Fullscreen HTML5Med Res (??MB)HTML4

Part 2 of John Clarke’s Secure Remote Switch This new Secure Remote Switch uses rolling codes for high security. The DC-powered receiver fits in a compact plastic case, so it can be mounted pretty much anywhere. After explaining how the circuitry works last month, this second and final article has all the construction details. T here are two versions of the keyfob transmitter; one uses a prebuilt transmitter module from Jaycar or Altronics, while the other uses mostly discrete parts (with one extra IC) and is available as a complete kit. Up to 16 transmitters can be used with one receiver, and multiple independent receivers can be built without the risk of the transmitters accidentally triggering the wrong receiver. The receiver can be powered from 12V or 24V DC; there are slight component differences between the two options – the relay coil voltage varies, as does the value of one resistor. The receiver provides SPDT relay outputs that can switch low-voltage AC or DC up to 10A (possibly more if you choose a beefier relay). Assuming you have gathered the parts, we will get straight into construction. After that will come the testing and setup instructions. Construction Both transmitter versions are built on PCBs measuring 29.8 × 39.4mm, with some common components including the SOIC-14 microcontroller, regulator, capacitors and a resistor. They vary in the UHF transmitter section, which can either be a prebuilt 68 Silicon Chip module (for the PCB coded 10109232) or built from discrete components (PCB coded 10109233). The latter PCB includes more surface-­ m ounting parts, making assembling slightly more challenging. However, it doesn’t have any parts with particularly closely-spaced leads, so anyone with reasonable soldering skills should have a good chance of building it successfully. Transmitter construction The PCB overlays for the two transmitter boards are shown in Figs.4 & 5. Whichever transmitter you build, they are housed in a remote control enclosure that measures 37 × 63 × 17.5mm. This enclosure is designed for use with an A23 12V battery; you can also use an A27 12V battery with a smaller diameter but similar length. The PCB is positioned within the enclosure by a moulded protrusion in the base that fits into a location hole in the PCB. This hole is just at the top edge of switch S2. Take care with the locating pin in the enclosure, as it can break easily. If it is damaged, you can fix it by soldering a PCB pin into the locating pinhole on the PCB from the underside and drilling a 1mm hole into the Australia's electronics magazine keyfob base at the broken locating pin position. Trim the PCB pin at both ends so it’s flush with the PCB on top and just long enough to meet flush with the underside of the enclosure when the PCB is installed. IC1 will need to be programmed before it is soldered. This IC can be obtained pre-programmed from Silicon Chip (individually or as part of a transmitter kit), or you can program it yourself if you have a suitable programmer. We described a programming adaptor that can be used for this type of chip in the September 2023 issue (siliconchip.au/Article/15943). We’ll start with the construction steps that apply to both versions, then follow with separate UHF transmitter assembly descriptions. The common parts are in the sections at the top and bottom of the transmitter PCB, with the parts that vary all being in the middle, below the row of switches and above the through-hole diode and SOT-223 package regulator. Note that most SMD capacitors and inductors are unmarked, so you will need to rely on the packaging to show what they are and their value. Mount one component at a time to avoid mixing them up. Start by fitting IC1, making sure it is siliconchip.com.au Fig.4 (top): bend the module leads so that the pins can be soldered as shown here, with GND at the top and ANT at the bottom. The battery clips are soldered to the pairs of slots in the two lower corners of the board. Fig.5 (bottom): on the discrete transmitter PCB, the only new polarised part is the transmitter IC (IC2). When soldering the two SMD inductors, you must position them so their exposed copper leads are in contact with the PCB. the clips to be captured in moulded L-shaped corrals in the base of the enclosure. Module version parts orientated correctly. Solder pin 1 to the PCB and check the alignment to ensure the IC pins all align with the PCB pads before soldering the remaining pins. Also check that it’s sitting flat and not lifted on one side. After soldering, if any pins have a solder bridge between them, you can remove it with a dab of flux paste and some solder wick. The Identity can be set at this stage. If only using one transmitter, it can be left at the default of ‘0’ where none of the 1, 2, 4 or 8 links are made. For a different identity, connect one or more identity pins and the ground track using a solder bridge or a short wire soldered between