Silicon Laboratories Si4010 Series User manual

Rev 1.0 7/10 Copyright © 2010 by Silicon Laboratories AN517
AN517
Si4010 KEY FOB DEMO WITH AES CAPABILITY
1. Purpose
Thank you for your interest in Silicon Laboratories’ Si4010 SoC RF key fob demo with AES capability. The Silicon
Laboratories Si4010 key fob demo with AES capability (4010 DA AKF 434) contains everything you need to
familiarize yourself with and evaluate the Si4010 RF SoC. The key features of the development platform are as
follows:
The key fob demo board has five push buttons and one LED output, a PCB antenna, and a battery in a plastic
case.
The key fob uses hardware-accelerated 128-bit advanced encryption standard (AES) encryption and rolling
counter for RKE application.
The receiver demo board has a graphic LCD to display received key fob commands.
The provided software pack contains all the documentation and files needed to develop a user application. It
contains Silicon Laboratories’ Integrated Development Environment (IDE) for software debugging and supports
the use of the Keil C compiler, assembler, and linker toolchain.
Contains demo applications using API functions and the key fob demo application.
2. Kit Contents
The kit contains the following items:
4010 RKE universal key fob 434 (dual footprint, SOIC populated) with CRD2032 battery (P/N 4010-DAPB 434)
Key fob plastic case 1 (translucent grey, P/N MSC-PLPB1, shown in Figure 1)
Si4311 FSK receiver 434 (P/N 4311-DA CB 434, shown in Figure 2)
434 MHz antenna (P/N MSC-50-434, shown in Figure 2)
WDS CDROM set (P/N MSC-DKSW1)
Figure 1. 4010 RKE Universal Key Fob and Plastic Case (P/N 4010-DAPB 434 and MSC-PLPB1)

AN517
2 Rev 1.0
Figure 2. Si4311 FSK Receiver 434 (P/N 4311-DA CB 434) with 434 MHz Antenna (P/N MSC-50-434)

AN517
Rev 1.0 3
3. Key Fob Demo with AES Capability
The 4010-DAPB 434 RKE key fob transmitter and the Si4311 FSK receiver 434 are the transmit and receive
devices used in this key fob demo. This transmit/receive pair can be used to evaluate the capabilities of the Si4010
transmitter and the Si4311 receiver.
3.1. Operation of the Demo
The Si4311 demo receiver board uses the following RF parameters:
9.6 kbps
FSK modulation
433.92 MHz
±70 kHz deviation
If any push button is pressed on the key fob, it sends a message to the receiver. The demo uses Silicon Labs'
general EZMacPRO protocol.
3.2. Association
To enable the receiver to react to the button presses on the key fob(s), they have to be paired (i.e., the key fob has
to be associated to the receiver by pressing the left and right buttons simultaneously on the key fob).
3.2.1. Meanings of the Different Fields
AES—Defines whether the transmitter is using AES-128 encryption or not. It is set to 0x01; then, the Rolling
counter field of the packets is extended to 16 bytes length (12 dummy bytes are appended) and is encoded by
AES-128. Other fields of the packet are not affected by the encryption.
Address—4 bytes of key fob address. The four byte random number factory burned in the Si4010 is used as
the address.
Rolling Counter—The transmitter increments a 4 byte counter after every packet transmission. This counter is
stored in the MTP memory of the Si4010.
If the receiver accepts the association, it registers the Address, Master Key, and Rolling Counter value of the
requesting key fob.
The Master accepts the association if it is in pairing mode and there is a free slot for a key fob (i.e., if there are
fewer than four key fobs associated to the receiver).
After power up, the Receiver board is in pairing mode automatically. After pairing, it goes to normal packet
reception mode. The Pairing mode can be invoked by pressing the push button, PB, on the Receiver Board. This
button needs to be pressed before the second and any subsequent pairing. If the PB is pressed for more than one
second, the receiver disassociates all key fobs.
Table 1. General EZMacPRO Extended Packet Configuration Used by Demo Key Fobs
Preamble SynchWord MACHeader MACPayload CRC
Min.13 bytes 2 bytes 5 bytes 0...64 bytes 2 bytes
0xAA...0xAA 0x2DD4 CTRL CID SID DID PL NHDR NWK payload CRC
Table 2. The MAC Payload Field of the “Associate Request from TX only Device” Packet
MACPayload
NHDR NWK Payload
1 byte 1 bytes 1 byte 1 byte 4 byte 4 byte
0x47 0x05 0x01 AES Address Rolling Counter

