K180.

A ROLLING CODE 4-CHANNEL UHF REMOTE CONTROL

This kit is almost exactly the same as the kit described in the accompanying article which was published in the Australian electronics magazine Silicon Chip in 7/2002. We have permission from Silicon Chip to supply a copy of the article and from Oatley Electronics to copy the PCB. The only differences are that we have used a different brand relay, used different transistors with opposite pinout, and added an extra Ground pad for convenience. Otherwise everything is the same. Up to 15 Transmitter units can be learnt by one Rx unit. (The article says 16 but the technical manual says 15.) Press button 1 (the button all by itself) while simultaneously pressing the LEARN tact switch on the main board. You only have to do this briefly for under a second. But note it takes about 15 seconds for the two units to internally connect and recognize each other. (During this 15 seconds it seems that one and only one keypress of the Tx unit will be recognised. Just disregard this. Wait the full 15 seconds until the two units have connected. Do not press the LEARN button again. Just wait 15 seconds.) Tx units attached to any Rx unit can be unattached by pressing the LEARN button continuously for 8 seconds. The VALID DATA LED is on during these 8 seconds. As soon as the LED goes off then you know that all Tx units previously recognized by the Rx unit have now been unattached from the Rx unit. If you want more details about the Microchip technology behind these Tx & Rxs then get
http://www.kitsrus.com/pdf/an662.pdf

and

http://www.kitsrus.com/pdf/an665.pdf

Technical details about the Automicro devices can be got from http://www.kitsrus.com/pdf/automicro.pdf

We sell Tx units and Rx units separately as A16TX and A16RX. The article makes reference to assemblying the remote control Tx units. However, it is supplied here full assembled, tested, with a battery included and ready to go. Assembly. See Parts List on page 24 of the article below. Here are some more details. - we have supplied 3 pins which you may use if you wish in the ANTenna, Ground and 12V+ positions. We have put two places for the Ground connection: one is next to the 12V+ point, and the other is on the opposite side of the PCB. Use which ever one best suits you best. - follow the overlay for component placement. - we have used BC547 transistors with the opposite pinout to the PCB in the article.

Email me at peter@kitsrus.com if you have any problems.

November 1, 2002. Errata: there are two errors in the schematic on page 20 below. Pin 6 in both 4013 ICs which is shown going to the Receiver Module (pin 6 D0, and pin 9 D2 of the RX module) should be labelled pin 11 in both cases.

The nearest thing you can get to unbreakable . . .

A Rolling Code 4-channel UHF Remote Control

This is one very clever remote control. With rolling code, its close-toimpossible to electronically crack. With four channels, all either latching or momentary operation, its extremely versatile. With a sensitive prebuilt receiver, its long range. With up-to-16 keyring-size transmitters, its go-anywhere. And the kit even includes the keyring!
By Ross Tester

Whether you want to control a garage door or gate, a car and/or home alarm, or perhaps remotely turn lights or anything else on or off, this high-security system is just what youre looking for! Inset top right are the pre-built, aligned and tested receiver (top) and transmitter (bottom) modules, shown here same-size.

18

SILICON CHIP

www.siliconchip.com.au

eve presented a number of remote (radio) control devices in the past. None has been more secure than this one. To guess the code combination, youre going to need something like 23 billion years. But dont bother: the next time its used, the code will have changed anyway. Thats the advantage of a rolling code (or code hopping) system. We explain what this means, and does, later in this article. Suffice to say at this stage that it makes one v-e-r-y secure system. For all intents and purposes, it is impossible to electronically crack. Go on, give it a go well see you in a few million years or so!

