ee July 1998 FAIRCHILD ee SEMICONDUCTOR HiSeC High Security Rolling Code Generator General Description Features The NM95HS01/02 HiSeC Rolling Code Generator is a small @ High security coding scheme with 248 combinations footprint, monolithic CMOS device designed to provide a com- @ High linear complexity and correlation immunity plete, low-cost, high security solution to the problem of generating B22V to 65V ti encrypted signals for remote keyless entry (RKE) applications. , 0 O.o operation Mi Less than 1 LA standby current The NM95HS01/02 generates a fully encoded bit stream each w Full hronizati bili time one of (up to) 4 switch inputs is activated. The patented ull resynchronization capability coding scheme utilizes 2 48 possible user-programmable coding @ Unique customized algorithm option combinations, and features high linear complexity and correlation @ 13 bytes on-chip non-volatile configuration memory immunity. High security is guaranteed by generating a unique (rolling) code for each transmission, and can be further enhanced by creating customized algorithms for individual customers. With this product, each key can be designed to be both unique and Mf Selection of bit coding and transmission frame formats highly secure. @ RC or XTAL clock options for to 4.1 MHz operation M@ Supports both IR and FF signal transmission lf Space saving narrow body SO8 or SO14 packages The NM95HS0 1/02 supports either an IR or RF signal transmitter, Mf Up to 4 key switch inputs on SO14 package and can be clocked with either an RC clock (NM95HS01) or a . . crystal oscillator (NM95HS02). The device operates over a volt- Applications age range of 2.2V to 6.5V, and offers a low power standby mode ll Remote Keyless Entry (RKE) applications (<1 pA) for battery applications. The product is available in both 8- pin and 14-pin SO packages with 2 or 4 key switch inputs that can be used for customer presets such as seat positions, and vehicle Mi Individualized recognitiontransmission systems operating functions such as car door locking/unlocking. @ Personalized consumer automotive applications Relevant Documents @ Designing and Programming a Complete HiSeC -based RKE System: AN-985 @ Burglar alarms/garage door openers Note: *Patents Pending Functional Block Diagram ae Key Application Decoder ENPRE -}> P ble G ; INIT > reamble Generator Tx Data DATA OUTPUT > >| i i TRANSMIT AND 8-bit Sync Field Reg. ENS . TIMING BLOCK EN24 >| 24-bit Key 10 Reg. > Parity Generator CODE GENERATOR | >| 24/36-bit Buffer Reg. BLOCK A ENBUF DS012302-1 Note: Signals shown are internal logic signals. FIGURE 1. J0}e19U94) 9pogd Hurjjoy Aywindses YyYBIH Oe8SIH ZOSHSG6INN/ LOSHS6INN 1998 Fairchild Semiconductor Corporation 1General Characteristics The NM95HS01/02HiSeC Generator was developed to meet existing standards for rolling code-based security systems. Theft prevention systems typically involve user identification and transmission of information at various distances from the vehicle. These Remote Keyless Entry (RKE) systems are generally imple- mented with IR transmitters for short distances, or RF transmitters for longer distances. RF transmission has become state of the art; however the longer distances involved require a much higher degree of security, since the possibility of signal interception is greatly increased. These applications are ideally served by the NU95HS01/02. This generator is a small footprint, low current solution that supports both IR and RF transmission. The device is available in an 8-pin SO package with 2 key switch inputs, or a 14-pin SO package with 4 key switch inputs. The proprietary coding scheme used generates a rolling code based on 2 48 possible user combinations, and ensures a high level of coding security for any RKE application. The NU95HS01 can be clocked with an RC circuit, while the NU95HSO2 can be clocked with a crystal oscillator. General Device Operation The Functional Block Diagram ( Figure 1) shows the internal elements of the code generating logic and program registers. The NM95HS01/02 HiSeC Generator achieves its high security level by combining the contents of several dynamic data registers in anon-linear manner to generate an encoded output. Data in the registers is comprised of a mixture of user programmable data, factory programmable data, and randomized data. This inherently random and separate data is encrypted by clocking it through a non-linear logic block, and feeding part of the output back to produce a final coded output with a high degree of linear complex- ity and correlation immunity. The NM95HS01/02 incorporates 13 bytes of non-volatile EEPROM memory which can be used to configure the device registers. This memory is accessible to the user, and can be configured to the desired configuration, then write-disabled to prevent tampering. User programmable data includes 24 bits of the code block, a 24- bit key ID register, and an 8-bit sync field register. The 24-bit key ID register can be used to configure a large number of unique keys, each of which will produce a unique encoded output bit stream. The 24 bits in the code generator block are mixed with coded data. The output of this block is then fed into the 24-/36-bit buffer register, where the 40 bits are recombined to produce a 24-or 36- bit output (a user option). The 8-bit sync field register can be configured by the user to provide a pattern to facilitate synchroni- zation between the transmitter and receiver. The details of the code block are available to customers, and exclusive algorithms are available