Fullscreen HTML5Med Res (??MB)HTML4

A Deluxe 3-channel UHF Rolling Code Remote Control Part 2 – by John Clarke Last month we introduced our new high security remote control and got as far as completing both the receiver/relay driver and transmitter. This month we’ll put it all together and get the two parts talking to each other – securely! W e’re assuming that you’ve completed construction, including setting the transmitter and receiver identities, as detailed last month. You will also have given both PC boards a visual check and made sure that there are no solder bridges (except the deliberate ones in the transmitter identity!) or breaks, bad joins or errors. Testing With IC1 out of its socket, connect a 12V plugpack or other 12V supply via the power socket. Check that LED5 lights and that there is about 5V between pins 5 and 14 of the IC1 socket. The voltage could range from 4.85 to 5.15V. If this is correct, switch off power and plug in IC1. Place the LK1 jumper in the “out” position and rotate VR1, VR2 and VR3 fully anticlockwise to set the momentary period at minimum. Apply power and press S1, S2 and S3. This should activate RELAY1, RELAY2 and RELAY3 for about a quarter of a second each with LED1, LED2 and LED3 lighting up during this period. If this test is OK, you can assume the circuit is working correctly. Now it’s time to set the operation of the relays. Momentary or Toggle Note that while we have made two of the relay “NC” connections available, these may not be of much use in the momentary mode. However, they could be quite useful in the toggle mode. Setting the relays for momentary or toggle mode is done in this way. 82  Silicon Chip We presented construction details for the two PC boards last month. Here’s what our completed project looks like. The panel on the receiver is actually an overhead projector transparency glued to the inside of the lid, so you can see the LEDs inside the case. siliconchip.com.au 135 54 B A 20 15 (SIDE OF BOX) ALL DIMENSIONS IN MILLIMETRES (END OF BOX) 22 B 22 B B Fig.6: drilling details for the specified polycarbonate box. The “B” holes are for the output wiring cable glands while the “A” hole is for the DC input socket. 14 CL Place the LK1 jumper in the ‘in’ position. Set BCD1 switch to the number of the relay that you wish to change operation. Then press S2 momentarily. (Do not press S1 or you will lockout the transmitter with the identity number that is set on BCD1 instead). For example, if you want RELAY1 to be changed from momentary to toggle operation, set BCD1 to position 1. Then press S2. Now you can place the LK1 jumper in the out position and by pressing S1 you will have RELAY1 operating in the toggle mode. To revert to momentary mode, place LK1 in the ‘in’ position, set BCD1 to ‘1’ and press S2 again. Placing LK1 in the out position and pressing S1 will show that RELAY1 now operates in momentary mode. Momentary period Momentary period for each of the relays is set with its associated trimpot (ie, RELAY 1 is set by VR1; RELAY2 by VR2 and RELAY3 by VR3. Periods are adjustable from 0.26s to 2s in 0.26s steps, then in 1s steps to 10s and in 15s steps to 4.4minutes. Table 1 shows a sample of the settings available and the approximate voltage that is measured at the trimpot test points for various timeouts. The voltages can be measured between TP GND and the appropriate test point (TP1, 2 or 3) for VR1, VR2 and VR3 respectively. If you want only short timeouts, it is easier to simply experiment with the position of the trimpot for the desired timeout. For longer timeouts you will save time in finding the right setting for the trimpot by measuring the voltage and comparing this to the timeouts from Table. 1. Note that the minimum period of 0.26s will be set for the first 10-20° of trimpot movement clockwise from its fully anticlockwise point. This is done so that it will be possible to finely set the increments of 0.26s at the lower end of travel. Trimpots tend to jump in value at their travel extremes and having this dead band of operation moves any changes in time settings into the more linear section of the trimpot. At this stage if the transmitter identity is ‘0’, pressing the switches on the transmitter should activate the relays on the siliconchip.com.au HOLE A: 10mm DIAMETER HOLES B: 12mm DIAMETER receiver. This is only if you have not used the randomise function on the transmitter. Also the transmitter needs to be at least 1m from the receiver to work correctly – any closer may overload it. If you have activated the randomise function on the transmitter, then you will need to register the transmitter. See the registering section. Randomising Randomisation of the transmitter ensures that it uses a unique set of parameters to calculate the rolling code. This procedure is a vital step