Now we move on to the heart of the system, at least the bits you have to put together to make it work. In fact, there are two parts to the receiver as well. There is a 433MHz receiver module which comes assembled, aligned and ready to go. This solders into an appropriate set of holes on the main PC board once youve finished assembling that board. The main PC board contains the electronics which process the output from the receiver. The receiver checks the incoming code and if valid, sends a signal to one of four outputs depending on which button was pressed on the transmitter). The transmitter From here, depending on how the Its probably not necessary to say it four jumpers are set on the board, the but there are two parts to this project, signal goes either direct to an NPN a transmitter and a receiver. transistor relay driver (for momentary First of all, there is operation the relay is energised while the tiny 4-channel the button remains key-ring transmitpressed) or to a DSPECIFICATIONS ter which, fortunattype flipflop and UHF (433MHz) licence-fr ee (LIPD band) opera ely, comes 99% prethen to the transistion Long range prototype assembled. tor relay driver (for tested to 100m+ We say fortunately alternate operation Pre-built and aligned tra nsmitter & receiver mo because its just press once and the du les Rolling-code (code ho pping) operation (7. about all SMD (surrelay latches, press 3 x 1019 codes) Receiver learns trans face mount devices) again and the relay mitter coding which, while not releases). Receiver can handle up to 16 remotes impossible for the The flipflops Transmitter can handle hobbyist to work change state (toggle) any number of receiv ers with, requires some each time a postive 4 channels available, ea ch either momentary rather special hangoing pulse appears off) or latching (push (push on, release on, push off) via jum dling. You are at the clock input. pers Code acknowledge LED spared that! This is achieved by and channel status LE Ds Each channel relay conta All you have to the connection from cts rated at 28VDC/1 changeover) 2A (single pole, do with the transthe Q-bar output to mitter PC board is the D input via an RC 12V DC operation (6mA quiescent; 150mA all solder on the two network. relays actuated) battery connectors The circuit has a and place it in the case (with battery). The battery contacts are slightly different: the one with a spring is for the negative battery connection it goes on the righthand side of the PC board with the only straight side of the PC board at the bottom. You may find, as we did, that some of the holes for the battery connectors are filled with solder. This is easily melted during installation. Once this is done, its just a matter of assembling the board in its keyring case. Incidentally, the keyring case and battery are all supplied in the kit. The transmitter itself is in the licence-free 433MHz LIPD band (its most garage door openers, for example but its nice to know there are four channels available. And before we move off the transmitter, up to three channels can be pressed simultaneously and the receiver will react to all three (it wont handle four at once, though). Finally, as well as multiple transmitters, you can use more than one receiver if you wish. Each receiver learns its transmitter(s) so you can have a multiple system controlling, for example, the garage door, the car doors, the car alarm, the home security system in power-up reset. When power is first applied, the Q outputs of the flipflops are reset low by the 0.1F capacitor and 1M resistor on the reset (S) inputs. Reset is caused by sending the reset inputs of all flipflops high. Once the capacitor is charged, the voltage at the reset inputs of the flipflops falls to virtually zero, allowing normal operation It is perfectly acceptable to have a mixture of momentary and latched modes amongst the four channels. Its up to you. But if you only require momentary action (for example, as needed by JULY 2002 19

actually on 433.9MHz). As with most devices of this type these days, it is based on a SAW resonator (that stands for surface acoustic wave, so now you know!). This keeps the circuit very simple but enables excellent performance. Without wanting to get into the nitty-gritty of SAW resonator operation, in essence it controls the RF side of things while a dedicated chip controls the complex digital coding. The receiver (which well get to shortly) can handle up to 16 transmitters so if you have a really big family or maybe have a secure company carpark you want to give a certain number of people access to, you can do so simply by purchasing more transmitters. The transmitter has four pushbuttons, one for each of the four channels. Of course you dont have to use all four channels just one will control

fact, anything your little heart desires.

