TRANSPONDER EVALUATION KIT USER'S GUIDE Information contained in this publication regarding device applications and the like is intended by way of suggestion only. No representation or warranty is given and no liability is assumed by Microchip Technology Incorporated with respect to the accuracy or use of such information. Use of Microchip's products as critical components in life support systems is not authorized except with express written approval by Microchip. 2000 Microchip Technology Incorporated. All rights reserved. The Microchip name and logo, and KEELOQ are registered trademarks of Microchip Technology Incorporated in the U.S.A. and other countries. All product/company trademarks mentioned herein are the property of their respective companies. 2000 Microchip Technology Inc. DS51111B Transponder Evaluation Kit User's Guide DS51111B 2000 Microchip Technology Inc. TRANSPONDER EVALUATION KIT USER'S GUIDE Table of Contents Chapter 1. Setup 1.1 Evaluation Kit Overview .................................................................. 1 1.2 Software Installation ....................................................................... 1 1.3 Hardware Setup .............................................................................. 2 1.4 Quick Start ...................................................................................... 2 Chapter 2. Base Station 2.1 Base Station Overview ................................................................... 5 2.2 Base Station Outputs ...................................................................... 6 2.3 Base Station Polling Mode .............................................................. 7 2.4 Inductive Communication ............................................................... 8 2.5 RF Communication ......................................................................... 8 2.6 High Voltage - Danger ................................................................... 8 2.7 Stand-Alone Mode .......................................................................... 8 2.8 Base Station Programming ............................................................. 8 2.9 Learning a Transponder ................................................................. 9 2.10 Erasing Transponders .................................................................. 10 Chapter 3. HCS410 3.1 Selecting an HCS410 ................................................................... 11 3.2 Programming an HCS410 ............................................................. 11 3.3 Code Hopping Transmissions ....................................................... 16 3.4 SEED Transmissions .................................................................... 16 Chapter 4. HCS412 4.1 Selecting an HCS412 ................................................................... 17 4.2 Programming an HCS412 ............................................................. 17 4.3 Code Hopping Transmissions ....................................................... 23 4.4 SEED Transmissions .................................................................... 23 2000 Microchip Technology Inc. DS51111B-page iii Transponder Evaluation Kit User's Guide Chapter 5. Other Dialog Boxes 5.1 User EEPROM Dialog ...................................................................25 5.2 IFF Dialog ......................................................................................25 5.3 Monitor IFF Dialog .........................................................................26 Chapter 6. Configuration File 6.1 Configuration File Overview ..........................................................27 6.2 New Setup .....................................................................................27 6.3 Load Setup ....................................................................................27 6.4 Save Setup ....................................................................................27 6.5 Save Setup As ..............................................................................27 Chapter 7. Key Generation 7.1 Key Generation Overview .............................................................29 7.2 Manufacturer's Code .....................................................................29 7.3 Key Generation Algorithm .............................................................30 7.4 Key Generation Source .................................................................30 7.5 SEED/IFF2 ....................................................................................30 7.6 Simple Learn .................................................................................30 7.7 Normal Learn ................................................................................31 7.8 Secure Learn .................................................................................31 Chapter 8. Communication 8.1 Serial Port Selection ......................................................................33 Chapter 9. Demonstrations 9.1 Overview .......................................................................................35 Chapter 10. Fault Finding 10.1 Fault Finding .................................................................................39 DS51111B-page iv 2000 Microchip Technology Inc. Table of Contents Appendix A. Schematic Diagrams Figure A.1: Figure A.2: Figure A.3: Figure A.4: Figure A.5: Figure A.6: Figure A.7: Figure A.8: Transponder Base Station (BASE_V3.0) ............................. 41 Transponder Base Station (GEN_5V) ................................. 42 Transponder Base Station (demod) ..................................... 43 Transponder Base Station (PIC16C66) ............................... 44 Transponder Base Station (coildrv) ..................................... 45 HCS410 DIP Socket Long Range RF Transponder ............ 46 HCS412 Credit Card Transmitter/Transponder ................... 47 HCS410 SOIC Short Range Transponder ........................... 48 Index .........................................................................................................49 Worldwide Sales and Service .................................................................50 2000 Microchip Technology Inc. DS51111B-page v Transponder Evaluation Kit User's Guide DS51111B-page vi 2000 Microchip Technology Inc. TRANSPONDER EVALUATION KIT USER'S GUIDE Chapter 1. Setup 1.1 Evaluation Kit Overview The Transponder Evaluation kit enables the programming of HCS410s and HCS412s, as well as evaluating how the transponders are used in a system. The kit is made up of four principal items: * * * * Software Base Station Batteryless Transponders Battery-powered Transponder/RF Transmitters. The Base Station has the ability to program transponders inductively and act as a stand-alone decoder. When in stand-alone mode, the Base Station can learn transponders and do inductive Identify Friend or Foe (IFF) validation. The Batteryless Transponders are powered through the magnetic field provided by the Base Station. The Transponder/Transmitter combines the convenience of an RF transmitter with the security of a transponder. Typically, the RF transmitter will be used as a convenience item: i.e., unlocking the car door as the owner approaches the vehicle. Once in the car, a coil around the ignition electronically validates the key and disarms the immobilizer. This is completely transparent to the operator. Even if the battery in the key goes flat, the transponder will still be able to get power from the field generated by the car's coil. 1.2 Software Installation 1.2.1 Windows(R) 3.1 Place the software into a disk drive. From Program Manager, choose File > Run. Type in a:install.exe. Follow the installation instructions on the screen. The first time you run the software, select the serial port you will be using for communicating to the Base Station from the Options > Serial Port menu. 1.2.2 Windows(R) 95/98 or Windows NT(R) Place the software into a disk drive. From the Start menu, select the Run... option. Type in a:install.exe. Follow the installation instructions on the screen. The first time you run the software, select the serial port you will be using for communicating to the Base Station from the Options > Serial Port port menu. 2000 Microchip Technology Inc. DS51111B-page 1 Transponder Evaluation Kit User's Guide 1.3 Hardware Setup When programming either the Base Station or a transponder, the Base Station needs to be connected to a free serial port on the driving PC using the provided serial cable. After this, the Base Station should be powered up using the 12V power supply provided in the evaluation kit. When programming a transponder inductively make sure the transponder is in the field when hitting the program button. 1.4 Quick Start For those of you who don't read the user manual when you open a new toy here is a quick start to using the Evaluation Kit. 