in ensuring security because the default parameters are the same for every transmitter. You need to personalise the parameters to prevent another transmitter that has the same identity from possibly operating your receiver. If randomisation is not done there is the risk that someone else’s transmitter that also has not been randomised will operate your receiver. To randomise a transmitter, simply connect the jumper shunt into the LK1 position. The transmit LED will flash at a 4 per second rate for the duration. Wait for a short period (say several seconds to a few minutes) then remove the jumper. To prevent losing the jumper, it can be stored in the “keeper” position when finished. Parameters are altered every 40s and that is 25,000 times per second, so they will end up being different for each transmitter. The randomisation relies on the fact that it would be impossible to randomise two transmitters over exactly the same period by plugging and unplugging the jumper plug to within 40s of the same period. Add this to the fact that we do not specify a particular period to run the randomisation (as we leave this up to each individual person); a unique set of rolling code parameters is ensured. Registering After randomisation, the transmitter needs to be registered with the receiver in order to work. Both transmitter and receiver must be readied for this. Place the transmitter September 2009  83 EXTERNAL SWITCH CONNECTION OPTION (JAYCAR SP-0702 OR EQUIVALENT, MOUNTED ON LID) Fig.7: wiring the controller to external devices. CON3 (door strike) output is effectively in parallel with RELAY1 COM/NO contacts so it would not be normal to have both wired. But you can do so if your application calls for it. CABLE TO ELECTRIC DOOR STRIKE CABLE GLAND TP 12V V 0 WS V 2 1 0V P-TYPE NYLON CABLE CLAMPS 3 2 RELAY3 F0 1 V 5 PT D N G SK NIL 1S D N G PT S1 TPS1 1P T GND DNG RELAY2 1 2P T S3 S2 4 56  BC DE 4 C 1 A 2 C 8 23 OUT RELAY1 TPS2 78 9 2-CORE SHEATHED 7.5A MAINS FLEX CABLES 3P T TPS3 CON2 CON3 +12V CON4 M4 x 10mm SCREWS WITH M4 WASHERS & NUTS UHF ROLLING CODE RECEIVER 15008092 CON1 CABLE GLANDS G NI H CTI WS CAV 0 3 2 jumper in the LK2 position and at the receiver, place the LK1 jumper in the ‘in’ position. Now press and hold S3 on the receiver and then momentarily press S3 on the transmitter (with the transmitter about 1m away from the receiver). The acknowledge LED on the transmitter will flash twice and the receiver’s acknowledge LED should then flash on and off at a 1-second rate until S3 on the receiver is released. This 1-second flashing is an indication that the registration process has been successful. If the LED does not flash, then registration was unsuccessful so try again. Release S3 on the transmitter and receiver, then press and hold S3 on the receiver again and momentarily press S3 on the transmitter. If the registration process still fails, try re-randomising the parameters and then register again. The randomisation and registering procedure must be done for each new transmitter. Note that registering a transmitter will prevent the use of a previously registered transmitter if it has the same identity. For this reason transmitters need to have their own identity. A different identity transmitter can be registered with the receiver without affecting the registration of the other transmitter. Testing transmission If registration was successful, the LK2 jumper can be 84  Silicon Chip removed from the transmitter and placed in the keeper position. Switch S3 on the receiver should by now be released. The receiver is now ready to respond to the transmitter on the second press of one of the transmitter switch buttons. Pressing a switch on the transmitter for the second time should activate the corresponding relay on the receiver. It should activate the relay on each successive press of a switch thereafter. Lockout Any transmitter that has been synchronised can be later locked out from operating the receiver. To do this, insert LK1 on the receiver in its ‘in’ position. Then set BCD1 to the identity number of the transmitter you wish to lockout. Note again that the A, B, C, D, E and F positions on BCD1 are the 10, 11, 12, 13, 14 and 15 identities. Press S1 and the acknowledge LED will light once for 1 second. Then it will flash briefly for about 0.25s a number of flashes equal to the identity number. For identity 0, only the 1-second flash will not occur because the identity is zero and so does not briefly flash. Put another way for identity 0, the LED does flash but for zero times. After flashing the identity number, the LED will remain off for 3 seconds. If S1 is held pressed the cycle of displaying a 1-second flash and then the identity number siliconchip.com.au Use this photo in conjunction with the diagram at left to ensure that your