MCS3142 MCS3142 Dual KEELOQ® Technology Encoder Data Sheet Features Overview: Typical Applications: SECURITY MCS3142 is ideal for Remote Keyless Entry (RKE) applications. These applications include: 2014 Microchip Technology Inc. • • • • • • • • Automotive RKE Systems Automotive Alarm Systems Gate and Garage Door Openers Home Security Systems Security and Safety Sensors Remote Control Remote Keypad Wireless Sensors Package Type: • 20-pin TSSOP FIGURE 1: 20-PIN TSSOP VDD 1 20 VSS SOSCI 2 19 SW0 SOSCO 3 18 SW1 SW3 4 17 SW2 PGC 5 PGD 6 MCS3142 • Ultimate KEELOQ® Technology: - Programmable 32-bit serial number - AES-128 block cipher - Programmable 128-bit crypt key - Timekeeping based on external 32.768 kHz crystal - 192-bit transmission code length: - 32-bit unencrypted portion - 128-bit encrypted, hopping code portion - 32-bit authorization check • Classic KEELOQ Technology: - Programmable 28-bit serial number - Data based on Classic KEELOQ Technology: - KEELOQ technology 32-bit block cipher - Programmable 64-bit crypt key - KEELOQ technology secure learn - Programmable 60-bit seed value - 66-bit transmission code length: - 34-bit unencrypted portion - 32-bit encrypted, hopping code portion • Operating Features: - 1.8 to 3.6V operation - Four switch inputs - 15 functions available - Configurable button modes - One active-low LED drive - Configurable minimum code word completion • RF: - Configurable bit rate - Configurable modulation, supporting FSK and OOK - Configurable data modulation, supporting PWM and Manchester • Other: - Button inputs have internal pull-up resistors - LED output 16 LED 15 DATA_OUT 14 CTRL_OUT VSS 7 VDD 8 13 XTAL CTRL_IN 9 12 DATA_IN 10 11 VSS RFOUT DS40001747A-page 1 MCS3142 TABLE 1: PIN DESCRIPTION Name 20-Pin TSSOP Input Type Output Type Description VDD 1 Power — Power SOSCI 2 Analog — Secondary Oscillator SOSCO 3 Analog — Secondary Oscillator SW3 4 TTL — Switch 3 Input PGC 5 TTL — Programming Clock PGD 6 TTL TTL — 7 — — No Connection; Tie to Vss VDD 8 Power — Power CTRL_IN 9 TTL — Transmitter Clock RFOUT 10 — RF Transmitter Output VSS 11 Power — Power DATA_IN 12 TTL — Transmitter Data XTAL 13 Analog — Transmitter Reference Oscillator CTRL_OUT 14 — TTL DATA_OUT 15 — TTL Transmitter Data LED 16 — TTL LED Output (active-low) SW2 17 TTL — Switch 2 Input SW1 18 TTL — Switch 1 Input SW0 19 TTL — Switch 0 Input VSS 20 Power — Power DS40001747A-page 2 Programming Data Transmitter Clock 2014 Microchip Technology Inc. MCS3142 Table of Contents 1.0 General Description ................................................................................................................................................................... 4 2.0 Device Description .................................................................................................................................................................... 6 3.0 Memory Organization ................................................................................................................................................................ 7 4.0 Classic KEELOQ® Operation ..................................................................................................................................................... 16 5.0 Ultimate KEELOQ Operation ..................................................................................................................................................... 18 6.0 Transmitter Operation .............................................................................................................................................................. 21 7.0 Device Operation ..................................................................................................................................................................... 25 8.0 Integrating MCS3142 into a System ........................................................................................................................................ 27 9.0 Electrical Specifications ........................................................................................................................................................... 29 10.0 Packaging Information ............................................................................................................................................................. 30 The Microchip Web Site ....................................................................................................................................................................... 34 Customer Change Notification Service ................................................................................................................................................ 34 Customer Support ................................................................................................................................................................................ 34 Product Identification System ............................................................................................................................................................. 35 TO OUR VALUED CUSTOMERS It is our intention to provide our valued customers with the best documentation possible to ensure successful use of your Microchip products. To this end, we will continue to improve our publications to better suit your needs. Our publications will be refined and enhanced as new volumes and updates are introduced. If you have any questions or comments regarding this publication, please contact the Marketing Communications Department via E-mail at [email protected]. We welcome your feedback. Most Current Data Sheet To obtain the most up-to-date version of this data sheet, please register at our Worldwide Web site at: http://www.microchip.com You can determine the version of a data sheet by examining its literature number found on the bottom outside corner of any page. The last character of the literature number is the version number, (e.g., DS30000000A is version A of document DS30000000). Errata An errata sheet, describing minor operational differences from the data sheet and recommended workarounds, may exist for current devices. As device/documentation issues become known to us, we will publish an errata sheet. The errata will specify the revision of silicon and revision of document to which it applies. To determine if an errata sheet exists for a particular device, please check with one of the following: • Microchip’s Worldwide Web site; http://www.microchip.com • Your local Microchip sales office (see last page) When contacting a sales office, please specify which device, revision of silicon and data sheet (include literature number) you are using. Customer Notification System Register on our web site at www.microchip.com to receive the most current information on all of our products. 2014 Microchip Technology Inc. DS40001747A-page 3 MCS3142 1.0 GENERAL DESCRIPTION MCS3142 is a dual encoder, designed for secure Remote Keyless Entry (RKE) and secure remote control systems. MCS3142 utilizes both the Classic KEELOQ code hopping technology and the new Ultimate KEELOQ technology time-stamping solution. Both of these encoders incorporate high security, a small package outline and low cost to make this device a perfect solution for unidirectional authentication systems and access control systems. Classic KEELOQ technology combines a hopping code generated by a nonlinear encryption algorithm, a serial number and Status bits to create a secure transmission code. The length of the transmission eliminates the threat of code scanning and code grabbing access techniques. Ultimate KEELOQ technology is generated using the industry standard AES-128 encryption algorithm, a serial number and a timer-driven message counter which continuously increments, independent of events, to provide a better, more secure solution. The timekeeping functionality protects against jam-and-replay attack techniques. The crypt key, serial number and configuration data are stored in an EEPROM array which is not accessible via any external connection. The EEPROM data is programmable but read-protected. The data can be verified only after an automatic erase and programming operation. This protects against attempts to gain access to keys or manipulate synchronization values. In addition, MCS3142 provides an easy to use serial interface for programming the necessary keys, system parameters and configuration data. 1.1 Key Terms The following is a list of key terms used throughout this data sheet. For additional information on KEELOQ technology and code hopping, refer to “An Introduction to KEELOQ® Code Hopping” Technical Brief (DS91002). • RKE: Remote Keyless Entry • Function Code: It indicates what button input(s) activated the transmission. It encompasses the function code bits. • Code Hopping: A method by which a code, viewed externally to the system, appears to change unpredictably each time it