the IC pins and the ground track. Table 5 (from last month) shows the 16 possible identity settings. Next, fit the 220W resistor and 100nF capacitor at either end of IC1. To do this, tack solder one end of the component and remelt the solder to straighten it, if necessary, before soldering the opposite end. Then add a bit of fresh solder (or flux paste) to the first joint and heat it to re-flow it so it is nice and shiny. Now install the three pushbutton switches, S1-S3. These are supplied with a kink in their leads and are more easily mounted if you straighten the siliconchip.com.au leads first with pliers, then insert the switch leads into the allocated holes, pushing each switch down so its body is in contact with the PCB. After that, install LED1, ensuring its polarity is correct (the longer lead is the anode [A]) and that the top of the LED lens is 10mm above the top surface of the PCB. Mount REG1, diode D1 and the two 1μF capacitors next. D1 is a throughhole component that needs to be inserted into the PCB holes with the correct orientation. Solder REG1 in place by one pin first, then remelt that joint if necessary to align the pins correctly before soldering the remaining pins, then the tab. The two 1μF capacitors can be soldered similarly to the 100nF capacitor and 220W resistor. The battery clips supplied with the enclosure should now be attached to the lower sides of the PCB. Solder these on both sides of the PCB, with the two prods inserted into the allocated slotted pads. Refer to our photos on page 73 to see how they should look once soldered in. Our prototype isn’t exactly the same as the final version, as we narrowed the prototype PCB slightly where the clips go. The final PCBs supplied will have a full-width PCB design that allows Australia's electronics magazine For the UHF module version (Fig.4), a 100nF capacitor needs to be soldered on the underside of the PCB; it is the only part on that side of the board. The UHF transmitter module can then be installed on the top side of the PCB, with its pins bent around the end of its PCB so it lies parallel to the main board, with a 1mm clearance between the main PCB. You can see how that was done on page 73. The module’s antenna is made from a 147mm length of 0.8mm diameter enamelled copper wire. Scrape 1mm of enamel off each end using a sharp craft knife, then close-wind seven turns on a 5.5mm diameter shaft (eg. the shank of a 5.5mm drill bit). Stretch the coil out to 13mm between the wire ends before soldering the ends to the PCB pads. The coil sits 1mm off the PCB. Discrete version parts Start with the discrete version parts by fitting IC2 – see Fig.5. Position it so the small pin 1 location dot aligns with that on the PCB. IC2 will have “F_113” etched on the top face. When it is orientated with the writing the right way up, pin 1 is at lower left. Crystal X1 can be mounted next. It is soldered at the very ends of the component. We recommend you mount the capacitors before the two inductors January 2024  69 (68nH and 470nH). Unlike the other passives, the inductors don’t have pads on all four sides. Therefore, you must ensure their exposed leads are sitting on the PCB before soldering the ends. If you can’t see this clearly, use a magnifying glass. If you want to be sure that the components have been soldered correctly, trace the connections to the other sections of the PCB to where there should be continuity. Their inductance values are low enough that they will appear as short circuits (or at least low-­resistance connections) to a multimeter. For example, pin 3 of IC1 should provide a low resistance reading to pin 6 of IC2. Additionally, check that there are no short circuits between component pins on the PCB that shouldn’t be connected. The board assembly is completed by fitting the antenna. Make it from a 167mm length of 0.8mm diameter enamelled copper wire. Strip the insulation from each end by about 1mm using a sharp hobby knife and close-wind it on a 6.5mm shaft (eg, the shank of a 6.5mm drill bit). Stretch it out to 13mm end-to-end before soldering in with a 1mm coil clearance above the PCB. Receiver construction The Secure Remote Monitor receiver PCB shown enlarged for clarity. Fig.6: the antenna wire is not shown on this diagram; refer to the photo above to see how it’s routed between the two ANT pads on either side. The polarised components on this board are IC1, REG1, LED1-LED3, D1, D2, S4, the three electrolytic capacitors and the receiver module. Match the pin markings on the receiver module with those shown here. 70 Silicon Chip Australia's electronics magazine The 70 × 96.5mm receiver PCB is coded 10109231 – see Fig.6. All the onboard components are throughhole types, giving you a break from the surface-­mounting parts that were on the transmitter. The assembled PCB fits nicely in a Ritec enclosure that measures 105 × 80 × 33mm. Install the resistors first, taking care to place each in its correct position. The