Iosoft Ltd. 
ChipWeb Wireless Development Kit 
Hardware Manual 
1. Introduction 
The   Iosoft   Ltd.   ChipWeb   Wireless   kit   supports   the   development   of embedded  802.11b  hardware  and  software,  with  particular  reference  to Microchip   PIC18xxx   microcontroller   family,   and   the   ‘C’   programming language. It is supplied in two parts: 
o  The ER21 development board  
o  The ChipWeb Wireless source-code package. 
This  manual  describes  the  ER21  hardware,  and  the  firmware  that  is  supplied pre-loaded into the microcontroller; for software information, please refer to 
the manual supplied with the source-code package. 
It   is   assumed   that   the   reader   has   a   reasonable   familiarity   with   TCP/IP networking and PICmicro® microcontrollers as described in ‘TCP/IP Lean: Web Servers for Embedded Systems’ by Jeremy Bentham (2nd edition ISBN 1-57820- 108-X). Other books that may be of help are: 
o  ‘Wireless LANs’ by Jim Geier, ISBN 0-672-32058-4 
o  ‘802.11 Wireless Networks: The Definitive Guide’ by Matthew Gast, ISBN  0-596-00183-5 
For sales and support information on ChipWeb products, refer to the Iosoft Ltd. Web site, www.iosoft.co.uk 
Page 1  © Iosoft Ltd. 2002

2. Hardware 
Processor 
The ER21 is supplied with a PIC18F452 processor, which has 16K words of Flash program memory, 1536 bytes of data memory, and 256 bytes of data EEPROM. It can be reprogrammed in-circuit via the standard Microchip ICD connector. 
Power 
Power  is  applied  using  a  standard  2.1mm  connector,  with  the  centre  pin positive. A regulated DC supply of 9 volts, with at least 500 mA capacity should  be  used.  Unregulated  or  AC  supplies  must  not  be  used,  as  the  board  will probably malfunction and may be damaged. 
The ER21 has a voltage regulator that gets warm in normal use. If the regulator 
is  called  upon  to  dissipate  extra  power  (i.e.  by  the  use  of  a  higher  supply voltage,  or  the  addition  of  extra  loads  such  as  emulators)  then  the  regulator temperature may rise significantly, and it will be necessary to add a heatsink to     the device. 
Figure 1: ER21 board layout 
Communication interfaces 
There are three communication interfaces: 
1.  RS232 serial 
2.  10baseT Ethernet 3.  802.11b wireless 
The  first  two  of  these  are  described  in  TCP/IP  Lean  and  are  identical  to  the existing development board implementation; no software changes are required.    The wireless interface is implemented using a plug-in PC card. This ensures that   the interface is fully compliant with all the relevant standards, and allows for 
simple hardware upgrades as the technology advances. 
Page 2  © Iosoft Ltd. 2002

User interfaces 
One pushbutton and four LEDs are provided; three of the LEDs indicate Ethernet status,  and  are  normally  on;  the  ‘transmit’  &  ‘receive’  LEDs  briefly  flash  off during network transfers. The fourth LED provides a ‘heartbeat’ indication to    show the microcontroller is running. 
The pushbutton is used on power-up to initiate a system configuration routine;   this allows the basic system settings to be reconfigured through the serial link at 9600   baud.   Once   this   is   complete,   detailed   wireless   configuration   and monitoring  is  performed  using  a  Web  browser  into  the  Ethernet  or  wireless interfaces.  
Firmware 
The  ER21  is  supplied  with  ChipWeb  Wireless  software  pre-loaded  into  the PICmicro, so that the unit will operate when power is applied. 
Although this firmware is useful for initial experimentation, it is assumed that    the  developer  will  wish  to  modify  and  extend  the  software,  in  order  to customise  it  for  a  specific  application.  To  this  end,  Iosoft  offer  a  software package containing the full source code to the current firmware, and upgrades that provide additional features. Although this manual describes the principal firmware functionality (to assist the user in their initial experimentation), the software implementation details will not be described here; please refer to the manual supplied with the source-code package. 
Page 3  © Iosoft Ltd. 2002

