ATAK51004-V2 User's Guide

Transcription

1 User's Guide ATAK51004-V2 Features Full Car Access System Capability Multichannel RF Remote Keyless Entry (RKE) LF Passive Entry/Passive Start (PEPS) Vehicle Immobilization (IMM) Open System Software: PEPS protocol with a high-precision 3D localization using AES-128 RKE RF rolling code using AES-128 AOIP ( open immobilizer protocol) immobilizer stack using AES-128 Scalable and configurable PC graphical user interface (GUI) for system visualization and viewing data communication Body Computer Emulation Using ATmega2560 On the Main ATAB0001A CARS Interface Board Kit Contents Vehicle-Side PCBs: 1x ATAB0001A CARS interface board 1x ATAB5291B 6-channel LF coil driver PCB with built-in immobilizer base station (ATA5291) 1x ATAB0003A RF receiver application board (ATA5782) Fob and Transponder: 1x ATAB5702A RF transmitter with 3D LF PEPS and 3D LF immobilizer transponder application board (ATA5702) Other Accessories: 1x UHF SMA whip Antenna 1x ATAB-LFTX LCR PEPS antenna board (can be configured for pure L needed for Immobilizer) 1x USB cable 1x 120/240VAC to 12VDC wall transformer Quick start user guide Note: CR2032 lithium batteries required for the fob operation are not supplied in the kit Microchip Technology Inc. User Guide DS A-page 1

2 Table of Contents Features... 1 Kit Contents Introduction Immobilizer Support RKE Support PEPS Support Kit System Setup Hardware PC Application Software System Operation Immobilizer Operation Remote Keyless Entry (RKE) Operation PEPS Operation Programming Instructions Programming the ATmega2560 on ATAB0001A Interface Board Programming the ATA5702 on the ATAB5702A PEPS Fob Board Programming the ATA5782 on the ATAB0003A RF Receiver Board Installing Virtual COM Port USB Driver Setup for Windows Errata (Version3_Rev3 Software Version) Revision History Object of Declaration The Microchip Web Site Customer Change Notification Service...46 Customer Support Microchip Devices Code Protection Feature Legal Notice...47 Trademarks Quality Management System Certified by DNV...48 Worldwide Sales and Service Microchip Technology Inc. User Guide DS A-page 2

3 1. Introduction This document provides set up and usage instructions for the Car Access Reference System (CARS) featuring remote keyless entry, passive entry/passive start, and vehicle immobilization functionality based on the Microchip Technology Inc. GEN2 communication protocols. It offers a complete car access system allowing the comprehensive family of car access products offered by Microchip Technology Inc. to be evaluated. The reference designs utilized are both scalable and configurable, through either the PC application or source code modifications, enabling adaptation of the basic hardware and software building blocks to meet the most recent requirements for specialized systems. Figure 1-1. System Block Diagram 1.1 Immobilizer Support The immobilizer is considered the system foundation because it must always work, even if the fob battery is dead, and secures a vehicle against unauthorized engine starts. It consists of a base station placed in the vehicle, which provides the LF (125 khz) magnetic field enabling a wireless link with the transponder in the fob to be established. This LF immobilizer link is used to exchange power supply and digital data between the vehicle and the passive transponder. The implemented immobilizer system supports Microchip Technology Inc. Open Immobilizer Protocol (AOIP), which consists of an open/unlicensed protocol stack based on AES-128 encryption. First, the ReadUID command is sent to the fob. The fob has to decode the ReadUID command and respond with its UID value. If the received UID value is correct (matches the stored UID), the start authentication command is issued and challenge data is sent to the fob based on the authentication type (unilateral or bilateral). The fob receives the challenge, performs the encryption and sends a ciphered response back. This response is received by the base station and verified to complete the authentication process. Please request ATAN0088 documentation for more information about the AOIP protocol Microchip Technology Inc. User Guide DS A-page 3

4 1.2 RKE Support Remote Keyless Entry (RKE) functionality provides the means to lock/ unlock and even start the vehicle from a long distance with a fob carried by the user. The system consists of an RF receiver in the vehicle and an RF transmitter in the fob. Unlike Immobilizer operation, RKE operation requires a battery (CR2032 or equivalent) be inserted in the fob. The implemented RKE system supports Microchip messaging protocol (AVR411), which consists of a unidirectional UHF link that is secured based on an AES-128 rolling code algorithm. The message contains information that is used to verify the identity, authenticity of the user, and the intended action (command code). For more information about the RKE protocol, reference the Microchip AVR411 application note found at PEPS Support Also included in the kit is Passive Entry/Passive Start (PEPS) functionality, which provides a user the added convenience of being able to lock/unlock and start a vehicle just by having the electronic fob with them without the need to actively interact with it. It consists of a LF driver placed in the vehicle, which generates a strong magnetic field on multiple (optional) LF PEPS antennas. The passive fob implemented in the PEPS system is capable of waking up on this LF field and receiving the incoming data via the unidirectional LF link. The fob also measures the strength of the magnetic field which is used to determine the position of the fob relative to the vehicle (outside or inside). It then encrypts the received challenge data (using AES) and returns the correct cipher response, together with the positioning information, to the vehicle via the unidirectional UHF link. See ATAN0073 documentation for more information about the PEPS protocol Microchip Technology Inc. User Guide DS A-page 4