is transmitted • Code Word: A block of data that is repeatedly transmitted upon button activation • Transmission: A data stream consisting of repeating code words DS40001747A-page 4 • Crypt Key: A unique and secret number (64-bit for Classic KEELOQ technology, 128-bit for Ultimate KEELOQ technology) used to encrypt and decrypt data. In a symmetrical block cipher such as those used on MCS3142, the encryption and decryption keys are equal and, therefore, will generally be referred to as the crypt key. • Encoder: A device that generates and encodes data • Encryption Algorithm: A method whereby data is scrambled using a crypt key. The data can only be interpreted by the respective decryption algorithm using the same crypt key. • Decoder: A device that decodes data received from an encoder • Decryption Algorithm: A recipe whereby data, scrambled by an encryption algorithm, can be unscrambled using the same crypt key • Time-Stamp: The time-derived value recorded with a message • Learn: Learning involves the receiver calculating the transmitter’s appropriate crypt key, decrypting the received hopping code and storing the serial number, synchronization counter or timer value, and crypt key in EEPROM. The KEELOQ technology product family facilitates several learning strategies to be implemented on the decoder. The following are examples of what can be done: - Simple Learning: The receiver uses a fixed crypt key. The crypt key is common to every component used by the same manufacturer. - Normal Learning: The receiver derives a crypt key from the encoder serial number. Every transmitter has a unique crypt key. - Secure Learning: The receiver derives a crypt key from the encoder seed value. Every encoder has a unique seed value that is only transmitted by a special button combination. • Manufacturer’s Code: A unique and secret number (64-bit for Classic KEELOQ technology, 128-bit for Ultimate KEELOQ technology) used to derive crypt keys. Each encoder is programmed with a crypt key that is a function of the manufacturer’s code. Each decoder is programmed with the manufacturer’s code itself. The MCS3142 code hopping encoder is designed specifically for keyless entry systems. Typical applications include vehicles and home garage door openers. The encoder portion of a keyless entry system is integrated into a transmitter carried by the user. The transmitter is operated to gain access to a vehicle or a restricted area. MCS3142 is meant to be a costeffective, yet secure solution to such systems, requiring very few external components (see Figure 2-1). 2014 Microchip Technology Inc. MCS3142 Most low-end keyless entry transmitters are given a fixed identification code that is transmitted every time a button is pushed. The number of unique identification codes in a low-end system is usually a relatively small number. These shortcomings provide an opportunity for a sophisticated thief to create a device that ‘grabs’ a transmission and retransmits it later, or a device that quickly ‘scans’ all possible identification codes until the correct one is found. MCS3142, on the other hand, employs both the Classic and Ultimate KEELOQ code hopping technology. The high-security level of MCS3142 is based on the patented KEELOQ technology. For Classic KEELOQ technology, a block cipher based on a block length of 32 bits and a key length of 64 bits is used. The algorithm obscures the information in such a way that if a single hopping code data bit changes (before encryption), statistically more than 50% of the encrypted data bits will change. Ultimate KEELOQ technology uses the industry standard AES-128 encryption algorithm to obscure data using 128 bits for both its block and key length. In addition to the security of Classic KEELOQ technology, Ultimate KEELOQ technology sends a time-stamp as part of the transmission. This can prevent other more sophisticated attacks such as the ‘jam-and-relay’ attack. 2014 Microchip Technology Inc. DS40001747A-page 5 MCS3142 2.0 DEVICE DESCRIPTION As shown in the typical application circuit (Figure 2-1), MCS3142 is a simple device to use. It requires only the addition of buttons, an external 32.768 kHz watch crystal, a transmitter reference oscillator, and RF circuitry for use as the transmitter in your security application. See Table 1 for a description of each pin. FIGURE 2-1: TYPICAL CIRCUIT Rev. 20-000011A 9/23/2013 VDD VDD VDD B3 Matching Circuit Block DS40001747A-page 6 VSS CLKIN S0 CLKOUT S1 S3 S2 PGC LED PGD DATA NA CTRL VDD XTAL CTRL DATA RFOUT B0 B1 B2 VSS 2014 Microchip Technology Inc. MCS3142 3.0 MEMORY ORGANIZATION MCS3142 has 128 bytes of configuration data. In general, the Configuration bytes can be divided into three categories: those options related to the Classic KEELOQ technology encoder, those options related to the Ultimate KEELOQ technology encoder, and those options related to the transmitter and device operation shared by the two encoders. TABLE 3-1: Address 0x00-0x07 CONFIGURATION REGISTERS Size (Bytes) 8 Description ® Classic KEELOQ Technology Crypt Key 0x08-0x0F 8 Classic KEELOQ Technology Seed Value 0x10-0x13 4 Classic KEELOQ Technology Serial Number 0x14-0x15 2 Classic KEELOQ Technology DISC Value 0x16-0x17 2 Classic KEELOQ Technology Encoder Configuration 0x18-0x19 2 Classic KEELOQ Technology Transmitter Configuration 0x1A 1 Classic KEELOQ Technology Minimum Packet 0x1B-0x1C 2 Classic KEELOQ Technology Maximum Packet 0x1D 1 Classic KEELOQ Technology Time Element PR2 Value 0x1E-0x2D 16 Ultimate KEELOQ Technology Crypt Key 0x2E-0x3D 16 Ultimate KEELOQ Technology Seed Value 0x3E-0x41 4 Ultimate KEELOQ Technology Serial Number 0x42-0x43 2 Reserved 0x44-0x53 16 Ultimate KEELOQ Technology Authorization Code 0x54-0x55 2 Ultimate KEELOQ Technology Encoder Configuration 0x56-0x57 2 Ultimate KEELOQ Technology Transmitter Configuration 0x58 1 Ultimate KEELOQ Technology Minimum Packet 0x59-0x5A 2 Ultimate KEELOQ Technology Maximum Packet 0x5B 1 Ultimate KEELOQ Technology Time Element PR2 Value 0x5C-0x5E 3 Encoder Frequency Setting 0x5F-0x60 2 Encoder Button Configuration 0x61-0x62 2 Seed Packet Button Configuration 0x63-0x65 3 Ultimate KEELOQ Technology Synchronization Counter, Copy 1 0x66 1 Ultimate KEELOQ Technology Synchronization Counter CRC, Copy 1 0x67-0x68 2 Classic KEELOQ Technology Synchronization Counter, Copy 1 0x69 1 Classic KEELOQ Technology Synchronization Counter CRC, Copy 1 0x6A-0x6B 2 Ultimate KEELOQ Technology Reset Counter, Copy 1 0x6C 1 Ultimate KEELOQ Technology Reset Counter CRC, Copy 1 0x6D-0x70 4 Ultimate KEELOQ Technology Low-Speed Timer, Copy 1 0x71 1 Ultimate KEELOQ Technology Low-Speed Timer CRC, Copy 1 0x72-0x74 3 Ultimate KEELOQ Technology Synchronization Counter, Copy 2 0x75 1 Reserved 0x76-0x77 2 Classic KEELOQ Technology Synchronization Counter, Copy 2 0x78 1 Reserved 0x79-0x7A 2 Ultimate KEELOQ Technology Reset Counter, Copy 2 0x7B 1 Reserved 0x7C-0x7F 4 Ultimate KEELOQ Technology Timer, Copy 2 2014 Microchip Technology Inc. DS40001747A-page 7 MCS3142 3.1 Counter and Timer Protection Because they are written during normal operation of the device, the two synchronization counters, Reset counter and time value receive special protection to guard against data loss from unexpected power loss. An 8-bit CRC is calculated and stored alongside each variable. Further, each variable is duplicated in a different portion of memory. Whenever a value is read, the CRC is calculated and verified against the stored value. If there is a mismatch, the second copy of the data is read instead. The CRC calculation uses a 8 4 3 2 x +x +x +x +1 . polynomial represented by Example 3-1 describes a sample C function to compute this value. EXAMPLE 3-1: CRC CALCULATION static uint8_t crc(const uint8_t* buffer, size_t len){ uint8_t bitcount; uint8_t c = 0xFF; while(len--) { c ^= *buffer++; for(bitcount = 0; bitcount < 8; bitcount++){ if((c & 0x80)!