HCS473 KEELOQ® 3-Axis Transcoder FEATURES Package Types PDIP, SOIC Encoder Security Read protected 64-bit encoder key 69-bit transmission length 60-bit, read protected seed for secure learning Programmable 32-bit serial number Non-volatile 16/20-bit synchronization counter S0 1 14 VDD S1 2 13 LED S2 3 12 DATA S3/RFEN 4 11 VSS VDDT 5 10 VSST LCX 6 9 LCCOM LCY 7 8 LCZ Encoder Operation • • • • • • 2.05V to 5.5V operation Four switch inputs – up to 15 functions codes PWM or Manchester modulation Selectable Baud Rate (416 - 5,000 bps) Transmissions include button queuing information PLL interface Block Diagram Low Voltage Detector Transponder Security • • • • • • 2 read protected 64-bit Challenge/Response keys Two IFF encryption algorithms 16/32-bit Challenge/Response Separate Vehicle ID and Token ID 2 vehicles supported CRC on all communication Three sensitive transponder inputs Bi-directional transponder communication Transponder in/RF out operation Anticollision of multiple transponders Intelligent damping for high Q-factor LC-circuits Low battery operation Passive proximity activation 64-bit secure user EEPROM Fast reaction time Peripherals • Low Voltage Detector • On-board RC oscillator with 10% variation 2000-2013 Microchip Technology Inc. Internal Oscillator EEPROM S0 S1 S2 Wake-up Control VDD LED Driver LED Data Output DATA VSS VDDT LCX LCY RESET and Power Control Control Logic S3/ RFEN Transponder Operation • • • • • • • • • HCS473 • • • • • 3 Input Transponder Circuitry LCZ LCCOM VSST Typical Applications • • • • • • • • • Passive entry systems Automotive remote entry systems Automotive alarm systems Automotive immobilizers Gate and garage openers Electronic door locks (Home/Office/Hotel) Burglar alarm systems Proximity access control Passive proximity authentication Preliminary DS40035D-page 1 HCS473 Table of Contents 1.0 General Description ..................................................................................................................................................................... 3 2.0 Device Description ...................................................................................................................................................................... 5 3.0 Device Operation ....................................................................................................................................................................... 11 4.0 Programming Specification ....................................................................................................................................................... 37 5.0 Integrating the HCS473 Into A System ..................................................................................................................................... 39 6.0 Development Support................................................................................................................................................................. 43 7.0 Electrical Characteristics ........................................................................................................................................................... 49 8.0 Packaging Information................................................................................................................................................................ 57 INDEX .................................................................................................................................................................................................. 61 On-Line Support................................................................................................................................................................................... 62 Systems Information and Upgrade Hot Line ........................................................................................................................................ 62 Reader Response ................................................................................................................................................................................ 63 Product Identification System............................................................................................................................................................... 64 TO OUR VALUED CUSTOMERS It is our intention to provide our valued customers with the best documentation possible to ensure successful use of your Microchip products. To this end, we will continue to improve our publications to better suit your needs. Our publications will be refined and enhanced as new volumes and updates are introduced. If you have any questions or comments regarding this publication, please contact the Marketing Communications Department via E-mail at [email protected] or fax the Reader Response Form in the back of this data sheet to (480) 792-4150. We welcome your feedback. Most Current Data Sheet To obtain the most up-to-date version of this data sheet, please register at our Worldwide Web site at: http://www.microchip.com You can determine the version of a data sheet by examining its literature number found on the bottom outside corner of any page. The last character of the literature number is the version number, (e.g., DS30000A is version A of document DS30000). Errata An errata sheet, describing minor operational differences from the data sheet and recommended workarounds, may exist for current devices. As device/documentation issues become known to us, we will publish an errata sheet. The errata will specify the revision of silicon and revision of document to which it applies. To determine if an errata sheet exists for a particular device, please check with one of the following: • Microchip’s Worldwide Web site; http://www.microchip.com • Your local Microchip sales office (see last page) • The Microchip Corporate Literature Center; U.S. FAX: (480) 792-7277 When contacting a sales office or the literature center, please specify which device, revision of silicon and data sheet (include literature number) you are using. Customer Notification System Register on our web site at www.microchip.com/cn to receive the most current information on all of our products. DS40035D-page 2 Preliminary 2000-2013 Microchip Technology Inc. HCS473 1.0 GENERAL DESCRIPTION The HCS473 combines the patented KEELOQ code hopping technology and bi-directional transponder challenge-and-response security into a single chip solution for logical and physical access control. The three-input transponder interface allows the combination of three orthogonal transponder antennas, eliminating the directionality associated with traditional single antenna transponder systems. When used as a code hopping encoder, the HCS473 is well suited to keyless entry systems; vehicle and garage door access in particular. The same HCS473 can also be used as a secure bi-directional transponder for contactless authentication. These capabilities make the HCS473 ideal for combined secure access control and identification applications, dramatically reducing the cost of hybrid transmitter/transponder solutions. 1.1 1.1.1 System Overview KEY TERMS The following is a list of key terms used throughout this data sheet. For additional information on terminology, please refer to the KEELOQ introductory Technical Brief (TB003). • AGC - Automatic Gain Control. • Anticollision - A scheme whereby transponders in the same field can be addressed individually, preventing simultaneous response to a command (Section 3.2.1.4). • Button Status - Indicates what button input(s) activated the transmission. Encompasses the 4 button status bits S3, S2, S1 and S0 (Figure 3-2). • Code Hopping - A method by which a code, viewed externally to the system, appears to change unpredictably each time it is transmitted (Section 1.2.3). • Code word - A block of data that is repeatedly transmitted upon button activation (Figure 3-2). • Crypto key - A unique and secret 64-bit number used to encrypt and decrypt data. In a symmetrical block cipher such as the KEELOQ algorithm, the encryption and decryption keys are equal and will therefore be referred to generally as the crypto key. • Decoder - A device that decodes data received from an encoder. • Decryption algorithm - A recipe whereby data scrambled by an encryption algorithm can be unscrambled using the same crypto key. • Device Identifier - 16-bit value used to uniquely select one of multiple transponders for communication. • Encoder - A device that generates and encodes data. 2000-2013 Microchip Technology Inc. • Encryption Algorithm - A recipe whereby data is scrambled using a crypto key. The data can only be interpreted by the respective decryption algorithm using the same crypto key. • IFF - Identify Friend or Foe, a classic authentication method (Section 3.2.3.3). • Learn - Learning involves the receiver calculating the transmitter’s appropriate crypto key, decrypting the received hopping code and storing the serial number, synchronization counter value and crypto key in EEPROM (Section 5.1). The KEELOQ product family facilitates several learning strategies to be implemented on the decoder. The following are examples of what can be done. • Simple Learning The receiver uses a fixed crypto key, common to all components of all systems by the same manufacturer, to decrypt the received code word’s encrypted portion. • Normal Learning The receiver uses information transmitted during normal operation to derive the crypto key and decrypt the received code word’s encrypted portion. • Secure Learn The transmitter is activated through a special button combination to transmit a stored 60-bit seed value used to derive the transmitter’s crypto key. The receiver uses this seed value to calculate the same crypto key and decrypt the received code word’s encrypted portion. • LF - Low Frequency. For HCS473 purposes, LF refers to a typical 125 kHz frequency. • Manufacturer’s code – A unique and secret 64bit number used to generate unique encoder crypto keys. Each encoder is programmed with a crypto key that is a function of the manufacturer’s code. Each decoder is programmed with the manufacturer code itself. • Proximity Activation - A method whereby an encoder automatically initiates a transmission in response to detecting an inductive field (Section 3.1.1.2). • PKE - Passive Keyless Entry. • RKE - Remote Keyless Entry. • Transmission - A data stream consisting of repeating code words. • Transcoder - Device combining unidirectional transmitter capabilities with bi-directional authentication capabilities. • Transponder - A transmitter-receiver activated for transmission by reception of a predetermined signal. Preliminary DS40035D-page 3 HCS473 • Transponder Reader (Reader, for short) - A device that authenticates a transponder using bidirectional communication. • Transport code - An access code, ‘password’ known only by the manufacturer, allowing write access to certain secure device memory areas (Section 3.2.3.2). 1.2 Encoder Overview The HCS473 code hopping transcoder is designed specifically for passive entry systems; particularly vehicle access. The transcoder portion of a passive entry system is integrated into a fob, carried by the user and operated to gain access to a vehicle or restricted area. The HCS473 is meant to be a cost-effective yet secure solution to such systems, requiring very few external components (Figure 2-1). 