transmission clearly or if someone activated the keys outside the range of the receiver Increasing the depth of this code window would allow the decoder to miss a greater number of codes from the generator and still remain in sync One method for implementing a code window is to include a MICROWIRETM EEPROM (such as the NM93Cx6) in the decoder design and store the codes in memory This becomes even more important if the decoder is designed to accomodate several HiSeC generator devices In this case the decoder should have a code window available for each device Generator Clock Design Parameters Tables IV V and VI provide a basis for selecting component values for both the RC clocked generator (NM95HS01) and the crystal (XTAL) oscillator clocked generator (NM95HS02) The component values shown in the tables have been chosen for low cost general availability and reliable operation Components are referenced to the circuit schematics shown in Figure 3 Though there is some flexibility in selecting alternate values there are constraints on permissible component values All resistors and capacitors should be kept within the following ranges 3 kX s Rx s 200 kX and 50 pF s Cx s 200 pF TABLE IV RC Clock Components TA e 25 C VCC e 5V – 6 5V R (kX) 33 56 68 C (pF) 82 100 100 CKI (MHz) 2 12 – 2 32 1 1 – 1 17 0 9 – 0 95 CKI (ns) 470 – 430 870 – 850 1100 – 1050 TABLE V RC Clock Components TA e 25 C VCC e 2 5V R (kX) 33 56 68 C (pF) 82 100 100 CKI (MHz) 1 53 – 1 6 0 9–1 0 8 – 0 83 CKI (ns) 650 – 600 1100 – 1000 1250 – 1200 TABLE VI XTAL Clock Components TA e 25 C VCC e 2 5V – 6 5V R1 (MX) 1 C1 (pF) 30 C2 (pF) 30 –36 CKI (MHz) 4 CKI (ns) 250 http www national com 12 Generator Clock Design Parameters (Continued) TABLE VII NM95HS01 02 EEPROM Array Configuration and Definitions Parameter AutoResync LEDSEL BatteryType TIMEOUTEN Pause Length (Pause0 Pause1) FactoryDisableBit WriteDisableBit PreamblePresent SyncType SyncPresent FixSize FixPresent DynSize ParityPresent CompareEnable BitTransmitFormat IRSel PRSeI2 1 0 TxPol SCLK Prescaler3 Prescaler2 Prescaler1 DynamicCode KeyIDCode SyncFieldCode Reserved Bits 1 1 1 1 2 1 1 1 1 1 1 1 1 1 1 1 3 1 1 6 6 6 24 24 8 8 Address Byte 0 bit 7 Byte 0 bit 6 Byte 0 bit 5 Byte 0 bit 4 Byte 0 bits 3–2 Byte 0 bit 1 Byte 0 bit 0 Byte 1 bit 7 Byte 1 bit 6 Byte 1 bit 5 Byte 1 bit 4 Byte 1 bit 3 Byte 1 bit 2 Byte 1 bit 1 Byte 1 bit 0 Byte 2 bit 7 Byte 2 bits 6–4 Byte 2 bit 3 Byte 2 bit 2 Byte 2 bits 1–0 Byte 3 bits 7–4 Byte 3 bits 3–0 Byte 4 bits 7–6 Byte 4 bits 5–0 Bytes 5–7 Bytes 8–10 Byte 11 Byte 12 Function Allows user to send a sync frame by holding a key down for l10 seconds Determines whether RFEN LED or CKO LED is the LED connect pin for the NM95HS02 Selects between 3V and 6V battery voltage Disables data transmission if key is depressed l80 seconds Sets the pause time between data frames during data transmission (0 20 50 100) ms Disables ability to write to Byte 12 Enables disables ability to write into EEPROM array Enables disables presence of preamble field Determines if sync field is sent in user-selected IR RF format or default NRZ format Enables disables presence of sync field Determines length of Key ID field (0 20 24 bits) Enables disables presence of Key ID field Determines length of Dynamic Code field (24 36 bits) Enables disables presence of parity field Enables disables low battery detect option Selects among the 12 possible IR RF bit coding formats Selects between IR and RF bit coding formats Used with IRSeI to select particular bit coding format