5 2. Kit System Setup 2.1 Hardware ATAK51004-V2 kit hardware needs to be assembled before initial use. Follow the steps below to assemble the LF PCB, the RF receiver PCB and ATAB0001A interface board: 1. Remove the ATAB0001A interface board from the packaging and verify the jumper J13 on the ATAB0001A interface board is set to position LF_DR - +12V as noted in Figure Insert the ATAB5291B LF driver/immobilizer base station in the LF_X1 and LF_X2 sockets on the ATAB0001A interface board as shown in Figure Connect the LF antenna module: 3.1. Connect the ATAB-LFTX LCR PEPS antenna module to J1 connector on ATAB5291B PCB Ensure the J1 jumper on the antenna module is set to the inductor ONLY ( ) option. Note: For use of the antenna on the J2 J8 connectors, ensure the jumper on the antenna module is set to LCR. 4. Insert the ATAB0003A RF receiver adapter board in the UHF_X1 and UHF_X2 sockets on the ATAB0001A interface board. 5. Connect the RF antenna to the ATAB0003A RF receiver adapter board at the X4 SMA connector. 6. Connect 12VDC power supply to the J11 power socket on the ATAB5291B board. Note: J11 powers the ATAB0001A interface board and ATAB0003A RF Receiver Adapter Board. Do not connect a power supply to J14 power socket on the ATAB0001A board. All the hardware PCB modules come with the correct preprogrammed software configuration. Once the kit is assembled and the power connected, the correct power-up status of the kit is indicated by the LED0 - LED7 LEDs immediately blinking Microchip Technology Inc. User Guide DS A-page 5

6 Figure 2-1. CARS Hardware Connections RF Antenna LF PEPS Antenna (ATAB-LFTX- V4.0) J1 set to inductor only ATAB0003A (RF PCB) ATAB5291B (LF PCB) ATmega2560 JTAG Header ATmega2560 ISP Header Place jumper in LF_DR +12V position on J13 header 32UC3B1256 JTAG Header USB Connector 2017 Microchip Technology Inc. User Guide DS A-page 6

7 Figure 2-2. ATAK51004-V2 Complete Assembly 2.2 PC Application Software The system software consists of a PC GUI interface, which runs on a host PC and communicates with the ATAB0001A interface board via the virtual COM port. The USB cable is connected to the PC and mini- USB port on the ATAB0001A interface board. There must be a USB driver (Windows 7 and later) installed to support a virtual COM port via a USB connection (see Section 5. Installing Virtual COM Port ). The USB virtual COM port firmware is on the AT32UC3B1256 located on the ATAB0001A interface board. This firmware is preprogrammed and does not need to be updated. 1. Locate and execute the CARS_PC_Application.exe file on your host PC. 2. Configure the COM settings: 2.1. Use the pull-down menu (COM>PORTs) to configure the COM port (see Section 5. Installing Virtual COM Port below in order to determine the COM port used) Use the pull-down menu (COM>BAUD Rate) to configure the baud rate to as shown in Figure Microchip Technology Inc. User Guide DS A-page 7

8 Figure 2-3. COM Port and Baud Rate Selection Note: Use the pull-down menu (Help>About) to display the GUI Software revision. 3. Open the virtual COM port (click on the COMxx: text in the bottom right hand side of the window). 4. Use the pull-down menu (View>System Config) to open the System Configuration window as shown in Figure Microchip Technology Inc. User Guide DS A-page 8

9 Figure 2-4. System Configuration Window Click here to load the System Software Version (Step 5). Fob s UID is displayed when one is learned. If not, follow the learning procedure (Step 6). 5. Click on the clockwise arrow button to update the system firmware version and other variables. The system software version loads correctly, as shown above, if the connection is valid (COM port is open). 6. The actual UID of the fob must be learned by the base station and the secret keys must be transferred to the fob in order for the system to function properly. Note: The fob included with the kit comes pre-learned and its UID will be displayed under Learned Fobs section of the System Configuration window, as shown in Figure 2-4. If not, then proceed with the following Place the fob in close proximity (<10 cm) to the base station immobilizer coil as shown in Figure 2-5. Figure 2-5. Fob Placement 6.2. Click the Learn button in the System Configuration window or press the SW4 (LF) push button switch on the ATAB0001A interface board The successful completion of the learn cycle is indicated by the LED5 blinking once followed by the location of the stored fob (LED0 LED3) being illuminated. The fob UID is 2017 Microchip Technology Inc. User Guide DS A-page 9

10 also displayed in the Learned Fobs section of the System Configuration window, as shown in Figure 2-4. Note: If the fob is unsuccessful in being learned, repeat step 6.2 a couple of times. If still unsuccessful, try moving the fob position slightly on the coil and repeat step 6.2. Note: Once the system has learned the fob, its UID value is stored in the ATmega2560 EEPROM. Do not press the SW3 (Clear) push button switch on the ATAB0001A interface board. Doing so erases all stored UID values. Without this stored value, the system cannot authenticate the fob Microchip Technology Inc. User Guide DS A-page 10

11 3. System Operation The system includes the following features: Immobilizer functionality: Supports AOIP Support for AES-128 encryption Passive fob authentication supporting unidirectional authentication (UA) Support for base station to transponder key learn sequence used during the pairing process Support for several utility immobilizer commands (such as communication or transponder data management) RKE functionality: Support for unidirectional AES-based rolling code protocol Use of multi-channel UHF messaging provides robustness against the effects of multipath or in-band interference PEPS wake-up functions: Selectable LF driver coil Selectable LF driver current (ICOIL = 50 ma to 1000 ma) LF driver polling support Configurable preamble and header settings for LF wake-up via source code updates Unidirectional UHF data return channel included 3.1 Immobilizer Operation The immobilizer functionality is tested using the base station hardware (ATAB0001A/ATAB5291B) and the fob PCB. The UID, challenge, response and the result of this authentication are displayed in the immobilizer status window of the PC application each time the authentication command is executed. The immobilizer can be tested using the PC GUI running on the host PC as follows: 1. If not done so already, follow procedure detailed in Section 2.2 PC Application Software. 2. Use the pull down menu (View>Immobilizer) to open the Immobilizer Status window as shown in Figure 3 1. Figure 3-1. Immobilizer Status Window The immobilizer status window contains the following data fields, see Figure 3 1: Immobilizer UID : Displays unique ID value received from the fob Immobilizer Challenge : Displays the most current challenge data sent to the fob Immobilizer Response : Displays the most current response data received from the fob Immobilizer Result : Displays the authentication status 2017 Microchip Technology Inc. User Guide DS A-page 11