and under contract with Fair- child. Call your local sales office for details. The HiSeC Generator is shipped with a standard algorithm as a standard product, with the configuration shown. Figure 2 shows a general operational block diagram of the NM95HS01/02 HiSeC Generator. The 4 key switch inputs shown use internal pull-up resistors, and are suitable for normally open, single pole input switches connected to ground. The inputs are buffered by debounce logic which repeatedly polls the inputs to determine ifakey switch has been asserted. If any key switch input is seen as low for four continuous 10 ms samples, its associated output is set high, the HiSeC control logic is activated, and a security code is generated and transmitted. The timer block is used to set the key debounce time and the IR or RF clock times. These clock times are used as the time base for the chosen bit coding format. The timer block is also used to generate the interframe pause time, and the timeout delay, ifthese are enabled. These parameters are configured by the user in the 13-byte on-chip EEPROM array. The NM95HS01 version ofthe device uses an RC network toclock the CKI input pin. The CKO/LED pin is not required for clocking, but may be used for a visual indicator LED. If the NM95HS02 crystal oscillator version is used, the device is clocked using both the CKI and CKO pins. If an LED is used with this device, it may be grounded through the RFEN /LED pin. Either the CKO/LED or the RFEN/LED output pins can provide the sink current needed to drive an indicator LED. The RFEN pin is active low during signal transmission, and is used to provide power to the RF circuit only during transmission to increase battery life. The transmit output (TX) pin is a configurable logic level output, andis used to transmit the encoded bit stream. An on-chip power- on reset circuit is used to initialize the device during power-up. J0}e19U94) 9pogd Hurjjoy Aywindses YyYBIH Oe8SIH ZOSHSG6INN/ LOSHS6INNConnection Diagrams 8Pin SO Package (M8) 14-Pin SO Package (M14) and 14-Pin Dual-In-Line Package (N14) Key Voc Di Key GND 14-Pin TSSOP Package (MT14) RFEN/LED TX Key e V6 CKO/LED Ck Keyo | GND DS012302-2 Top View NC NC See Package Number Key3 } TX MO8A (M8) or NOSE (N) Key4 FNC RFEN/LED I NC CKO/LED - LCkI . DS012302-3 Top View See Package Number M14A (M), MTC14 (MT14) N14A (N14) Pin Names Pin Description KEYn Key Input RFEN/LED RF Enable/LED CKO/LED XTAL Clock/LED TX Data Transmit CKI RC Clock Input GND Ground Voc Supply Voltage Ordering Information Commercial Temperature Range (0C to +70C) Order Number NM95HS01M8/NM95HS02M8 NM95HS01N/NM95HSO02N NM95HS01M/NM95HS02M NM95HS01MT14/NM95HS02MT14 NM95HS01N14/NM95HS02N1 4 Extended Temperature Range (-40C to +85C) Order Number NM95HS01 EM8/NM95HS02EM8 NM95HS01EN/NM95HSO02EN NM95HS01EM/NM85HS02EM NM95HS01EN14/NM85HSO02EN14 J0}e19U94) 9pogd Hurjjoy Aywindses YyYBIH Oe8SIH ZOSHSG6INN/ LOSHS6INNOrdering Information (Continued) Vee POWER-ON GND >] RESET cki~| tineR EEPROM BLOCK REGISTERS cko >} (13 BYTES) pt KEY1 ] KEY2 | DEBOUNCE KEY3* CONTROL KEva 2} LOGIC LOGIC >1 DYNAMIC DATA [_ CODE GENERATOR TRANSMIT [> RFEN BLOCK | *Note: Keys 3 and 4 available in 14 pin packages. *Note: Keys 3 and 4 available in 14-pin packages. DS012302-4 FIGURE 2. Operational Block Diagram of the NM95HS01/02 HiSeC Generator General Transmitter Circuit Configurations Figure 3 shows several typical circuit configurations for a HiSeC based RKE system transmitter. Note that all circuits require few external components beyond a battery and transmitter stage. IR and RF bit timing may be optimized through the timer block settings in the EEPROM array, which allows flexibility in selecting the smallest and least expensive clock components in the chosen design range. The first two circuits are examples of RF transmitter applications, with both RC and crystal (XTAL) oscillator clocks; the third circuit is an example of an IR transmitter application. Two circuits are configured for an LED. Note that the LED pin refers to a visual indicator LED, and not the IR LED which might be used in an IR transmitter circuit. The LEDSEL bit in the EEPROM array determines whether the RFEN/LED or CKO/LED pins are dedicated to the LED for a particular circuit configuration. LED pin select options are detailed in Table 1. Design considerations for selecting and optimizing clock compo- nent values are detailed in the Generator Clock Design Param- eters section. J0}e19U94) 9pogd Hurjjoy Aywindses YyYBIH Oe8SIH ZOSHSG6INN/ LOSHS6INNKEY1 KEY2 R CKI Vec 7 KEY: GND Veo IR > KEY2 a stage ck cko LED - Rw DS012302-5 FIGURE 3. Typical Transmitter Circuit Configurations TABLE 1. LED Pin Select Options Clock | LEDSEL |RFEN/LED| CKO/LED Function RG X RFEN LED RF Mode with LED XTAL 0 LED CKO RF Mode w/o LED XTAL 1 RFEN CKO IR mode with LED Either the LED or RFEN outputs of the NM95HS01/02 can be used to indicate device transmission. The LED output is active during a pause, whereas the RFEN output is active during frame transmission. The IR Drive Current is 10 mA so an amplifier stage may be needed. Bit Coding Formats The NM95HS01/02 HiSeC Generator supports eleven-bit coding formats which may be used for IR and RF transmission. Seven-bit formats are available for RF applications, and four are available for IR applications. One-bit format is reserved for future use. Bit coding formats are selected by configuring four bits in the EEPROM array: IRSEL, PRSEL2, PRSEL1 and PRSELO. Table ll shows the possible bit coding options available. Each bit coding format