APPLICATION NOTE Short Form Description of the Atmel PEPS System Atmel ATAN0073 Introduction This document introduces the Atmel implementation of a complete passive entry/passive start (PEPS) system. The orientation-independent LF wake-up functionality with key localization, the required RF (one-way or two-way) communication and the immobilizer LF communication based on the Atmel Open Immobilizer Protocol (AOIP) are described. The Atmel car access reference system (CARS) provides a clear demonstration of how the in-vehicle system and key fob works. The following pages briefly describe the system, functions, and implementation using Atmel parts running as a PEPS system. This paper briefly provides an overview of all functions implemented but does not describe implementation details. Full documentation is currently being prepared and will be available soon. Features Complete Atmel car access system featuring: Passive entry/passive start Immobilization Remote keyless entry One-way RF communication Two-way RF communication Direction-independent 3D LF key detection and localization Unilateral and bilateral authentication protocol AES128 hardware crypto engine Supports four (one-way RF) and eight (two-way RF) key fobs Hardware and software reference implementation available Key fob with integrated RF Tx, 3D LF receiver, 1D LF immobilizer (Atmel ATA5791) Car side with six-channel LF PEPS antenna coil driver (Atmel ATA5279) Intelligent LF immobilizer base station (Atmel ATA5272) Intelligent RF receiver (Atmel ATA5782) Body computer emulation using Atmel ATmega2560 on main board PC GUI to configure the system and visualize the communication
1. Purpose This document describes the Atmel PEPS system built around the Atmel ATA5791 PEPS controller. It includes the immobilizer interface, the 3D LF receiver, and the RF transmitter on the key fob side as well as the vehicle side microcontroller controlling the RF receiver, the immobilizer base station, and the six-channel LF driver. The software implements all necessary functions for unilateral or bilateral authentication, key fob localization, and field-supplied immobilization. 2. General System Description 2.1 Main System Function The system enables hands-free system vehicle functions, allowing the driver to lock/unlock the vehicle doors and to start/stop the vehicle engine without performing any manual action on the key fob or use a mechanical key. These functions focus on a secured procedure of fob recognition to determine driver presence and authorization. 2.2 System Architecture The system consists of the following functional blocks: One or more vehicle LF antennas driven by the Atmel ATA5279 One Atmel ATA5724 or Atmel ATA5780 vehicle RF receiver (or the Atmel ATA5830 for two-way RF transceivers) One to four Atmel ATA5791 key fobs (or the Atmel ATA5790 and Atmel ATA5830 for two-way RF) One limp home antenna (immobilizer function) connected to the Atmel ATA5272 base station One vehicle control unit emulated by the Atmel ATmega2560 Door sensors and locks Figure 2-1. System Architecture 2
2.3 System Overview When the driver approaches the vehicle, the fob is identified using secure wireless communication between the vehicle control unit (VCU) and the fob. A driver/passenger event (such as contact with the door handles) triggers this authentication. Once the fob has been authenticated, the doors are automatically unlocked. This function is called passive entry (PE). When the driver presses the vehicle s start/stop button, a new authentication process is executed. If the key fob is identified and localized inside the car, the ignition procedure is started. This function is called passive start (PS). All these actions require no action to be taken on or manipulation of the key fob. The driver only has to press start/stop button again to stop the vehicle. Vehicle LF antennas are there to detect where the key fobs are. In other words, they determine if the key fob is inside or outside the vehicle cabin. The number of antennas and their positions vary to maintain system flexibility to cater to various vehicle types. 2.3.1 One-Way RF System The authentication process is generally based on bidirectional wireless communication between the key fob and the vehicle. In one-way RF systems the remote key receives data from the vehicle via an LF downlink and sends data to the vehicle using an RF uplink. The LF downlink is used first to wake up the key and to receive commands and data for the authentication process. The response is then provided to the vehicle via the RF uplink. 2.3.2 Two-Way RF System In two-way RF systems the LF downlink mostly is only used to wake up the key fob and establish the RF uplink and downlink. The required communication during the authentication process is fully performed using the bidirectional RF link. 3