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. DS51111B-page 2 Open the box and unpack the kit's contents. Install the software. Connect the Base Station to a free serial port on your PC. Connect the Base Station to the provided power supply. Run the Evaluation Kit Software (Start > Programs > Transponder Evaluation Kit > Transponder Evaluation Kit). Select and test the serial port that the Base Station is connected to (Setup > Serial Port). Select a demo and work your way through to program the Base Station and transmitter. A suggested demo is the HCS412s Passive Entry Demo (Demos > HCS412 > Passive Entry Demo). See Chapter 9 for more information. Bring up the Monitor IFF dialog. This dialog displays any communication between the Base Station and a transmitter. Press the LEARN button on the Base Station. Notice how the LEARN and FIELD LEDs turn on as the Base Station searches for a transponder. Bring the credit card-shaped HCS412 Transmitter/Transponder into the field. The LEARN LED will start flashing, indicating that the Base Station has learned the HCS412. Notice how the VALID_TOKEN LED lights up each time the Base Station 'Polls' for a transmitter (the FIELD LED will turn on). This indicates that the transponder has been validated. Look at the Monitor IFF dialog. Notice how the Base Station sends a challenge to the transponder, the response the transponder sends back to the Base Station, and the decrypted version of the transponder's response. Press a button on the Transmitter/Transponder twice. Notice how the LEARN LED flickers while the transmitter button is pressed. This indicates that the Base Station is receiving transmissions from the transmitter. After two transmissions, the Base Station will have 'synchronized' with the transmitter and will put an output on the S0:S1 LEDs, depending on which button is pressed. 2000 Microchip Technology Inc. Setup 15. Look at the Monitor IFF dialog. Whenever you transmit, the counter increments. 16. Remove JP3 on the Base Station to disable the RF receiver. 17. Press a button on the transmitter 10 times. 18. Replace JP3 and press S0 on the transmitter. The S0 LED on the Base Station lights up and that the counter has increased by 10. 19. Remove JP3 again and press a button on the transmitter 20 times. 20. Replace JP3. Press and hold S0 on the transmitter. The LEARN LED flickers on and off indicating that transmissions are being received but there is no other output on the Base Station LEDs. 21. Press S0 again. The LEARN LED flickers and the S0 LED on the Base Station lights up indicating that the Base Station has resynchronized with the transmitter. 22. To change the polling mode of the Base Station from continuous polling to user-activated polling: a) b) c) d) Press and hold the RESET push button on the Base Station. Press and hold the POLL push button. Release the RESET push button. After a second, release the POLL push button. 23. The Base Station has now toggled to user-activated polling (repeat the previous step to return to continuous polling mode). 24. When in user-activated polling mode, polling can be initiated by hitting the POLL push button. 2000 Microchip Technology Inc. DS51111B-page 3 Transponder Evaluation Kit User's Guide NOTES: DS51111B-page 4 2000 Microchip Technology Inc. TRANSPONDER EVALUATION KIT USER'S GUIDE Chapter 2. Base Station 2.1 Base Station Overview 2.1.1 Warning: High Voltage First and foremost: THERE ARE HIGH VOLTAGE AREAS on the Base Station board. The voltage on the coil can reach over 400 VPP and has a peak current of 1A. The high voltage areas on the board are marked clearly. Don't touch anything within those areas. Warning: Strong Magnetic Field The Base Stations generates a strong magnetic field. Avoid close proximity with devices influenced by magnetic fields: i.e., CRTs, pacemakers, computer disks, audio and video tapes, and magnetic strip cards. 2.1.2 Base Station Features * * * * Inductive authentication of transponders Can receive and validate KEELOQ(R) code hopping transmissions Can learn up to four KEELOQ encoders Can be used to program HCS410 and HCS412 devices inductively or through the PWM/S2 lines * Selectable polling mode The Base Station has a number of push button inputs and LED outputs: RESET push button - Resets the Base Station. POLL push button - Forces the Base Station to poll continuously for 2 seconds before switching off. LEARN push button - Places the Base Station in learn mode. LEARN LED - Gives information about the status of a learn and general functioning of the Base Station. The LEARN LED will flicker on briefly each time a transponder's serial number is read when a transponder is brought into the field. This indicates that the Base Station has detected a transponder in the field. If the transponder has been learned, the Base Station will attempt to validate the transponder. VALID TOKEN LED - Lights up for 500 ms each time the Base Station successfully validates a learned transponder inductively. S0:S1:S2:S3 and PROX_RF LEDs - Indicates that a valid RF transmission has been received from a transmitter. The LEDs are lit for 500 ms depending on which button is pressed on the transmitter. FIELD LED - Indicates when the Base Station is polling for a transponder and that the field is on. 2000 Microchip Technology Inc. DS51111B-page 5 Transponder Evaluation Kit User's Guide 2.2 Base Station Outputs Connect RS-232 DB9 to here Connect 12V Power Supply 12V DC S2 S3 93C 46B S1 PIC16C66 LEARN VALID TOKEN FIELD S0 PROX_RF RESET POLL LEARN High Voltage Area RF Receiver JP2 Transponder Evaluation Kit Base Station Figure 2.1: Base Station The Base Station has a number of LEDs which display the results of authentication attempts. The S0:S1:S2:S3, and PROX_RF LEDs are switched on for 500 ms whenever the Base Station receives a valid code hopping transmission from a learned transmitter. The PROX_RF will be illuminated if a transmission is initiated by a magnetic field. The VALID TOKEN LED is switched on for 500 ms whenever the Base Station authenticates a learned transponder. The LEARN LED flickers every time an RF transmission is received or if the serial number is read from a transponder. The LEARN LED will flicker before the Base Station attempts to check if the transmitter has been learned. This output is useful to a programmer giving feedback as to whether the Base Station detects a transponder or transmitter. DS51111B-page 6 2000 Microchip Technology Inc. Base Station Table 2.1: Base Station Jumpers Jumper Description JP1 B2T This is the line between the PICmicro(R) 8-bit microcontroller (MCU) and the circuitry controlling the Base Station coil. The jumper should be in place unless the user wants to disable the Base Station coil. JP2 T2B This connects the Base Station to the inductive analog reception circuitry (pins 1 and 2) or to the 8x2 header (pins 2 and 3). JP3 RF_OUT This is the output of the RF receiver. This jumper should be removed to disconnect the RF receiver from the PICmicro MCU. J2 2.3 Name The pins on the 8x2 header are mapped as follows: Pin 1 - Ground Pin 2 - Not used Pin 3 - PWM used during programming Pin 4 - Not used Pin 5 - 12V directly from the power supply Pin 6 - Not used Pin 7 - LC0 Pin 8 - Not used Pin 9 - LC1/S3 Pin 10 - Not used Pin 11 - S2 Pin 12 - Not used Pin 13 - S1 Pin 14 - 5V Pin 15 - S0 Pin 16 - Not used Base Station Polling Mode The Base Station has two polling modes: Continuous and User-activated. In continuous polling mode, the Base Station automatically switches the field on and off. In user-activated polling mode, the Base Station only polls when activated by pressing the POLL push button on the Base Station. There are two ways to switch from continuous polling mode to user-activated polling mode. The first uses the Transponder Evaluation Kit software. The polling mode can be found on the Base Config tab of the Program dialog (Transponder > Program). Once the correct polling mode is selected, use the PROGRAM BASE button to program the Base Station. The second method is to toggle between the two modes without connecting the Base Station to the PC. To do this, connect the Base Station to the power supply. Next, press and hold the RESET push button on the Base Station. While still holding the RESET push button, press the POLL push button, and 2000 Microchip Technology Inc. DS51111B-page 7 Transponder Evaluation Kit User's Guide then release the RESET push button. Wait a second and then release the POLL push button. The Base Station will continue to poll for a second or two and then switch to the newly-selected polling mode. 2.4 Inductive Communication The inductive communication between the Base Station and a transponder takes place via the resonant capacitor/coil combination and analog reception circuitry on the Base Station. The capacitor/coil are resonated at 125 kHz. 2.5 RF Communication RF reception on the Base Station is done using the Telecontrolli receiver module on the Base Station. The transmitter transmits at 433 MHz. 2.6 High Voltage - Danger Please note that the Base Station capacitor/coil has a peak-to-peak voltage of over 400V and a peak current of over 1A. Warning: HIGH VOLTAGE AREA DO NOT touch any of the areas that are labeled HIGH VOLTAGE. You will get shocked. 2.7 Stand-Alone Mode In stand-alone mode, the Base Station acts as a stand-alone decoder. The Base Station can learn up to four transponders in stand-alone mode. When in stand-alone mode, the IFF activity on the Base Station can be monitored by connecting the Base Station to the PC and selecting the Monitor IFF dialog. Stand-alone mode is the default state of the Base Station, and the Base Station returns to stand-alone mode whenever a command from the PC is completed. The Base Station does not need to be connected to the PC when in standalone mode. 2.8 Base Station Programming To program the Base Station, connect the Base Station to the appropriate COM port on the PC using the RS-232 cable included in the evaluation kit. To program the Base Station with the correct Key Generation options and encoder type in the Base Station, select Transponder > Program from the main menu. This displays the Program dialog. Set the transponder options as if a transponder is being programmed, and press the Program Base push button to transfer the information to the Base Station. See Chapter 10 for more information. DS51111B-page 8 2000 Microchip Technology Inc. Base Station 2.9 Learning a Transponder The Base Station is able to "Learn" up to four transponders. During this process, the Base Station reads the transponder's serial number, calculates the transponder's key, and gets the transponders synchronization counter (if used as a transmitter). This information is then saved in EEPROM. The next time the Base Station receives a transmission or reads the serial number from a transponder, the Base Station searches through its "data base" of serial numbers. If the Base Station finds the newly acquired serial number, the code hopping portion of a transmission (or response from the transponder) is decrypted. The resulting value is then compared to the expected value (synchronization counter or challenge). If the decrypted data is valid, the output LEDs lights up for 500 ms. To learn a transponder onto a system inductively, perform the following steps: 1. 