has a distinction which may be advanta- geous for a particular application. RF bit coding format 0 is the simplest bit coding scheme, and data may be easily recovered from a transmission by exclusive OR-ing the data and clock stream. Both RF bit coding formats 0 and 2 have a DC level that is independent of the data. RF format 4, and the IR modes operate with a constant transmis- sion energy per message, and RF coding formats 1, 3, 5 and7 are pulse-width modulated (PWM) formats which are relatively easy to decode. RF coding format 7 has a low duty cycle. J0}e19U94) 9pogd Hurjjoy Aywindses YyYBIH Oe8SIH ZOSHSG6INN/ LOSHS6INNBit Coding Formats (Continued) The IR bit coding formats are modulated versions of RF coding format 4, and are all suitable for IR applications. The duty cycle and number of pulses are variable among these four to allow the user to fine tune the IR circuit power curve. IR bit coding formats all follow the same general pattern. In this mode, a logic 1 is always two periods long, and a O is always three periods long. This may be an important consideration when considering preamble and sync timing. Waveform diagrams for all available RF and IR bit transmission coding formats are shown below. Bit Transmission Coding Formats RF Bit Coding Format 0 (Manchester Code) Bit O Bit 1 RF Clock DS012302-6 RF Bit Coding Format 2 (50% Duty Cycle) Bit O Bit 1 RF Clock DS012302-8 TABLE 2. Transmission Bit Coding Options IRSEL | PRSEL2|PRSEL1 |PRSELO Function 0 0 0 0 RF Bit Coding Format 0 0 0 0 1 RF Bit Coding Format 1 0 0 1 0 RF Bit Coding Format 2 0 0 1 1 RF Bit Coding Format 3 0 1 0 0 RF Bit Coding Format 4 0 1 0 1 RF Bit Coding Format 5 0 1 1 0 Reserved 0 1 1 1 RF Bit Coding Format 7 1 0 0 0 IR Bit Coding Format 1 1 0 0 1 IR Bit Coding Format 2 1 0 1 0 IR Bit Coding Format 3 1 0 1 1 IR Bit Coding Format 4 1 1 x x Reserved RF Bit Coding Format 1 (33%/66% End High) Bit O Bit 1 RF Clock DS012302-7 RF Bit Coding Format 3 (25%/50% Start High) Bit O Bit 1 RF Clock DS012302-9 J0}e19U94) 9pogd Hurjjoy Aywindses YyYBIH Oe8SIH ZOSHSG6INN/ LOSHS6INNBit Transmission Coding Formats (Continued) RF Bit Coding Format 4 (IR Style) RF Bit Coding Format 5 (33%/66% Start High) Bit 0 (3 clocks long) Bit 0 Bit 1 (2 clocks long) Bit 4 ] RF Clock RF Clock | | | | | DS012302-10 DS012302-11 RF Bit Coding Format 7 (Low Duty Cycle 1:16/2:16) Bit Oo] | | Bit 1 | ! | ! ! | RF Clock | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | DS012302-12 IR Bit Coding Format 1 (5 Pulses 33% Duty Cycle) | IR Clock ii ! i i Bit | it | w ULL : | DS012302-13 IR Bit Coding Format 2 (8 Pulses 33% Duty Cycle) IR Clock Bit | ae TILL | | IR Bit Coding Format 3 (5 Pulses 25% Duty Cycle) DS012302-14 | IR Clock i: : : : Bit ! | | | | wf ! DS012302-15 J0}e19U94) 9pogd Hurjjoy Aywindses YyYBIH Oe8SIH ZOSHSG6INN/ LOSHS6INNBit Transmission Coding Formats (Continued) IR Bit Coding Format 4 (8 Pulses 25% Duty Cycle) Programmable Signal Output Polarity The transmit (TX) output pin signal polarity and quiescent state output is controlled by the TxPol bit, which may be configured in EEPROM. If TxPol=0, the TX output pin will be at a logic low when no frame is transmitted, or when a O appears as data in a frame. Conversely, if TxPol = 1, the TX output pin will be at a logic high when no frame is transmitted, or when a 1 appears as dataina frame. This option allows the designer to choose between a configuration where a logic 1 represents power transmission (for example, when an FF stage is activated by driving the base of an NPN transistor), and a configuration where a logic 0 represents power transmission (for example, when an IR LED is connected between VCC and the TX output). Data Frames The NM95HS01/02 HiSeC Generator transmits the encrypted data it generates as data frames. These frames are transmitted through an IR or RF transmitter stage using the bit coding format selected. The NM95HS01/02 transmits two types of data frames: a normal data frame, and a synchronization (sync) frame. The format of each frame is similar, but there are slight differences to suit the purposes of each. Normal data frames are used to transmit encoded data in general operation. Sync frames are used to synchronize (or initialize) the HiSeC to its decoder. Data frames are comprised of a number of different fields. Each field occupies a fixed position in the data frame, and serves a specific purpose. Most data fields are user-configurable to some extent. The user may enable/disable the presence of a field, control its length, or modify its format. The user also has several options available to tailor the data frame transmission format, such as pause time between frames, and time-out time. Options are configured by programming the on-chip EEPROM array. The content and format of each of the fields is discussed below. NORMAL DATA FRAME The NM95HS01/02 HiSeC Generator transmits normal data frames in general operating mode. Frame transmission begins each time a key switch is asserted, and continues as long as the key is held DS012302-16 down. The device has an option to terminate transmitting data frames, and go into halt mode, if a key is held down for more than 80 seconds (if the TIMEOUTEN feature has been enabled). The normal data frame format contains both dynamic code and key application data (in the data field). Since the length of several fields is adjustable, there are several possibilities for the length of the data frame. The shortest possible normal data frame is 29 bits, and the longest possible normal data frame is 92 bits. 24 bits of dynamic