3. System Functions 3.1 Function Overview The proposed hands-free system (HFS) provides the following main functions: Immobilizer (IMMO) Remote keyless entry (RKE) Passive entry (PE) Passive start (PS) Passive lock (PL) Additional functions concerning system configuration: A learning procedure for pairing the vehicle and key fob Synchronization of RKE rolling code End-of-line parameters (RSSI compensation ) The following sub-functions are common to the PE/PS/PL functions Fob wake-up Fob authentication Fob localization 3.2 Passive Entry The passive entry function allows the driver to unlock the vehicle s doors without any user action on the key fob. Instead a user action is needed to trigger the system, such as approaching the door handle, touching the door handle, or pulling on it. When the car has detected this action, it starts the: Outside fob localization (search for fob outside the vehicle cabin, preferably by LF) Fob authentication Finally, if at least one paired key fob is localized outside the vehicle cabin and authenticated, the vehicle automatically unlocks its doors. 3.3 Passive Start/Stop The passive start function allows the driver to start/stop the vehicle engine without the user interacting with the key fob. A start/stop engine button is added in the vehicle cabin (replacing the lock cylinder) which activates the passive start function. Once this action is detected, the vehicle initiates: Inside fob localization (search for fob inside vehicle cabin, preferably by LF) Fob authentication Communication between a vehicle and a fob is almost the same as for passive entry. The main difference between these two functions is that passive entry searches for fobs located outside the vehicle cabin, whereas passive start searches for fobs located inside the vehicle cabin. Finally, if at least one paired key fob is localized inside the vehicle cabin and authenticated, the vehicle starts/stops the engine. 3.4 Passive Lock The passive lock function allows the driver to lock the vehicle doors without any user action on the key fob. Before PEPS systems had been introduced, the RKE function was used to lock vehicle doors. A button on the fob was dedicated to door locking. With PEPS systems, a lock button or a sensor is generally added on door handles to avoid fob manipulation. Users only have to push this button or touch the handle to lock doors. 4
3.5 RKE Once this action is detected, the vehicle initiates: Outside fob localization (search for fob outside the vehicle cabin) Inside fob localization (search for fob inside vehicle cabin) Fob authentication Finally, if at least one key fob is localized/authenticated outside the cabin and if no paired key fob is localized/authenticated inside the cabin, the vehicle locks its doors. Instead of keeping the doors unlocked if keys have been detected inside the cabin, it is also possible to blacklist those keys and disable them for the next passive entry request. In general, even with PEPS systems, in addition to lock and unlock functions, more remote functions may be implemented in the key fobs. Special care has been taken to avoid unwanted interaction between PEPS and RKE. For example, if the driver wants to lock the doors via RKE, the vehicle needs to check for active keys inside the vehicle cabin. If a paired key fob is detected inside the cabin, it must be disabled for the next passive entry request. 3.6 Immobilizer The immobilizer function is a backup procedure in case the passive start does not work properly or the key fob s battery is empty. It uses the same authentication procedure as passive start does but using short range LF LF communication. The LF field generated by the vehicle base station supplies the key fob with power via antenna coupling. This magnetic field then serves as a bidirectional communication channel. For more information on the highly secure, ultra-low-power Atmel AES-128 transponder with immobilizer function in compliance with the Atmel Open Immobilizer Protocol, go to http://www.atmel.com/devices/ata5580.aspx. 3.7 Key Fob Wake-Up In a hands-free PEPS system the key never knows in advance when a communication sequence requires the PEPS controller to actively respond to a request. Leaving the controller continuously active would consume more power and thus reduce battery life. The Atmel solution allows the controller to stay in sleep mode until a wake-up event occurs. A 3D LF amplifier, operating in a highly sensitive, ultra-low-power listen mode, continuously checks for a valid LF signal. If it receives a valid LF signal containing the correct vehicle-specific wake-up ID, it generates a signal to wake up the PEPS controller. 