2. 3. 4. 5. Check that the Base Station is powered up and connected to the PC. Program the Base Station and transponder with the appropriate setup. Hit the LEARN push button - the LEARN LED will light up. Bring the transponder into the field. If the transponder is successfully learned, the LEARN LED will flash on and off about 10 times. 6. The Base Station can learn up to four transponders, after which the first transmitter learned will be overwritten. 7. If the learn operation fails, the learn LED will turn off and on for a second before returning to stand-alone mode. It is also possible to learn a transponder onto the Base Station using RF: 1. 2. 3. 4. Check that the Base Station is powered up and connected to the PC. Program the Base Station and transponder with the appropriate setup. Hit the LEARN push button - the LEARN LED will light up. Press one of the buttons on the transmitter - the LEARN LED will switch off. 5. Press a button on the transmitter a second time. Note that when using secure learn, the second transmission should be a SEED transmission. 6. If the transponder is successfully learned, the LEARN LED will flash on and off about 10 times. 7. If the learn operation fails, the learn LED will turn off and on for a second before returning to normal stand-alone mode. If the learn operation fails, check that both the transponder and Base Station have been programmed correctly. 2000 Microchip Technology Inc. DS51111B-page 9 Transponder Evaluation Kit User's Guide 2.10 Erasing Transponders It is possible to erase all the transponders learned by the Base Station. 1. Press and hold the LEARN push button. The LEARN LED will switch on. 2. After about eight seconds, the LEARN LED will switch off, indicating that all the transponders have been erased. 3. Release the LEARN push button. DS51111B-page 10 2000 Microchip Technology Inc. TRANSPONDER EVALUATION KIT USER'S GUIDE Chapter 3. HCS410 3.1 Selecting an HCS410 The HCS410 can be selected as the transponder being evaluated in the Transponder Select dialog (Setup > Xponder Select from the main menu). 3.2 Programming an HCS410 The Program dialog can be reached via Transponder > Program from the main menu. The Program dialog allows the selection of the HCS410s options to be programmed into the HCS410. After programming the HCS410 the Base Station should be programmed so that it will be able to learn the HCS410. For a more detailed description of all the features, consult the latest data sheet. The following is a description of the options available in the Program dialog. * Anticollision/XPRF - Sets anticollision and RF transmission options in transponder mode. * Code Word Blanking - Blanks out alternate code words enabling more power to be transmitted in each transmission (FCC). * Counter - 16-bit counter transmitted as part of a code hopping transmission. * Delayed Increment - Increments the synchronization counter by 12, 20 seconds after the last button is pressed. This can be used by the decoder to defeat the latest attack on code hopping systems. * Discrimination Value - 12-bit value transmitted as part of a code hopping transmission. * Extended Serial Number - The full 32-bit serial number is transmitted in a code hopping transmission when the extended serial number is enabled. If not enabled the S0:S1:S2 status replaces the most significant nibble of the serial number in a transmission. * IFF Baud Rate - Selects the communication speed used in inductive communication. * Intelligent Damping - Used in circuits with a high Q to enable faster data communication rates. * LED Output - S2 can double as a LED output if this option is enabled. * Low-Voltage Trip Point - Can be set to low (3V lithium battery) or high (6V battery). * Min 3 Tx - At least three complete RF transmissions are sent each time the transponder is activated using the S0, S1 or S2 inputs. * Overflow - Extends the range of the synchronization counter. 2000 Microchip Technology Inc. DS51111B-page 11 Transponder Evaluation Kit User's Guide * RF Baud Rate - Selects the communication speed used in code hopping mode. * Serial Number - 32-bit serial number. * Transmission Format - The transmission format is selectable between PWM and Manchester Modulation * Transport Code - 32-bit transport code. * User EEPROM - 64-bit user EEPROM. Connect RS-232 DB9 to here Connect 12V Power Supply 12V DC HCS 410 E T S1 S2 S3 93C 46B S1 PIC16C66 LEARN VALID TOKEN FIELD S0 Prox_RF RESET POLL LEARN High Voltage Area RF Receiver JP2 Transponder Evaluation Kit Base Station Figure 3.1: Wire Programming a Transmitter/Transponder * OK push button - Accepts the settings selected but does not program the HCS410 or Base Station. * CANCEL push button - Discards the changes made and closes the dialog. * HELP push button - Brings up the online help. * PRGM BASE push button - Programs the Base Station with the appropriate manufacturer's code, key generation source and algorithm, transmission format, and speed so that it is able to communicate with an HCS410 programmed with the settings as given. * WIRE PRGM push button - Programs the HCS410 with the selected data using the S2 and PWM lines. This can be done when the transmitter is connected to the Base Station at J2. * INDUCT PRGM push button - Programs the HCS410 with the data selected inductively. For more information about communication problems, see Chapter 10. DS51111B-page 12 2000 Microchip Technology Inc. HCS410 3.2.1 Advanced Options Certain options should not be changed to ensure that the transponder can be learned by the Base Station.These are: * The code hopping transmission modulation format defaults to PWM and can be changed on the Advanced Opts tab of the Program dialog. * The oscillator tuning bits are set by the Base Station. * The Key/SEED options are set on the Key Generation tab of the Program dialog. * The synchronization counter is incremented and transmitted each time the HCS410 transmits a code hopping transmission. The synchronization counter is automatically set to 0000 by default. * The discrimination values defaults to the least significant bit of the serial number. 3.2.2 Anticollision/XP RF These two bits in the HCS410 are used to enable or disable anticollision mode, and enable or disable RF transmissions when in transponder mode. * None - Disables both anticollision and inductively activated RF transmissions to allow the HCS410 to work as a pure transponder in IFF mode. * Proximity Activated - When selected, the HCS410 sends out ACK pulses when placed in a magnetic field. If the Base Station does not send a command within 50 ms, the HCS410 transmits a code hopping transmission for 2 seconds before returning to transponder mode. * Anticollision - Places the Base Statin into anticollision mode. This allows multiple transponders to be brought into the same field. * RF Echo - When selected, all of the HCS410 transponder responses are echoed on the PWM output. 3.2.3 Code Word Blanking When code word blanking is enabled, alternate code words are blanked. The FCC limits the amount of power that can be transmitted in a 100 ms window. Code word blanking is useful when trying to transmit the maximum power to a receiver. 3.2.4 Delayed Increment When delayed increment is enabled, the HCS410 increases the synchronization counter by 12, 20 seconds after pressing the last push button. This can be used to foil jam and scan techniques. 2000 Microchip Technology Inc. DS51111B-page 13 Transponder Evaluation Kit User's Guide 3.2.5 Discrimination Value The HCS410 has a 10-bit discrimination value. The discrimination value forms part of the encrypted portion of a code hopping transmission. A KEELOQ decoder uses the discrimination value to validate the decrypted code. 3.2.6 Extended Serial Number The serial number is 32-bits long. To transmit the full 32 bits of the serial number, this option must be enabled. If this option is disabled, a copy of the function code (buttons pressed) is transmitted instead of the most significant nibble of the serial number. 3.2.7 IFF Baud Rate The HCS410 can communicate inductively at two speeds. The slow baud rate has a nominal elemental period of 200 s and a fast baud rate of 100 s. The demodulator circuitry has been optimized to work with the slow communication rate (200 s) and will not work at the fast communication rate. 3.2.8 Intelligent Damping When intelligent damping is active, the HCS410 will briefly load the coil when the HCS410 expects a command from the Base Station. This allows LC circuits with a high Q to be used with the HCS410 and allows higher communication rates. 3.2.9 LED Output S2 is used as a LED output when this option is enabled. 3.2.10 Low Voltage Trip Point The HCS410 can be used with either a 3V or a 6V battery. The low-voltage trip point selects between the initial battery voltages. If the supply voltage drops below approximately 4V (6V battery) and 2V (3V battery), the HCS410 sets the VLOW bit in a code hopping transmission. This gives the Base Station the ability to warn the user if the bit is used. In addition to the VLOW bit being set, the LED output is disabled when a low-voltage condition occurs, warning the user to replace the battery. 