resistor colour codes were shown in the parts list last month, but you should also use a digital multimeter to check each resistor before mounting it in place. Note the different R1 value for 24V use (470W 1W) compared to 12V (100W ½W or 1W). Diodes D1 & D2 are next. Make sure these are orientated correctly before soldering their leads. Then install the socket for IC1, ensuring its notched end matches the position shown in Fig.6. Wait to fit IC1 as that step comes later, after the power supply has been checked. Regulator REG1 is mounted vertically on the PCB as far down as it will go, to allow clearance for the lid when in the enclosure. siliconchip.com.au Next, install trimpot VR1, transistor Q1 and the BCD switch (S4). S4 must also be orientated as shown. Switches S2 and S3 can also be mounted now. The capacitors can then be fitted. The electrolytic capacitors are polarised and must be installed with the polarity shown (the longer lead is positive). Pay attention to the voltage ratings for the 10μF and the 100μF capacitors if you intend to use a 24V supply. For a 12V supply, 16V-rated capacitors can be used throughout. You can install the two 100nF MKT polyester capacitors either way around. LED1 mounts with the top of the lens up to 12mm above the surface of the PCB and the anode (longer lead) to the hole marked “A”. Switches S1 and S5 can be installed now, taking care to use the toggle switch at the S5 location and the pushbutton switch for S1. The two remaining LEDs (LED2 and LED3) mount horizontally with leads bent at right angles 6mm back from the rear of the package. Make sure you bend the leads so the longer anode lead is in the “A” pad. The height of the LED centres should be 5mm above the PCB’s top face. CON1 is the PCB-mounting barrel socket, while CON2 and CON3 are 2-way and 3-way screw terminals. Dovetail CON2 and CON3 together by sliding them along the side mouldings to produce a 5-way connector. Orientate all these connectors so the openings are toward the rear of the PCB, then solder them in place. Mount relay RLY1 next. Ensure you use a 24V coil relay if you will use a 24V DC supply or a 12V coil relay for 12V use. Now fit the headers for jumpers JP1, JP2 and JP3 and install the 433.9MHz receiver module. Before soldering the receiver module, compare the pin labels on the back of the module to siliconchip.com.au Fig.7: the front and rear panel drilling details. The large hole marked “C” on the rear panel is for a cable gland that secures the wires to the relay terminals. those in Fig.6 to ensure it is the right way around; there are two possible ways it could be fitted, and only one is correct. Your module might differ from ours, so don’t rely on the photos; check the pin connections. The antenna (not shown in Fig.6) is made from a 169mm length of 0.8mm diameter enamelled copper wire. It extends from the antenna pad adjacent to the UHF receiver to another pad between LED2 and LED3. We covered it with 1mm heat shrink tubing. That is not really required, but it produces smoother bends in the wire as the antenna is shaped. Make sure to scrape away the enamel insulation from both ends of the antenna wire before soldering it into position. close to 5V (4.75-5.25V). If this is correct, switch the power off and insert IC1 into the socket, taking care to orientate it correctly (with its pin 1 end at the notched end of the socket). Case preparation The front and rear panels need holes drilled to allow the LEDs and switches to protrude through and for access to the relay contact screw terminals and DC socket at the rear. Fig.7 shows all the panel drilling details. There is provision for a cable gland to secure any wires connecting to the screw terminals. Either a PG7 or PG9sized gland will fit. When using a PG9 gland, the nut that secures the gland to the back of the panel will need to have the circular fused-on washer cut Testing back to be flush with the straight sides IC1 will need to be programmed of the nut. before use. You can order a pre-­ To do that, only the washer sections programmed device from Silicon Chip on directly opposite sides of the nut (either individually or as part of a need to be brought back to the shape short-form receiver kit). You can also of the hexagonal nut so those sides of program it yourself using the hex file the nut can sit flush on the PCB and available from our website. top lid of the enclosure. This can be Before plugging in IC1, apply power done with side cutters and a file. and check that the voltage between The panel artwork (Fig.8) can be pins 1 and 20 of its socket measures downloaded from our website as a PDF file and printed onto a stickyFig.8: you can download this panel backed label. We have instructions on label artwork from the Silicon making labels at siliconchip.au/Help/ Chip website, print it onto adhesive FrontPanels stock and stick it to the front and Once made, the labels can be affixed rear case panels. Stickers are also to the panels