Sets the quiescent output state and data logic level on the TX output pin Determines whether the IR clock or RF clock is used as the bit timing time base Sets interframe delay time and key debounce time (Also generates timeout delay time) Sets RF Clock timing Sets IR Clock timing Sets initial configuration of the Rolling Code registers Sets user-configurable key identification register Sets configuration of sync field register Reserved for factory use unique customized algorithm option Note The first bit clocked into the device is Byte 0 bit 7 The seventh and eight bits are the chip disable bits Once they are set and VCC is removed the chip will be disabled 13 http www national com Absolute Maximum Ratings (Note 1) If Military Aerospace specified devices are required please contact the National Semiconductor Sales Office Distributors for availability and specifications Ambient Storage Temperature b 65 C to a 150 C Lead Temperature (Soldering 10 sec ) ESD Rating Ambient Operating Temperature NM95HS01 NM95HS02 NM95HS01E NM95HS02E Power Supply (VCC) Range a 300 C 2000V 0 C to a 70 C b 40 C to a 85 C 2 2V to 6 5V Input or Output Voltages with Respect to Ground b 0 5V to a 7V All except K1 or K2 b 0 5V to a 13V K1 or K2 NM95HS01 02 DC and AC Electrical Characteristics 2 2V s VCC s 6 5V (unless otherwise specified) Symbol VCC VRW VSV ICC Parameter Supply Voltage Read Write Voltage Supervoltage Supply Current Halt Mode (3 0V) (Note 2) Halt Mode (6 0V) Normal Mode Input Voltage (High) Input Voltage (Low) Pullup Current Leakage Current (RFEN) Output Current Source (Push-Pull) Sink (Push-Pull) Power Supply Rise Time Max Sink-Source Current per Pin Comparator Threshold Voltage K1 Initiate Write Time Write Time High Write Time Low K2 Setup Time K2 Hold Time Program Write Time Supervoltage Low to Clock High Time Clock Low to Supervolt High Time Exit Write Time Data Setup Time Data Hold Time Initiate K1 Read Time Read Time High Read Time Low Start Read Time 10 tWR e tWHR a tWLR 100 100 40 20 20 BattType e 0 (3V) BattType e 1 (6V) tWW e tWHW a tWLW 22 44 40 20 20 20 20 10 10 10 10 (Note 2) CKI e 0 MHz VCC e 3 0V CKI e 0 MHz VCC e 6 0V CKI e 4 1 MHz VCC e 6V CKI Logic High All Others Logic High CKI Logic Low All Others Logic Low VCC e 6V VIN e 0V VCC e 6V RFEN e 6V VCC e 4 5V VOH e 3 3V VCC e 4 5V VOL e 0 4V 10 15 1 ms 10 ms 10 ms 20 24 48 mA V V ms ms ms ms ms ms ms ms ms ns ns ms ms ms ms 35 120 0 8 VCC 0 7 VCC 0 2 VCC 0 2 VCC 250 1 Conditions Min 25 45 11 5 Typ 50 50 12 0 01 05 1 Max 65 55 12 5 1 2 3 Units V V V mA mA mA V V V V mA mA mA mA VIH VIL IP IRF IOUT tPS IMP VTH tWW tWHW tWLW tSW tHW tPW tCKIHSW tSVLW tXW tDSW tDHW tWR tWHR tWLR tCKIHSR http www national com 14 NM95HS01 02 DC and AC Electrical Characteristics 2 5V s VCC s 6 5V (unless otherwise specified) (Continued) Symbol tCKI tCKIH tCKIL tDAR tDALR tENDR tSVLR tXR Clock Period Time (Note 4) Clock High Time (Note 4) Clock Low Time (Note 4) Data Access Time Data Access Time Low End Read Time K1 Supervoltage Low Time (Read) Exit Read Time Parameter Conditions XTAL Clock RC Clock XTAL Clock RC Clock XTAL Clock RC Clock tDAR e tCKIH a tDALR Min 2000 2000 1000 1000 1000 1000 11 100 10 10 10 Typ Max DC DC DC DC DC DC Units ns ns ns ns ns ns ms ns ms ms ms Note 1 Stresses above those listed under ‘‘Absolute Maximum Ratings’’ may cause permanent damage to the device This is a stress rating only and functional operation of the device at these or any other conditions above those indicated in the operational sections of the specification