3.2.11 Minimum 3 Transmissions When a button is pressed on a transmitter, the HCS410 will normally complete a single transmission. When a minimum of three transmissions are enabled, at least three complete code words are transmitted, even if the button is released. DS51111B-page 14 2000 Microchip Technology Inc. HCS410 3.2.12 Overflow There are two overflow bits available in the HCS410. An overflow bit is cleared every time the 16-bit synchronization counter wraps from FFFF to 0000 (hex). This extends the counter range from 64k transmissions to 192k transmissions. The overflow bits cannot be reset unless the device is re-programmed. 3.2.13 RF Baud Rate The HCS410 can communicate at four speeds in RF mode. The baud rate bits select the nominal communication rate. These run from 00 being the slowest (TE = 400 s) to 11 being the fastest (TE = 100 s) communication rate. The RF receiver module on the Base Station works best at the slow communication value (400 s) and may not work at all at the fastest transmission rate. 3.2.14 Serial Number The HCS410 has a 32-bit (8 hex digit) serial number that the user can select. When checked, the auto-increment option increments the serial number if the HCS410 is successfully programmed. 3.2.15 Transport Code To program the HCS410, change the serial number, or the configuration word inductively, the Base Station needs to send a 32-bit transport code after the appropriate op-code has been sent. After the transport code has been presented, the Base Station can send the data to be programmed into the device. If the transport code presented to the HCS410 does not match the transport code in the HCS410, the op-code is ignored. This feature was added to prevent accidentally reprogramming the HCS410 inductively. The transport code is the 32 most significant bits of the SEED/ Key2. During wire programming, the transport code being programmed into the HCS410 is set in the Key Generation tab of the Program dialog and does not need to match the transport code currently in the HCS410. To inductively program the HCS410 or change the serial number, the enter the transport code currently in the transponder in the Transport Code tab of the Program dialog. 3.2.16 Transmission Format The HCS410 has two transmission formats available namely PWM and Manchester. Note: 2000 Microchip Technology Inc. The Base Station only receives PWM transmissions. DS51111B-page 15 Transponder Evaluation Kit User's Guide 3.2.17 User EEPROM The HCS410 has 64 bits of user EEPROM. A 64-bit number can be entered (16 hex digits) when programming the device. When entering a 64-bit number, the data is mapped so that the last 8 bits are programmed into USR0 and the first 8 bits are programmed to USR3. For example: If entering a number such as 0123456789ABCDEF, the data is mapped so that CDEF is programmed into USR0 and 0123 is programmed into USR3. 3.3 Code Hopping Transmissions The transponder can be used as an RF transmitter. To force a KEELOQ code hopping transmission, activate any of the S inputs, S0, S1, S2 or a combination of the S inputs (Note: certain button combinations cause a SEED transmission, if enabled). A code hopping transmission has two portions - a fixed portion and a code hopping portion. The fixed portion contains the 2 QUE bits, 2 CRC bits, a VLOW bit, 4/0 button status bits and 28/32-bit serial number. The encrypted information contains 4 button status bits, 12 discrimination bits and a 16-bit synchronization counter. 3.4 SEED Transmissions If SEED transmissions are enabled in the Key Generation tab of the program dialog, the transponder can be forced to transmit a SEED transmission in place of a code hopping transmission. A SEED transmission takes 60 least significant bits of the SEED from EEPROM and transmits them, followed by the 4-bit button status information, VLOW bit, 2 CRC bits, and the 2 QUE bits. SEED transmissions are activated by pulling S0, S1, and S2 high at the same time. A delayed SEED transmission can be activated by pulling S0 and S1 high at the same time. A delayed SEED transmission transmits a normal code hopping transmission for 2 seconds and then switches over to SEED transmissions. It is possible to erase all the transponders learned by the Base Station. 1. Press and hold the LEARN push button. The LEARN LED will switch on. 2. After about 8 seconds the LEARN LED will switch off indicating that all of the transponders have been erased. DS51111B-page 16 2000 Microchip Technology Inc. TRANSPONDER EVALUATION KIT USER'S GUIDE Chapter 4. HCS412 4.1 Selecting an HCS412 The HCS412 can be selected as the transponder being evaluated in the Transponder Select dialog (Setup > Xponder Select from the main menu). 4.2 Programming an HCS412 The Program dialog can be reached via Transponder > Program in the main menu. The Program dialog allows the selections of the HCS412 options to be programmed into the HCS412. After programming the HCS412, the Base Station should be programmed so that it will be able to learn the HCS412. For a more detailed description of all the features please consult the latest data sheet. The following is a description of the options available in the Program dialog. * Anticollision/XPRF - Sets anticollision and RF transmission options in transponder mode. * ASK / FSK Control - An ASK and FSK control sequence has been implemented. * Code Word Blanking - Blanks out alternate code words enabling more power to be transmitted in each transmission (FCC). * Counter - 16-bit counter transmitted as part of a code hopping transmission. * Delayed Increment - Increments the synchronization counter by 12, 20 seconds after the last button is pressed. This can be used by the decoder to defeat the latest attack on code hopping systems. * Discrimination Value - 12-bit value transmitted as part of a code hopping transmission. * Extended Serial Number - The full 32-bit serial number is transmitted in a code hopping transmission when the extended serial number is enabled. If not enabled the S0:S1:S2 status replaces the most significant nibble of the serial number in a transmission. * IFF Baud Rate - Selects the communication speed used in inductive communication. * Intelligent Damping - Used in circuits with a high Q to enable faster data communication rates. * LC Demodulator - In this mode, data detected on the LCD line will be output on the DATA line. * Low Voltage Trip Point - Can be set to low (3V lithium battery) or high (6V battery). 2000 Microchip Technology Inc. DS51111B-page 17 Transponder Evaluation Kit User's Guide * Min 4 Tx - At least four complete RF transmissions are sent each time the transponder is activated using the S0, S1 or S2 inputs. * Overflow - Extends the range of the synchronization counter. * RF Baud Rate - Selects the communication speed used in code hopping mode. * RF Enable - This option allows S2 to be to enable the RF circuitry during RF transmissions. * S2/LC Pin - This option allows the S2 line to be used as a button input or as a transponder input. * Serial Number - 32-bit serial number. * Transmission Format - The transmission format is selectable between PWM and Manchester Modulation. * Transport Code - 28-bit transport code. * User EEPROM - 64-bit user EEPROM. * CANCEL push button - Discards the changes made and closes the dialog. * HELP push button - Brings up the online help. * INDUCT PRGM push button - Programs the HCS412 with the data selected inductively. * OK push button - Accepts the settings selected but does not program the HCS412 or Base Station. * PRGM BASE push button - Programs the base with the appropriate manufacturer's code, key generation source and algorithm, transmission format and speed so that it is able to communicate with an HCS412 programmed with the settings as given. * WIRE PRGM push button - Programs the HCS412 with the selected data using the S2 and PWM lines. This can be done when the transmitter is connected to the Base Station at J2. For more information about communication problems, see Chapter 10. DS51111B-page 18 2000 Microchip Technology Inc. HCS412 4.2.1 Advanced Options Certain options should not be changed to ensure that the transponder can be learned by the Base Station.These are: * The code hopping transmission modulation format defaults to PWM and can be changed on the Advanced Opts tab of the Program dialog. * The oscillator tuning bits are set by the Base Station. * The key/SEED options are set on the Key Generation tab of the Program dialog. * The synchronization counter is incremented and transmitted each time the HCS412 transmits a code hopping transmission. The synchronization counter is automatically set to 0000 by default. * The discrimination values defaults to the least significant bit of the serial number. 4.2.2 ASK/FSK Control The HCS412 has the ability to send ASK/FSK control signals on S2 when transmitting data. 4.2.3 Anticollision/XP RF These two bits in the HCS412 are used to enable or disable anticollision mode and enable or disable RF transmissions when in Transponder mode. * None - Disables both anticollision and inductively activated RF transmissions to allow the HCS412 to work as a pure transponder in IFF mode. * Proximity Activated - When selected, the HCS412 sends out ACK pulses when placed in a magnetic field. If the Base Station does not received a response within 50 ms, the HCS412 transmits a code hopping transmission for 2 seconds before returning to transponder mode. * Anticollision - Places the Base Statin into anticollision mode. This allows multiple transponders to be brought into the same field. * RF Echo - When selected, all of the HCS412 transponder responses are echoed on the PWM output. Note: 2000 Microchip Technology Inc. The HCS412 can only be inductively validated by the evaluation kit's Base Station mode in RF Echo mode. This is because the inductive demodulation circuitry on the base is too slow for the HCS412. DS51111B-page 19 Transponder Evaluation Kit User's Guide 4.2.4 Code Word Blanking When code word blanking is enabled, alternate code words are blanked. The FCC limits the amount of power that can be transmitted in a 100 ms window. Code word blanking is useful when trying to transmit the maximum power to a receiver. 