Car safety and anti-theft - design of keyless system

The initial electronicization of automobile safety and anti-theft began with engine immobilizer (IMMO) in 1994. NXP Semiconductors (then Philips Semiconductors) was the first semiconductor company to successfully apply RFID electronic tag technology to automobile electronic engine locks: electronic identity recognition was achieved through 125kHz wireless communication between the car and the key to determine whether to start the car engine. This technology greatly improved the safety of the car and was soon widely used in Europe and North America. In just a few years, the car theft rate in Europe was greatly reduced by 90%, and it became the standard configuration of cars throughout Europe.

The emergence of remote control keys (RKE) has brought people a good user experience and met people's requirements for convenience and comfort. However, due to the technical limitations of its radio frequency one-way communication, it has its own shortcomings in terms of security. NXP Semiconductors (hereinafter referred to as NXP) has timely launched an integrated solution (Combi) that combines engine anti-theft and remote control keys into one chip, which not only improves the security of the system, but also reduces the cost of the entire key. It has gradually replaced independent remote control keys and become the mainstream solution in the European, American and Japanese markets. Of course, it still retains one-way communication in radio frequency communication, and security has not been substantially improved.

Figure 1

In 2003, NXP launched the keyless system (PKE or PEPS), which completely changed the development prospects of automotive security applications and brought users a new experience of comfort and convenience: car owners do not need to use keys at all during the entire driving process, they only need to carry them with them. When the owner enters the effective range near the car, the car will automatically detect the key and perform identity recognition. If successful, it will open the door or trunk accordingly; when the owner enters the car, he only needs to press the engine start button, and the car will automatically detect the location of the key, determine whether the key is in the car, whether it is in the main driving position, and start the engine if successful. Don't underestimate this seemingly insignificant change, it plays a major role in simplifying your life. The keyless system not only brings comfort and convenience, but also has a substantial improvement in security. Through low-frequency and radio frequency two-way communication, the car and the key can complete complex two-way identity authentication. In terms of security, it is similar to engine anti-theft, and is much better than traditional remote control keys. Starting from the successful mass production of keyless systems in a small number of high-end models in 2003, it took two to three years for the global market to popularize this technology. At present, almost every mainstream car manufacturer in the world uses NXP's keyless products, covering mid-to-high-end models and even low-end models.

Let's take a look at how this technology is implemented. As shown in Figure 2, the keyless system needs to detect and judge three areas: the gray area outside the car, the light pink area inside the car, and the gray-white main driver's seat. The gray shadow area includes three parts, which represent the effective area of ​​the main driver's seat, the co-driver's seat, and the trunk door control. When the owner enters this position with the key, the car and the key can establish effective communication. Through the field strength detection of the low-frequency signal, the car can determine the corresponding position of the key and decide to open the corresponding door. The light pink area inside the car is the difficulty of the entire PKE system design. It is necessary to accurately determine whether the key is in the car to determine the door status and whether the engine can be started. In the design of some high-end models, the gray-white main driver's seat will also be detected to see if the key is valid and whether there is someone in the main driver's seat to avoid engine start-up caused by children's misoperation; it may also include detection of the area inside the trunk to prevent the key from being locked in the trunk by mistake. In summary, we can find that in the keyless system, regional detection is a very important technology that is different from various previous automotive security products. Therefore, the accuracy of regional detection has become an important parameter to measure the quality of a keyless system. There are two main corresponding technologies on the market. One is to adjust the sensitivity of the low-frequency signal and then make a fuzzy judgment based on whether the communication is stable. Its accuracy is limited but it is easy to implement; the other is to judge based on the strength detection of the received low-frequency signal, that is, RSSI (Received Signal Strength Indication). According to the size of the low-frequency signal, the relative distance between the key and the low-frequency antenna in the car is calculated, and the specific position of the key is accurately located through the cross-coverage range of multiple low-frequency antennas. All NXP products use the second technology. In order to achieve ideal performance parameters, NXP provides a minimum 2.5 mV signal sensitivity of the three-dimensional low-frequency receiving front end, and the typical sensitivity value can reach 1mV. Different from the successive approximation ADC of other solutions, NXP uses 12-bit Sigma-Delta (Σ-Δ) ADC to eliminate noise interference through multi-point sampling and averaging. The best in-vehicle and out-vehicle detection accuracy that has been achieved so far is up to 2cm. At present, car manufacturers usually require in-vehicle and out-vehicle detection accuracy of 5 to 10cm.