12 3. Place the fob across the LF antenna module within a short distance (<10 cm). 4. Click the Read UID button in the Immobilizer Status window to execute the ReadUID command. The ReadUID command is sent to the fob. The fob responds by sending its UID. Note: This works even for fobs not learned by the system. 5. Click the Start Authentication button in the Immobilizer Status window or press the SW1 (IMMO) push button switch on the ATAB0001A interface board to execute fob authentication. The green shield indicates the immobilizer status upon successful execution of the start authentication command. Note: Since the challenge is a random number, the challenge and the response values are different each time a new authentication sequence is executed. The UID value is fixed every time. 6. To test passive operation, remove the battery from the fob and repeat steps 4 and Remote Keyless Entry (RKE) Operation The RKE functionality is tested using the base station hardware (ATAB0001A/ATAB0003A) and the fob PCB RF Learn Mode Before RKE system functionality can be exercised, the RF transmitter must be paired with the vehicle. This process involves placing the vehicle's receiver into a mode that allows it to learn the secret key contained in the fob. Note: The RKE secret key is also learned during the LF learn mode described in Section 2.2 PC Application Software. This means the LF learn mode takes priority over the RF learn mode. If the fob has already been learned using LF mode, this section can be skipped. In RF learn mode the RKE transmitter sends its device ID, secret key and current rolling counter to the vehicle to be stored. This information is sent from the fob to the vehicle in a secure manner. The fob encrypts the data with a shared key common to the vehicle and fob. This shared key is only used to ensure that the pairing information sent from the fob to the receiver is secret. Upon reception, the vehicle can decrypt the secure data and add the fob to the list of associated (learned) devices. The vehicle side of the RF link enters the learn mode first. This is done by pressing SW5 (RF) push button switch on the ATAB0001A interface board. The LED5 turns on, indicating the RF learn mode is currently active. To send the pairing message, press the S1 and S2 buttons on the fob simultaneously for 3 to 5 seconds during the next 10-second period. Successful learning is indicated by the LED5 blinking once, the memory position to which the fob was learned lights up (LED0 to LED3), and a learn mode icon (graduation cap) is displayed on the PC application. As long as LED5 stays illuminated, the RF learn mode is active and the other transmitters can be learned as well. Just repeat the sequence detailed up for the other fobs to pair each one with the vehicle. To exit learn mode, press either the SW5 (RF) push button switch on the ATAB0001A interface board again or let the 10-second period expire. LED5 turns off, indicating normal operation. Note: The RKE system is only operational after exiting learn mode (LED5 is off) and the system is paired with a fob. Up to four fobs in total can be paired (learned) with the vehicle Microchip Technology Inc. User Guide DS A-page 12

13 3.2.2 Normal RKE Operation RKE functionality can be observed using the PC application or the visual LED feedback from the ATAB0001A. ATAB5702A-V2.3 All three buttons provide RKE command messages. Each button also has two types of press action. There are short button press and long button press events, with each type handled differently. The following table shows how these are currently configured. In all cases, the LED corresponding to the learned memory position (LED0 LED3) blinks several times before staying continuously ON. Table 3-1. ATAB5702A Push Buttons Functionality S1 S2 S3 Short Press Lock Unlock Driver Door Open Trunk Long Press Remote Start Unlock All Doors Close Trunk All button presses, except a long press of S1, transmit using FSK modulation at 9.6 kbd. To carry out a long-range remote start, a long press of S1 changes to ASK modulation at 1 kbd. This is due to the fact that as the transmitted data-rate decreases, the sensitivity of the receiver increases thus improving the link budget of the system therefore increasing the range. The transmitting and receiving devices are seamlessly changed, demonstrating their power and flexibility. In order to provide high-quality performance even in the presence of noise, three RKE messages are sent sequentially on three different UHF channels, referred to as Time and Frequency Domain Redundancy. This makes it more probable that at least one of the messages is received successfully. For additional information on the RF protocol, see the AVR411 application note, and for other information on time and frequency domain redundancy, see the ATAN0014 application note, found on Using the RKE System with the GUI Once one or more fobs are paired with the system, the RKE can be tested using the PC GUI running on the host PC as follows: 1. If not done so already, follow procedure detailed in Section 2.2 PC Application Software. 2. Use the pull-down menu (View> RKE Messaging) to open the RKE Message Status window as shown in Figure 3 2. Figure 3-2. RKE Message Status Window 2017 Microchip Technology Inc. User Guide DS A-page 13

14 The RKE status window contains the following data fields, see Figure 3 2: RF message S/N : Contains the UID returned by the fob. The same UID value for a given fob is shown in the learned fobs section of the system configuration window. RF message counter : Displays the rolling code message counter value sent to the vehicle. This value is incremented for every key push. All commands (e.g., lock and unlock) increment the counter value. The counter is checked against a window of valid counts on the vehicle side to prevent recording and replaying of past RKE messages from being accepted as valid, which is commonly referred to as Replay Attack. RF message command : Decodes the most recent command received from the fob. RF message MAC : Displays the received 4-byte (32-bit) MAC. RF message result : Displays the result of the comparison between the expected MAC (computed using AES-128) and the received MAC. RF channel : Displays which RF channel the message was received. RF RSSI : The signal strength at the UHF receiver is measured and displayed in three formats. There is a decimal representation read directly from the UHF device followed by a calculated dbm value. Finally, there is a bar graph that provides visual representation. 3. Press any of the RKE buttons discussed in Section Normal RKE Operation to send the RKE message. 3.3 PEPS Operation The PEPS functionality is tested using the base station hardware (ATAB0001A/ATAB0003A/ ATAB5291B) and the fob PCB. The PEPS operation is configured (by the GUI) to send LF wake-up messages to the fob which then the fob responds with information via the RF channel System Configuration Window Overview The System Configuration window displays specific software information, reports the status of the learned fobs, selects the PEPS authentication method and selects a PEPS fob to perform testing. It also is used for setting calibration values and provides an interface to read/write user data in each selected fob. Use the pull-down menu (View>System Config) to open the System Configuration window as shown in Figure Microchip Technology Inc. User Guide DS A-page 14