3. Getting started 
Creating a network 
It  is  strongly  recommended  that  a  ‘scratch’  network  be  created  for  test purposes,  and  that  this  network  be  isolated  from  all  other  networks  in  the building. This ensures that your experimentation will not disrupt the activities 
of other network users. 
The creation of an isolated network is particularly important when testing the wireless   capabilities;   for   simplicity,   initial   experimentation   will   focus   on unencrypted (i.e. insecure) networks, which are vulnerable to malicious attack   by anyone within radio range. 
For  initial  testing,  a  PC  with  a  spare  serial  port  and  Ethernet  interface  is needed. The PC should have TCP/IP networking enabled, and be set to a fixed (‘static’) IP address. It should be isolated from the main office network, so can 
be assigned a suitable IP address for a machine not connected to the Internet,    e.g.  192.168.0.10.  To  set  this  address  in  Windows,  edit  the  TCP/IP  Network Properties for the Ethernet interface you’re using, and set to 
IP address:   
192.168.0.10 
Subnet mask:  
255.255.255.0 
To test the ER21, any IP address may be used, but it is important that 
o  The PC has a fixed address (not obtained ‘automatically’ using DHCP), 
o  The PC and the ER21 are in the same ‘domain’, i.e. their IP addresses  have the same base value on the left-hand side. 
For example a PC at 192.168.0.10 will normally communicate with an ER21 at 192.168.0.20, but probably not if the address is 10.1.1.20, even though these     may  be  the  only  two  systems  on  the  network.  For  detailed  discussion  of  IP addressing and domains, refer to the ‘TCP/IP Lean’ book. 
If  only  a  single  PC  is  used,  it  can  be  connected  directly  to  the  ER21  using  a ‘crossover’ network cable; otherwise a network ‘hub’ (either 10 Mbit, or 10/100 auto-switching) is used with uncrossed cables. 
Wireless network 
There are two options when setting up a wireless network: 
1.  Ad-hoc  (IBSS)  All  computers  within  the  network  communicate  directly with each other 
2.  Infrastructure  (ESS)  The  computer  communicate  via  an  ‘Access  Point’ (hub) which coordinates their communication. 
The ChipWeb firmware supports both network modes, and these are described in later sections of this manual. For initial testing, the ad-hoc network is the 
Page 4  © Iosoft Ltd. 2002

simplest; the only requirement is a PC with a wireless interface, e.g. a laptop with a PCMCIA/USB 802.11b network adaptor. 
Infrastructure networks are more common than ad-hoc, and can be set up in one of two ways: 
1.  The PC has a wireless interface, and the Access Point is effectively used as a wireless repeater. 
2.  The PC has an Ethernet interface, and effectively uses the Access Point as an Ethernet-to-wireless converter. 
The ER21 will operate in both these configurations, but they can be complex to set  up,  so  it  is  recommended  that  wireless  novices  start  with  an  ad-hoc network, then move up to an Infrastructure network later. 
Board configuration 
Before using the board, it has to be configured using the serial interface. 
1.  Serial connection. Connect the board to a PC using a straight-through (uncrossed) cable DB9M-DB9F. Run a terminal emulator on the PC at 9600 baud, no parity, one stop bit, no handshaking. 
2.  Power supply. Connect a 9 volt regulated supply, with at least 500 mA capacity.  The  2.1mm  connector  should  be  wired  with  the  centre  (tip) positive, and is compatible with the 2mm connectors used on Microchip demonstration boards. 
3.  Start-up. Power up the board, with the pushbutton pressed; the terminal emulator should show a sign-on message such as: 
P18Web vx.xx Config 
Serial num? 
If  the  display  does  not  appear,  check  the  system  LED  is  flashing (indicating the microcontroller is running), the serial cable connections, and the terminal emulator settings. 
To restart the configuration at any stage, simply re-power the board (i.e. power down then up) with the pushbutton pressed on power-up. 
4.  Serial  number.  Release  the  pushbutton  and  enter  the  board  serial number, as printed on the label attached to the board. This value will be used to determine the Ethernet controller address. 
5.  IP address. Next, the board will prompt for an IP address: 
IP addr? 
Enter the IP address in the usual dotted notation, e.g. 
Page 5  © Iosoft Ltd. 2002