The receiver/decoder

www.siliconchip.com.au

IC1, IC2: 4013 D1- D4: 1N4004 IC1 PIN14, IC2 PIN14 0.1m F ANTENNA

+5V 10M
4 5 3 D CLK R 6 S Q Q 1 2

2.2k
K

+12V RELAY1 NC COM NO Q1 C8050

0.1m F

LED1

D1
A

J1 4.7k
B

IC1a

C E

2.2k
K

+12V RELAY2 NC COM NO Q2 C8050

10M

170mm

LED2
10 3 9 D CLK R 8 9 S Q Q 13

D2
A

J2 4.7k
B

C E

0.1m F
11 10

IC1b
12

2.2k 10M LED3

4 5 D CLK R 6 S Q Q 1 2 K

+12V RELAY3 NC COM NO Q3 C8050

433MHz RECEIVER MODULE TEST POINT

4 7

8 6

D3
A

J3 4.7k
B

0.1m F

IC2a

C E

12

2.2k 1k 10M
K

+12V RELAY4 NC COM NO Q4 C8050

PB1

LEARN

LED4 l LED5
9 10 D CLK R 8 S Q Q 13 12

D4
A

J4 4.7k
B

C E

0.1m F

IC2b

+12V REG1 7805 +12V 0.1m F GND 100m F IN OUT 100m F 0.1m F IC1 PIN7, IC2 PIN7 +5V

1M 7805 Q1- Q4 C8050 K IN OUT C B E A A D1-4 K

LEDS

COM

GND

2002

SC

4-CHANNEL UHF rolling code REMOTE CONTROL RECEIVER

an acknowledge LED to give a visible output of whats happening. There is also a valid signal acknowledge LED attached to the 433MHz module, which lights when valid code is being received. Each of the four identical relays has contacts rated at 28VDC & 12A, so can be used to control significant loads. The wide track widths on the PC board also allow high currents. The relay contacts could, of course, also be used to switch higher-rated relays or you could replace the acknowledge LED with an opto-coupler. The relays themselves are single pole but have normally open (NO) and normally closed (NC) contacts. These states refer to the unenergised state of the relay (ie, the NC contacts go open when power is applied to the relay coil and vice-versa).

Fig.1: the circuit of the control section of the receiver unit. We havent attempted to show the 433MHz receiver itself, nor the transmitter, as these are both pre-assembled modules, saving you a lot of difficult work!

some door openers/closers) the flipflops, along with their associated RC network components and the four header pin jumper sets, could be left out of circuit. (Youd then need four links on the PC board to directly connect the receiver outputs to their respective transistors.) Along with spike suppression diodes across each relay coil, part of each relay driver circuit also includes 20 SILICON CHIP

www.siliconchip.com.au

ASSEMBLING THE REMOTE CONTROL:

The photo above shows seven of the eight parts you should find when you take the bits out for the remote control (the battery is missing!). Above centre shows the two battery connectors soldered in place on the top of the PC board, above right shows the same thing from the other side. Dont mix up the connector with spring and the connector without. Finally, the photo at right shows the PC board in place, with battery, in one half of the keyring case. The blue pushbuttons are all on one plate they fit in as shown but can easily fall out. As you push the two halves of the case together, make sure the pushbutton plate stays in place. The keyring itself also fits into the notch in the case as you push the two halves together.

The only other components on the board are a simple 5V regulated supply, consisting of a 7805 3-terminal regulator and a couple of capacitors. This supply powers the 433MHz module and the 4013 flipflops. The relay coils are powered direct from the 12V supply.

If it does, you can be reasonably sure that the transmitter is working properly. Put it to one side while we move on to the receiver.

Receiver board
As usual, check the receiver PC board for any defects before assembly. Then solder in the resistors, capacitors, diodes, IC sockets (if used) and the four header pin sets (which select momentary or latching function). If you use IC sockets, make sure they go in the right way around the notch is closest to the edge of the PC board. The learn pushbutton switch solders in place between the IC sockets. These have two pairs of pins which are not identically spaced the switch should be an easy fit in the PC board if you get it the right way around. If in doubt, check the closed state with your multimeter. Now solder in the semiconductors the regulator, diodes, transistors and

Construction
Start by soldering in the two battery terminals to the transmitter PC board, in the positions shown in the photographs. Place the completed board in the keyring case, making sure the pushbuttons stay in position. Push the two halves together with the battery in place (and the right way around see pictures), with the keyring clip sandwiched between the two halves. One screw holds the two halves of the transmitter case together. Press each of the four buttons and ensure that the LED lights each time.