15 Figure 3-3. System Configuration Window The System Configuration window contains the following sections and associated data fields, see Figure 3-3: The LF Antennas section includes controls used to select the antenna channel and the current and associated vehicle ID. Antenna channel : Selects which antenna channel is used to send the LF message from the vehicle. The antenna module must be connected to the corresponding port on the ATAB5291B board for this to function properly. Note: When antenna channel 1 is used, ensure the J1 jumper on the antenna module is set to the inductor ONLY ( ) option. When channels 2 through 6 are used, ensure the J1 jumper on the antenna module is set to the LCR option. Antenna current : Determines the amount of current flowing in the LF antenna during the LF message. This is directly related to the field strength at a given distance from the antenna. Therefore, any change to this value has a direct impact on the performance of the localization during PEPS. Vehicle ID : Sets the wake-up value transmitted with the LF message. Only fobs that are looking for this value will wake up and respond. The vehicle ID is set in the fob during immobilizer learn mode and is user definable. The learned fobs section lists up to four individual fob IDs paired with the system and saved in memory. Learn button: Used to perform the initial pairing of any new fobs to the system using the Immobilizer LF field provided by the base station coil. See Section 2.2 PC Application Software step 6 for details on the LF learn mode. Clear button: Erases all the saved fob secret keys and configuration data from the system memory. Note: The system will no longer have full functionality until a fob is paired. PEPS features section includes configuration settings, which affect PEPS messaging functions, including the type of authentication during polling as well as a polling interval Microchip Technology Inc. User Guide DS A-page 15

16 Authentication radio buttons: Two possible authentication types are available. Selecting these has an effect on the type of communication used during polling only. Note: If RKE learn (See Section RF Learn Mode ) was used then PEPS BA will not work for that particular fob. Polling options: Range checking and the determination of a desired threshold performance can easily be done with polling. The checkbox starts the polling cycle, which repeats at a rate set in milliseconds. In/out threshold : Used to determine if a fob is inside or outside the vehicle by comparing the distance scale result against the in/out threshold value. The boundary can be specified by manually entering a new value or by pressing the SW2 (RSSI) pushbutton switch on the ATAB0001A interface board. Priority fob : Allows users to specify which fob is given priority when responding to a PEPS command following the common slot of the anticollision process. PEPS Fob Actions section allows selection and communication with an individual fob even with other PEPS fobs present. Selected fob : Allows direct access to an individual fob. Selecting Broadcast allows communication with any fob, even unlearned ones. This facilitates accessing a fob ID even if the vehicle ID for that specific fob is unknown. Fob ID button: Provides a way to access the current fob ID, the vehicle ID, and battery status. S/W Ver button: Requests the current fob software version. Low Bat checkbox: Checked if the battery voltage in the current fob is below the low battery threshold (approximately 2.6V). Fob Vehicle ID : The vehicle ID stored within the current fob. LF test tab: Used to display all the details relating to a test LF field measurement. Details such as the external, internal RSSI values, and coil phase clock counts are displayed here. The distance scale value is determined by the combined result of all post-rssi processing. In a standard PEPS message, the distance scale and the coil phase values are sent. Note: Three copies of each user memory block are stored in the fob. The fob compares these copies to ensure user memory has not been corrupted. Parameter access tab: This is used to display general user memory sections of the fob EEPROM that can be accessed via the PEPS system link. These are configured into 32 blocks of memory with each block having 16 bytes of data available. The data can be displayed in HEX or ASCII format. To access the memory, the fob must first be put into a password-protected diagnostic mode by clicking the Enter Diag button. Then for several seconds the fob responds to read or write commands. Calibrate Fob button: This initiates a calibration cycle, which provides reference values since each fob LF antenna coil axis has slightly different gains due to the antenna coil, capacitor, and IC tolerances. This is typically done at the end-of-line testing by the manufacturer, but is necessary to achieve consistent results. It only needs to be performed once for each fob PEPS Message Status Window Overview The System Configuration window displays the challenge/response information along with localization details for each fob that is learned to the system. Use the pull-down menu (View>PEPS Messaging) to open the PEPS Message Status window as shown in Figure Microchip Technology Inc. User Guide DS A-page 16

17 Figure 3-4. PEPS Message Status Window The PEPS Message Status window contains the following data fields, as seen in Figure 3-4: Serial number : Displays the received fob ID. This should correspond to the value in the Learned Fobs section of the System Configuration window. LF challenge : Displays the 4-byte LF challenge data, which was sent to the fob. This challenge data is sent during bilateral and unilateral authentication. LF-encrypted challenge : Displays the 4-byte LF-encrypted data sent to the fob during bilateral authentication only. RF MAC : Displays the received RF MAC (message authentication code) value from the fob. Localization : Displays the current localization status of the current fob (e.g., inside or outside the vehicle). This is determined by comparing the distance scale value against the In/Out Threshold value displayed in the system configuration window. Note: Each fob section is highlighted in blue if the fob is found inside and pink if the fob is found outside. This allows easy determination from a distance while the range of the system is being tested. The fob section will be highlighted in gray and the Distance Scale box will be highlighted in red when a LF measurement error occurs within the ATA5702. Distance scale : Indicates the RSSI scale value received. Coil Phase Signature : Displays a three-digit binary code, where: Bit Position Calculation using coil phase clock count values Bit value if 90 < Calc. Result < 270 Otherwise 1 "Z Y" value "360" value x "Z X" value "360" value x "Y X" value "360" value X Microchip Technology Inc. User Guide DS A-page 17