192.168.0.20 
6.  Basic configuration complete. The ER21 will report 
Config updated Infra or Adhoc? 
If you don’t wish to specify wireless settings yet, power the board down, and on power-up it will boot up with the IP address you have specified. 
7.  Wireless   settings.   To   set   the   wireless   configuration,   enter   I   for infrastructure or A for adhoc network, and press the Enter key. You will     be prompted for a channel number 
Channel num (1-13)? 
There  are  constraints  on  the  available  channels,  to  avoid  interference with  other  radio  equipment,  or  other  802.11  networks.  In  particular, your  country  may  have  a  specific  regulatory  constraints  as  to  which channels are permissible; if in doubt, do not use the radio interface.  
8.  Wireless  configuration  complete.  Once  the  channel  number  has  been entered, the network interface configuration updated and stored in non- volatile memory. The wireless network name (SSID) has been set blank 
(so that any name will be accepted) and encryption has been disabled. 
Updating WLAN config Xmodem? 
Unless  you  wish  to  update  the  on-board  Web  pages,  you  should  now power  the  board  down;  on  the  next  power-up,  the  configuration  will  be fetched from non-volatile storage, and displayed on the serial link, e.g. 
192.168.0.20 
WLAN status Searching WLAN status Infra. 
9.  Web pages. To update the on-board Web pages, a single binary image of     the pages must first be prepared using the WEBROM utility provided in 
the ‘TCP/IP Lean’ book; see that book for details as to how it is used. 
The resulting ROM file (e.g. WEBPAGE.ROM) should be uploaded to the  ER21  when  the  XMODEM  prompt  appears;  be  sure  to  use  the  simplest XMODEM  (checksum)  variant,  not  the  CRC  or  1K  versions.  When  the download  is  complete,  re-power  the  board  to  initialise  using  the  new settings. 
Page 6  © Iosoft Ltd. 2002

4. Ethernet tests 
Once the ER21 has been configured, launch a Web browser on the PC to access the on-board Web server; a page such as figure 2 should appear. 
Figure 2: typical browser display 
The display is similar to that described in Chapter 12 of ‘TCP/IP Lean’; the left- hand frame is used for navigation links, the centre has explanatory text, and  the right frame shows the current status, updated every few seconds. 
If the page fails to display, it can be for various reasons: 
o  The wrong network cable has been used; it should be a crossed cable for  direct connection to a PC, or uncrossed if the connection is via a hub. Ensure that the ‘link’ LED on the ER21 lights up when the connection is made. 
o  The IP address on the ER21 has been set incorrectly; re-power the ER21  with  the  serial  link  connected,  and  check  the  address  given  on  the terminal display, e.g. 
192.168.0.20 
If the value is incorrect, or the ‘config’ prompt is displayed, re-run the configuration steps described above. 
Page 7  © Iosoft Ltd. 2002

o  The PC may be using ‘automatic’ (DHCP) configuration, in which case it      is waiting for a response from a DHCP server. Change its configuration to a static IP address, as described earlier. 
o  The PC is on a different domain to the ER21. If the two addresses are  dissimilar,  the  PC  will  be  looking  for  an  IP  ‘router’  to  complete  the connection,  even  though  the  electrical  connection  is  fine.  Alter  the addresses  so  they  are  on  the  same  domain,  e.g.  192.168.0.10  and 192.168.0.20 
o  The ARP cache entry on the PC is wrong. This problem may occur if you   have attempted to recycle an existing IP address (e.g. you have used one    IP  address  for  more  than  one  system).  The  PC  may  have  retained  a memory of the old IP-to-Ethernet address translation in its ‘ARP cache’,     and  be  attempting  to  use  the  wrong  Ethernet  address.  You  can  check whether there is an ARP entry by entering the command ‘arp -a’ in a DOS box; you would receive a display similar to the following: 
C:\WINDOWS>arp -a 
Interface: 192.168.0.10 on Interface 0x2000003 Internet Address      Physical Address      Type 192.168.0.20          00-0b-75-00-04-d2     dynamic 
This   shows   that   there   is   a   physical   (MAC)   entry   for   the   address 192.168.0.20;  if  that  address  was  recently  ‘borrowed’  from  another machine, it may be incorrect. The problem may be cleared by rebooting 
the PC, or less drastically by doing a manual deletion in the ARP cache,     e.g. 
arp -d 192.168.0.20 
The PC will then re-fetch the correct address (by sending an ARP request to the ER21) and normal communications will be resumed. 
To  help  in  network  debugging,  the  ER21  does  respond  to  ‘pings’  (ICMP  echo requests). 
Wireless re-configuration 
The  most  convenient  way  to  re-configure  the  Wireless  interface  is  using  a browser connected to the ER21 Ethernet port. Clicking the ‘configuration’ link     on the left-hand frame produces the page shown in figure 3. 
Page 8  © Iosoft Ltd. 2002