after drilling. Cut out the supplied with the transmitter kits. holes in the label with a sharp craft knife. There is also artwork to make labels for the transmitters. The two Australia's electronics magazine January 2024  71 Rolling Code Systems – frequently asked questions One question that’s often asked about rolling code systems is what happens if one of the switches on the transmitter is pressed when the transmitter is out of range of the receiver. Will the receiver still work when the transmitter is later brought within range, and the button pressed again? This question is asked because the code the receiver was expecting has already been sent (but not received), and the transmitter has rolled over to a new code. How does the system get around this problem? The answer is that the receiver will process a signal that is the correct length and data rate, but it will not trigger the relay unless it receives the correct code. So if the signal format is valid, but the code is incorrect, the receiver then calculates the next code that it would expect and checks this against the received code. If it matches, the receiver will trigger the relay; that means it missed one button press. If the code is still incorrect, the receiver calculates the next expected code, and it will do this up to 10 times, to handle cases where there have been multiple transmitter button presses out of range. If none of these are correct, the receiver then changes its operation to allow for a possible valid signal more than 10 codes ahead. The receiver waits for two valid separate transmission codes before restoring correct operation. On the first receipt of a valid transmission, it looks ahead up to 200 codes, so it is more likely the required valid code will be found, but it doesn’t trigger the relay. The Learn LED lights during this look-ahead operation. If a valid code is found, the receiver waits for the next code sent by the transmitter. This following code must also be correct before the receiver will operate the relay. If only one or neither code is correct, the receiver will not take action. If it’s more than 200 codes ahead, the transmitter will need to be re-registered to operate the receiver. You can test this process by switching the receiver off and pressing one of the remote control switches 10 times or more. Then switch on the receiver and press one of the switches again. 72 Silicon Chip The Learn LED will light, indicating that the look-ahead feature beyond the initial 10 times is activated. The selected function on the remote should operate on the next press of the switch, and the Learn LED extinguishes. While two successive transmission codes could be intercepted, recorded and re-sent in an attempt to activate the receiver, these codes will not be accepted by the receiver. That’s because they have presumably already been received and processed, and the receiver has already rolled past those codes. It will look forwards but not backwards. Another transmitter with a different identity will still operate the receiver (provided it has been synchronised in the first place). That’s because the receiver tracks each transmitter’s rolling codes separately. Calculating the code Another question that’s often asked is how the receiver knows which code to expect from the transmitter since it changes each time. The answer is that the transmitter and the receiver both use the same series of calculations to determine the next code. They also both use the same variables in the calculation; unique values that no other transmitter uses. For our Secure Remote Switch, we use a linear congruential generator (LCG) in conjunction with a 31-bit pseudo-­random number generator (PRNG). The LCG uses an initial seed value, an addition value and a multiplication factor to produce a nominally random result. For example, if consecutive codes have the number 3 added and then multiplied by 49, with the same starting number, both the transmitter and receiver will go through the same sequence. But the actual numbers used are very large, making it difficult to predict the next code by peeking at a few values in the sequence. The code is 48 bits long, with 281,474,976,710,656 possible values (that’s over 281 quintillion or 2.8 x 1014). One problem with the LCG is that it can produce recurring values; depending on the factors, it can produce the same number more than once within a Australia's electronics magazine few hundred rolling code calculations. To prevent this, we include a second layer of randomisation. So once we have the value from the LCG calculation, this value is used in the PRNG to generate a pseudo-random number for the rolling code. The PRNG randomisation runs between one and 256 times before providing the ‘random’ number for the rolling code value. The number generated is then used as the seed in the LCG for generating the next number in the sequence. Using the PRNG makes it difficult to predict the rolling code sequence even