project looks the same when completed. Note that the nuts for the three P-type cable clamps (right side) are all soldered to the underside of the PC board to make final assembly much easier. will occur again. This cycle will occur only for three times, as S1 is kept held pressed. After this if S1 is still held pressed the LED will then stay lit. This ‘stay lit’ indication means that now all identities are locked out. When all identities are locked out, re-registration will be necessary for each transmitter that is in use. To open the case remove the self-tapping screw and take off the battery cover compartment by prising at the holes where the keyring attaches. The lower half of the case is removed by squeezing the sides of the top half of the case to release the catches from the base. Transmitter case Using Fig.6 as a guide, mark out and drill the holes in the side of the box for the four cable glands and the power lead connector. At this stage you can also drill the holes for the four cable glands but don’t put any wire in yet. The PC board is secured in the box using the integral corner pillars. These accept M3 x 10mm screws. While the three on-board switches will generally not be needed once setup is finished, some constructors may wish to fit external switches so the relays can be activated without the keyfob transmitter (ie, a “local” mode). In fact, external switches can completely replace the on-board switches. In this case momentary push to close switches can be installed onto the lid or side of the case and wired as shown in Fig.7 to TPS1, TPS2, TPS3 and GND PC stakes. A suitable switch is the Jaycar SP-0702. If you decide not to install S1, S2 and S3 on the PC board because you are placing switches on the lid, note that the ground track on the PC board is connected via the lower two Switch caps supplied with the keyfob case are designed to fit over the switch actuators of S1-S3. You may find that when the lid of the keyfob case is in place, the switches are already pressed. Note also that IC1 must be pressed fully into its socket so that S1 can be operated. The top of each switch actuator may need to be shortened by a very small amount so the switch is not depressed when the lid is in place. Take care with filing the actuator so not too much is removed. If you do remove too much, the switch will not work, as the switch cap will touch the switch body before the actuator is pressed. To solve this the bottom of the switch cap can be filed to prevent it touching the switch body. A translucent light pipe diffuser is supplied with the case and is inserted into the hole in the top of the lid. The rounded triangular wire for a keyring attachment is placed in the case lid at the battery end of the case. A self-tapping screw holds the lid secure at the battery end of the case. siliconchip.com.au Receiver in its box September 2009  85 Table 2: Momentary period settings Momentary period settings for VR1, VR2 and VR3 with Voltages as measured at TP1, TP2 and TP3 respectively. Timeout periods are adjustable in 0.26s increments to 2s, then in 1s increments from 5 to 10s. Adjustments in 5s increments are made above 10s. Not all available timeout periods are shown in the table. You would need to interpolate the values for other timeouts. For example, to set for 2.5 minutes adjust the trimpot to between 2.79V (2 minutes) and 4V (3 minutes). A 3.4V setting should be close enough for 2.5 minutes timeout. TESTPOINT TIMEOUT VOLTAGE (V) 0 to 0.18........... 0.26s 0.26............... 0.52s 0.34............... 0.78s 0.41............... 1.04s 0.49................ 1.3s 0.57............... 1.56s 0.65............... 1.82s 0.73................ 2.0s 0.81..................3s 0.88..................4s 0.97..................5s 1.36.................10s 1.44.................15s 1.68.................30s 1.92.................45s 2.15.................60s 2.47.................90s 2.79............2 minutes 4..............3 minutes 5............ 4.4 minutes bridging terminals of switch S1. Removing S1 will mean you need to place a horizontal wire link between the lower two horizontal holes left after removing the switch. S2 and S3 positions do not require any links. A note to this effect concerning S1 is located on the underside of the PC board. Wiring into equipment For an electric door strike, which is usually rated at less than 1A, you can use CON4 to directly drive the strike with 12V. The wires pass through a cable gland in the side of the box. The relays are provided for switching 230VAC mains to power lights, door motors, etc. The relays do not supply any power – they can simply be regarded as a switch. If controlling a light, for example, the pair of wires from each relay (common and NO) are simply wired across the light switch. For two-way light switching, the