Figure 3: wireless re-configuration display 
Entering  the  revised  parameters  in  the  centre  frame  and  clicking  on  the ‘update’ button will produces a confirmation screen, indicating the update has taken place, or an error screen if, for example, the channel number is too high.   If the SSID is blank, any network name is accepted; the actual network name is reported in the status area on the right. 
Page 9  © Iosoft Ltd. 2002

5. Ad-hoc wireless tests 
It  is  recommended  that  you  start  wireless  experimentation  using  an  ad-hoc (IBSS)  network,  since  it  is  simpler  to  set  up.  Figure  4  shows  a  typical  set-up screen for a PCMCIA network card.  
Figure 4: PCMCIA card set-up 
The important parameters are: 
o  Network mode: ad-hoc (IBSS) 
o  SSID:  set  to  accept  any  network  name,  or  the  usual  default  name  ‘Wireless’ (the leading upper-case letter is significant). 
o  Channel: 1 is legal within many countries. 
o  Encryption: disabled 
If the ER21 is configured for ad-hoc operation, with channel 1 and blank (any) SSID, the serial link should report 
WLAN status Searching WLAN status Ad Hoc 
This indicates that an ad-hoc network is established; the Web server (accessed using the Ethernet or wireless interfaces) displays more details, such as shown in figure 5 
Page 10  © Iosoft Ltd. 2002

Figure 5: Ad-hoc network status on ER21 
The PC card will also report the ad-hoc network as shown in figure 6. 
Figure 6: Ad-hoc network PC status 
If the wireless units fail to connect, the most likely causes are: 
Page 11  © Iosoft Ltd. 2002

o  Incorrect  SSID:  in  the  example  above,  both  units  have  been  set  to  accept  any  SSID.  Alternatively,  any  character  string  may  be  used  (the most common is ‘Wireless’, but be aware that these are case-sensitive. 
o  Incorrect  channel:  the  channel  numbers  may  be  mismatched,  or  you  may  be  attempting  to  use  an  incorrect  channel  for  you  regulatory domain. 
o  Encryption: ensure that encryption is disabled for the purposes of this  test. 
Page 12  © Iosoft Ltd. 2002

6. Infrastructure wireless tests 
Configuration 
If an ‘infrastructure’ (ESS) network has been specified (see figure 3 and 4), the ER21 will search for an Access Point (AP) that matches the given network name (SSID), or matches any SSID if the name field is blank. The serial link will report  if an Access Point is found: 
WLAN status Searching WLAN status Infra. 
If that Access Point is lost again, the link will report 
WLAN status No infra. 
In  infrastructure  mode  the  channel  number  is  relatively  unimportant,  as  the wireless card will search all permissible channels to match the SSID. Once the ER21 has locked on to a specific Access Point it will tend to stay with it; to force   it to search again, re-power the unit, or hit the ‘update’ button on the wireless configuration Web page. 
If the Access Point isn’t found, it may be for the following reasons: 
o  Mismatched SSID: don’t forget the SSID is case-sensitive; set the ER21 to  a blank SSID, so it will match any Access Point. 
o  Incorrect mode: the ER21 may be in ad-hoc mode, or the Access Point  may  be  set  to  ‘access  point  client’  (i.e.  wireless  client)  or  ‘wireless bridge’ (i.e. point-to-point link with another AP), rather than standard 
AP mode. 
o  Encryption: should be disabled on the Access Point for the purposes of  this test. 
Usage 
Once the ER21 is communicating with an Access Point, then it can be accessed in either of the following ways: 
o  PC with wireless. A PC with wireless capability (typically a laptop with a  wireless  card,  or  a  desktop  unit  with  a  USB  wireless  adaptor)  may communicate with the ER21 via the Access Point; the AP is transparent  to the communications, like an Ethernet hub. 
o  PC with Ethernet. The PC may use an Ethernet connection to the AP, in  which case it effectively acts as an Ethernet-to-Wireless converter. 
The   use   of   an   AP   has   some   traps   for   the   unwary,   especially   when communicating over both Ethernet and Wireless: 
o  One IP address. Be aware that the ER21 uses the same IP address but 2  different   Ethernet   (MAC)   addresses   for   its   two   interfaces.   When 
Page 13  © Iosoft Ltd. 2002

