I. Overview

PCF7961 is a chip used in car keys. The chip integrates IMMO anti-theft, RKE transmitter and MRK2 core to provide a single-chip anti-theft remote control key solution. This article will introduce the chip, the main contents include the basic composition and characteristics of PCF7961, the characteristics of the MRK2 core and the operating mode of the chip.

2. The basic composition and characteristics of PCF7961

2.1 Basic composition of PCF7961

The figure below shows the internal block diagram of PCF7961, which mainly includes the following parts：

(1) 8-bit RISC architecture core (MRK2)

(2) UHF transceiver

(3) Memory unit, including ROM, E-ROM, RAM, and EEPROM

(4) Power management unit

(5) Calculation unit, used for encryption and other operations

(6) RC oscillator circuit (accuracy <±8%)

(7) Peripherals such as I/0, timer, ADC, interrupt controller, etc.

(8) Debugging unit

                                                         Figure 2.1 PCF7961 internal block diagram

2.2 Basic characteristics of RISC

The following are some basic features of RISC (MRK2)：

• The operating voltage is 2.1V~3.6V
• E-ROM size is 4K/8K/16K bytes
• RAM size is 192 bytes
• The working frequency is up to 2MHz
• The current is 100 nA in power-down mode
• The encryption unit supports standard HT2 and extended HT2 algorithms (the key length is 48 bits or 96 bits), and supports the generation of pseudo-random numbers.
• Up to 7 IO
• Programmable voltage comparator for battery voltage detection

2.3 Basic characteristics of analog transponders

The PCF7961 analog transponder includes the following basic features：

• The carrier frequency is 125khz
• The data transmission rate is: 4.0 kbit/s (read) and 5.2 kbit/s (write)
• Encoding method: Manchester encoding (read) and BPLM encoding (write)
• Half-duplex transmission method
• The modulation method is ASK
• The key length is 48 digits
• Verification time is 39 ms (typical value)

2.4 Basic characteristics of UHF transceiver

The UHF transceiver of PCF7961 includes the following basic features：

• The working voltage is: 2.1V~3.6V
• At 434 MHz, the operating current in TRANSMIT mode is 8mA, and the current in LOCKED mode is 1.5mA.
• The carrier frequency is 315MHz or 434 MHz
• The output power is 9 dBm (434MHz)
• Programmable crystal oscillator load capacitor
• Programmable FSK modulation characteristics
• Programmable output amplitude
• Programmable ASK modulation characteristics
  
  

Third, PCF7961 core MRK2

MRK2 uses a Harvard architecture with an 8-bit ALU and a 16-bit instruction width. Due to the use of a two-stage pipeline, MRK2 can execute one instruction in one clock cycle, so it also has ultra-low power consumption. The instruction set of MRK2 is also backward compatible with the chips of the MRK1 series.

PCF7961ATT provides up to 16 Kbytes of application code storage. When the chip is reset, the program starts to execute from the built-in startup code, then runs the user code, and starts to execute from the warm boot vector. When the CHIP is in BATTERY MODE, THE CHIP starts TO EXECUTE CODE from 0000H, AND when the chip is in TRANSPONER mode, IT starts to EXECUTE CODE from 0010, provided that the function of the analog TRANSPONDER is DISABLED.

PCF7961 provides 5 interrupt vector entries, INT0 ~ INT4, the vector entry address is shown in Figure 3.1, each interrupt can be independently set to enable or disable. When an interrupt is generated, the code will jump to the corresponding interrupt vector entry. A JMP instruction should be placed at the interrupt vector entry to redirect the interrupt handler, where INT0 is a non-maskable interrupt.

PCF7961 also contains 8 Kbytes of system code storage inside, which is used to store NXP's pre-implemented code, including a series of library functions and the implementation of functions such as analog transponders, startup codes, internal monitors, and download interfaces. The system code is not visible to the application, and the user can call the library function and simulate the transponder function through the system call. Interrupts are disabled when executing system code, including INT0.

                                                          Figure 3.1 Application code memory distribution

The data memory address space of PCF7961 is divided into several parts: register file (R0~R7), reserved space, special function register (SFR), and 192 Bytes of user RAM, as shown in Figure 3.2.

                                                         Figure 3.2 PCF7961 data memory distribution

 

Fourth, PCF7961 working mode

PCF7961 has a total of 4 operating modes, including：

• INIT mode
• PROTECTED mode
• TAMPERED mode
• VIRGIN mode

 

PCF7961 is in INIT mode by default. INIT mode should only be used in the software development stage. In this mode, the monitor and download interface are fully available. At this time, both EEPROM and E-ROM can be accessed normally. In order to prevent EEPROM and E-ROM data from being read out and disable the debugging function, the device should ENTER PROTECTED mode. When the device is in INIT mode while working, once the MSDA data cable detects a low level, the system will terminate the execution of the application code and call the built-in debugging code. Only when the correct debugging command is received or the device is reset will the application code resume operation.

When the device is in PROTECTED mode, the EEPROM and E-ROM will be disabled, and the debugging function will be disabled. This mode is usually used for system testing. Issue the corresponding command (C_ER_EROM) through the monitor and download interface, and the device may be forced into INIT mode again. The EEPROM and E-ROM will be erased before entering INIT mode. However, if the execution is not successful, the DEVICE will enter TAMPERED MODE. The device will remain in TAMPERED mode until the C_ER_EROM mode is resend and the execution is successful.

VIRGIN mode is the MODE in which THE CHIP runs AFTER IT IS PRODUCED. IT is used to support extended CHIP TESTING and CHIP CONFIGURATION. NXP forces the CHIP TO ENTER INIT mode after the CHIP leaves THE FACTORY, AND VIRGIN mode is locked irreversible, SO for users, THIS MODE cannot be re-entered.

                                                         Figure 4.1 PCF7961 mode conversion

 

V. Reference materials

1. "f7961att_2015"