= 0) { c <<= 1; c ^= 0x1D; }else{ c <<= 1; } } } return ~c; } DS40001747A-page 8 2014 Microchip Technology Inc. MCS3142 3.2 Configuration Byte Details The following tables describe Configuration bytes in detail. TABLE 3-2: CLASSIC KEELOQ® TECHNOLOGY CRYPT KEY CONFIGURATION REGISTERS Byte Address Bit Description 0x00 7:0 0x01 7:0 Byte 1 of the crypt key 0x02 7:0 Byte 2 of the crypt key 0x03 7:0 Byte 3 of the crypt key 0x04 7:0 Byte 4 of the crypt key 0x05 7:0 Byte 5 of the crypt key Crypt Key Values Least Significant eight bits of the crypt key 0x06 7:0 Byte 6 of the crypt key 0x07 7:0 Most Significant eight bits of the crypt key TABLE 3-3: CLASSIC KEELOQ® TECHNOLOGY SEED CONFIGURATION REGISTERS Byte Address Bit Description 0x08 7:0 0x09 7:0 Byte 1 of the seed 0x0A 7:0 Byte 2 of the seed Seed Values Least Significant eight bits of the seed 0x0B 7:0 Byte 3 of the seed 0x0C 7:0 Byte 4 of the seed 0x0D 7:0 Byte 5 of the seed 0x0E 7:0 Byte 6 of the seed 0x0F 7:0 Most Significant eight bits of the seed TABLE 3-4: CLASSIC KEELOQ® TECHNOLOGY SERIAL NUMBER CONFIGURATION REGISTERS Byte Address Bit 0x10 7:0 Description Serial Number Values Least Significant eight bits of the serial number 0x11 7:0 Byte 1 of the serial number 0x12 7:0 Byte 2 of the serial number 0x13 3:0 7:4 TABLE 3-5: Most Significant four bits of the serial number Reserved Maintain as ‘0000’ CLASSIC KEELOQ® TECHNOLOGY DISC CONFIGURATION REGISTERS Byte Address Bit 0x14 7:0 0x15 1:0 7:2 2014 Microchip Technology Inc. Description DISC Value Values Least Significant eight bits of DISC value Most Significant two bits of DISC value Reserved Maintain as ‘000000’ DS40001747A-page 9 MCS3142 TABLE 3-6: CLASSIC KEELOQ® TECHNOLOGY ENCODER CONFIGURATION REGISTERS Byte Address Bit 0x16 7:6 Description Seed Option Values 00 = No seed 01 = Limited and immediate 10 = Permanent and delayed 11 = Permanent and immediate 5:2 Reserved 1:0 Time Element Clock Prescaler 00 = 1:1 Leave ‘0000’ 01 = 1:4 10 = 1:16 11 = 1:64 0x17 7 6:5 Reserved Leave ‘0’ Blank Alternate Code Word Configuration 00 = All words transmitted 01 = One in two words transmitted 10 = One in four words transmitted 11 = Reserved; illegal value 4:1 0 Reserved — Line Encoding 0 = PWM 1 = Manchester TABLE 3-7: CLASSIC KEELOQ® TECHNOLOGY TRANSMITTER CONFIGURATION REGISTERS Byte Address Bit Description 0x18 7:5 Frequency Deviation Low three bits of frequency deviation calculation (see Section 6.4 “Center Frequency and Frequency Deviation”) Output Power 0 = 0 dBm 4 Values 1 = +10 dBm 3:0 Reserved 7 Reserved Reserved, maintain as ‘0’ 6 Data Encoding 0 = FSK 5 Band 0 = 310-450 MHz Frequency Deviation High five bits of frequency deviation calculation 0x19 Reserved, maintain as ‘1100’ 1 = OOK 1 = 868-870, 902-928 MHz 4:0 TABLE 3-8: CLASSIC KEELOQ® TECHNOLOGY MINIMUM AND MAXIMUM CODE WORDS COUNT CONFIGURATION REGISTERS Byte Address Bit 0x1A 7:0 Minimum Code Word Count Integer value of the minimum number of code words sent 0x1B 7:0 Maximum Code Word Count Least Significant eight bits of value of the maximum number of code words sent 0x1C 7:0 DS40001747A-page 10 Description Values Most Significant eight bits of value of the maximum number of code words sent 2014 Microchip Technology Inc. MCS3142 TABLE 3-9: CLASSIC KEELOQ® TECHNOLOGY TIME ELEMENT VALUE CONFIGURATION REGISTER Byte Address Bit 0x1D 7:0 TABLE 3-10: Description Time Element Timer Value Values See Section 6.2 “Baud Rate” ULTIMATE KEELOQ® TECHNOLOGY CRYPT KEY CONFIGURATION REGISTERS Byte Address Bit 0x1E 7:0 Description Crypt Key Values Least Significant eight bits of the crypt key 0x1F 7:0 Byte 1 of the crypt key 0x20 7:0 Byte 2 of the crypt key 0x21 7:0 Byte 3 of the crypt key 0x22 7:0 Byte 4 of the crypt key 0x23 7:0 Byte 5 of the crypt key 0x24 7:0 Byte 6 of the crypt key 0x25 7:0 Byte 7 of the crypt key 0x26 7:0 Byte 8 of the crypt key 0x27 7:0 Byte 9 of the crypt key 0x28 7:0 Byte 10 of the crypt key 0x29 7:0 Byte 11 of the crypt key 0x2A 7:0 Byte 12 of the crypt key 0x2B 7:0 Byte 13 of the crypt key 0x2C 7:0 Byte 14 of the crypt key 0x2D 7:0 Most Significant eight bits of the crypt key TABLE 3-11: ULTIMATE KEELOQ® TECHNOLOGY SEED CONFIGURATION REGISTERS Byte Address Bit Description 0x2E 7:0 0x2F 7:0 Byte 1 of the seed 0x30 7:0 Byte 2 of the seed 0x31 7:0 Byte 3 of the seed 0x32 7:0 Byte 4 of the seed 0x33 7:0 Byte 5 of the seed 0x34 7:0 Byte 6 of the seed 0x35 7:0 Byte 7 of the seed 0x36 7:0 Byte 8 of the seed 0x37 7:0 Byte 9 of the seed Seed Values Least Significant eight bits of the seed 0x38 7:0 Byte 10 of the seed 0x39 7:0 Byte 11 of the seed 0x3A 7:0 Byte 12 of the seed 0x3B 7:0 Byte 13 of the seed 0x3C 7:0 Byte 14 of the seed 0x3D 7:0 Most Significant eight bits of the seed 2014 Microchip Technology Inc. DS40001747A-page 11 MCS3142 TABLE 3-12: ULTIMATE KEELOQ® TECHNOLOGY SERIAL NUMBER CONFIGURATION REGISTERS Byte Address Bit 0x3E 7:0 0x3F 7:0 Byte 1 of the serial number 0x40 7:0 Byte 2 of the serial number 0x41 7:0 Most Significant eight bits of the serial number TABLE 3-13: Description Serial Number Values Least Significant eight bits of the serial number ULTIMATE KEELOQ® TECHNOLOGY AUTHORIZATION KEY CONFIGURATION REGISTERS Byte Address Bit Description 0x44 7:0 0x45 7:0 Byte 1 of the authorization key 0x46 7:0 Byte 2 of the authorization key 0x47 7:0 Byte 3 of the authorization key 0x48 7:0 Byte 4 of the authorization key 0x49 7:0 Byte 5 of the authorization key 0x4A 7:0 Byte 6 of the authorization key Authorization Key Values Least Significant eight bits of the authorization key 0x4B 7:0 Byte 7 of the authorization key 0x4C 7:0 Byte 8 of the authorization key 0x4D 7:0 Byte 9 of the authorization key 0x4E 7:0 Byte 10 of the authorization key 0x4F 7:0 Byte 11 of the authorization key 0x50 7:0 Byte 12 of the authorization key 0x51 7:0 Byte 13 of the authorization key 0x52 7:0 Byte 14 of the authorization key 0x53 7:0 Most Significant eight bits of the authorization key TABLE 3-14: ULTIMATE KEELOQ® TECHNOLOGY ENCODER CONFIGURATION REGISTERS Byte Address Bit 0x54 7:6 Description Seed Option Values 00 = No seed 01 = Limited and immediate 10 = Permanent and delayed 11 = Permanent and immediate 5:2 Reserved Leave ‘0000’ 1:0 Time Element Clock Prescaler 00 = 1:1 01 = 1:4 10 = 1:16 11 = 1:64 DS40001747A-page 12 2014 Microchip Technology Inc. MCS3142 TABLE 3-14: ULTIMATE KEELOQ® TECHNOLOGY ENCODER CONFIGURATION REGISTERS 0x55 7 6:5 Reserved Leave ‘0’ Blank Alternate Code Word Configuration 00 = All words transmitted 01 = One in two words transmitted 10 = One in four words transmitted 11 = Reserved; illegal value 4:1 0 Reserved Line Encoding 0 = PWM 1 = Manchester TABLE 3-15: ULTIMATE KEELOQ® TECHNOLOGY TRANSMITTER CONFIGURATION REGISTERS Byte Address Bit 0x56 7:5 Description Values Frequency Deviation Low three bits of frequency deviation calculation (see Section 6.4 “Center Frequency and Frequency Deviation”) Output Power 0 = 0 dBm 3:0 Reserved Reserved, maintain as ‘1100’ 7 Reserved Reserved, maintain as ‘0’ 6 Data Encoding 0 = FSK 5 Band 4 1 = +10 dBm 0x57 1 = OOK 0 = 310-450 MHz 1 = 868-870, 902-928 MHz 4:0 TABLE 3-16: Frequency Deviation High five bits of frequency deviation calculation (see Section 6.4 “Center Frequency and Frequency Deviation”) ULTIMATE KEELOQ® TECHNOLOGY MINIMUM AND MAXIMUM CODE WORDS COUNT CONFIGURATION REGISTERS Byte Address Bit 0x58 7:0 Minimum Code Word Count Integer value of the minimum number of code words sent 0x59 7:0 Maximum Code Word Count Least Significant eight bits of value of the maximum number of code words sent 0x5A 7:0 TABLE 3-17: Values Most Significant eight bits of value of the maximum number of code words sent ULTIMATE KEELOQ® TECHNOLOGY TIME ELEMENT VALUE CONFIGURATION REGISTER Byte Address Bit 0x5B 7:0 TABLE 3-18: Description Description Time Element Timer Value Values See Section 5.2 “Encoder Time-Stamp” ENCODER FREQUENCY CONFIGURATION REGISTERS Byte Address Bit 0x5C 7:0 0x5D 7:0 Middle byte of encoder frequency 0x5E 7:0 Most Significant Byte of encoder frequency 2014 Microchip Technology Inc. Description RF Frequency Values Least Significant Byte of encoder frequency DS40001747A-page 13 MCS3142 TABLE 3-19: ENCODER BUTTON ASSIGNMENT CONFIGURATION REGISTERS Byte Address Bit 0x5F 7 Encoder Assignment when S0, S1, S2 active; S3 inactive 6 Encoder Assignment when S1, S2 active; S0, S3 inactive 5 Encoder Assignment when S0, S2 active; S1, S3 inactive 4 Encoder Assignment when S2 active; S0, S1, S3 inactive 3 Encoder Assignment when S0, S1 active; S2, S3 inactive 2 Encoder Assignment when S1 active; S0, S2, S3 inactive 1 Encoder Assignment when S0 active; S1, S2, S3 inactive 0 Reserved 7 Encoder Assignment when S0, S1, S2, S3 active 6 Encoder Assignment when S1, S2, S3 active; S0 inactive 5 Encoder Assignment when S0, S2, S3 active; S1 inactive 4 Encoder Assignment when S2, S3 active; S0, S1 inactive 3 Encoder Assignment when S0, S1, S3 active; S2 inactive 2 Encoder Assignment when S1, S3 active; S0, S2 inactive 1 Encoder Assignment when S0, S3 active; S1, S2 inactive 0 Encoder Assignment when S3 active; S0, S1, S2 inactive 0x60 TABLE 3-20: Description Values 0 = Classic KEELOQ® 1 = Ultimate KEELOQ® SEED BUTTON ASSIGNMENT CONFIGURATION REGISTERS Byte Address Bit 0x61 7 Seed Assignment when S0, S1, S2 active; S3 inactive 6 Seed Assignment when S1, S2 active; S0, S3 inactive 5 Seed Assignment when S0, S2 active; S1, S3 inactive 4 Seed Assignment when S2 active; S0, S1, S3 inactive 3 Seed Assignment when S0, S1 active; S2, S3 inactive 2 Seed Assignment when S1 active; S0, S2, S3 inactive 1 Seed Assignment when S0 active; S1, S2, S3 inactive 0x62 DS40001747A-page 14 Description 0 Reserved 7 Seed Assignment when S0, S1, S2, S3 active 6 Seed Assignment when S1, S2, S3 active; S0 inactive 5 Seed Assignment when S0, S2, S3 active; S1 inactive 4 Seed Assignment when S2, S3 active; S0, S1 inactive 3 Seed Assignment when S0, S1, S3 active; S2 inactive 2 Seed Assignment when S1, S3 active; S0, S2 inactive 1 Seed Assignment when S0, S3 active; S1, S2 inactive 0 Seed Assignment when S3 