code, 4 bits of key application data, and 1 stop bit are always present. The composition of a normal data frame is shown in Figure 4. SYNC FRAME The NM95HS01/02 HiSeC Generator transmits sync frames only in sync mode so that it can synchronize itself with its decoder. This mode occurs only during initialization of the device, or after holding a key down for more than 10 seconds (if the AutoResync feature has been enabled). The sync frame format contains both start code and a fixed 4-bit sync code of 0000. This sync code replaces the key application data in the data field, and is used to confirm HiSeC sync mode to the decoder. Sync mode is built into the generator to allow resynchronization of the device under certain conditions as a convenience to the end user. If the designer wishes to preclude any possible resynchronization, the presence of the sync code allows the decoder to detect any synchronization attempt. Since the length of several fields is adjustable, there are several possibilities for the length of a sync frame. The shortest possible sync frame is 45 bits, and the longest possible sync frame is 96 bits. 40 bits of start code, 4 bits of sync code, and 1 stop bit are always present. The composition of a sync frame is shown in Figure 5. J0}e19U94) 9pogd Hurjjoy Aywindses YyYBIH Oe8SIH ZOSHSG6INN/ LOSHS6INNData Frames (Continued) O/11 bits | O/Bbits | 0/20/24 4bits | 24/36 bits | 0/8 bits 1 bit bits Preamble| Sync Key ID Data |Dynamic) Parity Stop Field Field Field Code Field Bit FIGURE 4. Normal Data Frame Configuration O/11 bits | O/Bbits | 0/20/24 4 bits 40 bits 0/8 bits 1 bit bits Preamble| Sync Key ID | Sync Start Parity Stop Field Field Code Code Field Bit FIGURE 5. Sync Frame Configuration Data Frame Fields Data frames are comprised of a number of data fields. Each field occupies a fixed position in the data frame, and serves a specific purpose. Most data fields are user-configurable by programming the on-chip EEPROM array. The content and format of each field is discussed below, as well as the EEPROM options available. All data frame fields are transmitted Most Significant Bit first. THE PREAMBLE The user has the option of allowing a preamble to be tranmitted as the first frame of either a normal data frame or a sync frame. This option is enabled/disabled by setting the PreamblePresent bit in the EEPROM array. PreamblePresent = 0 means no preamble is transmitted. PreamblePresent = 1 means an 11-bit preamble is transmitted as described below. The purpose of the preamble is to generate a relatively long, clearly recognizable bit pattern to give the decoder a chance to wake up and configure its logic circuits and registers. This allows the receiver to be placed in a standby mode to conserve power for battery applications. The preamble is only transmitted once as the first frame of a data transmission, regardless of how long the key is held down, although the remaining frames of the data transmission (including any inter-frame pauses) will continue to repeat as long as the key remains depressed. The preamble has a fixed format of two bit times at system logic high, then one-bit time at system logic low, then eight zeroes using the user-selected bit coding format. This arrangement is clearly shown in Figure 6for several bit coding formats. If desired, a preamble may be isolated from the frame by eight-bit times at logic low during a frame transmission. This can be achieved by enabling the sync field in NRZ mode with the byte Oh. SYNC FIELD If enabled, the sync field is transmitted in every normal data frame or sync frame to provide a bit timing reference for the rest of the frame. This allows the decoder to determine the proper bit coding format the generator is using, and to synchronize to it. The sync field option is set with the SyncPresent bit in the EEPROM array. If SyncPresent = 0, no sync field is sent. If SyncPresent = 1 an 8-bit sync field is included in the data transmission. This 8-bit field is transmitted Most Significant Bit first. The sync field data is programmable, and can be encoded with any user-selected bit coding format, or with an NRZ (unencoded binary) bit format. The option to select between a user bit coding formatand NRZ formatis set by configuring the SyncType bitin the EEPROM array. If SyncType =0, sync field data is sent according to the user-selected IR or RF bit coding format. If SyncType = 1, the information is sentin NRZ format with the bit length determined by the chosen IR or RF bit coding format. For NRZ bit coding, both high and low bit times are the same as the IR or RF bit coding time. For bit coding modes where the 1s and Os have different bit lengths all IR modes for example the length of the NRZ 1 and O bits have correspondingly different bit lengths. RF bit coding format 7 is a special case. As in the other formats, if SyncType = 0, information is sent according to the user-set IR or RF bit coding format. However, if SyncType = 1, a O is sent using the bit coding determined by the IR or RF coding format, and a 1 is sent as an NRZ zero. This is to maintain the spirit of the low duty cycle arrangement for RF format 7. Figure 7 shows sync field examples for several bit coding formats. J0}e19U94) 9pogd Hurjjoy Aywindses YyYBIH Oe8SIH ZOSHSG6INN/ LOSHS6INNData Frame Fields (Continued) me UYU H H L 0 0 0 0 0 0 0 0 mes LULU H H L 0 0 0 0 0 0 0 0 RF Format 7 DS012302-17 FIGURE 6. Preamble Format Examples 0 0 0 0 0 0 1 1 RF Format 5 ] | | | | | Sync Type = 0 LI 0 0 0 0 0 0 1 1 RF Format 5 | Sync Type = 1 0 0 0 0 0 1 1 PF Format 