18 Note: The Z-Y, Z-X, Y-X and 360 coil phase clock count values are found in the PEPS Fob Actions section of the System Configuration window. Battery low checkbox: Checked if the battery voltage in the current fob is below the low battery threshold (approximately 2.6V). Log file checkbox: Used to create a new record line in a comma separated variable (CSV) document for each received message when it is selected Identifying Fobs in Range The available fobs can be identified by sending out a broadcast, which returns the Fob# in the selected fob field. To identify available fobs within the LF range: 1. If not done so already, follow the procedure detailed in Section 2.2 PC Application Software. Figure 3-5. Identifying Fobs in Range Test 2. Select Broadcast from the selected fob drop-down list within the PEPS fob actions section of the System Configuration window as shown in Figure Click the Fob ID button to send the broadcast request as shown in Figure 3-5. The available fobs respond with their fob ID and their Fob# assignment. The associated vehicle ID is returned and displayed in the Fob Vehicle ID field. 4. Click the S/W Ver button as shown in Figure 3-5 to send the software version request to the fob. The software version number is returned and displayed in the S/W Ver field. Note: To use the broadcast function, only one fob should be in range and it must have a battery inserted in the battery socket Microchip Technology Inc. User Guide DS A-page 18

19 Note: Fobs in range, which are not paired with the current system, and fobs, which have a different vehicle ID, can also be identified as in range. If the located fob is paired with the system, the selected fob index changes to the location in the system to which the fob is believed to be stored. The fob ID should be verified by checking it against the list of learned fobs Fob Calibration Overview In a PEPS system, the learned fobs receive the LF signal and measure the magnetic field strength as a receive signal strength indicator (RSSI) value. This value is reported to the vehicle and is used to determine the fob s position with respect to the transmitting LF antenna. To ensure RSSI accuracy, the fobs must be calibrated, including normalization and compensation, along all three LF antenna coil axes (X, Y and Z-axis). Typically, this calibration is performed during the final test using high precision equipment at the fob s manufacturing facility. However, with the help of the GUI, the end-of-line calibration sequence can be approximated by clicking the Calibrate Fob button in the system configuration window. The normalization procedure is used to establish a relationship between a known magnetic flux density and a measured RSSI value. Ideally, a Helmholtz coil would be used to perform this task but considering the constraints of the kit, this is not feasible. Instead, the RSSI value for each fob LF antenna coil (X, Y and Z) axis is measured at a fixed distance (e.g., 50cm) from the transmitting LF antenna. Arbitrarily using x-axis as the reference, the difference in measurements of the other two axes are stored in EEPROM as the Normalization Constants. On the other hand, the compensation procedure accounts for any non-ideal influences (e.g., magnetic flux disturbances due to adjacent ferrous bodies, temperature, and/or aging effects) and is based on the following: 1. Measuring the internal RSSI values at reference conditions (end-of-line) denoted as Ref. RSSI within the PEPS Fob Actions section of the System Configuration window. 2. Measuring the current internal RSSI, (no external LF signal present) denoted as Int. RSSI within the PEPS Fob Actions section of the System Configuration window. 3. Measuring the current external RSSI, (external LF signal present) denoted as Ext. RSSI within the PEPS Fob Actions section of the System Configuration window. The actual RSSI amplitude is then calculated by adding the error term [(1) - (2)] to the values measured at (3). Using both of these procedures ensures that a constant RSSI is reported, regardless of the fob orientation, and ensures accuracy over a large set of influences Fob Calibration Process The calibration cycle must be performed for each fob separately. The following steps are used to perform the Calibration Fob cycle: 1. If not done so already, follow procedure detailed in Section 2.2 PC Application Software Microchip Technology Inc. User Guide DS A-page 19

20 Figure 3-6. Fob Calibration 2. Select the fob to be calibrated in the Selected Fob field within the PEPS Fob Actions section of the System Configuration window as shown in Figure Click the Fob ID button. 4. Click the Calibrate Fob button as shown in Figure Click the Next button within the Fob EOL Configuration window, as shown in Figure Microchip Technology Inc. User Guide DS A-page 20

21 Figure 3-7. Fob EOL Configuration Window 6. Position the LF antenna module and the fob (as shown in the Fob EOL Configuration window) to align the X-axis of the fob with the LF antenna module axis, and click the Measure button. This measures the current X-axis RSSI signal amplitude and updates the result to the Peak RSSI field for the X-axis. Click the Measure button several times to ensure the peak value is stable. 7. Click the Next button. 8. Position the fob, as shown, to align the Y-axis and click the Measure button. This measures the current Y-axis signal amplitude and updates the result to the Peak RSSI field for the Y-axis. Click the Measure button several times to ensure the peak value is stable. 9. Click the Next button. 10. Position the fob, as shown, to align the Z-axis and click the Measure button. This measures the current Y-axis signal amplitude and updates the result to the Peak RSSI field for the Y-axis. Click the Measure button several times to ensure the peak value is stable Microchip Technology Inc. User Guide DS A-page 21

22 11. Click the Next button. 12. Click the Measure button to have the fob perform an internal RSSI measurement and display the results in the Measured Int. RSSI field. This measurement is performed by an internal current source, which drives each of the fob s 3-axis LF antenna coil circuits. 13. Selecting the Update EEPROM checkbox updates the RSSI values currently stored in EEPROM with the newly measured values after the Next button is clicked. Note: This is recommended when the Measured Int. RSSI field is significantly different from the EEPROM Int. RSSI field, which can occur when the fob s components age over time or if a change in the circuit has occurred (e.g., evaluating different 3D coil). Otherwise, leave the No Change checkbox selected. 14. Click the Next button. 15. Click the Configure button to store the compensation constants into the fob EEPROM. Be aware that it will take a few seconds to complete this action, and you must wait until the lights stop blinking on the ATAB0001A interface board before you can close the Fob EOL Configuration window. 16. To check, click the LF Test button in the System Configuration window, as shown in Figure 3-6, to request the RSSI values and display them in the respective fields within the PEPS Fob Action section of the System Configuration window PEPS Wake-Up Functionality The PEPS wake-up functionality can be tested using the PC GUI running on the host PC as follows: 1. If not done so already, follow procedure detailed in Section 2.2 PC Application Software. 2. If not done so already, perform the fob calibration (see Section Fob Calibration Process ) Microchip Technology Inc. User Guide DS A-page 22