common, NO and NC contacts would need to be used. These three contacts are available for outputs from Relays 1 and 2. If you want to control a garage door, you would wire across the push button switch “local” door control switch Fig.8 shows how this is done. The push-button switch almost invariably controls a low-voltage circuit (hence they can use bell-push switches) so this can be run using light-duty figure-8 cable. If using this mode, make sure the system is set for momentary operation – garage door controller local switches are almost invariably wired as push to open, push again to close. And some controllers might not like a long-term short across their local switch! Switching mains For switching 230V mains, the wire must be sheathed 2 or 3-core mains flex (depending on what you are switching), rated at 7.5A 230VAC. Use 10A wire if switching more than 7.5A. In Australia, a licensed electrician must wire anything connected permanently into the 230V supply. The wire is passed through a cable gland in the box end 86  Silicon Chip 3.3k A LED3 1 EXISTING GARAGE DOOR CONTROLLER “LOCAL” PUSH BUTTON RELAY3 K  D3 K A B C Q3 BD681 2 3 COM NO CON2 TO GARAGE DOOR CONTROLLER ADD GREEN WIRING E Fig.8: connecting to an existing garage door controller is really simple (and safe!) if your system has a “local” pushbutton switch to open and close the door. This section of the circuit shows relay 3 but any of the three relays could be used – wire in the COM and NO terminals. Note that this would require the Rolling Code Remote Control to be used in “momentary” mode. and secured using a P-clamp that is attached to the PC board with an M4 x 10mm screw washer and nut. We soldered the M4 nuts to the underside of the PC board. This allows securing the P-clamps in position without accessing the underside of the PC board. If the 2-core wire is not held tightly enough in the P-clamp, enlarge the diameter of the wire by placing a short length of heat shrink tubing over the wire. Use a second layer of heatshrink tubing, if one layer is insufficient. The cable gland also helps secure the wire when tightened. Note that these glands are easily undone from the outside of the box and so do not meet Australian standards for mains wiring where wiring is required to be securely held in place; hence the need for the P-clamps as well. After wiring, replace the plastic cover over the CON1/ CON2 terminal strip. It snaps into place when the PC board is mounted in the case (otherwise it slides in from the side). Disable existing controllers? While this controller should operate quite happily in conjunction (parallel) with an existing wireless garage door controller, it could become confusing to the operators. Because you can add up to 16 transmitter remotes, you’re not likely to need the old unit anyway. We suggest disabling the existing wireless receiver. The best way to do this would be to disconnect power to the receiver without disconnecting power to the controller itself. However, in many commercial garage door openers, the receiver and door control circuitry are combined so this might prove difficult. Because of the variety of commercial garage door controllers, we cannot offer any real advice in this area – except to say that it might be as simple as removing the external (wire) antenna which most have fitted. This should make the existing receiver “deaf” enough so that nothing happens if an old transmitter button is pressed! Errata from Part 1 of this project (August 2009) On page 77, discussing the BCD switch, should read: Position 15 (or F) sets all switch outputs at 0V. Also on page 77, on the circuit diagram, the terminal second from bottom on CON2 is of course the common terminal for relay 3. On page 81, where it says we need a seven-way barrier terminal, we actually need an eight-way, as described and shown in the photographs. siliconchip.com.au Frequently Asked Questions Q: What happens if the transmitter is out of range and one of the transmit switches is pressed? Will the receiver still work when the transmitter is later brought within range and the button pressed again? These questions are asked because the receiver was expecting a code that has already been sent and the transmitter has rolled over to a new code. So how does the system get around this problem? A. The answer to this is that if the signal format is correct but the code is incorrect, the receiver then calculates the next code that it would expect and checks this against the received code. If the code is now correct the receiver will operate. If the code is still incorrect, the receiver calculates the next expected code and will do this up to 100 times. If none of these are correct, the receiver keeps its original code and it will not trigger. So the transmitter buttons can be pressed up to 