0 Sync Type = 0 0 0 0 0 0 1 1 PF Format 0 Sync Type = 1 0 0 0 0 0 0 1 1 RF Format 7 Sync Type = 1 | | | | | | | | DS012302-18 FIGURE 7. Sync Field Examples for Data Byte 03h KEY ID FIELD The key ID field is another user option. Both its presence and the length of its field can be configured in EEPROM. If FixPresent = 0, no key ID field will be transmitted with the frame. If FixPresent = 1, a 24-bit field will be transmitted. The contents of the key ID field are programmable by the user. Its purposeis to provide a unique identification code for each user key to allow a decoder to identify a particular key in applications where a decoder may be configured for multiple keys. Since the key ID register allows 24 bits, there are 2 24 possible key combinations. Each user key will be unique, and take full advantage of the HiSeC Generators high security coding scheme. The field size is selected with the FixSize bit. If FixSize = 1, the 24- bit fieldis selected. If FixSize = 0, the 20-bit field is selected. Since a full 24 bits are allowed in the Key ID register, the NU95HS01/02 will transmit the most significant 20 bits if FixSize = 0. The field is transmitted in the user-selected bit coding format. DATA FIELD The data field is transmitted with every frame. Ithas several uses, which are discussed here. The primary use of the data field is to indicate which key switch has been pressed. Since each key switch input can be associated with a particular application, the decoder can determine which function to initiate. The data field is 4 bits long, and each key switch input is associated with a particular bit in the field. If any key switch is pressed, its corresponding bit in the data field will be seen asa 1. Any key switch not pressed is seen as a default O. Key bits are transmitted in the order: K1, K2, K3, K4. The sync code fieldin the sync frame is a special case of the data field, and is found in the same position in the data frame. In any sync frame, the sync code is always 0000, so the decoder can always distinguish between a normal data frame and a sync frame. Since each bit represents a key, and a data frame is initiated as a result of pressing a key, it is not possible to have all zeroes in a normal data frame. 10 J0}e19U94) 9pogd Hurjjoy Aywindses YyYBIH Oe8SIH ZOSHSG6INN/ LOSHS6INNData Frame Fields (Continued) The data field can also serve as a low battery indicator. This is an option which can be enabled by setting the CompareEnable bit. If CompareEnable = 1, and the NU95HS01/02 detects a low battery level, the device will signal that fact by alternating between transmitting normal data frames with the correct key usage information, and transmitting normal data frames with a data field of 1111. Inthe first data frame, the data field will represent the true state of the four key inputs. In the next frame, this field will be all ones. This sequence will be repeated as long as frames are being transmitted. For sync frames, this field will not alternate, and the data will remain 0000 regardless of the battery level. Setting CompareEnable = 0 disables the low battery detect option. DYNAMIC CODE FIELD The dynamic code field is transmitted with every frame, and its length is programmable. If DynSize = 0, a 24-bit field is sent; if DynSize = 1,a 36-bit fieldis sent. Its function is to provide asecure dynamic code which changes with each new transmission. The field is the result of combining the 11-, 13-, and 16-bit CRC registers using non-linear logic and feedback. The result of this process is stored in the 24-/36-bit buffer register. If DynSize = 0, 24 of the possible 36 bits are transmitted in the field. Increasing the field length provides additional security. The start code fieldin a sync frame is a special case of the dynamic code field. In sync mode, 40 bits of data are sent regardless of the setting of the DynSize bit. PARITY FIELD The parity field is an 8-bit field that is ttansmitted with every frame to ensure dataintegrity. Itis a user option that is enabled by setting ParityPresent = 1. The parity check is a bytewise exclusive OR-ing of all the bytes in the data frame from the sync field to the dynamic code field. The preamble, parity field and stop bit are not included. In practice, the parity process works as follows: bit m of the 8-bit parity field is a modulo 2 addition of the data frame bits m, m+8, m+16, ... to the end of the frame. If the addition of the 1s in these bits is odd, bit m of the parity field is set to 1. If the addition is even, bit m is set to O. This process is continued for all 8 parity bits. If the frame is not byte aligned, the parity field is calculated by zero extending the last four bits, calculating the bytewise exclusive OR- ing of all the bytes as described above, then swapping the higher and lower nibbles to give the correct parity. STOP BIT The stop bit is present in all frames. Itis used to delimit the end of the frame for bit formats that require a definite end. Itis necessary for formats that end with along zero pulse. |Rmodes require astop bit to distinguish between a 0 and a 1 in the next-to-last bit of a frame. The stop bit is read as a 1, and is added for all modes. DATA FRAME SEQUENCING AND TRANSMISSION The NM95HS01/02 becomes operational any time akeyis pressed. When this happens, the code generator logic is clocked to randomize the data and generate a new rolling code. Once the code is generated, data frames using this new code are repeat- edly transmitted over the TX output pin as long as the key remains pressed. These data