AN517
4 Rev 1.0
3.3. Button is Pressed on the Key Fob
If any single button or button combination (except association combination) is pressed on the key fob, then it
transmits a key fob data packet showing the button number in the button field.
3.3.1. Meaning of the Different Fields
AES—Defines whether the transmitter is using AES-128 encryption. It is set to 0x01, then Button, Temp,
Battery, and Rolling counter fields of the packets are extended to 16 bytes length all together and are encoded
by AES-128. Other fields of the packet are not affected by the encryption.
Address—4 bytes of key fob address. The four-byte random number factory burned in the Si4010 is used as
the address.
Button—Each bit of this byte corresponds to the status of a push button on the key fob. If the bit is set, the
given button is pressed. If the bit is cleared, the button is released.
TEMP—The temperature is encoded as a signed 16-bit integer. Each incremental bit of temperature reading
represents 0.1 °C. If the temperature function is not implemented in the key fob, this field is set to 0xFFFF.
Battery—1 byte unsigned char showing the actual power supply status of the key fob. It must be interpreted as
follows:
LBD Available Bit—If set, the LBD status bit shows the actual status of the battery.
LBD Status—Shows whether the actual battery voltage is above the LBD limit (set if the actual voltage is below
the threshold). The LBD limit is configurable in the key fob program.
Battery Voltage Available—If set, the battery voltage information is available.
Battery Voltage—It shows the actual battery voltage of the key fob. Each increment of the battery voltage bit
corresponds to 50 mV. However, 0 represents 1.7 V.
Rolling Counter—The transmitter increments a 4 byte counter after every packet transmission. This counter is
stored in the MTP memory of the Si4010.
Since AES is used by the key fob, the receiver board decrypts the encrypted portion of the packet and discards the
dummy bytes. Then, the receiver board checks the sync counter value against its own copy of the sender key fob's
counter. If the key fob sync counter value minus the copy counter value is more than zero and less than a
configurable window value (default value is 10), the master increments the copy.
Table 3. The MAC Payload Field of the “Key Fob Data” Packet
MAC Payload
NHDR NWK payload
1byte 1byte 4bytes 1byte 2bytes 1byte 4byte
0x04 AES Address Button TEMP Battery Rolling Counter
1bit 1bit 1bit 5bits
Lbd Available LBD Status Battery Voltage Available Battery Voltage[4:0]

AN517
Rev 1.0 5
3.4. Key Handling
Figure 3. SRW AES128 Applications Key Hierarchy
AES keys used in the demos are generated according to the hierarchy shown in Figure 3. Only the Application
level keys are stored on the receiver board. The function level keys are calculated at power-up. The Session level
keys are calculated at their first use.
In the key fobs Function level, keys are not generated but only stored to save power. The Session level keys are
calculated at each power up.
The Assoc_SK is used for association packets, and the Btn_SK is used for encrypting the messages generated by
a button press.
3.5. Key Fob Firmware Description
The complete project of the program used in the demo key fob can be found in the Si4010 documentation kit in the
“rke_demo” folder.
The key fob wakes up for button push or battery insert. If the battery was inserted, the vSys_FirstPowerUp() API
function is called, which shuts down the chip after 600 ms. This is for safe startup in case of battery contact
bouncing. Upon button push wakeup, the system variables and hardware control registers are initialized first, and
the session keys used in the AES encoding are generated from the function keys and the device address. Then,
button debouncing is made.
If a valid button push is detected, first a packet is assembled and transmitted six times for the Si4320 receiver
demo board used in the Si4010 Simplified Key Fob Demo Kit (see details in “AN516: Si4010 Simplified Key Fob
Demo Quick Start Guide”). Then, a packet is assembled according to the description in the previous chapters. It is
transmitted in FSK modulation for the Si4311 receiver board (part of this kit), and then in OOK modulation for the
Si4312 receiver. The next step is to increment the sync counter stored in the MTP memory.
If there is no valid button push detected for 3.2 s, the program shuts down the chip.
Application
Level
MK: Master Key
SK: Session Key
RKE_MK
Function
Level AES_128AES_128 AES_128Node_Association Node_ButtonPress Functionzzzzzzzz
Btn_K
Session
Level
FuncX_K
Assoc_K
AES_128 12byte padding(0) +
Node Addr
Assoc_SK
AES_128 12byte padding(0) +
Node Addr
Btn_SK