the LEDs as shown on the component overlay. Watch the LED and transistor polarities each is opposite to its neighbour! The last things to be soldered in place before the 433MHz receiver module are the four relays and the six output terminal blocks. The relays will only go in one way but the terminal blocks could be mounted back-tofront, making it almost impossible to get wires into them! (The open side of the terminals go towards the edge of the board, in case you were wondering!) At this point, check your assembly for any solder bridges, dry joints or missed joints. You might also now solder in the three wires two connect 12V power while the third is the antenna. Make the power leads the necessary length to reach your supply. When the antenna wire is soldered in, measure exactly 170mm from the PC board and cut the wire to this JULY 2002 21

www.siliconchip.com.au

GND REG1 7805 LED5 100m F + 1k

GND +5V DOUT

+12V

0.1m F
RELAY1

Learning and testing

NC COM NO

0.1m F TP
433MHz RECEIVER MODULE

10M

IC1 4013
1

0.1m F Q2

0.1m F Q1

VALID DATA

100m F M J1

4.7k 2.2k

D1 LED1

C8050 LED2 D2 D3
RELAY3 RELAY2

L
0.1m F

10M J2 M

NC COM NO NC COM NO NC

4.7k PB1 LEARN

2.2k

J3

4.7k
0.1m F 0.1m F Q3 Q4

2.2k

10M IC2 4013

LED3

ANT
ANT

C8050 LED4
RELAY4

GND

TX1

10M J4 M 1M

COM NO

4.7k

2.2k

D4

Looking at the board with the outputs/relays on the left side, move all header pins to the right side (latching). Apply power and you should see absolutely nothing happen. So far, so good. Now press the learn button once, then within 15 seconds press button one on the keyring transmitter for a second or so. Button one is the one all by itself on one side of the transmitter. The receiver then learns the encryption from the keyring transmitter and remembers it. Now all four buttons on your transmitter should alternately close and open the appropriate relay and light/ switch off its associated LED. Change the four jumpers over to the

D3

D2

NC

D1

LA

D0

VT

TP

length. This makes it resonant at 433MHz. You should not have any bare wire(s) emerging from the end of the antenna this could short onto something nasty and do you/it/something else some damage! If necessary, wrap a little insulation tape around the end of the antenna wire just in case! Plug the two ICs into their sockets, again watching the polarity. The notches should line up with the notches in the sockets (assuming you got the sockets right!) OK, were almost there. Place the receiver module in its appropriate holes along the edge of the PC board. It will only go one way (incidentally, take care not to move the coil or touch the trimmer capacitor). Solder each of the module pins into position (there are 13 of them dont forget the two by themselves) and your receiver is finished.

Fig.2 (above): the component overlay of the receiver module with the full-size photograph at right. Just to confuse you, weve shown the board turned 180 compared to the diagram above!

Power supply
The receiver unit is designed for 12V battery operation and power requirements are pretty modest. At rest, (ie, no relays operating), it draws only 6mA and even with all relays actuated, the current is just a smidgeon under 150mA. Therefore, most alarm-type batteries (eg, SLAs) will be more than adequate. We had it operating for a couple of weeks on a 7Ah 12V gell cell, periodically pressing the remote control just for the hell of it, without recharging the battery. In fact, at the end of this 22 SILICON CHIP

time the battery voltage changed only a few tens of millivolts probably not much more than you would expect during shelf life. Therefore, just about any 12V battery would be acceptable, even a couple of 6V lantern batteries in series or even 10 C or D-size Nicads. Of course, you could also use just about any garden-variety 12V or 13.8V DC (nominal) plug-pack supply. The relays wont worry about a few extra volts and the circuit has the onboard 5V regulator to ensure the electronics get the right voltage. Any DC plugpack over about 200mA capacity should be fine.

opposite way and all four buttons should now pull in a relay and light a LED while ever they are pressed and release it/dim it when let go. And thats just about it. Now all you have to do is select the jumpers the way you want them and connect the external devices you wish to control. Note that each relay has a normally open and normally closed connection as well as common, so you have a lot of flexibility at your disposal.

Want even more security?