frames are separated by a pause whose length is programmable. The transmission sequence is always begun by a preamble if this option is enabled. The preamble is only transmitted once, since its function is to wake the decoder from sleep mode if it is powered down for battery conservation. The preamble is then followed by a data frame, pause, data frame, pause, ... etc. TRANSMISSION INDICATION Both the LED and RFEN signals can be used to indicate HiSeC rolling code transmission. The LED output is active low during the transmission of a pause, whereas the RFEN output is active low during transmission of either a frame or apause. Either output may be used to provide a visual indication of transmission by connect- ing an LED between Vcc and LED or RFEN . If the low battery detect option is enabled, and the battery is low, the LED output is active only during the pause following the first frame of a new code transmission. It is not active on successive pauses, in order to conserve power. Operational Timing Issues DATA FRAME PAUSE LENGTH After the complete transmission of a data frame, a pause is inserted before the next data frame is transmitted. The pause length can be modifed by configuring the 2-bit PauseLength parameter in EEPROM. PauseLength is broken down into two single bit parameters, Pause1 and PauseO. Available configura- tion options are shown in Table 3. TABLE 3. Pause Length Select Options PAUSE1 PAUSEO Function |Pause Time 0 0 0 x P3 Output | No Pause 0 1 8 x P3 Output 20 ms 1 0 20 x P3 Output 50 ms 1 1 50 x P3 Output 100 ms HiSeC GENERATOR TIME-OUT If the NM95HS01/02 time-out option is enabled (TIMEOQUTEN = 1), the device will enter halt mode 80 seconds after a key is first activated, regardless of whether the key is still being pressed. This option guards against the condition that a key may be stuck low, which could drain the battery. If TIMEOUTEN = 0, the generator will continue to transmit data frames as long as a key is pressed. HiSeC GENERATOR TIMER BLOCK Bit timing and several function operating times are set in the generator through a user programmable timer block. This timer blockis used to provide IR and FF bit timing signals, the interframe pause time, the AutoResync timing period, and the time-out delay. The NM95HS01/02 timer block consists of three programmable 6- bit prescalers anda fixed 16-bit prescaler. The input to Prescaler1 is 1/4 of the frequency of CKI. The output is the IR clock. This signal becomes the inputto Prescaler2. The output from Prescaler2 is the RF clock. This signal then becomes the input to Prescaler3. The output from Prescaler3 is a target value of 2.5 ms. Finally. this 2.5 ms timing signal becomes the inputto the fixed 16-bit prescaler. 11 J0}e19U94) 9pogd Hurjjoy Aywindses YyYBIH Oe8SIH ZOSHSG6INN/ LOSHS6INNOperational Timing Issues (Continued) There are several outputs from this prescaler. The 2.5 ms is divided by 4, 4096 and 32768, and these times are used to set the key debounce time (10 ms), the AutoResync time (>10 sec), and the generator time-out period (>80 sec), respectively. The NM95HS01/02 timer block is shown in Figure 8. The purpose of the prescalers is to provide various timing signals to the state machines in the generator. The IR clock is used as a time base for the various IR bit coding formats. The RF clock is used for RF bit coding formats. A programmable bit called SCLK determines whether the IR clock (SCLK=0) or the RF clock (SCLK 6 bit 6 bit = 1) is used as the bit timing time base. In addition to SCLK, the system designer can program Prescaler1, Prescaler2 and Prescaler3 separately to set the necessary division factors. Since each of these prescalers is 6 bits, permissible values range from 2 to 64. The system designer must set the programmable prescalers to meet the necessary timing requirements for all the functions discussed above. All of these timings are interdependent. Figure 9 provides the basis for an example in calculating the necessary timing for these functions, and setting the timer block appropriately. 6 bit foxi Prescaler2 Fixed Output -+ | Prescaler 1 4 y IR Clock J Prescaler 3} > 25ms RF Clock DS012302-19 FIGURE 8. The NM95HS01/02 Timer Block no Bit Time > | <4 =1ms Bit 1 RF Clock DS012302-20 FIGURE 9. NM95HS01/02 Timer Block Example As an example, consider the following situation. A designer wishes to design an RF data transmitter using RF bit coding format 5 with a bit time of 1 ms. The designer also wishes to use a 3 MHz crystal oscillator as the system clock. The required bit time of 1 ms encompasses three RF clock periods for RF bit coding format 5. Therefore, the RF clock time needs to be 1 of 1 ms (=333 ps). The timer block has a target value of 2.5 ms (2500 ps) as the output of Prescaler3. Since the RF clock signal is divided by Prescaler3, Prescaler3 divides the signal by 2500/333 = 7.5. This figure is rounded off to become 8. One point of possible confusion should be clarified here. When- ever a division value is calculated for any of the 3 prescalers, the prescaler should be configured with one unit less than that division value. For example, in this case, we calculated a division value of 8 (after rounding) for Prescaler3. Therefore, Prescaler3 should be programmed with 8 - 1=7. Next we calculate values for Prescaler1 and Prescaler2. Although the crystal oscillator uses both the CKI and CKO pins, only the CKI input is relevant here. The CKI input frequency is 3 MHz, and 1/4 of that is 0.75 MHz. This is the input frequency to the HiSeC timer block, and the corresponding timing