active; S0, S1, S2 inactive Values 0 = Typical transmission 1 = Seed transmission 2014 Microchip Technology Inc. MCS3142 TABLE 3-21: ULTIMATE KEELOQ® TECHNOLOGY SYNCHRONIZATION COUNTER INITIAL VALUE REGISTERS Byte Address Bit 0x63 7:0 0x64 7:0 0x65 7:0 0x66 Description Values Synchronization Counter Value, Primary Copy Least Significant Byte of counter value 7:0 Synchronization Counter CRC See Section 3.1 “Counter and Timer Protection” 0x72 7:0 Least Significant Byte of counter value 0x73 7:0 Synchronization Counter Value, Secondary Copy 0x74 7:0 TABLE 3-22: Most Significant Byte of counter value Middle byte of counter value Most Significant Byte of counter value CLASSIC KEELOQ® TECHNOLOGY SYNCHRONIZATION COUNTER INITIAL VALUE REGISTERS Byte Address Bit 0x67 7:0 0x68 7:0 Synchronization Counter Value, Primary Copy 0x69 7:0 Synchronization Counter CRC 0x76 7:0 0x77 7:0 Synchronization Counter Value, Secondary Copy TABLE 3-23: Middle byte of counter value Description Values Least Significant Byte of counter value Most Significant Byte of counter value See Section 3.1 “Counter and Timer Protection” Least Significant Byte of counter value Most Significant Byte of counter value ULTIMATE KEELOQ® TECHNOLOGY RESET COUNTER INITIAL VALUE REGISTERS Byte Address Bit 0x6A 7:0 Description Values 0x6B 7:0 Synchronization Counter Value, Primary Copy 0x6C 7:0 Synchronization Counter CRC See Section 3.1 “Counter and Timer Protection” 0x79 7:0 Least Significant Byte of counter value 0x7A 7:0 Synchronization Counter Value, Secondary Copy TABLE 3-24: Least Significant Byte of counter value Most Significant Byte of counter value Most Significant Byte of counter value ULTIMATE KEELOQ® TECHNOLOGY TIMER INITIAL VALUE REGISTERS Byte Address Bit 0x6D 7:0 0x6E 7:0 Byte 1 of the counter value 0x6F 7:0 Byte 2 of the counter value 0x70 7:0 0x71 7:0 Timer CRC See Section 3.1 “Counter and Timer Protection” 0x7C 7:0 Timer Value, Secondary Copy Least Significant Byte of counter value 0x7D 7:0 Byte 1 of the counter value 0x7E 7:0 Byte 2 of the counter value 0x7F 7:0 Most Significant Byte of counter value 2014 Microchip Technology Inc. Description Timer Value, Primary Copy Values Least Significant Byte of counter value Most Significant Byte of counter value DS40001747A-page 15 MCS3142 4.0 CLASSIC KEELOQ® TECHNOLOGY OPERATION 4.1 Synchronization Counter This is the 16-bit synchronization value that is used to create the hopping code for transmission. This value will be incremented after every transmission. The initial value of the synchronization counter may be set via the Synchronization Counter Initial Value registers (see Table 3-22). 4.2 DISC Bits The Discrimination bits are used to validate the decrypted code word. The discrimination value is typically programmed with the ten Least Significant bits of the serial number or some other fixed value, as desired by the manufacturer. The Discrimination bits are programmed into the Configuration registers at program-time. SeeTable 3-5. 4.3 Function Code (Button Status Code) The function code is a bitmapped representation of the state of each button on the transmitter. States are active-high. TABLE 4-1: 4.4 CLASSIC KEELOQ® BUTTON CODE TRANSLATION Button Function Code S0 xxx1 S1 xx1x S2 x1xx S3 1xxx Serial Number Each Classic KEELOQ encoder transmits its 28-bit serial number with each transmission. It is intended that this serial number be unique to a system. It is set in the Serial Number Configuration registers, described in Table 3-4. DS40001747A-page 16 2014 Microchip Technology Inc. MCS3142 4.5 Code Word Format CLASSIC KEELOQ® CODE WORD FORMAT FIGURE 4-1: Rev. 20-000 006A 8/29/201 3 34 bits Fixe d P ortion 4.5.1 32 bits Encrypted Portion Blan k Functio n Code Ser ial Numbe r Functio n Code Counter Over Flow DIS C Sync Counter 2-bits 4-bits 28-bits 4-bits 2-bits 10-bits 16-bits HOPPING CODE PORTION The hopping code portion is calculated by encrypting the synchronization counter, discrimination value and function code with the encoder key. The hopping code is calculated when a button press is registered. 4.5.2 FIXED CODE PORTION The fixed code portion consists of 28 bits of the serial number and a copy of the 4-bit function code. Two bits of constant zero are prepended to the fixed code portion. 4.5.3 SEED WORD FORMAT A seed transmission transmits a code word that consists of 60 bits of fixed data that is stored in the NVM by the manufacturer. This can be used for secure learning of encoders or whenever a fixed code transmission is required. The seed code word format is shown is Figure 4-2. The function code for a seed transmission is always ‘1111’. The seed word is transmitted whenever a seed-configured button combination is registered. If the Delayed option is enabled, the encoder will transmit 25 typical code words before transmitting seed words. If the Limited option is enabled, the seed word will only be transmitted if the encoder’s synchronization counter is less than 256. If the synchronization counter is above this, a typical code word will be transmitted instead. CLASSIC KEELOQ® SEED WORD FORMAT FIGURE 4-2: Rev. 20-000008A 10/2/2013 6 bits Fixed Note: 60 bits Seed Blank Function Code Serial Number 2-bits 4-bits 60-bits In Seed code word, the fixed portion is sent as 0b001111. 2014 Microchip Technology Inc. DS40001747A-page 17 MCS3142 5.0 ULTIMATE KEELOQ TECHNOLOGY OPERATION 5.1 Synchronization Counter The synchronization counter is an always-incrementing, event-based counter. The counter is incremented whenever a new button combination is registered and a new code word is prepared. For increased security, the synchronization counter will not overflow. The device will cease operating when the counter reaches its maximum value. 5.4 Each Ultimate KEELOQ transmission contains a battery level indicator byte. It includes a 7-bit digital representation of the battery level and a 1-bit low battery flag. The battery level is captured by measuring an on-board 1.024V source using the battery as reference. The low battery flag is high whenever the measured battery voltage is estimated to be below 2.5V. Equation 5-1 converts the reference value into a voltage. EQUATION 5-1: The initial value of the synchronization counter may be set via the Synchronization Counter Initial Value registers (see Table 3-21). 5.2 7 1.024 2 V BAT = ------------------------BATT Encoder Time-Stamp MCS3142 requires an external 31.768 kHz oscillator connected to the secondary oscillator drive pins of the internal timer. This timer is used to track the passage of time over the lifetime of the encoder. Each Ultimate KEELOQ transmission includes this time with quarter-second resolution (i.e., each count represents one quarter of a second). The initial value of the timer may be set at programming time via the Timer Initial Value registers, described in Table 3-24. 5.3 Battery Level and Low Battery Flag Function Code The function code is a bitmapped representation of the state of each button on the transmitter. States are active-high. TABLE 5-1: ULTIMATE KEELOQ® FUNCTION CODE TRANSLATION Button Function Code S0 xxx1 S1 xx1x S2 x1xx S3 1xxx DS40001747A-page 18 5.5 Button Press Timer The button press timer is a high-resolution timer representing the duration of the current button press at the time the code word was prepared. Each count represents 50 ms of time. It resets whenever a new button combination is registered. 5.6 Delta Time The delta time represents the elapsed time since the previous code word was sent. The timer increments every second. 5.7 Reset Counter The Reset counter is an always-incrementing counter representing the number of Power-on Reset events experienced by the device. It is intended to be used by the receiver as an indication that the transmitter has been without power and that there will be a discrepancy in the time-stamp. For increased security, the Reset counter will not overflow. The device will cease operating when the counter reaches its maximum value. The initial value of the Reset counter may be set using the Reset Counter Configuration registers, described in Table 3-23. 2014 Microchip Technology Inc. MCS3142 5.8 Authorization Code The Authorization Code is a cryptographically-strong industry standard representation of the code word suitable for authentication and integrity verification. It is generated by using the on-board AES encryption algorithm in CBC-MAC mode. The calculation takes place over the entire code word, including the encrypted and unencrypted portions, using the Authorization Key as input. Figure 5-1 shows a representation of how this calculation is performed. This calculation is truncated to its Least Significant 32 bits for transmission. The Authorization Code requires a shared secret called the Authorization Key. This key is set in the Authorization Key Configuration Register, described in Table 3-13. FIGURE 5-1: AUTHORIZATION CODE CALCULATION Serial Number Encrypted Code Word E E 0 Authorization Key 5.9 Authorization Code Serial Number Each Ultimate KEELOQ encoder transmits its 32-bit serial number with each transmission. It is intended that this serial number be unique to a system. It is set in the Serial Number Configuration registers, described in Table 3-12. 