4.2.5 Delayed Increment When delayed increment is enabled, the HCS410 increases the synchronization counter by 12, 20 seconds after pressing the last push button. This can be used to foil jam and scan techniques. 4.2.6 Discrimination Value The HCS412 has a 10-bit discrimination value. The discrimination value forms part of the encrypted portion of a code hopping transmission. A KEELOQ decoder uses the discrimination value to validate the decrypted code. 4.2.7 Extended Serial Number The serial number is 32 bits long. To transmit the full 32 bits of the serial number this option must be enabled. If this option is disabled, a copy of the function code (buttons pressed) are transmitted instead of the most significant nibble of the serial number. 4.2.8 IFF Baud Rate The HCS412 can communicate inductively at two speeds. The slow baud rate has a nominal elemental period of 200 s and a fast baud rate of 100 s. The demodulator circuitry has been optimized to work with the slow communication rate (200 s) and will not work at the fast communication rate. 4.2.9 Intelligent Damping When intelligent damping is active the, HCS412 will briefly load the coil when the HCS412 expects a command from the Base Station. This allows LC circuits with high Q to be used with the HCS412 and allows higher communication rates. 4.2.10 LC Demodulator The HCS412 can be used as a low cost LC demodulator. A capacitor/coil is connected across the LC0 and LC1 (LC1 is optional and is used for high sensitivity applications) pins. The HCS412 will output the field that is being received on the DATA pin. DS51111B-page 20 2000 Microchip Technology Inc. HCS412 4.2.11 Low Voltage Trip Point The HCS412 can be used with either a 3V or a 6V battery. The low-voltage trip point selects between the initial battery voltages. If the supply voltage drops below approximately 4V (6V battery) and 2V (3V battery), the HCS412 sets the VLOW bit in a code hopping transmission. This gives the Base Station the ability to warn the user if the bit is used. In addition to the VLOW bit being set, the LED output is disabled after a single flash when a low-voltage condition occurs, warning the user to replace the battery. 4.2.12 Minimum 4 Transmissions When a button is pressed on a transmitter the HCS412 will normally complete a single transmission. When minimum of four transmissions are enabled, at least four complete code words are transmitted, even if the button pressed is released. 4.2.13 Overflow There are two overflow bits available in the HCS412. An overflow bit is cleared every time the 16-bit synchronization counter wraps from FFFF to 0000 (hex). This extends the counter range from 64k transmissions to 192k transmissions. The overflow bits cannot be reset unless the device is re-programmed. 4.2.14 RF Baud Rate The HCS412 can communicate at four speeds in RF mode. The baud rate bits select the nominal communication rate. These run from 00 being the slowest (TE = 400 s) to 11 being the fastest (TE = 100 s) communication rate. The RF receiver module on the Base Station works best at the slow communication value (400 s) and may not work at all at the fastest transmission rate. 4.2.15 RF Enable When this bit is enabled, the S2/LC1 pin of the HCS412 doubles as the RF enable control line for an ASK or FSK transmitter. 4.2.16 S2/LC Pin Pin 3 on the HCS412 can be configured as a button input or as a transponder input. When in transponder input mode, the resonant capacitor/coil is connected across LC0 and LC1. This is the transponder's high sensitivity mode. 2000 Microchip Technology Inc. DS51111B-page 21 Transponder Evaluation Kit User's Guide 4.2.17 Serial Number The HCS412 has a 32-bit (8 hex digit) serial number that the user can select. When checked, the auto-increment option increments the serial number if the HCS412 is successfully programmed. 4.2.18 Transport Code To program the HCS412, change the serial number, or the configuration word inductively, the Base Station needs to send a 28-bit transport code after the appropriate op-code has been sent. After the transport code has been presented, the Base Station can send the data to be programmed into the device. If the transport code presented to the HCS412 does not match the transport code in the HCS412, the op-code will be ignored. This feature was added to prevent accidentally reprogramming the HCS412 inductively. The transport code is the 28 most significant bits of the SEED/ Key2. During wire programming, the transport code being programmed into the HCS412 is set in the Key Generation tab of the Program dialog and does not need to match the transport code currently in the HCS412. To inductively program the HCS412 or change the serial number, the enter the transport code currently in the transponder in the Transport Code tab of the Program dialog. 4.2.19 Transmission Format The HCS412 has two transmission formats available namely PWM and Manchester. Note: 4.2.20 The Base Station only receives PWM transmissions. User EEPROM The HCS412 has 64 bits of user EEPROM. A 64-bit number can be entered (16 hex digits) when programming the device. When entering a 64-bit number, the data is mapped so that the last 8 bits are programmed into USR0 and the first 8 bits are programmed to USR3. For example: If entering a number such as 0123456789ABCDEF, the data is mapped so that CDEF is programmed into USR0 and 0123 is programmed into USR3. DS51111B-page 22 2000 Microchip Technology Inc. HCS412 4.3 Code Hopping Transmissions The transponder can be used as an RF transmitter. To force a KEELOQ code hopping transmission, activate any of the S inputs, S0, S1, S2 or a combination of the S inputs (Note: certain button combinations cause a SEED transmission, if enabled). A code hopping transmission has two portions - a fixed portion and a code hopping portion. The fixed portion contains the 2 QUE bits, 2 CRC bits, a VLOW bit, 4/0 button status bits and 28/32-bit serial number. The encrypted information contains 4 button status bits, 12 discrimination bits and a 16-bit synchronization counter. 4.4 SEED Transmissions If SEED transmissions are enabled in the Key Generation tab of the Program dialog, the user can force the Transponder to transmit a SEED transmission in place of a code hopping transmission. A SEED transmission takes 60 least significant bits of the SEED from EEPROM and transmits the, followed by the 4-bit button status information, VLOW bit, 2 CRC bits, and the 2 QUE bits. SEED transmissions are activated by pulling S0, S1, and S2 high at the same time. A delayed SEED transmission can be activated by pulling S0 and S1 high at the same time. A delayed SEED transmission transmits a normal code hopping transmission for 2 seconds and then switches over to SEED transmissions. It is possible to erase all the transponders learned by the Base Station. 1. Press and hold the LEARN push button. The LEARN LED will switch on. 2. After about 8 seconds the LEARN LED will switch off indicating that all the transponders have been erased. 2000 Microchip Technology Inc. DS51111B-page 23 Transponder Evaluation Kit User's Guide NOTES: DS51111B-page 24 2000 Microchip Technology Inc. TRANSPONDER EVALUATION KIT USER'S GUIDE Chapter 5. Other Dialog Boxes 5.1 User EEPROM Dialog The 64-bit user EEPROM and 32-bit serial number on the HCS410 or HCS412 can be read and modified in IFF mode. The User EEPROM dialog allows you to read or write to the user EEPROM on the HCS410 and HCS412. The User EEPROM dialog can be opened through the Transponder > EEPROM in the main menu. To read the user EEPROM press the READ push button. If there is a transponder in the field, this will read all of the user information. The user EEPROM can be modified as needed and written by pressing the WRITE push button. To write to the transponder's serial number, the Base Station needs to have the transport code that was originally programmed into the transponder. The transport code should be entered to allow the serial number to be changed. If the transport code entered does not match the transport code in the transponder, the serial number will not be modified. The command status line lets shows whether the read/write passed or failed. For more information about communication problems, see Chapter 10. 5.2 IFF Dialog The IFF dialog can be opened by selecting Transponder > IFF from the main menu. This option enables a manual operation of a challenge/response with a transponder in the field. To do this, select the key and algorithm to be used for the IFF and enter a 32-bit challenge. It is important to note that unless the 2-Key IFF mode is selected in the Key Generation tab at the Program dialog, the Key2 for an IFF will be disabled. After selecting an algorithm, selecting a key and entering the 32-bit challenge the hit the IFF push button. The Base Station will attempt to do an IFF with a transponder in the field. The IFF results text box gives information about the result of the IFF. The HCS412 has an "IFF Hop" command. When the HCS412 receives this command from the Base Station, the HCS412 will build the 32-bit code hopping portion of a transmission. For example: The counter will be incremented and encrypted along with the discrimination value and function code. Note: To use Key2 successfully, both manufacturers codes should be the same in the Key Generation tab of the Program dialog. For more information about communication problems, see Chapter 10. 