is not implied Exposure to absolute maximum rating conditions for extended periods may affect device reliability Note 2 The standby current of k 1 mA is tested at 3V During HALT Mode only a very small current is required to maintain the code in the shift registers HALT mode is exited by depressing one of the input keys Note 3 The clock rate used to program the NM95HS01 02 is generally less than the normal operating mode clock rate and should be temporarily reduced as necessary to meet the programming specifications shown here For example a generator might normally operate at 4 MHz but should be programmed at s 0 5 MHz (2000 ns) Note 4 Parameter characterized but not 100% tested Capacitance TA e a 25 C Symbol CIN COUT Test Input Capacitance 0utput Capacitance f e 1 MHz (Note 2) Max 7 12 Units pF pF Typical Halt Mode Current (nA) vs Voltage over Temperature TL D 12302 – 23 15 http www national com Timing Diagrams Write Mode TL D 12302 – 21 Read Mode TL D 12302 – 22 http www national com 16 Programming the NM95HS01 02 The NM95HS01 02 HiSeC Generator uses four pins to read and write the 13 bytes of on-chip EEPROM These are the Key1 (K1) Key2 (K2) TX and CKI pins K1 functions as the chip select line K2 functions as the data strobe CKI serves as the serial clock and TX acts as the data out pin Three voltage levels are required to program the device Supervoltage (VSV) Read Write voltage (VRW) and Ground (0V) Supervoltage is used to select Read and Write modes in the device These modes can only be entered by applying supervoltage to K1 and K2 This alleviates the risk of the device entering these modes during normal operation The programming protocol for the NM95HS01 02 on-chip EEPROM array was designed to match National Semiconductor’s MICROWIRE format closely However there are several differences One is the need to use a supervoltage to select modes Another concerns the CKI clock input Upon power-up the NM95HS01 02 CKI input must be clocked a minimum of 1500 times to ensure the part is ready for programming This allows the internal state machines and registers to perform their necessary power-on sequences (See Table VII ) pulses applied to CKI to initialize the part (See Timing Diagram on pg 16 ) After this initialization K2 is brought to supervoltage K1 is then brought to supervoltage Now K2 is brought back to VRW then K1 is brought back to VRW The NM95HS01 02 is now in Write mode To program the first byte set K1 back to supervoltage and place the first byte of data (VIH and VIL pulses) onto K2 (starting with the Least Significant Bit) As each bit is placed on K2 clock the CKI pin to latch the bit When all bits of the first byte have been latched in set K1 to VRW and poll the TX output pin for a logic low This confirms the NM95HS01 02 has written the byte to memory Repeat this sequence to program the remainder of the bytes When all 13 bytes have been programmed set K1 and K2 to 0V to end Write mode Read Mode The NM95HS01 02 HiSeC Generator can be placed in Read mode by applying supervoltage to K1 Upon powerup both K1 and K2 must be set to VRW and a minimum of 1500 clock pulses applied to CKI to initialize the part (See Timing Diagram on pg 16 ) After this initialization K1 is brought to supervoltage Then K1 is brought back to VRW The NM95HS01 02 is now in Read mode To read the first byte set K1 back to supervoltage and clock the CKI pin 8 times while polling TX EEPROM data is sent Most Significant Bit first Continue clocking CKI to read the remainder of the bytes When all 