if the multiplier or addition value for the LCG is known. We throw further complications by also using code scrambling. The calculated code is not sent in the same sequence each time. There are 32 possible scrambling variations that are applied to the code, so predicting the next code becomes very difficult. What if the transmitter rolling code is identical for two consecutive codes, and the first of these identical codes is intercepted and re-transmitted to open the lock? Our system has safeguards to prevent the same code from appearing twice in succession. There is a check for the same code repeating itself for consecutive codes. If the code is the same, the duplicate is effectively skipped, preventing this possibility. Multiple transmitters Wouldn’t the receiver lose its synchronisation if several transmitters were used? No, because each transmitter operates independently. Each of the 16 possible transmitters used with a given receiver has its own different identity from one to 16. The codes sent by each transmitter are different due to the unique identifier within each transmitter IC that sets the rolling code calculation. Also, the code includes the transmitter identity value that differs between each transmitter. The receiver stores up to 16 different rolling code and calculation parameters, one for each identity, so each transmitter is treated independently. Therefore, even if one transmitter is not used for months while other transmitters are used frequently, its rolling codes will remain synchronised with the receiver. siliconchip.com.au On the transmitter, S1 is red, S2 is blue and S3 is black. variations cater for the timer options, as shown in Table 2 last month, set using JP2. Note that the rear panel artwork and the receiver PCB have square white blocks to allow you to mark the power supply voltage required. Use a marker pen to colour the squares depending on whether the board has been built for a 12V or 24V supply. Four self-tapping screws are provided with the receiver enclosure to secure the PCB to the base. Similarly, two screws are supplied to secure the two halves of the enclosure. Registering a transmitter To register the transmitter with the receiver, press the Learn switch (S2) on the receiver. The Learn/Clear LED (LED1) will light. On the transmitter, remove the battery and reinsert it while pressing and holding switch S1. This will set the transmitter to Synchronisation mode (with its Acknowledge LED lit) and send the registering code when S1 on the transmitter is released and then pressed again. The rolling code is continuously updated during the synchronisation time between when S1 is released and when it is pressed again. This randomises the rolling code generation sequence to an undetermined point, due to the rapid rate of the code recalculation. On average, it is updated around 500 times per second. The rolling code is then well into its generating sequence. This makes it hard to guess the code based on possible MUI values, even if the initial seed value for the code generation is known. siliconchip.com.au The acknowledge LED on the receiver will flash twice, and the Learn LED will extinguish once registration is complete. If it does not seem to work, try this registration procedure again. Test the transmitter and check that the receiver responds by switching the relay on and off. It will take a couple of attempts before the transmitter and receiver start working together. Deregistering a lost transmitter Any transmitter that has been registered can be prevented from operating the receiver; for example, if a transmitter is lost and you don’t want it to be used by an unauthorised person. Deregister the lost transmitter by selecting the transmitter’s Identity using BCD switch S4. The switch is labelled 0 to F, where the labels A-F correspond to identities 10-15. Then press and hold the Clear button (S3) for over one second. The Learn/Clear LED will light initially, then extinguish after S3 is released and the transmitter is deregistered. If you are unsure of the Identity of the lost transmitter, you can deregister all the registered transmitters, one at a time, then re-register the other transmitters again. Jumper options There are three jumper positions on the receiver board; Table 1 to Table 4, published last month, show what they do. JP1 selects the timer length multiplier (see Table 1). The range is 250ms to 60s with JP1 out (the ×1 range) or 60s to 4.5 hours with JP1 in (the ×255 range). Table 4 shows typical timeouts versus TP1 voltages as trimpot VR1 is adjusted. JP2 affects the function of the buttons on the remote control, as shown in Table 2. JP3 affects the function of switch S1 on the receiver, as SC shown in Table 3. The modulebased (left) and discrete (right) versions of the transmitter PCB shown enlarged for clarity. We have used an A23 12V battery, which fits snugly with the recommended battery clips. Australia's electronics magazine January 2024  73