[page]

Figure 2

The structural block diagram of the keyless system is shown in Figure 3. The left side is the car side, including the main controller (Body Control Unit), the door handle and trunk handle trigger module, the engine one-button start module, the engine anti-theft base station module (IMMO Basestation), the low-frequency transmission module and the radio frequency receiving module. The three green modules are mainly used to trigger the entire system. When the owner pulls the door or presses the one-button start button, the corresponding module will send an interrupt signal to wake up the main control MCU and start the entire communication process. Common keyless system working modes are divided into two categories: trigger mode and scanning mode (polling). The trigger mode is divided into mechanical triggering and electronic induction triggering. Here, the system cost and system performance, such as the response time of the entire system, need to be considered comprehensively. The engine anti-theft base station module is a low-frequency communication module (125KHz) used to achieve close-range communication with the key and start the engine. This function is a backup plan, also known as the "power-off mode". It will only be used when the key battery is exhausted or there is an accidental interference with the keyless system that causes it to fail to work properly. In this case, the user only needs to hold the key in a fixed position (such as a groove), and the key can establish communication with the base station and perform identity authentication to start the engine. A major feature of NXP's keyless systems PCF7952 and PCF7953 is that the chip itself integrates the engine anti-theft function, which is fully compatible with all NXP Transponder products, including PCF7936. This greatly improves the reliability of the system without adding additional costs. The specific details will be mentioned later.

[page]

Figure 3: Block diagram of the keyless system.

The low-frequency transmission module and the radio frequency receiving module are the basic communication links of the keyless system. The low-frequency transmission uses 125KHz, which is the uplink, sent from the car end to the key end; the radio frequency reception uses 315MHz or 434MHz, which is the downlink, sent from the key end to the car end. The reason for using 125KHz is that on the one hand, it is compatible with the relevant technologies of engine anti-theft, and more importantly, the 125KHz signal is sensitive to distance, which can achieve accurate distance detection and play a key positioning role. The radio frequency uses the frequency band of the traditional RKE. On the one hand, it is compatible with the basic functions of the remote control key, and it also takes advantage of its fast communication speed. It should be emphasized here that the so-called communication speed refers to the data transmission between the key and the car for authentication and encryption. In order to ensure that the keyless door opening or ignition process is completed in a relatively short time, a higher baud rate (generally 8 to 20kbps) is required. It is usually not recommended to use a low-end SAW transmitter module (about 1kbps), but to use a transmitter chip based on phase-locked loop technology to achieve it, such as NXP's PCF7900, which can reach a maximum baud rate of 20kbps in FSK mode. For the same purpose, the radio frequency band also has a trend of using higher frequencies of 868MHz or 915MHz. As shown in the figure, the low-frequency transmitter module includes multiple low-frequency antennas, which are installed in the door handle to achieve keyless entry (Keyless Entry) and installed inside the car body to achieve keyless start (Keyless Start).

The specific block diagram of the key end is shown in Figure 4. The main chip is NXP's PCF7952 or PCF7953, the RF transmitter chip uses NXP's PCF7900, and the corresponding RF receiver chip on the car end is NXP's PQJ7910. PCF7952/53 has a low-frequency analog front end (LF Front End) to connect to the external 3D antenna. In the keyless system, the key end needs an external 3D low-frequency antenna to receive and detect the 3D energy field strength of the external space, which is the X, Y, and Z axes. By superimposing the energy in the three directions, it can ensure that the key can detect the same field strength at any angle. One of the axis antennas is also reused as the IMMO function to realize the engine start in the powerless mode. Through the uplink and downlink links, the key and the car can establish two-way communication for complex identity authentication. The latest generation of authentication technology is called mutual authentication technology (Mutual-Authentication). Not only does the car need to authenticate the key, but the key also needs to determine whether the car is legal. Any error will cause the entire communication to end, thereby ensuring the security of the system. The communication distance is determined by the low-frequency uplink 125KHz. The effective working distance of the general PKE system is about 2.5m, and the actual effective door opening and closing distance is 1.5m to 2m. In addition to the detection accuracy inside and outside the car, the power consumption of the key end is also an important indicator to measure the quality of a keyless system. The power management module of PCF7952 can minimize the power consumption of the entire system. A mature keyless system solution, the key end is powered by a 2032 3V lithium battery, and the battery life can be up to three years.

[page]

Figure 4: Block diagram of the key module.

After the keyless system, where will the car safety and anti-theft products go? NXP has given a definite answer: Keylink, the next generation of car keys. Its biggest breakthrough is that it connects the car key with the peripheral intelligent terminal, so that the key can achieve a close-range wireless connection with devices such as mobile phones and PDAs. With the display function and powerful processing power of intelligent terminals such as mobile phones, an extremely broad application space is in front of us:

- Check the vehicle status, door and window status, fuel tank level, vehicle temperature at any time... everything is displayed on the phone screen

- Find your car, by using your key and phone, the phone's GPS navigation will help you find your parking spot easily

- Easily plan your travel route and save the selected route to your key in front of your computer. When you enter the car, the car navigation system will automatically import the travel information.

- Vehicle maintenance, vehicle factory records, repair records, all stored in the key for easy maintenance.

There are many applications like the above. The following news is another new application of Keylink, which allows us to have a closer look at this technology. This is also the end of this article:

October 22, 2008 - BMW Technology and NXP Semiconductors (an independent semiconductor company founded by Philips) launched the world's first multifunctional car key prototype. This prototype has contactless payment functions, personal access control and advanced public transportation electronic ticketing functions to achieve a stronger mobility experience. Equipped with NXP's SmartMX security chip, this prototype enables drivers to make fast, secure and convenient electronic payments through car keys for the first time, creating an exciting new application environment for future consumers.