100 times while out of the receiver’s range without problems. transmitter and receiver will use these numbers to perform the calculation. The values quoted for the multiplier and increment value are not as simple as 100 and 7 but are 24 bits and eight bits respectively in length. Without knowing both the multiplier and the increment value, it would be very difficult to predict the next code. This is particularly true because of the very large numbers involved. The code length is 48 bits with as many as 2.8 x 1014 combinations. This reduces by a factor of 100 because of the lookahead feature to a 1 in 2.8 x 1012 chance of striking the correct code – still impossibly long odds. Code scrambling A further complication with the transmitted code is that the code is not necessarily sent in sequence. There are also 32 possible scrambling variations that are applied to the code and the scramble changes each time that code is transmitted. Q. How do you restore the transmitter operation? A. The only way to trigger the receiver after this is to reregister the receiver with the transmitter. A different registered transmitter will still operate the receiver. That’s because this transmitter has a different identity and a different code to the other transmitter. Automatic Re-registration Some rolling code transmitters systems offer automatic registration if the transmitter and receiver lose synchronisation. In these systems, the receiver includes a code “lookahead” feature as described above but the number of look-ahead codes is usually limited to fewer than 100. What happens is that if the code is not recognised after all the look-ahead calculations have been made, the receiver changes its synchronisation method. Basically, the receiver requires two separate transmission codes before restoring correct operation. On the first transmission, it calculates the next code it should receive using this received code as the basis for calculation. If the second code sent by the transmitter is the same as the code that was calculated, the receiver operates. The drawback of this latter scheme is somewhat less security since, in theory, two successive transmission codes could be intercepted and recorded. These codes could then be re-transmitted in sequence to re-register and thus trigger the receiver. Q. What if the rolling code calculation results in two consecutive codes that are the same and the code is intercepted and re-transmitted to open the lock? A. This is highly improbable and our rolling code transmitter has safeguards preventing the same code appearing twice in succession. For each code calculation, a comparison is made between the current and last code. If the code is the same, the code is recalculated after an increment of the code value to ensure successive code calculations diverge. It is this new code that is transmitted. The receiver performs the same re-calculation so that the new code will be accepted. A warning, though, is that, as with any encoded UHF encoded transmission, the signal can be intercepted and recorded. When played back it can be used to unlock a receiver. This is particularly true of fixed code systems where the same code is always used. For rolling code systems, a capture of the transmitted code can be used to unlock the system if the code is captured when the transmitter is used out of range from the receiver. The captured code could then be used to unlock the receiver if it is transmitted before the genuine transmitter is used to unlock the receiver. The captured code will only work once because the receiver will change to its new code upon reception of the signal. The captured signal will also be nullified if the genuine transmitter is used to unlock the receiver. Q. How does the receiver know which code to expect from the transmitter, since this changes each time? A. The answer to this is that the transmitter and the receiver both use the same calculation to determine the next code. They also both use the same variables in the calculation and these variables tend to be unique values that no other transmitter uses. For example, if the calculation for consecutive codes requires the original calculated code to be multiplied by 100 and the number 7 added to it, then both the Q. Does each transmitter use the same rolling code calculation and if so, wouldn’t the receiver lose its synchronisation if several transmitters were used? A. Each transmitter is treated independently to another and uses different rolling code and calculation parameters. So a receiver will not lose synchronisation with a particular transmitter, even if it is not generally used. Imbedded in the rolling code is the transmitter identity value from 0-15 and so the receiver knows which transmitter is sending the signal. SC siliconchip.com.au September 2009  87