2014 Microchip Technology Inc. DS40001747A-page 19 MCS3142 5.10 Code Word Format The Ultimate KEELOQ technology code word is 192 bits long. It comprises three sections (see Figure 5-2): • 32 bits of the encoder’s serial number • 128 bits of the encrypted hopping code • 32 bits of authorization code These segments are described in detail in the following sections. ULTIMATE KEELOQ® CODE WORD FORMAT FIGURE 5-2: Rev. 20-000 009A 8/29/201 3 32 bits Fixe d P ortion 5.10.1 32 bits Auth Portion 128 bits En crypted Ho pping Code Ser ial Numbe r Delta Time Sync Counter Battery Functio n Code Low Spee d Timestamp Button Timer Resync Counter Authori zation Code 32-bits 24-bits 24-bits 8-bits 8-bits 32-bits 16-bits 16-bits 32-bits HOPPING CODE PORTION The hopping portion of an Ultimate KEELOQ code word contains nearly all of the transmitted data. The time-stamp and Button Timer ensure that each transmission is unique. 5.10.2 FIXED CODE PORTION The fixed, unencrypted portion of an Ultimate KEELOQ code word consists of the encoder’s serial number. Unlike Classic KEELOQ, there is no copy of the function code. 5.10.3 AUTHORIZATION CODE The 32-bit Authorization Code is appended after the hopping portion of the code word. 5.11 Seed Word Format The seed word is used when pairing the transmitter to a receiver using a secure learn methodology. FIGURE 5-3: ULTIMATE KEELOQ® SEED WORD FORMAT Rev. 20-000010A 10/2/2013 32 bits Fixed Portion 128 bit Seed 32 bits Auth Portion Serial Number Seed Authorization Code Note: DS40001747A-page 20 In the Seed code word, the serial number is sent as 0xFFFFFFFF. 2014 Microchip Technology Inc. MCS3142 6.0 TRANSMITTER OPERATION 6.1 Data Modulation Format and Baud Rate A transmission is made of up several code words. Each code word contains a preamble, header and data. A code word is separated from another code word by guard time. All timing specifications for the modulation formats are based on a basic Time Element, described as TE. See Section 6.2 “Baud Rate” for details on baud rate calculation. This timing element can be set to a wide range of values. The length of the preamble, header and guard is fixed. The data modulation format is selected for each encoder. See Table 3-6 for the Classic KEELOQ encoder and Table 3-14 for Ultimate KEELOQ encoder. FIGURE 6-1: PWM TRANSMISSION FORMAT Rev. 20-000 003A 8/29/201 3 TE T E TE Log ic ‘0’ Log ic ‘1’ TBP 1 16 3-10 TE Heade r 31 TE Pre amb le FIGURE 6-2: Encrypted Portion Fixe d Cod e P orti on Gua rd Time MANCHESTER TRANSMISSION FORMAT Rev. 20-000 004A 8/29/201 3 TE TE Log ic ‘0’ Log ic ‘1’ TBP START bit bit 0 bit 1 bit 2 STOP bit 1 2 Pre amb le 16 Heade r 2014 Microchip Technology Inc. Encrypted Portion Fixe d Cod e P orti on Gua rd Time DS40001747A-page 21 MCS3142 6.2 Baud Rate The baud rate of an encoder’s transmission is highly configurable using two configuration options: • The Time Element Clock Prescaler • The Time Element Clock Value Each encoder has its own independent configuration and can therefore operate at a rate independent of the other encoder. See Table 3-6 and Table 3-9 for the Classic KEELOQ encoder and Table 3-14 and Table 3-17 for the Ultimate KEELOQ encoder. The Time Element is calculated using the formula in Equation 6-1. EQUATION 6-1: 4 T E = PRE TIME ----------------68 10 Table 3-17 lists appropriate settings for some baud rates common to KEELOQ systems. TABLE 6-1: 6.3 CONFIGURATION FOR COMMON BAUD RATES TE (µs) PRE TIME 100 1:1 200 200 1:4 100 400 1:4 200 800 1:16 100 Transmission Modulation Format The RF transmission can be configured to modulate using Frequency-Shift Keying (FSK) or On-Off Keying (OOK). Each encoder may be configured independently. See Table 3-7 and Table 3-15 for the Classic KEELOQ and Ultimate KEELOQ encoders, respectively. DS40001747A-page 22 2014 Microchip Technology Inc. MCS3142 6.4 Center Frequency and Frequency Deviation The RF transmitter is capable of generating many of the popular RF frequencies that are permitted within the radio regulations of the country the finished product will be sold. The RF frequency configuration is performed by selecting the frequency band, the reference crystal frequency and the frequency value to be stored in the Encoder Frequency Configuration register. If FSK modulation is used, the frequency deviation is set in the Transmitter Configuration register. Unlike other configuration options, the two encoders of the MCS3142 device share the same frequency configuration, which is shown in Table 3-18. Frequency deviation is individually configurable. See Table 3-7 and Table 3-15 for the Classic KEELOQ and Ultimate KEELOQ encoders, respectively. 6.4.1 BAND SELECTION The Band bit in the Transmitter Configuration register configures the RF transmitter for a range of frequencies for a given crystal frequency, as shown in Table 6-2. The Transmitter Configuration registers are shown in Table 37 for the Classic KEELOQ encoder and Table 3-15 for the Ultimate KEELOQ encoder. Although each encoder has its own band selection configuration, the requirements of proper antenna tuning and the inability to configure the fundamental frequency per encoder will likely require that this setting be identical for both encoders. TABLE 6-2: FREQUENCY CALCULATION(1) Reference Oscillator (fREF) Band Frequency Range (fRF) 22 MHz 0 310-450 MHz 24 MHz 312-450 MHz 26 MHz 338-450 MHz 1 Note 1: 860-928 MHz fRF Equation fDEV Equation 14 f RF DF = 2 ----------fREF 14 f DEV DA = 2 ----------f REF 13 f RF DF = 2 ----------fREF 13 f DEV DA = 2 ----------f REF 212992 < DF < 344064 and 10 kHz fDEV 200kHz. The reference crystal frequency tolerance and frequency stability over the operating temperature range depend on the system frequency budget. Typically, the receiver crystal frequency tolerance, stability and receiver bandwidth will have the greatest influence. For OOK modulation, the transmitted RF signal should remain inside the receiver bandwidth, otherwise signal degradation will occur. For FSK modulation, fRF should remain inside the receiver bandwidth and within 0.5 fDEV. As a general practice, do not choose an RF transmit signal with an integer or near integer multiple of fXTAL. This will result in higher noise and spurious emissions. 2014 Microchip Technology Inc. DS40001747A-page 23 MCS3142 6.4.2 CRYSTAL SELECTION Once the frequency band has been selected, the choice of crystal frequency is flexible provided the crystal meets the specifications summarized in Table 6-3, the boundaries of the Encoder Frequency Configuration value are followed and the RF transmit frequency error is acceptable to the system design. TABLE 6-3: CRYSTAL RESONATOR SPECIFICATIONS Symbol Min. Typ. Max. Unit fREF Crystal Frequency 22 — 26 MHz CL Load Capacitance — 15 — pF Equivalent Series Resistance — — 100 Ω ESR 6.4.3 Description FREQUENCY CALCULATION Once the frequency band and crystal frequency are selected, the transmit frequency is calculated by setting the Encoder Frequency Configuration bits according to the formula shown in Table 6-2. If the calculated value for Encoder Frequency Configuration is not an integer, there will be an associated transmit frequency error. 6.4.4 POWER OUTPUT The RF output power is configurable to either +0 dBm or +10 dBm (typical). This option is configurable for each encoder. See Table 3-7 for the Classic KEELOQ encoder and Table 3-15 for the Ultimate KEELOQ encoder. DS40001747A-page 24 2014 Microchip Technology Inc. MCS3142 7.0 DEVICE OPERATION 7.1 LED Operation typical code word or a seed word for the assigned encoder. This gives complete flexibility to the system designer. The button configuration is stored as two 16-bit words. Each bit in a Configuration Word represents one particular combination of active/inactive states of the buttons. The bit is determined by taking the four switches as one 4-bit value, with S0 being Least Significant, followed by S1, S2 and S3. For example, the Configuration bit corresponding to S1 and S2 active (or binary ‘1’) and S0 and S3 inactive (or binary ‘0’) is given by S 3 S 2 S 1 S 0 = 0110 2 = 6 . Configuration bit zero is considered “do not care” as it represents all buttons in their inactive state, which is a special condition for the encoder. The LED pin will be driven low periodically while MCS3142 is transmitting data. This output is designed to drive an external LED with an appropriate current-limiting resistor. The duty cycle varies between normal operation and a low battery condition (see Figure 7-1). Refer to Section 5.4 “Battery Level and Low Battery Flag” for details on low battery conditions. FIGURE 7-1: LED OPERATION Rev. 20-000012A 9/25/2013 One Configuration Word controls the encoder assignment, with