23 Figure 3-8. PEPS Wake-Up Functionality Test 3. Select the desired LF antenna channel from which to send the LF message as shown in Figure 3-8. Note: When antenna channel 1 is used, ensure the J1 jumper on the antenna module is set to the inductor ONLY ( ) option. When channels 2 through 6 are used, ensure the J1 jumper on the antenna module is set to the LCR option. 4. Select the desired LF antenna current. 5. Enter the polling interval value in milliseconds (e.g., 1000, meaning the LF wake-up signal is transmitted every one second) as shown in Figure 3-8. Note: 500 ms is the smallest allowable interval. 6. Select the Polling checkbox to enable polling and confirm the LEDs on the fob blinks each time the new wake-up signal is received. Note: If RKE learn (See Section "RF Learn Mode") was used then Bilateral Authentication will not work for that particular fob. 7. Type in a new vehicle ID (e.g., ) as shown in Figure 3-7, click on any other field within the window, and confirm that the LEDs on the fob no longer blink. This demonstrates that the fob will only wake up for the vehicle to which it was paired. 8. Type in the original vehicle ID: Deselect the Polling checkbox to disable polling PEPS Communication The PEPS communication functionality can be tested using the PC GUI running on the host PC as follows: 2017 Microchip Technology Inc. User Guide DS A-page 23

24 1. If not done so already, follow procedure detailed in Section 2.2 PC Application Software. 2. If not done so already, perform the fob calibration (see Section Fob Calibration Process ). 3. If not done so already, use the pull-down menu (View>PEPS Messaging) to open the PEPS Message Status window as shown in Figure Position the fob at an arbitrary distance from the LF antenna module. 5. Press the SW2 (RSSI) push button switch on the ATAB0001A interface board to set the in/out threshold field, within the PEPS features section of the System Configuration window, based on the fob s current location. Note: Successful update of the in/out threshold is, also, indicated by a steady illumination of LED7 (PEPS) and a momentary blink of LED5 (Learn) on the ATAB0001A interface board. 6. Move the fob closer to the LF antenna module. 7. Click the PEPS UA button within the PEPS Message Status window to execute the unilateral authentication sequence. Note: The LF Encrypted Challenge ' field is not populated since this data is not transmitted to the fob. Example: The results of a PEPS unilateral authentication sequence are shown in Figure 3-9. With the in/out threshold = and the measured value distance scale = 399.5, the fob is identified as inside the vehicle and highlighted in blue due to the distance scale value being greater than the threshold value Microchip Technology Inc. User Guide DS A-page 24

25 Figure 3-9. PEPS Unilateral Authentication with Inside Localization 8. Move the fob further away from the LF antenna module, beyond the location used in step 4, but still within PEPS operating range. 9. Click the PEPS BA button within the PEPS Message Status window to execute the bilateral authentication sequence. Confirm that the LF Encrypted Challenge ' field is now populated. Note: If RKE learn (See section "RF Learn Mode") was used then PEPS BA will not work for that particular fob. Example: The results of a PEPS bilateral authentication sequence are shown in Figure With the in/out threshold = and the measured value distance scale = 298.1, the fob is identified as outside the vehicle and highlighted in pink due to the distance scale value being less than the threshold value Microchip Technology Inc. User Guide DS A-page 25

26 Figure PEPS Bilateral Authentication with Outside Localization Note: 1. The PEPS UA and PEPS BA buttons can be used for either inside or outside localization. 2. Each time the PEPS UA or PEPS BA button is clicked, a new PEPS wake-up signal is generated. Once the fob receives the wake-up signal, the LED on the fob blinks and the PEPS Message Status window information is updated. 3. A continuous polling sequence can be achieved by selecting the Polling checkbox in the PEPS features section of the System Configuration window. This polling feature can be used to dynamically determine the PEPS fob area coverage in real-time with the PEPS results being shown in the PEPS Message Status window PEPS Normal Operation The PEPS sequence typically begins with the vehicle in a LOCKED state. If necessary, press the RKE lock button to ensure that the system is in the LOCKED state. To achieve best results, it may be necessary to adjust the in/out boundary (see Section "PEPS Communication") Microchip Technology Inc. User Guide DS A-page 26

27 PEPS Unlock A PEPS vehicle typically has sensors or buttons in the door-handles, which trigger the PEPS system to unlock the door once the handle is pulled. This is demonstrated by placing the fob beyond the in/out threshold boundary and pressing the SW7 (Unlock) push button switch on the ATAB0001A interface board. Even if multiple fobs are present, the system uses the first received response as the basis for all actions. The PEPS unlock action is indicated by a quick blink of LED7 (PEPS) followed by a steady illumination, a quick blink of LED4 (In/out) followed by a steady illumination (indicating that the fob location is outside the vehicle), and the fob index used (LED0 LED3) being illuminated on the ATAB0001A interface board. The fob index LED also indicates that AES authentication has been successfully completed. The PC GUI shows the trigger location; the location of the key fob (outside or inside) and the status of the action (color of the fob and lock status of the vehicle). The GUI response can be viewed in detail in Figure If the fob were within the in/out threshold boundary (i.e. inside the vehicle), the fob would be red to indicate the function could not be performed and the vehicle would remain locked. Figure PEPS Unlock PEPS Start The driver presses the START button to start the vehicle in a PEPS system. This is demonstrated by placing the fob within the in/out threshold boundary and pressing the SW0 (PEPS) push button switch on the ATAB0001A interface board. Even if multiple fobs are present, the system uses the first response as the basis for all actions. The PEPS start action is indicated by a quick blink of LED7 (PEPS) followed by a steady illumination, LED4 (In/out) is not illuminated (indicating that the fob location is inside the vehicle), and the fob index used (LED0 LED3) being illuminated on the ATAB0001A interface board. The fob index LED also indicates AES authentication has been successfully completed Microchip Technology Inc. User Guide DS A-page 27