13 bytes have been read set K1 back to VRW Set K1 and K2 to 0V to end Read mode Write Mode The NM95HS01 02 HiSeC Generator can be placed in Write mode when supervoltage is applied to both K1 and K2 in a specific sequence Upon power-up both K1 and K2 must be set to VRW and a minimum of 1500 clock Programmer Support for NM95HS01 02 Worldwide third party support is provided by Vendor Contact Number Europe 49-5722-203-125 (Germany) America 408-524-1929 Asia 65-296-6433 (Singapore) BBS 408-245-7082 Americas 800-272-9959 Switzerland 31-921-7844 America 408-263-6667 800-967-4776 Taiwan 886-2-917-3015 BBS 408-262-6438 Asia 886-2764-0215 America 510-623-3850 Xeltek SuperPro-EM Universal Programmer National Semiconductor NM95HS-PRO-X System General Turpro-1 Univeral Device Programmer Hi-Lo ALL-07 Evalutation kit support for NM95HS01 02 A demonstration kit for the HiSeC High Security Rolling Code Generator is available National Semiconductor NM95HSEV NM95HSPRO HiSeC Evaluation Board HiSeC Single Site Programmer 17 http www national com Physical Dimensions inches (millimeters) unless otherwise noted 8-Lead (0 150 Wide) Molded Small Outline Package JEDEC Order Number NM95HS01M8 or NM95HS02M8 NS Package Number M08A 14-Lead (0 150 Wide) Molded Small Outline Package JEDEC Order Number NM95HS01M14 or NM95HS02M14 NS Package Number M14A http www national com 18 Physical Dimensions inches (millimeters) unless otherwise noted (Continued) 8-Lead Dual-In-Line Package Order Number NM95HS01N NM95HS01EN NM95HS02N or NM95HS02EN NS Package Number N08E 14-Lead (0 300 Wide) Molded Dual-In-Line Package Order Number NM95HS01N14 or NM95HS02N14 NS Package Number N14A 19 http www national com NM95HS01 NM95HS02 HiSeC High Security Rolling Code Generator Physical Dimensions all dimensions are in millimeters (Continued) 14-Lead Molded Thin Shrink Small Outline Package JEDEC Order Number NM95HS01MT14 NM95HS02MT14 NS Package Number MTC14 LIFE SUPPORT POLICY NATIONAL’S PRODUCTS ARE NOT AUTHORIZED FOR USE AS CRITICAL COMPONENTS IN LIFE SUPPORT DEVICES OR SYSTEMS WITHOUT THE EXPRESS WRITTEN APPROVAL OF THE PRESIDENT OF NATIONAL SEMICONDUCTOR CORPORATION As used herein 1 Life support devices or systems are devices or systems which (a) are intended for surgical implant into the body or (b) support or sustain life and whose failure to perform when properly used in accordance with instructions for use provided in the labeling can be reasonably expected to result in a significant injury to the user National Semiconductor Corporation 1111 West Bardin Road Arlington TX 76017 Tel 1(800) 272-9959 Fax 1(800) 737-7018 2 A critical component is any component of a life support device or system whose failure to perform can be reasonably expected to cause the failure of the life support device or system or to affect its safety or effectiveness http www national com National Semiconductor Europe Fax a49 (0) 180-530 85 86 Email europe support nsc com Deutsch Tel a49 (0) 180-530 85 85 English Tel a49 (0) 180-532 78 32 Fran ais Tel a49 (0) 180-532 93 58 Italiano Tel a49 (0) 180-534 16 80 National Semiconductor Hong Kong Ltd 13th Floor Straight Block Ocean Centre 5 Canton Rd Tsimshatsui Kowloon Hong Kong Tel (852) 2737-1600 Fax (852) 2736-9960 National Semiconductor Japan Ltd Tel 81-043-299-2308 Fax 81-043-299-2408 National does not assume any responsibility for use of any circuitry described no circuit patent licenses are implied and National reserves the right at any time without notice to change said circuitry and specifications