a ‘0’ representing the Classic KEELOQ encoder and a ‘1’ representing the Ultimate KEELOQ encoder. The second word controls transmission type, with ‘0’ representing a typical transmission and ‘1’ representing a seed transmission. Because the MCS3142 memory is byte-oriented, each 16-bit Configuration Word is stored as two 8-bit bytes in “little endian” order. See Table 3-19 for encoder assignment and Table 3-20 for seed assignment. S[3210] VDD > VLOW TLEDON TLEDOFF LED TLEDON = 200 ms TLEDOFF = 800 ms VDD < VLOW TLEDON Table 7-1 may assist in calculating configuration values by iterating all button state combinations in the order in which they correspond to Configuration bits. In this worksheet, each column represents a specific set of states of the buttons, which in turn represents one bit in the Configuration Word. A stated button, for example S0 or S1, represents that button in its active state. A hyphen in place of a switch label represents that switch in its inactive state. Once all states have been assigned an encoder and a transmission type, the result can be examined as a 16-bit binary number and transcribed into the configuration values. TLEDOFF LED TLEDON = 200 ms 7.2 TLEDOFF = 200 ms Button Configuration MCS3142 allows all combinations of the four buttons to be individually assigned to an encoder. Each combination can also be assigned to transmit either a TABLE 7-1: BTN CFG BUTTON CONFIGURATION WORKSHEET S0 — S1 S1 S2 S2 S3 S3 ↓ ↓ ___ S0 — S0 — S0 — S0 — — — S1 S1 — — S1 S1 S2 S2 — — — — S2 S2 S3 S3 S3 S3 S3 S3 — — ↓ ↓ ↓ ↓ ↓ ↓ ↓ ↓ S0 — S0 — S0 — — — S1 S1 — — S2 S2 — — — — — — — — — — ↓ ↓ ↓ ↓ ↓ ↓ ___ ___ ___ ___ ___ ___ ___ ___ ___ ___ ___ ___ ___ ___ ___ = Button Configuration Byte 1 Button Configuration Byte 0 LSb * 0 = Classic KeeLoq, 1 = Ultimate KeeLoq Seed CFG ___ ___ ___ ___ ___ ___ ___ ___ ___ ___ ___ ___ ___ ___ ___ ___ = Seed Button Configuration Byte 1 Seed Button Configuration Byte 0 LSb * 0 = Typical transmission, 1 = Seed transmission 2014 Microchip Technology Inc. DS40001747A-page 25 MCS3142 7.3 Code Word Completion MCS3142 always ensures that a full and complete code word is transmitted even if all buttons are released before transmission is complete. Multiple code words may be transmitted after release to comply with the minimum code word configuration option. 7.4 Minimum and Maximum Code Word The Minimum and Maximum Code Word feature places boundaries on the total duration of a transmission. This feature is configured by setting the number of code words for a given encoder. The device will always transmit a complete code word. Because the code word durations are fixed and known, it is possible to convert code word counts into a duration time. Code word duration is fixed and based on the selected bit rate, data encoding method and encoder type. As described in Section 6.1 “Data Modulation Format and Baud Rate”, all timing is derived from TE, the Time Element, which describes the duration of a single element of transmission. A Manchester-encoded signal has two TE per bit; a PWM-encoded signal has three TE per bit. This feature is configured with the Minimum and Maximum Code Words Count Configuration registers (see Table 3-8 for the Classic KEELOQ encoder and Table 3-16 for the Ultimate KEELOQ encoder). Table 7-2 defines equations to convert code word length into time. TABLE 7-2: TRANSMISSION DURATION EQUATIONS Encoder Type Classic KEELOQ® Encoder Ultimate KEELOQ® Encoder 7.5 Data Encoding Code Word Duration Manchester T C = 187T E + 23.979 ms PWM T C = 201T E + 23.979 ms Manchester T C = 437T E + 46.527 ms PWM T C = 629T E + 46.527 ms Blank Alternate Code Word The Blank Alternate Code Word feature may be used to reduce the average power of a transmission by transmitting only every second or every fourth code word. Enabling this option may allow the manufacturer to transmit a higher amplitude transmission as the time-averaged power is reduced. This feature is configured in the Encoder Configuration registers, see Table 3-6 for the Classic KEELOQ encoder and Table 3-14 for the Ultimate KEELOQ encoder. DS40001747A-page 26 2014 Microchip Technology Inc. MCS3142 8.0 INTEGRATING MCS3142 INTO A SYSTEM FIGURE 8-1: TYPICAL DECODER OPERATION Rev. 20-000013A 1/29/2014 Start 8.1 The decoder waits until a transmission is received. The received serial number is compared to the EEPROM table of learned transmitters to first determine if this transmitter’s use is allowed in the system. If from a paired transmitter, the transmission is decrypted using the stored crypt key and authenticated via the Discrimination bits for appropriate crypt key usage. If the decryption is valid, the synchronization value is evaluated (see Figure 8-1). 8.2 No Note: Transmission Received? Yes No Decrypt Transmission Is Decryption Valid? Yes Is Counter Within 16? Yes No No Synchronization with a Decoder The synchronization method described in this section is an exemplar method. It may be altered to fit the needs and capabilities of a particular system. The KEELOQ technology includes a sophisticated synchronization technique that does not require the calculation and storage of future codes. The technique securely blocks invalid transmission while providing transparent resynchronization to transmitters inadvertently activated away from the receiver. Does Serial Number Match? Yes No Decoder Operation Is Counter Within 32K? Yes Save Counter in Temporary Location Execute Command and Update Counter Figure 8-2 shows a three-partition, rotating Synchronization window. The size of each window is optional but the technique is fundamental. Each time a transmission is authenticated, the intended function is executed and the transmission’s synchronization counter value is stored in EEPROM. From the currently stored counter value there is an initial Single Operation Forward window of 16 codes. If the difference between a received synchronization counter and the last stored counter is within 16, the intended function will be executed on a single button press and the new synchronization counter will be stored. Storing the new synchronization counter value effectively rotates the entire Synchronization window. A Double Operation (Resynchronization) window further exists from the Single Operation window up to 32K code forward of the currently stored counter value. It is referred to as Double Operation because a transmission with a synchronization counter in this window will require an additional, sequential counter transmission prior to executing the intended function. Upon receiving the sequential transmission the decoder executes the intended function and stores the synchronization counter value. This resynchronization occurs transparently to the user, as it is human nature to press the button a second time if the first was unsuccessful. The third window is a Blocked window ranging from the Double Operation window to the currently stored synchronization counter value. Any transmission with synchronization counter value within this window will be ignored. This window excludes previously used code-grabbed transmissions from accessing the system. 2014 Microchip Technology Inc. DS40001747A-page 27 MCS3142 FIGURE 8-2: 8.3 SYNCHRONIZATION WINDOW Security Considerations The strength of this security is based on keeping a secret inside the transmitter that can be verified by encrypted transmissions to a trained receiver. The transmitter’s secret is the manufacturer’s key, not the encryption algorithm. If that key is compromised, then a smart transceiver can capture any serial number, create a valid code word and trick all receivers trained with that serial number. The key cannot be read from the EEPROM without costly die probing, but it can be calculated by brute force decryption attacks on transmitted code words. The cost for these attacks should exceed what the manufacturer would want to protect. To protect the security of other receivers with the same manufacturer’s code, the manufacturer should use the random seed for secure learn. It is a second secret that is unique for each transmitter. Its transmission on a special button press combination can be disabled if the receiver has another way to find it, or limited to the first 127 transmissions for the receiver to learn it. This way, it is very unlikely to ever be captured. If a manufacturer’s key is compromised, clone transmitters can be created, but without the unique seed, they have to be relearned by the receiver. In the same way, if the transmissions are decrypted by brute force on a computer, the random seed hides the manufacturer’s key and prevents more than one transmitter from being compromised. The main benefit of hopping codes is to prevent the retransmission of captured code words. This works very well for code words which the receiver decodes. Its weakness is that, if a code is captured when the receiver misses it, the code may trick the receiver once if it is used before the next