2000 Microchip Technology Inc. DS51111B-page 25 Transponder Evaluation Kit User's Guide 5.3 Monitor IFF Dialog When the Base Station is in stand-alone mode, the Base Station will dump the serial number, challenge sent, the HCS410s or HCS412s response, and the decrypted response to the serial port, even if the encoder is not learned. RF transmissions received by the Base Station in stand-alone mode are also dumped to the serial port and can be seen in the Monitor IFF dialog. This can be monitored by the user in the Monitor IFF dialog (Transponder > Monitor IFF). DS51111B-page 26 2000 Microchip Technology Inc. TRANSPONDER EVALUATION KIT USER'S GUIDE Chapter 6. Configuration File 6.1 Configuration File Overview The evaluation kit uses a configuration file to save the user-selectable settings. The configuration file that was last used is loaded each time the program is started. 6.2 New Setup To load the default setup, select File > New from the main menu. 6.3 Load Setup To load a previously saved configuration file, select File > Load Setup from the main menu. 6.4 Save Setup To save the current configuration, select File > Save Setup from the main menu. 6.5 Save Setup As To save the current configuration file under a different name and directory, select File > Save Setup from the main menu. 2000 Microchip Technology Inc. DS51111B-page 27 Transponder Evaluation Kit User's Guide NOTES: DS51111B-page 28 2000 Microchip Technology Inc. TRANSPONDER EVALUATION KIT USER'S GUIDE Chapter 7. Key Generation 7.1 Key Generation Overview Key generation is used to generate keys for KEELOQ encoders. The encoder uses its key to generate responses to IFF challenges and to encrypt the code hopping portion of a transmission when used as a transmitter. The HCS410 and HCS412 both have two keys available. The first of the keys is used to encrypt the code hopping portion of the key and to do any of the IFF functions when an IFF is performed using Key1. Key2 can be used either as a second IFF key or as a SEED in a SEED transmission. The keys are generated when the encoder is programmed. Key generation in KEELOQ systems has three parts: the key generation source, the key generation algorithm, and the manufacturer's code. The key generation source is either the encoder's serial number or the encoder's SEED. Normal key generation uses the encoder's serial number as the source. Secure learn uses the encoder's SEED as a source. The manufacturer's code is a 64-bit value used to create a unique relationship between the key generation source and the encoder key. The key generation method used when programming the Base Station or a transponder is selected on the Key Generation tab in the Program dialog (Transponder > Program). Note that in order to use secure learn, the second key is used as a SEED,. Only one key is available for IFF functions. This also implies that if two keys are used for IFF, key generation must be either simple or normal key generation because enabling 2-key mode in the encoder disables SEED transmissions. 7.2 Manufacturer's Code The 64-bit manufacturer's code is used in key generation for one or both of the encoder's keys. The manufacturer's code creates a unique relationship between key generation source and the encoder key. If two manufacturers use the same source (e.g., serial number 1111) and algorithm (i.e., decryption), the key generation process will produce two completely different encoder keys for the two manufacturer's because of the different manufacturer's code. Encoders for the two different manufacturers are not interchangeable. This prevents cloning of transmitters. If two manufacturers decide to work together, they will have to share a manufacturer's code. The manufacturer's code is central to system security and should be kept as a closely guarded secret. The manufacturer's code is entered in the Key Generation tab in the Program dialog (Transponder > Program). 2000 Microchip Technology Inc. DS51111B-page 29 Transponder Evaluation Kit User's Guide 7.3 Key Generation Algorithm There are two key generation algorithms currently supported by Microchip. The first of these is the decryption algorithm. The second is the XOR algorithm. Both algorithms use the manufacturer's code to create a unique link between the key generation source and the encoder key. The Transponder Evaluation Kit only supports the Decryption algorithm. 7.4 Key Generation Source The source used in key generation is either the serial number of the encoder or the SEED of the encoder. Using the SEED (secure learn) as the source, requires a SEED transmission during the learn process. 7.5 SEED/IFF2 The HCS410 and HCS412 encoders have a 64-bit space that can be used as either a SEED during a SEED transmission or as a second IFF key. The selection can be made in the Key Generation tab in the Program dialog (Transponder > Program). This space is also used as the transport code which is used to protect the encoder from accidently being programmed in IFF mode. The Seed/Key2 is used as the transport code regardless of the setting of SEED/IFF2. No SEED - 1 Key - This option disables the use of the area, completely disabling both SEED transmissions and the areas used as a second key. Limited SEED - The SEED transmissions will be disabled when the synchronization counter goes over 256 when limited SEED transmissions are enabled. Only one key is available for IFF authentication. SEED - SEED transmissions are always enabled in this mode. Only one key is available for IFF authentication. 2 Key IFF - SEED transmissions are disabled and the transponder has two keys for IFF authentication available. 7.6 Simple Learn Simple learn uses a single key for all the encoders in a system. This key is the manufacturer's code. This method of key generation is less secure than either normal learn or secure learn because once the encryption key for one encoder in the system is known, the encryption key for all encoders in the system is known. Simple learn is useful in applications where convenience is a high priority and security is nominal. DS51111B-page 30 2000 Microchip Technology Inc. Key Generation 7.7 Normal Learn Normal learn uses the serial number of the encoder during key generation to generate the key. When learning the encoder onto a receiver/Base Station, the receiver needs to either read the serial number (IFF mode) or receive a valid transmission (RF mode). Thereafter, a key can be generated using the decryption algorithm and the manufacturer's code. 7.8 Secure Learn Secure learn uses a SEED transmission from an encoder to generate the encoder key. Only a single IFF key is used when Implementing key generation via secure learn. The location of the second IFF key is used to store the SEED. Generating the encoder key can be accomplished between the decryption algorithm or the XOR algorithm. Note: 2000 Microchip Technology Inc. The Base Station only supports the decryption algorithm. DS51111B-page 31 Transponder Evaluation Kit User's Guide NOTES: DS51111B-page 32 2000 Microchip Technology Inc. TRANSPONDER EVALUATION KIT USER'S GUIDE Chapter 8. Communication 8.1 Serial Port Selection The PC can be connected to the Base Station via serial ports COM1 through COM4. Serial port selection is established in the Select Serial Port dialog. Once the connection is established, test the communication between the Base Station and the PC by pressing the TEST COMS push button. If the connection is working, click OK to accept the selection. Press Cancel to discard the changes and leave the dialog. For more information about communication problems, see Chapter 10. 2000 Microchip Technology Inc. DS51111B-page 33 Transponder Evaluation Kit User's Guide NOTES: DS51111B-page 34 2000 Microchip Technology Inc. TRANSPONDER EVALUATION KIT USER'S GUIDE Chapter 9. Demonstrations 9.1 Overview The demonstrations are listed in the main menu. The demonstrations consist of five steps. The first step in the demonstration gives a brief introduction. If the setup (Low-Voltage Trip, IFF Baud Rate, etc.) that is being used has changed between the time the program was started and the demo is started, the software displays a prompt to save the setup before continuing. The setup is changed during the demo in order to provide the opportunity to see what the settings used during the demo are by going to the Program dialog (Transponder > Program). There are five control buttons in the Demonstration dialogs as described below: The PREVIOUS button goes back one step during the demo. This allows for checking or repeating a previous step. The SKIP button moves to the next step with out completing the programming necessary to successfully complete the current step. This can be used to step through the demo, without having the Base Station connected to a PC. The NEXT button moves to the next step, performing the actions the step requires, typically programming of the Base Station or the transponder. The CANCEL button aborts the demonstration. The HELP button brings up the online help. After the demonstration has been completed, the configuration will be changed. The transponder setup can be seen in the Program dialog. Additional transponders can be programmed at this point. 9.1.1 HCS410 Batteryless Demo The HCS410 batteryless demonstration sets the Base Station up to work with the small, batteryless HCS410 transponder that is supplied with the evaluation kit. The small transponder is not programmed. After the demonstration the user will be able to learn and validate the batteryless transponder. After the transponder has been learned the VALID_TOKEN LED will light up on the Base Station each time the transponder is brought into the field. The transponder is programmed with anti-collision off, but there is no reason why anti-collision cannot be used. The battery powered transmitter / transponder can also be used during this demonstration - if the user chooses not to use the battery powered transmitter / transponder the user should skip over the programming stage. 