signal is 1.33 ps. Since the RF clock must be 333 ts, Prescalers1 and 2 together must divide by 333/1.33 = 250. A convenient choice would be to make Prescaler1 divide by 10 and Prescaler2 divide by 25. Therefore, load Prescaler1 with 10 - 1 =9, and Prescaler2 with 25 -1=24. DEBOUNCE LOGIC The key switch input signals are connected to the debounce logic block, which continuously polls the inputs to determine if a key switch has been asserted. If a key switch has been asserted, its normally high input will be seen as a low. If the input is seen low for four continuous debounce strobe signals, itis considered to be a stable signal, and its associated output from the debounce logic block is set high. This enables the generator control logic, anda code is generated and transmitted. This debounced output signal is deasserted as soon as the key is released and its signal goes high again. This assumes normal operation. However, ifa key remained pressed for along time, the generator might time-out before seeing the signal go high again (if TIMEOUTEN = 1). The generator would then enter halt mode even if the key remained pressed. The generator would come out of halt mode when it saw the falling edge of another key input, which would occur when another key is pressed. LOW BATTERY DETECT OPTION The NM95HS01/02 contains an internal comparator circuit that detects low battery voltage, and indicates this condition to the data frame generator. The CompareEnable parameter in EEPROM enables this function (CompareEnable = 1). During halt mode, the comparator is switched off completely to minimize power con- sumption. The BatteryType parameter in EEPROM selects the threshold voltage range for the comparator. If BatteryType = 1, the comparator assumes a 6V battery, and sets the low battery detect region to approxi- 12 J0}e19U94) 9pogd Hurjjoy Aywindses YyYBIH Oe8SIH ZOSHSG6INN/ LOSHS6INNOperational Timing Issues (Continued) mately 4.4V to 4.8V. If BatteryType = 0, the comparator assumes a 3V battery, and sets the low battery detect region to approxi- mately 2.2V to 2.4V. Data output signals are sampled for low voltage at the start of the data field during frame transmission. If a low battery voltage level is detected, and the detect option is enabled, the LED will signal the condition by flashing at the first pause in the data frame transmission, and alternating normal data field data with a data field containing all ones. This procedure is explained more fully in the Data Field section. Security Aspects The basis of the HiSeC Generator is to provide a means of communicating information between the device and its decoder across some distance. Since data is transmitted at a distance, there is a possibility of signal interception and unauthorized use of the data by a third party. The NU95HS01/02 has been designed to provide such a high level of complexity and correlation immunity that intercepting the signal is immaterial. INITIALIZATION/SYNCHRONIZATION Initialization is the process of synchronizing the generator with its decoder for the first time. The NM95HS01/02 uses the following procedure to initialize the device. The user inserts anew battery into the HiSeC-based device, which causes the LED to light. The LED also has a secondary function for synchronization and initialization procedures. It will light to prompt the end user that it expects some action, and therefore serves as a guide. When the LED lights, the user presses a key. The LED will go off as the generator begins randomizing its registers, and configuring its internal logic. When the user releases the key, the LED will light a second time. This is a signal for the user to press a key again. This second action shifts the generator into sync mode. This causes the NM95HS01/02 to transmit at least four sync frames, allowing the decoder to synchronize to the generator. The genera- tor then exits sync mode, and is ready tor normal operation. RESYNCHRONIZATION If synchronization is lost between the generator and its decoder, resynchronization is accomplished using a sync frame. A sync frame is generated in two cases: when the battery is removed and replaced, or the user initiates an initialization procedure by holding Key Switch 1 and Key Switch 2 simultaneously for 5 seconds. A sync frame provides the decoder with enough information to learn the key and synchronize to it. For the highest possible security protection, resynchronization can be completely excluded by configuring the decoder to recog- nize, and refuse to act upon, the transmission of async frame. The sync frame format is discussed more fully elsewhere, but briefly, it can be recognized by the presence of all zeroes in the data field. In this case, if synchronization is lost between the generator and decoder, they could not be made to function together. Security Aspects NORMAL OPERATION Once the NM95HS01/02 has been initialized, the device will generate and transmit a new code each time a key is pressed. If a key is held down, the same frame (plus any pauses between frames) is transmitted repeatedly. Ifthe key is held down for longer than 80 seconds, the generator will go into halt mode to conserve battery power, and will stop transmitting data frames (if the TIMEOUTEN option is enabled). Another option available during normal generator operation is the ability to generate a resync after a key has been pressed for more than 10 seconds (ifthe AutoResync option is enabled). This option allows the end user to resynchronize the generator if necessary, without having to remove and