We mentioned before the one major drawback with any remotely controlled security application, whether that

www.siliconchip.com.au

What is Code Hopping or Rolling Code

These two names usually refer to the same thing in a nutshell, a security system for a security system. Its a way of preventing unauthorised access to a digital code which might be transmitted via a short-range radio link to do something: open a garage door, lock or unlock a car and perhaps turn its own security system on and off and much more. But before we look at these terms, though, lets go back in time to the days before code hopping and rolling code. Short-range radio-operated control devices have been around for a couple of decades or so (at least, in any volume). The earliest ones that I remember simply used a burst of RF, at a particular frequency, with an appropriate receiver. Its not hard to see the shortcomings of such devices. Simply sweeping the likely band(s) with an RF generator attached to an antenna would more often than not achieve the desired result (desired for the intruder, that is). It didnt take long for crooks to latch on to this one (do you like that metaphor?). So manufacturers decided to make it a bit harder for them by modulating the RF at a frequency (or indeed multiple frequencies in some cases) known to the receiver. Some used the standard DTMF tones generated by phone keypads because they were very cheap and made in the millions. Oh, gee, said the crooks. Now well have to use an RF oscillator with a modulator. Or maybe even a DTMF keypad! Duh! (Still, it probably seemed like a good idea at the time. . .) Ever one step ahead, the manufacturers went with this (then) new-fangled digital stuff and made each transmitter send a particular code which was matched to the receiver. This was usually done by way of DIP switches in both transmitter and receiver. With eight DIP switches (probably the most common because 8-way DIP switches were common!), you would have 28 or 256 codes available. So you and your next-door neighbour could have the same type of garage door opener on the same frequency and the odds would be pretty good that their door would stay down when you pressed your button. The problem with this, though, is that the transmitter spurted out exactly the same code every time (unless, of course, both sets of dip switches were changed). Enter the crooks again. With a suitable receiver, called a code grabber, if they got within a few tens of metres of you they could scan for the RF signal and record your code without you knowing anything about it (for example, as you left your car in a carpark and pressed the button on your remote to lock the doors and turn on the alarm). Once youd gone, they simply played it back using the same code grabber. Presto, one missing car. Or one house burgled, etc etc. Even without a code grabber, a smart intruder with the right equipment using digital techniques and trying eight combinations per second, could crack the code in no more than 32 seconds and probably much quicker. Its hard to believe the gall of some organisations openly flogging such devices, euphemistically disguising them (justifying them?) with names such as vehicle lockout recovery systems or disabled vehicle recovery systems. Then again, lock picks are sold for professional locksmiths, arent they? Now we move on a little. Microchip, the same people who brought you those ubiquitous PICs, invented a system called KEELOQ better known to you and me as a rolling code. What this does is simply present a different code every time the transmitter button is pressed. Of course, thats the easy part. The really clever part is that the receiver learns the algorithm which controls the code so it knows what code to expect. Once learnt, the receiver is effectively locked to that transmitter. Actually, its even cleverer than that, because the transmitted code is, for all intents and purposes, random (as far as any external device is concerned). But the receiver can still work out what the code is going to be in advance. If it gets the right code, it actuates. If not youre out in the cold, baby! The chances of the same code being transmitted twice in a persons lifetime is possible but remote (at four transmissions per day, every day, its reckoned to be about 44 years!) Heart of this system is a Microchip proprietary IC, the HC301. It combines a 32-bit hopping code generated by a nonlinear encryption algorithm with a 28-bit serial number and six information bits to create a 66-bit code word. The code word length eliminates the threat of code scanning and the code-hopping mechanism makes each transmission unique, rendering code capture and resend techniques useless. Even if it didnt code-hop, 66 bits allows 7.3 x 1019 combinations, which according to Microchip would only take 230,000,000,000 years to scan! The chip itself is also protected against intrusion. Several important data are stored in an EEPROM array which is not accessible via any external connection. These include the crypt key, a unique and secret 64-bit number used to encrypt and decrypt data, the serial number and the configuration data. The EEPROM data is programmable but read-protected. It can be verified only after an automatic erase and programming operation, protecting against attempts to gain access to keys or to manipulate synchronisation values. If the code is changed every time a button is pressed on the transmitter, what happens if, say a child starts playing with the remote control and continually presses buttons away from the receiver? OK, heres where it gets really clever (and you thought it was clever enough already, didnt you?). If the button is pressed say 10 times while out of range of the receiver, no problem. But if it is pressed more than 16 times, synchronisation between the two is lost. However, it only takes two presses of a button in range to restore sync. No, we dont know how either. Thats Microchips secret! And speaking of button presses, there are a couple of other clever things theyve done. At most, a complete code will take 100ms to send (it could be as low as 25ms). But if you manage to hit the button and release it before 100ms (difficult, but possible), it will keep sending that complete code. If you hold down the button, it will keep sending that same code. And if you press another button while the first is held down, it will abort the first and send the second. As you can see, KEELOQ is a very robust system. Sure, its not absolutely foolproof nothing is (eg, theres not much protection if they simply steal your transmitter!). But for most users, it gives almost total peace-of-mind. Thats why the system has been adopted by so many vehicle entry/exit and alarm system manufacturers, access controllers and so on. And thats the system thats used in the remote control unit presented here. JULY 2002 23