valid transmission. The receiver should increment the counter on questionable code word receptions. The transmitter should use separate buttons for lock and unlock functions. A different method would be to require two different buttons in sequence to gain access. There are more ways to make KEELOQ systems more secure, but they all have trade-offs. The user should find a balance between security, design effort and usability, particularly in failure modes. For example, if a button sticks or kids play with it, the counter should not advance into the Blocked Code window, rendering the transmitter useless or requiring retraining. The length of the code word at these baud rates make brute force attacks that guess the hopping code take years. To make the receiver less susceptible to this attack, it should test all bits in the decrypted code for the correct value, not just the low counter bits and function code. DS40001747A-page 28 2014 Microchip Technology Inc. MCS3142 9.0 ELECTRICAL SPECIFICATIONS 9.1 Absolute Maximum Ratings(†) Ambient temperature under bias........................................................................................................ -40°C to +85°C Storage temperature ........................................................................................................................ -55°C to +150°C Voltage on pins with respect to VSS on VDD pin ................................................................................................................................... -0.3V to +4V on all other pins ............................................................................................................ -0.3V to (VDD + 0.3V) Maximum current on any output pin ................................................................................................................................ 25 mA † NOTICE: Stresses above those listed under “Absolute Maximum Ratings” may cause permanent damage to the device. This is a stress rating only and functional operation of the device at those or any other conditions above those indicated in the operation listings of this specification is not implied. Exposure above maximum rating conditions for extended periods may affect device reliability. 9.2 Standard Operating Conditions The standard operating conditions for any device are defined as: Operating Voltage: Operating Temperature: VDDMIN VDD VDDMAX TA_MIN TA TA_MAX VDD — Operating Supply Voltage VDDMIN ................................................................................................................................................... +1.8V VDDMAX .................................................................................................................................................. +3.6V TA — Operating Ambient Temperature Range TA_MIN .................................................................................................................................................... -40°C TA_MAX................................................................................................................................................... +85°C IDD — Supply Current At 315 MHz, +10 dBm, FSK, typical(1) ................................................................................................ +15 mA At 315 MHz, +10 dBm, OOK, typical(1) ............................................................................................... +11 mA At 315 MHz, +0 dBm, FSK, typical(1) .................................................................................................... +9 mA At 915 MHz, +10 dBm, FSK, typical(1) ............................................................................................. +17.5 mA At 915 MHz, +0 dBm, FSK, typical(1) ............................................................................................... +10.5 mA IPD — Standby Current VDD = 3 V, typical(1) ............................................................................................................................. +2.3 µA VDD = 3 V, maximum.............................................................................................................................. +4 µA VIH — Input High Voltage, minimum.............................................................................................. 0.25 VDD + 0.8V VIL — Input Low Voltage, maximum .......................................................................................................... 0.15 VDD VOH — Output High Voltage IOH = 3 mA, VDD = 3.3V, minimum ..................................................................................................VDD – 0.7V VOL — Output Low Voltage IOL = 6 mA, VDD = 3.3V, maximum ......................................................................................................... +0.6V ILED — LED Sink Current, maximum .......................................................................................................... +25 mA Note 1: Typical values are at 25°C. 2014 Microchip Technology Inc. DS40001747A-page 29 MCS3142 10.0 PACKAGING INFORMATION 10.1 Package Marking Information 20-Lead TSSOP Example MCS3142 -I/ST e3 017 1406 Legend: XX...X Y YY WW NNN e3 * Note: * Customer-specific information Year code (last digit of calendar year) Year code (last 2 digits of calendar year) Week code (week of January 1 is week ‘01’) Alphanumeric traceability code Pb-free JEDEC® designator for Matte Tin (Sn) This package is Pb-free. The Pb-free JEDEC designator ( e3 ) can be found on the outer packaging for this package. In the event the full Microchip part number cannot be marked on one line, it will be carried over to the next line, thus limiting the number of available characters for customer-specific information. Standard PIC® device marking consists of Microchip part number, year code, week code, and traceability code. For PIC device marking beyond this, certain price adders apply. Please check with your Microchip Sales Office. For QTP devices, any special marking adders are included in QTP price. DS40001747A-page 30 2014 Microchip Technology Inc. MCS3142 10.2 Package Details The following sections give the technical details of the packages. /HDG3ODVWLF7KLQ6KULQN6PDOO2XWOLQH67±PP%RG\>76623@ 1RWH 2 &' !&"&3#*!(!!& 3%& &#& &&144***' '43 D N E E1 NOTE 1 1 2 b e c φ A2 A A1 L L1 5&! '! 6'&! 7"') %! 66++ 7 7 78 9 & 8;& < :,/0 < ##33!! = , &# %% , < , 8>#& + ##3>#& + - :/0 ##36& : :, :: 2 &6& 6 , : , 2 && 6 , +2 2 & ? < =? 6#3!! < 6#>#& ) < - 1RWHV !"#$%&"'()"&'"!&) &#*&&&# '! !#+# &"#' #%! &"! ! #%! &"! !! &$#,''!# - '! #& +., /01 /!'! &$&"! **& "&& ! +21 %'! ("!"*& "&& (% % '& " !! * 0==/ 2014 Microchip Technology Inc. DS40001747A-page 31 MCS3142 Note: For the most current package drawings, please see the Microchip Packaging Specification located at http://www.microchip.com/packaging DS40001747A-page 32 2014 Microchip Technology Inc. MCS3142 APPENDIX A: DATA SHEET REVISION HISTORY Revision A (03/2014) Initial release of the data sheet. 2014 Microchip Technology Inc. DS40001747A-page 33 MCS3142 THE MICROCHIP WEB SITE CUSTOMER SUPPORT Microchip provides online support via our WWW site at www.microchip.com. This web site is used as a means to make files and information easily available to customers. Accessible by using your favorite Internet browser, the web site contains the following information: Users of Microchip products can receive assistance through several channels: • Product Support – Data sheets and errata, application notes and sample programs, design resources, user’s guides and hardware support documents, latest software releases and archived software • General Technical Support – Frequently Asked Questions (FAQ), technical support requests, online discussion groups, Microchip consultant program member listing • Business of Microchip – Product selector and ordering guides, latest Microchip press releases, listing of seminars and events, listings of Microchip sales offices, distributors and factory representatives • • • • Distributor or Representative Local Sales Office Field Application Engineer (FAE) Technical Support Customers should contact their distributor, representative or Field Application Engineer (FAE) for support. Local sales offices are also available to help customers. A listing of sales offices and locations is included in the back of this document. Technical support is available through the web site at: http://microchip.com/support. CUSTOMER CHANGE NOTIFICATION SERVICE Microchip’s customer notification service helps keep customers current on Microchip products. Subscribers will receive e-mail notification whenever there are changes, updates, revisions or errata related to a specified product family or development tool of interest. To register, access the Microchip web site at www.microchip.com. Under “Support”, click on “Customer Change Notification” and follow the registration instructions. DS40001747A-page 34 2014 Microchip Technology Inc. MCS3142 PRODUCT