2000 Microchip Technology Inc. DS51111B-page 35 Transponder Evaluation Kit User's Guide 9.1.2 HCS410 Proximity Activation Demo The HCS410 proximity activation demonstration will set the Base Station and program the HCS410 transmitter / transponder to work in proximity activated mode. When used as a transmitter the HCS410 will send out a transmission when a button (S0, S1 or S2 is pressed). When the HCS410 is programmed with proximity activation enabled the HCS410 will send out a single code hopping word when the HCS410 is brought into a magnetic field and no command is received within 50ms of the first acknowledge pulse being sent out by the HCS412. After the HCS410 is learned onto the Base Station the proximity activation can be seen working whenever the PROX_RF LED illuminates. To force a proximity activated transmission remove JP2. This will prevent the Base Station from receiving data from the HCS410 transmitter / transponder inductively. The Base Station doesn't receive the HCS410's acknowledge pulses and the transponder is not detected. As a result the Base Station doesn't send out a command, causing the HCS410 to send a proximity activated transmission. 9.1.3 HCS410 RF Echo Demo The HCS410 RF echo demonstration sets the Base Station and HCS410 transmitter/transponder to work with RF echo mode enabled. When in RF Echo mode the HCS410 sends the response to any inductive command received out twice, first on the inductive lines and then on the RF output. RF Echo mode is used when no inductive receiver is present or when the inductive receiver is out of range. This can be checked by removing either JP2 (disable the inductive path back to the microcontroller) or removing JP3 (disables the RF path back to the microcontroller). When in RF Echo mode, anticollision mode is also active. 9.1.4 HCS412 Proximity Activation Demo The HCS412 proximity activation demonstration sets the Base Station and programs the HCS412 Transmitter/Transponder to work in proximity activated mode. When used as a transmitter the HCS412 sends out a transmission when a button (S0, S1 or S2) is pressed. When the HCS412 is programmed with proximity activation enabled, the HCS412 sends out a single code hopping word when the HCS412 is brought into a magnetic field and no command is received within 50 ms of the first acknowledge pulse being sent out by the HCS412. After the HCS412 is learned onto the Base Station the proximity activation can be seen working whenever the PROX_RF LED illuminates. To force a proximity activated transmission, remove JP2. This will prevent the Base Station from receiving data from the HCS412 Transmitter/Transponder inductively. The Base Station doesn't receive the HCS412s acknowledge DS51111B-page 36 2000 Microchip Technology Inc. Demonstrations pulses and the transponder is not detected. As a result, the Base Station doesn't send out a command. This causes the HCS412 to send a proximity activated transmission. Note: 9.1.5 The Base Station cannot inductively validate the HCS412 transponder in proximity activated mode. HCS412 Passive Entry Demo The HCS412 passive entry demonstration sets the Base Station and HCS412 transmitter/transponder to work in passive entry mode. When in passive entry mode, the HCS412 sends the response to any inductive command received out twice, first on the RF output and then on the LC output. Passive entry mode can be used when no inductive receiver is present or when the inductive receiver is out of range. This can be checked by removing either JP2 (disable the inductive path back to the microcontroller) or removing JP3 (disables the RF path back to the microcontroller). When in passive entry mode, anticollision mode is also active. 2000 Microchip Technology Inc. DS51111B-page 37 Transponder Evaluation Kit User's Guide NOTES: DS51111B-page 38 2000 Microchip Technology Inc. TRANSPONDER EVALUATION KIT USER'S GUIDE Chapter 10. Fault Finding 10.1 Fault Finding If, after giving a PC command (program, IFF, Read, Write, etc.) the command fails, check the following: 1. Check that the Base Station is powered up. 2. Check that the serial cable is securely connected to the Base Station and PC. 3. Check that the correct serial port has been selected. 4. Check that the Base Station has been programmed with the current setup (communication speed and protocol). 5. Check that the transponder is in the field. 6. Check that the jumpers at JP1, JP2 (across pins 1 & 2), and JP3 are inserted. If, after programming a transponder, and the transponder fails to learn the transponder: 1. Check the settings above. 2. Check that the Base Station has been programmed. Press the PRGM BASE button in the Transponder > Program dialog after programming the transponder. 3. Check that the transponder was programmed correctly. 4. Check that the IFF baud rate is set to the slowest setting. Failed to program a long range transmitter/transponder when plugged into the board: 1. Check that jumper at JP2 is placed across pins 2 and 3. Fails to receive RF transmissions: 1. Check that PWM transmission format is selected. 2. Check that JP3 is inserted. 3. Check that the transmitter is programmed with an RF transmission rate of 400 s or 200 s. Fails to validate a transponder inductively. 1. Check that the IFF baud rate is set to 200 s. 2. If using an HCS412, check that RF Echo mode is selected in the Options > Anticollision/XPRF dialog. The Base Station's reception circuitry is too slow to validate an HCS412 inductively and relies on RF talk back for validation. 2000 Microchip Technology Inc. DS51111B-page 39 Transponder Evaluation Kit User's Guide NOTES: DS51111B-page 40 2000 Microchip Technology Inc. 2000 Microchip Technology Inc. 12V 4 2 AN_5V DG_5V J1 MDC-034 + + 3 + + 1 + 5 D1 1N5820 CASE 267-03 12V GEN_5V VCC BS_RF AN_5V demod DATA_T2B OSC DATA_B2T DATA_T2B 12V PIC16C63 DATA_B2T OSC 12V coildrv HIGH VOLTAGE LC-CAP LC-COIL 10nF 500V 2225 C3 COIL 500V WB1528 L1 TRANSPONDER EVALUATION KIT USER'S GUIDE Appendix A. Schematic Diagrams Figure A.1: Transponder Base Station (BASE_V3.0) DS51111B-page 41 12V DS51111B-page 42 1 2 SOT-89 22R R2 22R R1 3 C6 1u 16V EIA Size A C4 1u 16V EIA Size A 3 3 JUMPER 1 JMP1 1 1 C7 100n 16V C5 100n 16V C40 68u EIA Size D POWER Green LED D14 C41 68u EIA Size D JMP1 IS A "VIRTUAL" JUMPER USED TO SEPARATE ANALOG AND DIGITAL GROUND NETLISTS ONLY AND IS TO BE SHORTED OUT. 2 G N D SOT-89 U1 NJM78L05UA VIN VOUT 2 G N D SOT-89 U2 NJM78L05UA VIN VOUT R71 1k AN_5V DG_5V Transponder Evaluation Kit User's Guide Figure A.2: Transponder Base Station (GEN_5V) 2000 Microchip Technology Inc. 2000 Microchip Technology Inc. HIGH VOLTAGE BS_RF R26 1M R25 1M R24 100R R23 100R D6 UF1007 Envelope Detector AN_5V C20 10n 500V C21 1n5 500V R27 470k 2.5V R41 270R R45 3 2 LL4148 DATA_T2B 100k 1k R52 1k 10k 10n 4 U8A 2 + 3 LM358M SOIC-8 8 C42 10n R22 C43 R42 4k7 D9 1k R29 LM6036M SOIC-14 1 U7A R48 1 4 + 1 1 5 + 6 1 1 4 270R R35 7 C29 100n 16V C30 100n 16V 1n C28 68k C27 2n7 R54 R50 N/C N/C R58 68k R55 U7C 4 10 + 8 9 LM6036M 1 1 SOIC-14 100n 16V C22 R31 1n 6k8 10k R32 680R C23 R33 1k 4 U8B 6 + 5 LM358M 8 SOIC-8 LM6036M SOIC-14 7 U7B Band Pass Filter R49 Schmidt Trigger 100n 16V R18 C18 220k 1n 10k R19 22k C19 R20 Band Pass Filter R47 LM385-2.5 TO-92 D7 1k D5 LL4148 1k Q8 2N7002A SOT-23 R44 1k D4 LL4148 R28 Buffer 1k8 C25 100p R38 47k R36 4 12 + 13 1 1 R37 47k Low Pass Filter 15k R39 LM6036M SOIC-14 14 U7D 18p C24 Schematic Diagrams Figure A.3: Transponder Base Station (demod) DS51111B-page 43 DS51111B-page 44 DATA_T2B J5 TP 1 D12 S1 D13 S3 Y1 JP2 T2B S0 S1 S2 S3 VDD20 1 MCLR/VPP RB0/INT21 RB122 RB223 RB324 RC0/T1OSO/T1CKIRB425 RC1/T1OSI/CCP2 RB526 RB627 RC2/CCP1 RB728 RC3/SCK/SCL U12 RA0 RA1 RA2 RA3 RA4/T0CKI RA5/SS R77 1k D15 VALID TOKEN D18 FIELD 1k R80 R83 1k PIC16C66 28 LEAD SKINNY DIP RFIN PWM D16 LEARN R81 1k RX1 TX1 12 ROUT1 RIN1 13 9 ROUT2 RIN2 8 1u 16V 1 U10 6 V C C 11 DIN1 DOUT114 10 DIN2 DOUT27 C35 1u 16V 2 V+ 5 P1 9 4 8 3 7 2 6 1 DB9 FEMALE C38 J3 VCC 100n 16V 1 2 3 R69 4 U11 8 10k 5 6 6 1 CS V 7 NC C 8 2 CLKC NC 7 9 10 3 DI V DO 4 11 S 12 S 93C46B 13 14 5 8 LEAD DIP 15 RF-MODULE J6 TP 1 1 JP1 DATA_B2T B2T OSC VCC C36 VCC 1 C1+ C2+ 4 C34 C37 1u 16V 1u 16V 5 3 C1C2G 6 VN R78 D C33 1k DS14C232TM 1 1u 16V SOIC-16 5 D17 PROX_RF R82 10k 1 JP3 RF OUT VCC Provide Strain Relief J9 ANTENNA-LEAD 1 J7 1 TP J8 1 TP RESET PB R70 10k SW2 VCC C39 100n 16V VCC 18 9 OSC1/CLKIN RC7/RX/DT 17 10 OSC2/CLKOUT RC6/TX/CK 16 RC5/SDO 15 8 VSS RC4/SDI/SDA 19 VSS 11 12 13 14 2 3 4 5 6 7 J2 1 2 PWM 3 12V 5 46 12V LC0 7 8 S3 9 10 VCC S2 11 12 S1 13 14 S0 15 16 CON16A R79 1k J4 1 TP R67 R66 10k 10k C32 27p R59 R61 1k 1k R60 R62 1k 1k 4 MHz C31 27p D10 S0 D11 S2 LEARN PB SW1 POL PB SW3 1 VCC Transponder Evaluation Kit User's Guide Figure A.4: Transponder Base Station (PIC16C66) 2000 Microchip Technology Inc. 2000 Microchip Technology Inc. N/C R74 R12 10k VCC 6 MC74HC00AD SOIC-14 U4B U4C 8 12 13 N/C R75 4 U5A MC74HC00AD 2 SOIC-14 PQ 5 D R 3 CLK 6 CQ L MC74HC74AD 1 SOIC-14 9 10 C17 3300u 25V 11 VCC C14 100n 16V C15 100n 16V HIGH VOLTAGE LC-CAP LC-COIL D3 Q4 MTW14N50E MUR860 TO-220AC TO-247AE Q2 MTP50N06V TO-220AB R76 N/C 1R 1WATT Q1 MTP23P06V TO-220AB R16 Q3 2N7002A SOT-23 RESISTORS R74, R75 AND R76 SOLDER IN 0 OHM RESISTORS IF NOT US ENHANCED FREQUENCY CIRCUIT INSIDE THIS BOX R15 680R Q7 MMBT3906 SOT-323 R14 150R Q6 MMBT3904 SOT-323 R84 8 100R MC74HC74AD SOIC-14 U5B 9 Q5 2N7002A SOT-23 R13 680R 1 0 MC74HC00AD SOIC-14 12 D P Q R 11 CLK CQ L 1 3 U4D C16 100n 16V U6 R72 Q4 7 VCC 11 PI Q5 5 6 MHz 12 RSTQ6 4 R73 0R 16 MHz 6 U4A Q7 1 14 C13 Q8 13 3 N/C 2 Q9 SOLDER ONLY ONE: R72 OR100n R73 16V Q10 15 Q12 1 MC74HC00AD 