www.siliconchip.com.au

be for a car, a building or anything else: what happens if someone pinches your remote control? It is possible to protect yourself against the casual button pusher on a stolen control at least to some degree. Having four channels at your disposal, in this remote control system, gives you the possibility of increasing security rather significantly, simply by using a combination of keys on your remote. It is normal to use one button to achieve a certain function. But what if you used two buttons? Its possible because when you press the second button, even while holding down the
RELAY 1 RELAY 1 NO C NC CIRCUIT TO BE SWITCHED C CIRCUIT TO BE SWITCHED NO NC C NO

Parts List 4-Channel Code-Hopping Remote Control

1 TX-4312RSA 4-channel keyring rolling code transmitter assembly 1 RX3302D A1.5 433MHz rolling code receiver module 1 PC board, coded K180, 86 x 78mm 4 miniature relays, SPDT, PCB mounting, 12V coils (Millionspot H5000xx) 1 ultramini pushbutton switch, PC mounting, N-O contacts 6 interlocking 2-way terminal blocks, PC mounting 2 14-pin DIL IC sockets (optional) 4 3-way header pin sets, PC mounting Red & black insulated hookup wire for power connection 1 200mm length insulated hookup wire for antenna (see text) Semiconductors 2 4013 dual D flipflops (IC1, IC2) 4 NPN general purpose transistors (C8050 or similar) (Q1-Q4) 1 7805 3-terminal regulator (REG1) 4 1A power diodes, 1N4004 or similar (D1-D4) 4 red LEDS, 5mm (LED1-LED4) 1 green LED, 5mm (LED 5) Capacitors 2 100F, 16VW PC mounting electrolytics 7 0.1F polyester or ceramic (monolithic 5mm) Resistors 4 10M 1 1M 4 4.7k 4 2.2k 1 1k achieve a thing. Only you know which two buttons (or even three buttons) have to be pressed to achieve a certain function. Fig.3 shows what we mean the exact combination of buttons is entirely up to you! SC

RELAY NC 2

Fig.3a (left): conventional device control with one relay. Adding a second relay in series (fig 3b, right) increases security against the casual button pusher. Both buttons must be pressed at the same time for the device to actuate.

OR

first, the second buttons code is sent. So if you made one button a momentary and linked another buttons relay contacts through the first buttons relay contacts, you have the situation where pressing single buttons (as most people would do) wouldnt

Wheredyageddit?
This project and the PC board are copyright 2002 Oatley Electronics. Oatley have made separate kits available for both the transmitter and receiver, due to the fact that you might want more than one of each (as explained in the text). Rolling Code Transmitter Kit: Complete with pre-assembled transmitter module PC board, battery contacts, battery, clamshell case and keyring clip: (TX4) $25.00. Rolling Code Receiver Kit: Has the 433MHz receiver module, PC board and all on-board components as described in this article: (K180) $54.00. Oatley Electronics can be contacted by: Phone (02) 9584 3563; Fax (02) 9584 3561; Mail (PO Box 89. Oatley NSW 2223); Email (sales @oatleyelectronics.com); Or via their website: www.oatleyelectronics.com

A close-up look at the receiver module soldered into the main PC board. Do this last, as explained in the text.

24

SILICON CHIP

www.siliconchip.com.au