AN517
6 Rev 1.0
3.5.1. Key Fob Firmware Flowchart
Figure 4. Key Fob Firmware Flowchart
Wake up
Battery
Insert? vSys_FirstPowerUp()Yes Shutdown
vSys_Setup( 15 )
Initialize application
Measure Vbat
Measure temp
Generate session keys
No
Button
pushed? Timeout?No
Shutdown
Yes
No
Assemble packet for Si4320
Yes
Is button
valid for
receiver?
Assemble packet for Si4311
Set RF parameters
Transmit packet
Set RF parameters
Transmit packet
Yes
No
Assemble packet for Si4311
Set RF parameters
Transmit packet
Increment sync
counter

AN517
Rev 1.0 7
3.6. Receiver Board Firmware Description
The Si431x Rx board receives the packets from the Si4010 key fob, and, by the packet headers, it decides what
kind of packet was received. Two packet types can be received: association packets or button press packets. The
Si431x Rx board has two operation modes: Association mode and Button press mode. A key fob can only
associate when the Si431x Rx board is in Association mode. If the Si431x is in Button press mode, then the
association packet will be discarded. During the first power up, the Si431x Rx board goes into Association mode,
and, after every key fob association, the firmware goes into Button press mode. The board can go back to
Association mode if the PB button is pressed. After an Si4010 key fob associates to the Si431x Rx board, the Rx
board can receive the button press packets. At every packet reception, the firmware updates the LCD and sends
an indication message to the PC via the UART interface. The LCD displays the associated key fob serial numbers
and the number of the last button pressed on the key fob. However, the firmware stores more information about
each associated key fob, such as AES keys, temperature, battery level, etc. Figure 5 shows a flow chart of the
receiver board firmware.

AN517
8 Rev 1.0
3.6.1. Receiver Board Firmware Flowchart
Figure 5. Basic Program Structure Block Diagram (1 of 2)

AN517
Rev 1.0 9
Figure 6. Basic Program Structure Block Diagram (2 of 2)
For details on how to program the Si4010, see the following documentation:
Si4010 Data Sheet
AN370: Si4010 Software Programming Guide
Si4010 Development Kit User's Guide

AN517
10 Rev 1.0
4. Demo Quick Start Guide
1. The first step is to insert the CR2032 battery into the 4010-DA PB 434 demo board and then place the board
with the battery into the plastic key fob case. Pushing any key will flash the LED on the key fob.
2. Connect the antenna into the SMA connector of the 4311-DA CB 434 receiver board.
3. Power up the Si4311 Receiver board by connecting it to the PC's USB port or by inserting batteries (3xAA) at
the back side of the board.
4. Switch the “S1” power supply switch to the proper position. If the board is supplied from the USB port, switch to
the “USB” state, or, if the board is supplied from the batteries, switch to the “Bat.” state.
5. After switching on the board, the LCD shows the Silicon Laboratories logo and the firmware version information.
The demo shows this information three times during the startup. This startup process can be skipped if the “PB”
button is pressed on the board.
6. Wait until the following screen appears.
7. Pair the key fob with the Receiver board by pressing the LEFT and the RIGHT buttons together on the key fob.
If the key fob can be associated to the receiver board, then the serial number of the key fob appears on the
display.
Note: Only four key fobs can be associated at the same time to the receiver board. The “PB” button on the receiver board has
to be pressed before every key fob association.
8. When the key fob is associated to the RKE receiver board, press any button on the key fob. The LCD screen
shows the number of the depressed button.
9. If the “PB” button is pressed for longer than 1 s, the RKE receiver board disassociates all associated key fobs.
If you want to use the key fob again then it is required to be paired again. Refer to Step 7 for instructions on how
to perform the pairing. In this case, the key fobs should associate again.
The code used in the transmitter of this key fob demo application can be found in the documentation kit in the
\Si4010 projects\rke_demo folder.