IDENTIFICATION SYSTEM To order or obtain information, e.g., on pricing or delivery, refer to the factory or the listed sales office. [X](1) PART NO. Device - X Tape and Reel Temperature Option Range /XX XXX Package Pattern Device: MCS3142 Tape and Reel Option: Blank T = Standard packaging (tube or tray) = Tape and Reel(1) Temperature Range: I = -40C to Package:(2) ST Pattern: QTP, SQTP, Code or Special Requirements (blank otherwise) = +85C Examples: a) MCS3142 - I/ST Industrial temperature, TSSOP package (Industrial) TSSOP Note 1: 2: 2014 Microchip Technology Inc. Tape and Reel identifier only appears in the catalog part number description. This identifier is used for ordering purposes and is not printed on the device package. Check with your Microchip Sales Office for package availability with the Tape and Reel option. For other small form-factor package availability and marking information, please visit www.microchip.com/packaging or contact your local sales office. DS40001747A-page 35 Note the following details of the code protection feature on Microchip devices: • Microchip products meet the specification contained in their particular Microchip Data Sheet. • Microchip believes that its family of products is one of the most secure families of its kind on the market today, when used in the intended manner and under normal conditions. • There are dishonest and possibly illegal methods used to breach the code protection feature. All of these methods, to our knowledge, require using the Microchip products in a manner outside the operating specifications contained in Microchip’s Data Sheets. Most likely, the person doing so is engaged in theft of intellectual property. • Microchip is willing to work with the customer who is concerned about the integrity of their code. • Neither Microchip nor any other semiconductor manufacturer can guarantee the security of their code. Code protection does not mean that we are guaranteeing the product as “unbreakable.” Code protection is constantly evolving. We at Microchip are committed to continuously improving the code protection features of our products. Attempts to break Microchip’s code protection feature may be a violation of the Digital Millennium Copyright Act. If such acts allow unauthorized access to your software or other copyrighted work, you may have a right to sue for relief under that Act. Information contained in this publication regarding device applications and the like is provided only for your convenience and may be superseded by updates. It is your responsibility to ensure that your application meets with your specifications. MICROCHIP MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND WHETHER EXPRESS OR IMPLIED, WRITTEN OR ORAL, STATUTORY OR OTHERWISE, RELATED TO THE INFORMATION, INCLUDING BUT NOT LIMITED TO ITS CONDITION, QUALITY, PERFORMANCE, MERCHANTABILITY OR FITNESS FOR PURPOSE. Microchip disclaims all liability arising from this information and its use. Use of Microchip devices in life support and/or safety applications is entirely at the buyer’s risk, and the buyer agrees to defend, indemnify and hold harmless Microchip from any and all damages, claims, suits, or expenses resulting from such use. No licenses are conveyed, implicitly or otherwise, under any Microchip intellectual property rights. Trademarks The Microchip name and logo, the Microchip logo, dsPIC, FlashFlex, KEELOQ, KEELOQ logo, MPLAB, PIC, PICmicro, PICSTART, PIC32 logo, rfPIC, SST, SST Logo, SuperFlash and UNI/O are registered trademarks of Microchip Technology Incorporated in the U.S.A. and other countries. FilterLab, Hampshire, HI-TECH C, Linear Active Thermistor, MTP, SEEVAL and The Embedded Control Solutions Company are registered trademarks of Microchip Technology Incorporated in the U.S.A. Silicon Storage Technology is a registered trademark of Microchip Technology Inc. in other countries. Analog-for-the-Digital Age, Application Maestro, BodyCom, chipKIT, chipKIT logo, CodeGuard, dsPICDEM, dsPICDEM.net, dsPICworks, dsSPEAK, ECAN, ECONOMONITOR, FanSense, HI-TIDE, In-Circuit Serial Programming, ICSP, Mindi, MiWi, MPASM, MPF, MPLAB Certified logo, MPLIB, MPLINK, mTouch, Omniscient Code Generation, PICC, PICC-18, PICDEM, PICDEM.net, PICkit, PICtail, REAL ICE, rfLAB, Select Mode, SQI, Serial Quad I/O, Total Endurance, TSHARC, UniWinDriver, WiperLock, ZENA and Z-Scale are trademarks of Microchip Technology Incorporated in the U.S.A. and other countries. SQTP is a service mark of Microchip Technology Incorporated in the U.S.A. GestIC and ULPP are registered trademarks of Microchip Technology Germany II GmbH & Co. KG, a subsidiary of Microchip Technology Inc., in other countries. All other trademarks mentioned herein are property of their respective companies. © 2013, Microchip Technology Incorporated, Printed in the U.S.A., All Rights Reserved. Printed on recycled paper. ISBN: 978-1-63276-006-7 QUALITY MANAGEMENT SYSTEM CERTIFIED BY DNV == ISO/TS 16949 == DS40001747A-page 36 Microchip received ISO/TS-16949:2009 certification for its worldwide headquarters, design and wafer fabrication facilities in Chandler and Tempe, Arizona; Gresham, Oregon and design centers in California and India. The Company’s quality system processes and procedures are for its PIC® MCUs and dsPIC® DSCs, KEELOQ® code hopping devices, Serial EEPROMs, microperipherals, nonvolatile memory and analog products. In addition, Microchip’s quality system for the design and manufacture of development systems is ISO 9001:2000 certified. 2014 Microchip Technology Inc. Worldwide Sales and Service AMERICAS ASIA/PACIFIC ASIA/PACIFIC EUROPE Corporate Office 2355 West Chandler Blvd. Chandler, AZ 85224-6199 Tel: 480-792-7200 Fax: 480-792-7277 Technical Support: http://www.microchip.com/ support Web Address: www.microchip.com Asia Pacific Office Suites 3707-14, 37th Floor Tower 6, The Gateway Harbour City, Kowloon Hong Kong Tel: 852-2401-1200 Fax: 852-2401-3431 India - Bangalore Tel: 91-80-3090-4444 Fax: 91-80-3090-4123 Austria - Wels Tel: 43-7242-2244-39 Fax: 43-7242-2244-393 Denmark - Copenhagen Tel: 45-4450-2828 Fax: 45-4485-2829 Atlanta Duluth, GA Tel: 678-957-9614 Fax: 678-957-1455 Austin, TX Tel: 512-257-3370 Boston Westborough, MA Tel: 774-760-0087 Fax: 774-760-0088 Chicago Itasca, IL Tel: 630-285-0071 Fax: 630-285-0075 Cleveland Independence, OH Tel: 216-447-0464 Fax: 216-447-0643 Dallas Addison, TX Tel: 972-818-7423 Fax: 972-818-2924 Detroit Novi, MI Tel: 248-848-4000 Houston, TX Tel: 281-894-5983 Indianapolis Noblesville, IN Tel: 317-773-8323 Fax: 317-773-5453 Los Angeles Mission Viejo, CA Tel: 949-462-9523 Fax: 949-462-9608 New York, NY Tel: 631-435-6000 San Jose, CA Tel: 408-735-9110 Canada - Toronto Tel: 905-673-0699 Fax: 905-673-6509 2014 Microchip Technology Inc. Australia - Sydney Tel: 61-2-9868-6733 Fax: 61-2-9868-6755 China - Beijing Tel: 86-10-8569-7000 Fax: 86-10-8528-2104 China - Chengdu Tel: 86-28-8665-5511 Fax: 86-28-8665-7889 China - Chongqing Tel: 86-23-8980-9588 Fax: 86-23-8980-9500 China - Hangzhou Tel: 86-571-8792-8115 Fax: 86-571-8792-8116 China - Hong Kong SAR Tel: 852-2943-5100 Fax: 852-2401-3431 China - Nanjing Tel: 86-25-8473-2460 Fax: 86-25-8473-2470 China - Qingdao Tel: 86-532-8502-7355 Fax: 86-532-8502-7205 China - Shanghai Tel: 86-21-5407-5533 Fax: 86-21-5407-5066 China - Shenyang Tel: 86-24-2334-2829 Fax: 86-24-2334-2393 China - Shenzhen Tel: 86-755-8864-2200 Fax: 86-755-8203-1760 China - Wuhan Tel: 86-27-5980-5300 Fax: 86-27-5980-5118 China - Xian Tel: 86-29-8833-7252 Fax: 86-29-8833-7256 India - New Delhi Tel: 91-11-4160-8631 Fax: 91-11-4160-8632 India - Pune Tel: 91-20-3019-1500 Japan - Osaka Tel: 81-6-6152-7160 Fax: 81-6-6152-9310 Japan - Tokyo Tel: 81-3-6880- 3770 Fax: 81-3-6880-3771 Korea - Daegu Tel: 82-53-744-4301 Fax: 82-53-744-4302 Korea - Seoul Tel: 82-2-554-7200 Fax: 82-2-558-5932 or 82-2-558-5934 France - Paris Tel: 33-1-69-53-63-20 Fax: 33-1-69-30-90-79 Germany - Dusseldorf Tel: 49-2129-3766400 Germany - Munich Tel: 49-89-627-144-0 Fax: 49-89-627-144-44 Germany - Pforzheim Tel: 49-7231-424750 Italy - Milan Tel: 39-0331-742611 Fax: 39-0331-466781 Italy - Venice Tel: 39-049-7625286 Malaysia - Kuala Lumpur Tel: 60-3-6201-9857 Fax: 60-3-6201-9859 Netherlands - Drunen Tel: 31-416-690399 Fax: 31-416-690340 Malaysia - Penang Tel: 60-4-227-8870 Fax: 60-4-227-4068 Poland - Warsaw Tel: 48-22-3325737 Philippines - Manila Tel: 63-2-634-9065 Fax: 63-2-634-9069 Singapore Tel: 65-6334-8870 Fax: 65-6334-8850 Taiwan - Hsin Chu Tel: 886-3-5778-366 Fax: 886-3-5770-955 Spain - Madrid Tel: 34-91-708-08-90 Fax: 34-91-708-08-91 Sweden - Stockholm Tel: 46-8-5090-4654 UK - Wokingham Tel: 44-118-921-5800 Fax: 44-118-921-5820 Taiwan - Kaohsiung Tel: 886-7-213-7830 Taiwan - Taipei Tel: 886-2-2508-8600 Fax: 886-2-2508-0102 Thailand - Bangkok Tel: 66-2-694-1351 Fax: 66-2-694-1350 China - Xiamen Tel: 86-592-2388138 Fax: 86-592-2388130 China - Zhuhai Tel: 86-756-3210040 Fax: 86-756-3210049 03/13/14 DS40001747A-page 37