3.8 Key Fob Localization Localization is a key feature of any PE/PS system. Localization means the key is detected when near the vehicle and, depending on the strategy desired, can distinguish if the key is inside or outside the vehicle. Localization is performed by measuring the LF signal level (RSSI) during communication with the vehicle. The RSSI is acquired by the fob and sent back to the vehicle. The vehicle then analyzes the data to determine the fob s position. Because the spatial orientation of the key fob is not known, the RSSI measurement has to be performed for the x, y, and z axes using three discrete antenna coils or one 3D coil. The vehicle has four to six LF antennas. These antennas produce an LF magnetic field which covers the vehicle cabin as well as the perimeter near the vehicle. The primary goal is to localize a fob inside or outside the vehicle cabin. 3.8.1 Vehicle Cabin LF Coverage The antennas should be arranged so that the most common fob locations (such as seats) are covered, whereas coverage of uncommon fob locations (such as under the roof) is not mandatory. In most cases, it is sufficient to place three centered antennas inside the vehicle to cover both sides of the vehicle. The number, locations, and orientation of the antennas may vary depending on the size of the vehicle. A common scenario is: Coverage for the front of the car (driver and front passenger feet, top of console, etc.) the antenna is positioned inside the center of the dashboard Coverage of front seats and back seats with the antenna positioned between the front seats in the armrest Coverage of the back seats and trunk with the antenna positioned between the rear seats and the trunk In addition, each antenna s LF power is adjustable so that a constant field strength matches the cabin perimeter. 5
Figure 3-1. Inside Cabin Antennas 3.8.2 Outside Vehicle LF Coverage For the passive entry function, LF antennas need to be positioned to cover vehicle access paths. These paths are: The left side of the vehicle (front and rear door) The right side of the vehicle (front and rear door) The trunk One configuration option is to place an LF antenna in each door and one in the trunk. With more powerful antennas (e.g., higher driving current), only one per side is required to cover the front and rear door at once (the antenna should be placed inside the door pillar between the front and rear door). Figure 3-2. Outside Cabin Antennas 6
3.8.3 Trigger Sequence for Inside Localization For passive start, the inside localization process is started using only the cabin antennas. One after the other, all antennas are activated. The LF field generated covers the vehicle cabin as well as the immediate perimeter of the vehicle. For each vehicle cabin antenna trigger, the fob measures the LF field RSSI and sends it to the vehicle. The vehicle gathers all the RSSI values for further computation. These values are either compared to a threshold (internal threshold) or computed together to determine if the fob is located inside the vehicle cabin or not. The vehicle manufacturer must know the vehicle s LF cartography to be able to define the threshold value. Figure 3-3. Thresholds for Inside Localization In the above constellation, a good threshold accepting a key fob as inside the cabin seems to be if a RSSI level higher than 30 has been returned from the fob for at least one cabin antenna. 3.8.4 Trigger Sequence for Outside Localization The outside localization process is used for the following functions: Passive entry Passive lock Passive approach Depending on the access strategy desired by the manufacturer for passive entry, one or more antennas can be activated. Possible strategies are (for information on the antenna position reference, see Figure 3-4 on page 8). Table 3-1. Access Strategies Event Access Level Selected Access Antenna Used Vehicle looks for fobs at all access points Antennas 1/2/3 User pulls door Vehicle looks for fobs at all access points except trunk Antennas 1/2 handle on driver s side (antenna 1) Vehicle looks for fobs on the same side where access point is triggered Antennas 1 Vehicle looks for fobs at the access point triggered Antenna 1 Regarding inside localization, all antennas selected are activated one after the other. 7
Figure 3-4. Thresholds for Outside Localization Because protocol timings often are more critical for passive entry compared to other functions, antenna trigger order is adjustable to obtain the fastest possible response during passive entry. Therefore, the first antenna activated is the one covering the area where the door handle is pulled. In fact, the probability of locating a fob next to the door triggering the passive entry process is higher compared to other access areas. The vehicle antenna activation sequence is set based on fob location statistics. In the example above, with the access level set to Vehicle looks for fobs at all access points, someone pulling the driver handle will start the antenna sequence 1 2 3 (driver side, then passenger side, then trunk area). If a fob successfully responds after antenna 1 activation, checking the range of the next antenna is not