28 The PC GUI shows the trigger location; the location of the key fob (outside or inside) and the status of the action (color of the fob and engine status of vehicle). The GUI response can be viewed in detail in Figure If the fob were beyond the in/out threshold boundary (i.e. outside the vehicle), the fob would be red to indicate the function could not be performed and the vehicle engine would remain unstarted. Figure PEPS Start Function Note: If the fob battery is dead (demonstrated by removing the battery), pressing the SW0 (PEPS) push button switch on the ATAB0001A interface board initially attempts to carry out a PEPS start, but then tries the immobilizer as a backup method. Follow the instructions in Section 3.1 Immobilizer Operation, but press the SW0 (PEPS) push button switch on the ATAB0001A interface board instead of the SW1 (IMMO) push button switch in step PEPS Lock (Fob Left in Vehicle) A very important feature for PEPS is the ability to prevent accidentally locking the fob inside the vehicle. This is demonstrated by placing the fob within the in/out threshold boundary and pressing the SW6 (Lock) push button switch on the ATAB0001A interface board. Even if multiple fobs are present, the system uses the first response as the basis for all actions. The PEPS action is indicated by a quick blink of LED7 (PEPS) followed by a steady illumination, LED4 (In/out) is not illuminated (indicating that the fob location is inside the vehicle), and the fob index used (LED0 LED3) being illuminated on the ATAB0001A interface board. The fob index LED also indicates AES authentication has been successfully completed. The PC GUI shows the trigger location; the location of the key fob (outside or inside) and the status of the action (color of the fob and lock status of vehicle). The GUI response can be viewed in detail in Figure Since the fob is within the in/out threshold boundary (i.e. inside the vehicle), the fob is red to indicate the function could not be performed and the vehicle remains unlocked Microchip Technology Inc. User Guide DS A-page 28

29 Figure PEPS Lock (Fob Inside) PEPS Lock (Fob Removed from Vehicle) To lock the vehicle the fob must first be removed and taken away by the owner. This is demonstrated by placing the fob beyond the in/out threshold boundary and pressing the SW6 (Lock) push button switch on the ATAB0001A interface board. Even if multiple fobs are present, the system uses the first response as the basis for all actions. The PEPS lock action is indicated by a quick blink of LED7 (PEPS) followed by a steady illumination, a quick blink of LED4 (In/out) followed by a steady illumination (indicating that the fob location is outside the vehicle), and the fob index used (LED0 LED3) being illuminated on the ATAB0001A interface board. The fob index LED also indicates AES authentication has been successfully completed. The PC GUI shows the trigger location; the location of the key fob (outside or inside) and the status of the action (color of the fob and lock status of vehicle). The GUI response can be viewed in detail in Figure Since the fob is now outside the vehicle, the fob is green and the vehicle locked Microchip Technology Inc. User Guide DS A-page 29

30 Figure PEPS Lock (Fob Outside) 2017 Microchip Technology Inc. User Guide DS A-page 30

31 4. Programming Instructions Specific firmware (Flash) and configuration settings (EEPROM) are required to operate the system. These are found in the MCU (ATmega2560) and the RF receiver (ATA5782) on the vehicle side. The fob comes with its own PEPS, IMMO and RKE firmware and configuration files. The list below details exactly what type of file is needed for each device: Car Side: ATmega2560: PEPS, IMMO and RKE firmware in Flash and configuration in the EEPROM ATA5782. PEPS and RKE configuration in the EEPROM Fob Side: ATA5702: PEPS, IMMO and RKE firmware in Flash and configuration in the EEPROM Note: All devices within the system are shipped fully programmed and it is normally not necessary to perform the steps described in sections that follow; except in circumstances when revised ATAK51004-V2 Tool Package software is available for download from or where the source code has been modified or when a device becomes erratic or unresponsive in behavior. 4.1 Programming the ATmega2560 on ATAB0001A Interface Board If it is necessary to reprogram the ATmega2560 on the ATAB0001A interface board, connect the programmer (e.g., Atmel-ICE, JTAGICE3, etc.) either to the JTAG or to the ISP header placed on the left perimeter of the board (see Figure 4-1). Figure 4-1. ATAB0001A Programming Header Locations ATmega2560 JTAG Header ATmega2560 ISP Header The following programming steps are used with the Atmel-ICE programmer and the JTAG interface: 1. Using Studio 7, program the ATmega2560 by selecting Device Programming in the Tools menu (see Figure 4-2). Figure 4-2. Device Programming 2. Select the programmer, device, interface as shown in Figure 4-3, and press Apply: Figure 4-3. Programmer Configuration 3. Click the Read Signature button to be sure the signature matches the selected device (see Figure 4-4) Microchip Technology Inc. User Guide DS A-page 31

32 Figure 4-4. Device Signature 4. Select the Fuses tab and verify the proper fuse settings exist. If not, change them to match Figure 4-5 and press the Program button. Figure 4-5. ATmega2560 Fuse Settings 5. Select the Memories tab and click the Erase now button (see Figure 4-6). 6. Browse to locate the CARS_ATmega2560_flash.hex file for the flash memory image (see Figure 4-6). 7. Click the Program button and wait for completion. Note: LEDs 0 through 7 on the ATAB0001A CARS interface board will blink rapidly indicating that the EEPROM within the ATmega2560 still is needed. These LEDs will stop blinking upon the initiation of step Browse to locate the CARS_ATMega2560_EEPROM.eep file for the EEPROM memory image (see Figure 4-6). 9. Click the Program button and wait for completion Microchip Technology Inc. User Guide DS A-page 32