switching between the interfaces, it is probable that the PC will have a     stale MAC address in its ARP cache, and refuse to communicate with the ER21 over the new interface. To fix this problem, delete the offending address  using  the  ARP  command  in  a  DOS  box,  as  described  in  the ‘Ethernet Tests’ section of this manual, e.g. 
arp -d 192.168.0.20 
o  Complicated  AP.  Some  Access  Points  have  sophisticated  capabilities,  including  IP  routing,  Network  Address  Translation  (NAT)  and  a  firewall capability, which makes them relatively difficult to set up. If possible, do    your initial testing on the simplest AP, without all these complications. 
Page 14  © Iosoft Ltd. 2002

7. Wireless encryption 
WEP 
The  ER21  fully  supports  Wired  Equivalent  Privacy  (WEP)  encryption.  As  the name implies, it is intended to provide low-level security, similar to the physical protection  inherent  in  wired  network  communications.  This  is  insufficient  to protect  sensitive  data,  but  does  provide  some  measure  of  protection  against casual eavesdropping. 
WEP  uses  secret  keys,  which  are  known  to  all  nodes  on  the  network,  but (hopefully) unknown to outsiders. There are two standards for the encryption, known as 64-bit (also known as 48-bit) and 128-bit; the 64-bit standard uses a 5- byte key, while the 128-bit uses a 13-byte key. Each node may have up to 4   keys, though only one (the ‘default’ key) is in use at any one time. 
Some   implementations   use   text   strings   for   the   keys,   while   others   use hexadecimal  values,  or  even  ‘pass-phrases’  that  automatically  generate  the keys. The ER21 firmware supports the use of string and hex values, but not pass- phrases. 
Entering keys 
To enter the encryption keys, select the ‘keys’ page on the navigation frame, as shown in figure 7. 
Figure 7: Encryption key entry 
Page 15  © Iosoft Ltd. 2002

A radio button is used to select the key (1-4) to be updated, and then a text 
string or hexadecimal data is entered. Pressing the ‘update’ button will cause 
the  key  to  be  updated;  an  error  message  may  displayed  if  the  key  length  is incorrect, or both text and hex data are present. 
It is not necessary to enter all four keys; for a simple test, it is sufficient to select key 1, and enter the (highly insecure) string  
abcde 
Press the ‘update’ button to store the new key. 
As the key is being entered, the characters are not displayed, but are replaced by asterisks. This is to safeguard against others seeing them being entered, or against the use of the browser ‘back’ button being used to find out what keys were entered. 
Enabling encryption 
At this stage, encryption is still not enabled, to do this the ‘encryption’ page is selected, as in figure 8. 
Figure 8: Enabling encryption 
The ‘default key’ setting chooses which key shall be used for all transmissions; for a simple test, select key 1, which  has the 5-character string, and hit the ‘update’ button. 
Page 16  © Iosoft Ltd. 2002

If  all  is  well,  encryption  is  engaged;  if  you  are  accessing  the  ER21  over  an Ethernet interface, you will see an acknowledgement as shown in figure 9. 
Figure 9: Encryption acknowledgement 
Note that the status information indicates that the ER21 is still in contact with the Access Point, even though all data communications will fail unless the AP has an identical 64-bit key. 
On  hitting  the  OK  button,  the  encryption  page  is  re-displayed,  but  with  the ‘WEP type’ field filled in, based on the length of key used (in this case, a 5- character key means 64-bit encryption). 
Authentication 
The encryption key may also be used to authenticate the ER21, so that it will only associate with an AP that has a matching key. This is accomplished using the shared-key authentication tick-box in figure 8. 
Page 17  © Iosoft Ltd. 2002