necessary. For other functions (passive lock, passive approach, walk-away, etc.), no specific trigger order sequence is required. The fob sends the measured LF RSSI to the vehicle for each vehicle antenna trigger. Once enough RSSI values have been sent to the vehicle, the vehicle can determine if the fob is located outside the vehicle either by: Checking if a fob has responded without checking the RSSI value if the fob s location is known from the previous action (passive entry, walk-away). Comparing the RSSI value with a threshold (external threshold) (passive approach, walk away). Different threshold values can be used to verify if the fob is located near or far from the vehicle. The vehicle manufacturer must know the vehicle s LF cartography to be able to define these threshold values. Finally, the vehicle has a list containing all fobs which have responded while also fulfilling the outside localization criteria. However, the field generated from these antennas also covers part of the vehicle cabin. Fobs located inside the cabin may send the same RSSI value as fobs located outside the vehicle. A second trigger sequence for inside localization is executed to resolve this issue. 8
3.9 Authentication Security against opening the car or stealing it is one point that requires special treatment in PEPS systems. Before a key fob is allowed to gain access to the vehicle or start the engine, the system requires successful authentication between key fob and car. The authentication process is based on built-in AES 128-bit encryption integrated within the Atmel ATA5790/91 PEPS controllers as a hardware module. During system configuration, the vehicle and fobs exchange one or two 128-bit secret keys depending on the authentication procedure used (unilateral or bilateral). Both unilateral and bilateral authentication follow the challenge/response principal. Common to both procedures is that it is always the vehicle that initiates communication with a key fob. 3.9.1 Unilateral Authentication In unilateral authentication the vehicle authenticates the key fob. Having received a valid UID from the fob, the vehicle generates a random number (nonce) and transmits this as an LF challenge signal to the key fob. In response to the vehicle, the fob encrypts the challenge and returns it via RF. The vehicle follows the same procedure and encrypts its nonce. If the received response and encrypted nonce are identical, the key is authenticated to the vehicle and the access procedure is enabled and the doors are unlocked. 3.9.2 Bilateral Authentication A bilateral authentication offers increased security compared to unilateral authentication. Here the fob authenticates the vehicle first before responding and after this the vehicle then authenticates the fob. Both authentication steps use separate secret keys. Provided that the received UID is valid, the vehicle generates a nonce, encrypts the nonce with the secret key 1 to get *nonce* and transmits both via LF to the key fob. The fob now also encrypts the received nonce using secret key 1 and compares it to the received *nonce*. If these are identical, the vehicle is authenticated to the key fob. In a second step this first encryption result is encrypted again, this time using secret key 2, and sent as a response via RF to the vehicle. The vehicle has performed the same step and compares its result with the received response. If these are identical, the fob is also authenticated to the vehicle. The entry or start process continues. Because this procedure requires additional data to be exchanged and the encryption process is two times longer, it is lengthier than unilateral authentication. Should timing requirements for passive start be less critical than for passive entry, bilateral authentication is used for passive start while unilateral authentication is used for passive entry. 9
4. Communication Interfaces In general, a PEPS system communicates bidirectionally, implementing three different communication channels: Bidirectional short-range (4cm to 5cm) LF communication Unidirectional medium-range (~2m to 3m) 3D-LF communication Long-range (10m to 30m) RF communication One-way RF Two-Way RF 4.1 Short-Range LF Communication Short-range bidirectional LF communication is used for two different purposes. On the one hand it serves as an immobilizer according to the Atmel Open Immobilizer Protocol (AOIP) and on the other hand it is used for system configuration. In learning or pairing mode all relevant data for authentication (secret keys, length of challenge and response) or communication (modulation scheme, data rate) are transferred from the car to the key and stored in EEPROM. In both cases, the circuit operates battery-independent. The Atmel ATA5272 base station applies the magnetic field that supplies the circuit with power and is used for bidirectional communication. 