replace the battery. FORWARD CALCULATION AND CODE WIN- DOWS Aside from using a sync frame, there is another way to ensure the NM95HS01/02 remains in sync with its decoder during normal operation. The decoder can perform a forward calculation to predict what the next generator codes will be. This is an important point, and should be considered carefully in designing the decod- ing system. Inawell-designed system, the decoder should be able to calculate forward for some reasonable number of codes, and store the results for future reference. This allows the decoder to remain in sync even if it misses one or more codes from the generator. This could occur if the receiver did not receive a transmission clearly, or if someone activated the keys outside the range of the receiver. Increasing the depth of this code window would allow the decoder to miss a greater number of codes from the generator, and still remain in sync. One method for implementing a code window is to include aMICROWIRE EEPROM (such as the NM93Cx6) in the decoder design, and store the codes in memory. This becomes even more important if the decoder is designed to accomodate several HiSeC generator devices. In this case, the decoder should have a code window available for each device. Generator Clock Design Parameters Table 4, Table 5, and Table 6 provide a basis for selecting componentvalues for both the RC clocked generator (NM95HS01) andthe crystal (XTAL) oscillator clocked generator (NM95HS02). The component values shown in the tables have been chosen for low cost, general availability, and reliable operation. Components are referenced to the circuit schematics shown in Figure 3. Though there is some flexibility in selecting alternate values, there are constraints on permissible component values. All resistors and capacitors should be kept within the following ranges; 3 kQ < R, < 200 kQ and 50 pF < C, < 200 pF. TABLE 4. RC Clock Components, TA = 25C, Voc = 5V-6.5V R (kQ) C (pF) CKI (MHz) CKI (ns) 3.3 82 2.12-2.32 470-430 5.6 100 1.11.17 870-850 13 J0}e19U94) 9pogd Hurjjoy Aywindses YyYBIH Oe8SIH ZOSHSG6INN/ LOSHS6INNGenerator Clock Design Parameters (Continued) TABLE 5. RC Clock Components, TA = 25C, Voc = 2.5V TABLE 4. RC Clock Components, R (kQ) C (pF) CKI (MHz) CKI (ns) TA = 25C, Voc = 5V-6.5V (Continued) 3.3 82 1.53-1.6 650-600 R (kQ) C (pF) CKI (MHz) CKI (ns) 5.6 100 0.9-1 1100-1000 6.8 100 0.9-0.95 1100-1050 6.8 100 0.8-0.83 1250-1200 TABLE 6. XTAL Clock Components, TA = 25C, Voc = 2.5V-6.5V R1 (MQ) C1 (pF) C2 (pF) | CKI (MHz) | CKI (ns) 1 30 30-36 4 250 TABLE 7. NM95HS01/02 EEPROM Array Configuration and Definitions Parameter Bits Address Function AutoResync 1 Byte 0, bit 7 Allows user to send a sync frame by holding a key down for >10 seconds LEDSEL 1 Byte 0, bit 6 Determines whether RFEN/LED or CKO/LED is the LED connect pin for the NM95HS02 BatteryType 1 Byte 0, bit 5 Selects between 3V and 6V battery voltage TIMEOUTEN 1 Byte 0, bit 4 Disables data transmission if key is depressed >80 seconds Pause Length 2 Byte 0, bits 3-2 Sets the pause time between data frames during data transmission (Pause0/Pause1) (0/20/50/100) ms FactoryDisableBit 1 Byte 0, bit 1 Disables ability to write to Byte 12 WriteDisableBit 1 Byte 0, bit 0 Enables/disables ability to write into EEPROM array PreamblePresent 1 Byte 1, bit 7 Enables/disables presence of preamble field SyncType 1 Byte 1, bit 6 Determines if sync field is sent in user-selected IR/RF format or default NRZ format SyncPresent 1 Byte 1, bit 5 Enables/disables presence of sync field FixSize 1 Byte 1, bit 4 Determines length of Key ID field (0/20/24 bits) FixPresent 1 Byte 1, bit 3 Enables/disables presence of Key ID field DynSize 1 Byte 1, bit 2 Determines length of Dynamic Code field (24/36 bits) ParityPresent 1 Byte 1, bit 1 Enables/disables presence of parity field CompareEnable 1 Byte 1, bit 0 Enables/disables low battery detect option BitTransmitFormat Selects among the 12 possible IR/RF bit coding formats IRSel 1 Byte 2, bit 7 Selects between IR and FF bit coding formats PRSel2,1,0 3 Byte 2, bits 6-4 Used with IRSel to select particular bit coding format TxPol 1 Byte 2, bit 3 Sets the quiescent output state and data logic level on the TX output pin SCLK 1 Byte 2, bit 2 Determines whether the IR clock or RF clock is used as the bit timing time base Prescaler3 6 Byte 2, bits 1-0 Sets interframe delay time and key debounce time (Also generates Byte 3, bits 7-4 timeout delay time) Prescaler2 6 Byte 3, bits 3-0 Sets RF Clock timing Byte 4, bits 7-6 Prescaler1 6 Byte 4, bits 5-0 Sets IR Clock timing DynamicCode 24 Bytes 5-7 Sets initial configuration of the Rolling Code registers KeylDCode 24 Bytes 8-10 Sets user-configurable key identification register SyncFieldCode 8 Byte 11 Sets configuration of sync field register Reserved 8 Byte 12 Reserved for factory use unique customized algorithm option Note: The first bit clocked into the device is Byte 0, bit 7. The seventh and eight bits are the chip disable bits. Once they are set, and Veg is removed, the chip will be disabled. 14 J0}e19U94) 9pogd Hurjjoy Aywindses YyYBIH Oe8SIH ZOSHSG6INN/ LOSHS6INNAbsolute Maximum Ratings (Note 1) Ambient Storage Temperature -65C to +150C Input or Output Voltages with Respect to Ground All except K1 or K2 K1 or K2 -0.5V to +7V -0.5V to +13V Lead Temperature (Soldering, 10 sec.) ESD Rating Ambient Operating Temperature NM95HS01/NM95HS02 NM95HS01E/NM95HS02E Power Supply (Voc) Range +300C 2000V 0C to +70C -40C to +85C 2.2V to 6.5V NM95HS01/02 DC and AC Electrical Characteristics 2.2v