8.  DHCP auto-configuration  
Using DHCP 
To activate DHCP auto-configuration, it is only necessary to set the IP address to all zeros, and the ER21 will attempt to contact a DHCP server on the wireless network.  
There are a few points to bear in mind when using DHCP: 
o  Only the wireless interface is used for DHCP.  
o  It isn’t sensible to use DHCP on both interfaces, as they have differing  Ethernet (MAC) addresses - the IP address of the ER21 might change on each boot-up, depending on which interface received a DHCP response first. 
o  Once an IP address is obtained, it is used for both interfaces. 
o  If no IP address is obtained (e.g. no DHCP server is found) then you will  not be able to communicate using either network interface. 
It is recommended that you start your experimentation using a fixed IP address, and only engage DHCP when the wireless interface is well understood. 
Rev. 2 - 17/10/02 
--End of PDF version-- 
The circuit diagram & description are only available in the hard-copy version. 
Page 18  © Iosoft Ltd. 2002

9.  Circuitry 
Hardware description 
The  serial  and  Ethernet  interfaces  are  as  described  in  chapter  12  of  ‘TCP/IP Lean’ 2nd edition, so will not be described further here. 
The wireless card is driven using an 8-bit PCMCIA (PC card) interface, using the following pins on the PIC18F452: 
PICmicro pins    PCMCIA pins 
RB0-7 
A0-7 
RC0-1 
A8-9 
RD0-7 
D0-7 
RA0 
/OE 
RA1 
/WE 
RA2 
/IORD 
RA3 
/IOWR 
RA4 
/IREQ 
RE2 
RESET 
The PCMCIA chip enable CE1 is permanently low, and CE2 is high, indicating a single low-byte transfer. After the address lines A0-9 are set, attribute memory read/write cycles are initiated using /OE and /WE, while I/O read/write cycles   use /IORD and /IOWR (all normally high, asserted when low).  
For  more  information  on  PCMCIA,  see  ‘PCMCIA  System  Architecture’  by  Don Anderson, ISBN 0-201-40991-7. 
The ER21 as supplied is only compatible with 5 volt PCMCIA cards, if you are considering using an alternative card to the one supplied, make sure it can work with a 5 volt supply; severe damage may result if a 3.3 volt card is used instead. 
The use of RB6 and RB7 as address pins may conflict with their alternate usage as the In-Circuit Debug (ICD) pins. It may be necessary to remove the PCMCIA card when using ICD to re-program the PICmicro, and the PCMCIA card may fail to initialise when using the Microchip ICD, as RB6 and RB7 are being driven by the external interface. 
Page 19  © Iosoft Ltd. 2002

Circuit diagram 
--ends-- 
Page 20  © Iosoft Ltd. 2002

10. Addendum for firmware v2.17 
After this manual was written, a problem with blank network names (SSIDs) was identified. 
The manual states that a blank network name (SSID) can be used to match any SSID on an Access Point (AP), but this only true if the AP is broadcasting beacon frames (also known as ‘SSID broadcast’) to reveal its presence. 
If, for security reasons, the AP is not broadcasting its SSID, then the automatic detection in the wireless card won’t work. Instead, the card has to probe for 
the AP, and to do this, it needs to know the SSID; if the SSID is blank, no probes are sent. 
As a result, the ER21 may remain in search mode, even though there is a fully working Access Point within range. 
To  solve  this  problem,  an  extra  entry  has  been  added  to  the  serial  link configuration; after entering the channel number you are prompted 
SSID (network name)? 
To use a blank SSID, just hit the RETURN key; otherwise enter the SSID of the AP, such as 
Wireless 
or 
linksys 
Note that the SSID matching is case-sensitive: ‘wireless’ and ‘Wireless’ are the names of two different networks. 
The Web interface remains unchanged, since it already supports SSID entry. 
-- end of addendum -- 
Page 21  © Iosoft Ltd. 2002