33 Figure 4-6. ATmega2560 Memory Programming Note: When using an ISP programmer connected to the ISP header, follow the exact same procedure as described above. However, be sure to select the ISP interface in Step 2 and set the ISP programming frequency to 100 khz or lower prior to Step 4 (see Figure 4-7). Figure 4-7. ISP Clock Frequency 4.2 Programming the ATA5702 on the ATAB5702A PEPS Fob Board If it is necessary to reprogram the ATA5702 on the ATAB5702A PEPS transmitter board, connect the programmer (e.g., Atmel-ICE, JTAGICE3, etc.) to the ISP header located near the center of the board. The following programming steps are used with the ICE programmer and the ISP interface: 1. Using Studio 7, program the ATA5702 by selecting Device Programming in the Tools menu (see Figure 4-8). Figure 4-8. Device Programming 2. Select the programmer, device, interface as shown in Figure 4-9, and press Apply: 2017 Microchip Technology Inc. User Guide DS A-page 33

34 Figure 4-9. Programmer Configuration 3. Be sure to Set the ISP frequency to less than 100 khz (see Figure 4-10). Figure ISP Clock Frequency 4. Click the Read Signature button to be sure the signature matches the selected device (see Figure 4-11). Figure Device Signature 5. Select the Fuses tab and verify the proper fuse settings exist. If not, change them to match Figure 4 12 and press the Program button. Figure ATA5702 Fuse Settings 6. Select the Memories tab and click the Erase now button (see Figure 4-13). 7. Browse to locate the ATA5702_flash.hex file for the flash memory image (see Figure 4-13). 8. Click the Program button and wait for completion. 9. Browse to locate the ATA5702_eeprom.eep file for the EEPROM memory image (see Figure 4-13). 10. Click the Program button and wait for completion Microchip Technology Inc. User Guide DS A-page 34

35 Figure ATA5702 Memory Programming Note: Should the EEPROM verification step fail (similar to what is shown in Figure 4-14) repeat steps 1 10 to ensure everything is properly configured. If the error still occurs, then the ATA5702 IC version is outdated and you must contact your local sales representative for an upgrade. Figure ATA5702 EEPROM Verification Failure 4.3 Programming the ATA5782 on the ATAB0003A RF Receiver Board If it is necessary to reprogram the ATA5782 on the ATAB0003A RF receiver board, begin by first removing the board from the UHF_X1 and UHF_X2 sockets of the ATAB0001A CARS interface board. Then connect the programmer (e.g., Atmel-ICE, JTAGICE3, etc.) to the ISP header located near the center of the board. Finally, provide +3V across the Vs and Ground test points, as well as, connect the TRPB test point to ground as shown in Figure Note: To avoid potentially shorting Vs and Ground, it is recommended to make the connections on opposite sides of the board Microchip Technology Inc. User Guide DS A-page 35

36 Figure ATA5782 Programming Header and Test Point Locations The following programming steps are used with the Atmel-ICE programmer and the ISP interface: 1. Using Studio 7, program the ATA5782 by selecting Device Programming in the Tools menu (see Figure 4-16). Figure Device Programming 2. Select the programmer, device, interface as shown in Figure 4-17, and press Apply. Figure Programmer Configuration 3. Be sure to Set the ISP frequency to less than 100 khz (see Figure 4-18). Figure ISP Clock Frequency 4. Click the Read Signature button to be sure the signature matches the selected device (see Figure 4-19) Microchip Technology Inc. User Guide DS A-page 36

37 Figure Device Signature 5. Select the Fuses tab and verify the proper fuse settings exist. If not, change them to match Figure 4-20 and click the Program button. Figure ATA5782 Fuse Settings 6. Select the Memories tab and click the Erase now button (see Figure 4-21). 7. Browse to locate the ATA5781_eeprom.eep file for the EEPROM memory image (see Figure 4-21). 8. Click the Program button and wait for completion. Figure ATA5782 Memory Programming 9. Remount the ATAB0003A RF receiver board onto the UHF_X1 and UHF_X2 sockets of the ATAB0001A CARS interface board Microchip Technology Inc. User Guide DS A-page 37

38 5. Installing Virtual COM Port 5.1 USB Driver Setup for Windows 7 1. Connect the mini-usb plug to the USB connector (J12) on the ATAB0001A CARS interface board as shown in Figure Connect the USB cable to your PC and right-mouse click on the Computer entry in the Computer>Manage dialog as shown in Figure 5 1. Figure 5-1. Manage Dialog in Windows 7 3. Open the Add legacy hardware dialog by selecting Device Manager and right-mouse click the computer name as shown in Figure 5 2. Figure 5-2. Add Legacy Hardware Dialog 4. Select the Install the hardware dialog from the Add Hardware wizard and press Next as shown in Figure Microchip Technology Inc. User Guide DS A-page 38

39 Figure 5-3. Add Hardware Wizard - Install Selection Dialog 5. Choose Show All Devices and in the next prompt select the Have Disk button as shown in Figure 5 4. Figure 5-4. Show All Devices - Have Disk... Dialog 2017 Microchip Technology Inc. User Guide DS A-page 39

40 6. Choose the Browse button, select the directory for the USB driver (atmel_devices_cdc.inf), and open the file as shown in Figure 5 5. Figure 5-5. Locate File Dialog 7. In the next menu, select the EVK1XXX Virtual Com Port entry and press Next to install the driver as shown in Figure Microchip Technology Inc. User Guide DS A-page 40

41 Figure 5-6. Select Device Driver Dialog 8. When the Windows Security prompt appears, select Install this driver software anyway as shown in Figure 5 7. Figure 5-7. Windows Security Dialog 9. Click Finish in the Add Hardware dialog to close the wizard as shown in Figure Microchip Technology Inc. User Guide DS A-page 41

42 Figure 5-8. Complete Dialog 10. Now connect the USB cable to your PC and verify the successful installation by checking the COM port number in Device Manager. There should be a type EVK11xx Virtual COM Port device available that identifies the COM port number as shown in Figure 5 9. Figure 5-9. Device Manager with Port Settings 2017 Microchip Technology Inc. User Guide DS A-page 42