2 Q13 SOIC-14 Q14 3 PO 9 PO 10 74HC4060 SOIC-16 4 5 R11 10k VCC ENHANCED FREQUENCY CIRCUIT 0.47R 1Watt R17 Figure A.5: Transponder Base Station (coildrv) OSC DATA_B2T LOGIC HIGH = FIELD LOGIC LOW = NO FIELD 12V Schematic Diagrams DS51111B-page 45 DS51111B-page 46 C7 2.2uF 0805 S2 S1 SW3 S0 SW2 SW1 R6 1 2 3 4 HCS410 DIP-8 S0 VDD 8 S1 LC0 7 S2/LEDPWM 6 LC1 VSS 5 U2 10R 0805 D1 HSMH-TX00 3528 R5 220R 0805 PWM 220R 0805 R4 J1 1 2 3 4 6 5 7 8 9 10 D2 11 12 LL4148 14 MiniMELF 13 15 16 CON16A VCC LC0 PWM R7 220k 0805 C5 1.5nF 1206 C6 N/C 1206 47k 0805 R2 3 NC T L2 TRANSPONDER COIL 1206 JUMPER 1 JP1 U1 SAW 42527 NC4 T 1 2 R3 220R 0805 Q1 BFR92A SOT23 C3 12pF 0805 C2 2.2pF 0805 BT1 6V 47R 0805 C1 470pF 0805 L1 20mm PCB TRACE VCC R1 C4 100nF 0805 VCC Transponder Evaluation Kit User's Guide Figure A.6: HCS410 DIP Socket Long Range RF Transponder 2000 Microchip Technology Inc. Schematic Diagrams 4 Vcc Figure A.7: HCS412 Credit Card Transmitter/Transponder 2 Vcc 270 3 1 2000 Microchip Technology Inc. DS51111B-page 47 DS51111B-page 48 HCS410 SOIC-8 LC1 S2/LED S1 S0 VSS PWM LC0 VDD 5 6 7 8 * NOTE TRANSPONDER COIL FOOTPRINTS FOR A) CUSTOM FAIR RITE / EM2 FERRITE CORE INDUCTOR B) COILCRAFT SURFACE MOUNT 1812LS-105 XKBC INDUCTOR C) DALE IM-4 AXIAL LEAD INDUCTOR 4 3 2 1 U1 N/C 0805 R1 C1 1.5nF 1206 1 2 3 4 C2 N/C 1206 L1 TRANSPONDER COIL * SEE NOTE BELOW C3 2.2uF 0805 Surface mount pads with .1" spacing J1 CON4 Transponder Evaluation Kit User's Guide Figure A.8: HCS410 SOIC Short Range Transponder 2000 Microchip Technology Inc. TRANSPONDER EVALUATION KIT USER'S GUIDE Index A algorithm ................................................... 12, 18 Anti Collision ............................................. 11, 17 B battery .............................................................. 1 C Code Word Blanking ................................ 11, 17 D Damping ................................................... 11, 17 Delayed Increment ................................... 11, 17 E erase .................................................. 10, 16, 23 extended serial number ............................ 11, 17 H High Voltage ................................................. 5, 8 R RESET .............................................................. 5 RF ......................................................... 1, 11, 18 RF Baud Rate ........................................... 12, 18 S S0 ..................................................... 5, 6, 11, 18 S1 ......................................................... 5, 11, 18 S2 ......................................................... 5, 11, 18 Secure learn ................................................... 31 SEED ........................................................ 29, 30 serial number ........................................ 6, 12, 18 serial port .......................................................... 1 Simple learn .................................................... 30 Software Installation ......................................... 1 source ............................................................. 29 stand alone ................................................... 1, 8 I IFF .................................................. 1, 13, 19, 29 IFF2 ................................................................ 30 T transmission ........................................ 5, 6, 9, 30 transmitter ................................................. 5, 6, 9 Transport Code ......................................... 12, 18 K key generation .......................................... 29, 30 U user EEPROM .......................................... 12, 18 L LEARN ............................................... 10, 16, 23 learn ............................................................. 1, 9 Low Voltage Trip Point ................. 11, 14, 17, 21 V VALID TOKEN .............................................. 5, 6 M manufacturer's code ........................... 12, 18, 29 Monitor ............................................................. 8 N Normal learn ................................................... 31 O outputs .............................................................. 5 Overflow ................................................... 11, 18 P PC ................................................................ 2, 8 poll .................................................................... 5 power ................................................................ 1 PWM ................................................................. 5 2000 Microchip Technology Inc. DS51111B-page 49 WORLDWIDE SALES AND SERVICE AMERICAS AMERICAS (continued) Corporate Office Toronto Singapore Microchip Technology Inc. 2355 West Chandler Blvd. Chandler, AZ 85224-6199 Tel: 480-786-7200 Fax: 480-786-7277 Technical Support: 480-786-7627 Web Address: http://www.microchip.com Microchip Technology Inc. 5925 Airport Road, Suite 200 Mississauga, Ontario L4V 1W1, Canada Tel: 905-405-6279 Fax: 905-405-6253 Microchip Technology Singapore Pte Ltd. 200 Middle Road #07-02 Prime Centre Singapore, 188980 Tel: 65-334-8870 Fax: 65-334-8850 Atlanta Microchip Technology, Beijing Unit 915, 6 Chaoyangmen Bei Dajie Dong Erhuan Road, Dongcheng District New China Hong Kong Manhattan Building Beijing, 100027, P.R.C. Tel: 86-10-85282100 Fax: 86-10-85282104 Microchip Technology Inc. 500 Sugar Mill Road, Suite 200B Atlanta, GA 30350 Tel: 770-640-0034 Fax: 770-640-0307 Boston ASIA/PACIFIC China - Beijing ASIA/PACIFIC (continued) Taiwan Microchip Technology Taiwan 10F-1C 207 Tung Hua North Road Taipei, Taiwan Tel: 886-2-2717-7175 Fax: 886-2-2545-0139 EUROPE China - Shanghai Denmark Microchip Technology Unit B701, Far East International Plaza, No. 317, Xianxia Road Shanghai, 200051, P.R.C. Tel: 86-21-6275-5700 Fax: 86-21-6275-5060 Microchip Technology Denmark ApS Regus Business Centre Lautrup hoj 1-3 Ballerup DK-2750 Denmark Tel: 45 4420 9895 Fax: 45 4420 9910 Hong Kong France Microchip Asia Pacific Unit 2101, Tower 2 Metroplaza 223 Hing Fong Road Kwai Fong, N.T., Hong Kong Tel: 852-2-401-1200 Fax: 852-2-401-3431 Arizona Microchip Technology SARL Parc d'Activite du Moulin de Massy 43 Rue du Saule Trapu Batiment A - ler Etage 91300 Massy, France Tel: 33-1-69-53-63-20 Fax: 33-1-69-30-90-79 India Germany Microchip Technology Inc. Two Prestige Place, Suite 150 Miamisburg, OH 45342 Tel: 937-291-1654 Fax: 937-291-9175 Microchip Technology Inc. India Liaison Office No. 6, Legacy, Convent Road Bangalore, 560 025, India Tel: 91-80-229-0061 Fax: 91-80-229-0062 Arizona Microchip Technology GmbH Gustav-Heinemann-Ring 125 D-81739 Munchen, Germany Tel: 49-89-627-144 0 Fax: 49-89-627-144-44 Detroit Japan Microchip Technology Inc. Tri-Atria Office Building 32255 Northwestern Highway, Suite 190 Farmington Hills, MI 48334 Tel: 248-538-2250 Fax: 248-538-2260 Microchip Technology Intl. Inc. Benex S-1 6F 3-18-20, Shinyokohama Kohoku-Ku, Yokohama-shi Kanagawa, 222-0033, Japan Tel: 81-45-471- 6166 Fax: 81-45-471-6122 Arizona Microchip Technology SRL Centro Direzionale Colleoni Palazzo Taurus 1 V. Le Colleoni 1 20041 Agrate Brianza Milan, Italy Tel: 39-039-65791-1 Fax: 39-039-6899883 Microchip Technology Inc. 5 Mount Royal Avenue Marlborough, MA 01752 Tel: 508-480-9990 Fax: 508-480-8575 Chicago Microchip Technology Inc. 333 Pierce Road, Suite 180 Itasca, IL 60143 Tel: 630-285-0071 Fax: 630-285-0075 Dallas Microchip Technology Inc. 4570 Westgrove Drive, Suite 160 Addison, TX 75248 Tel: 972-818-7423 Fax: 972-818-2924 Dayton Los Angeles Microchip Technology Inc. 18201 Von Karman, Suite 1090 Irvine, CA 92612 Tel: 949-263-1888 Fax: 949-263-1338 New York Microchip Technology Inc. 150 Motor Parkway, Suite 202 Hauppauge, NY 11788 Tel: 631-273-5305 Fax: 631-273-5335 Korea Microchip Technology Korea 168-1, Youngbo Bldg. 3 Floor Samsung-Dong, Kangnam-Ku Seoul, Korea Tel: 82-2-554-7200 Fax: 82-2-558-5934 San Jose Microchip Technology Inc. 2107 North First Street, Suite 590 San Jose, CA 95131 Tel: 408-436-7950 Fax: 408-436-7955 All rights reserved. (c) 2000 Microchip Technology Incorporated. Printed in the USA. 3/00 Italy United Kingdom Arizona Microchip Technology Ltd. 505 Eskdale Road Winnersh Triangle Wokingham Berkshire, England RG41 5TU Tel: 44 118 921 5858 Fax: 44-118 921-5835 03/23/00 Microchip received QS-9000 quality system certification for its worldwide headquarters, design and wafer fabrication facilities in Chandler and Tempe, Arizona in July 1999. The Company's quality system processes and procedures are QS-9000 compliant for its PICmicro(R) 8-bit MCUs, KEELOQ(R) code hopping devices, Serial EEPROMs and microperipheral products. In addition, Microchip's quality system for the design and manufacture of development systems is ISO 9001 certified. Printed on recycled paper. Information contained in this publication regarding device applications and the like is intended through suggestion only and may be superseded by updates. It is your responsibility to ensure that your application meets with your specifications. No representation or warranty is given and no liability is assumed by Microchip Technology Incorporated with respect to the accuracy or use of such information, or infringement of patents or other intellectual property rights arising from such use or otherwise. Use of Microchip's products as critical components in life support systems is not authorized except with express written approval by Microchip. No licenses are conveyed, implicitly or otherwise, except as maybe explicitly expressed herein, under any intellectual property rights. The Microchip logo and name are registered trademarks of Microchip Technology Inc. in the U.S.A. and other countries. All rights reserved. All other trademarks mentioned herein are the property of their respective companies. DS51111B-page 50 2000 Microchip Technology Inc.