4.2 Medium-Range LF Communication Due to its extremely low power consumption in listen mode, the medium-range LF interface inside the key is best suited for continuously checking if a vehicle is requesting to wake up the key fob PEPS controller. This interface consists of three channels equipped with three separate orthogonal antenna coils or one 3D coil to compensate for the unknown spatial orientation of the key. Triggered from a user action on the vehicle (touching the door handle), the Atmel ATA5279 LF driver in the vehicle transmits LF commands for searching an associated key. If a key wakes up, it responds using the RF channel. 4.3 Long-Range RF Communication Common to both RF configurations is the need for an anti-collision method. The PEPS system must be capable of supporting up to eight (four in one-way RF) key fobs simultaneously. But if more than one key responds at the same time, the receiver in the car is not able to decode the signal. A common method for avoiding collisions of this kind is the time domain method. Protection against collisions is achieved by assigning time slots to each fob. Assigning each key a fob index during configuration allows the keys to identify what time slot to use for responding. This way no fob is allowed to send signals at the same time. The current implementation is configured so that the first time slot is assigned to every key. If there is only one key near the car, the vehicle gets the respond faster. If more than one fob is present, the common time slot is followed by four to eight slots assigned to individual keys. The vehicle can also modify the fob response order using the fob index. 4.3.1 One-Way RF One-way RF communication is performed with the single Atmel ATA5791 PEPS controller chip. In addition to the RF transmitter, it also contains the immobilizer circuit and the 3D LF receiver. The RF-Tx is based on a fully integrated fractional-n PLL, VCO, and loop filter covering 315MHz and 433MHz (software-programmable). 4.3.2 Two-Way RF Two-way RF communication requires two chips in the key fob. One is the Atmel ATA5790 PEPS controller without RF and the other one is the Atmel ATA5831 RF transceiver which offers frequencies of 315MHz/433MHz/868MHz and 915MHz with one 24.305MHz crystal. 10
5. CARS Kit Implementation The car access reference system (CARS) is used to demonstrate all implemented functions of the previously mentioned PEPS system. It is built around a body control computer emulation using an ATmega2560 on a base board with application boards plugged in on top. Figure 5-1. Complete CARS Kit Hardware With its PC-GUI, different steps can be visualized and parameters modified wherever necessary. The software itself is built and partitioned so that customer-specific modifications and adaptations can be easily carried out. The GUI is launched with the start screen shown below. 11
Figure 5-2. Start Screen The menu allows various windows to be selected to configure, control, transmit, and receive information used for a PEPS application. Figure 5-3. Different Windows for Controlling the Application 12
Atmel Corporation 1600 Technology Drive San Jose, CA 95110 USA Tel: (+1) (408) 441-0311 Fax: (+1) (408) 487-2600 www.atmel.com Atmel Asia Limited Unit 01-5 & 16, 19F BEA Tower, Millennium City 5 418 Kwun Tong Roa Kwun Tong, Kowloon HONG KONG Tel: (+852) 2245-6100 Fax: (+852) 2722-1369 Atmel Munich GmbH Business Campus Parkring 4 D-85748 Garching b. Munich GERMANY Tel: (+49) 89-31970-0 Fax: (+49) 89-3194621 Atmel Japan G.K. 16F Shin-Osaki Kangyo Building 1-6-4 Osaki Shinagawa-ku, Tokyo 141-0032 JAPAN Tel: (+81) (3) 6417-0300 Fax: (+81) (3) 6417-0370 2013 Atmel Corporation. All rights reserved. / Rev.: Atmel, Atmel logo and combinations thereof, Enabling Unlimited Possibilities, and others are registered trademarks or trademarks of Atmel Corporation or its subsidiaries. Other terms and product names may be trademarks of others. Disclaimer: The information in this document is provided in connection with Atmel products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Atmel products. EXCEPT AS SET FORTH IN THE ATMEL TERMS AND CONDITIONS OF SALES LOCATED ON THE ATMEL WEBSITE, ATMEL ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL ATMEL BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS AND PROFITS, BUSINESS INTERRUPTION, OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF ATMEL HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Atmel makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and products descriptions at any time without notice. Atmel does not make any commitment to update the information contained herein. Unless specifically provided otherwise, Atmel products are not suitable for, and shall not be used in, automotive applications. Atmel products are not intended, authorized, or warranted for use as components in applications intended to support or sustain life.