1.2.1 HCS473 SECURITY The HCS473, on the other hand, employs the KEELOQ code hopping technology coupled with a transmission length of 69 bits to virtually eliminate the use of code ‘grabbing’ or code ‘scanning’. The high security level of the HCS473 is based on the patented KEELOQ technology. A block cipher based on a block length of 32 bits and a key length of 64 bits is used. The algorithm obscures the information in such a way that even if the transmission’s pre-encrypted information differs by only one bit from that of the previous transmission, statistically greater than 50 percent of the transmission’s encrypted result will change. DS40035D-page 4 HCS473 HOPPING CODE The 16-bit synchronization counter is the basis behind the transmitted code word changing for each transmission; it increments each time a button is pressed. Once the device detects a button press, it reads the button inputs and updates the synchronization counter. The synchronization counter and crypto key are input to the encryption algorithm and the output is 32 bits of encrypted information. This encrypted data will change with every button press, its value appearing externally to ‘randomly hop around’, hence it is referred to as the hopping portion of the code word. The 32-bit hopping code is combined with the button information and serial number to form the code word transmitted to the receiver. The code word format is explained in greater detail in Section 3.1.2. 1.3 LOW-END SYSTEM SECURITY RISKS Most low-end keyless entry transmitters are given a fixed identification code that is transmitted every time a button is pushed. The number of unique identification codes in a low-end system is usually a relatively small number. These shortcomings provide an opportunity for a sophisticated thief to create a device that ‘grabs’ a transmission and retransmits it later, or a device that quickly ‘scans’ all possible identification codes until the correct one is found. 1.2.2 1.2.3 Identify Friend or Foe (IFF) Overview Validation of a transponder first involves an authenticating device sending a random challenge to the device. The transponder then replies with a calculated response that is a function of the received challenge and its stored crypto key. The authenticating device, transponder reader, performs the same calculation and compares it to the transponder’s response. If they match, the transponder is identified as valid and the transponder reader can take appropriate action. The HCS473’s IFF response is generated using one of two possible crypto keys. The authenticating device precedes the challenge with a three bit field dictating which key to use in calculating the response. The bi-directional communication path required for IFF is typically inductive for short range (<10cm) transponder applications with an inductive challenge and inductive response. Longer range (~1.5m) passive entry applications still transmit using the LF inductive path but the response is transmitted RF. Preliminary 2000-2013 Microchip Technology Inc. HCS473 2.0 DEVICE DESCRIPTION The HCS473 is designed for small package outline, cost-sensitive applications by minimizing the number of external components required for RKE and PKE applications. Figure 2-1 shows a typical 3-axis HCS473 RKE/PKE application. • The switch inputs have internal pull-down resistors and integrated debouncing allowing a switch to be directly connected to the inputs. The transponder circuitry requires only the addition of external LC-resonant circuits for inductive communication capability. • The open-drain LED output allows an external resistor for customization of LED brightness - and current consumption. • The DATA output can be directly connected to the RF circuit or connected in conjunction with S3/ RFEN to a PLL. 2.1 Pinout Overview A description of pinouts for the HCS473 can be found in Table 2-1. TABLE 2-1: Pin Name PINOUT SUMMARY Pin Number Description S0 1 Button input pin with Schmitt Trigger detector and internal pull-down resistor (Figure 2-3). S1 2 Button input pin with Schmitt Trigger detector and internal pull-down resistor (Figure 2-3). S2 3 Button input pin with Schmitt Trigger detector and internal pull-down resistor (Figure 2-3). S3/RFEN 4 Multi-purpose input/output pin (Figure 2-4). • Button input pin with Schmitt Trigger detector and internal pull-down resistor. • RFEN output driver. VDDT 5 Transponder supply voltage. Regulated voltage output for strong inductive field. LCX 6 Sensitive transponder input X (Figure 2-7). A strong signal on this pin is internally regulated and supplied on VDD for low-battery operation/recharging. LCY 7 Sensitive transponder input Y (Figure 2-7) LCZ 8 Sensitive transponder input Z (Figure 2-7) LCCOM 9 Transponder bias output (Figure 2-7) VSST 10 Transponder ground reference, must be connected to VSS. VSS 11 Ground reference DATA 12 Transmission data output (Figure 2-5) LED 13 Open drain LED output (Figure 2-6) VDD 14 Positive supply voltage 2.2 LF Antenna Considerations A typical magnetic low frequency sensor (receiving antenna) consists of a parallel inductor-capacitor circuit that is sensitive to an externally applied magnetic signal. This LC circuit is tuned to resonate at the source signal's base frequency. The real-time voltage across the sensor represents the presence and strength of the surrounding magnetic field. By amplitude modulating the source's magnetic field, it is possible to transfer data over short distances. This communication approach is successfully used with distances up to 1.8 meters, depending on transmission strengths and sensor sensitivity. Two key factors that greatly affect communication range are: 1. 2. An LC antenna’s component values may be initially calculated using the following equation. “Initially” because there are many factors affecting component selection. 1 2F = ----------LC It is not this data sheet’s purpose to present in-depth details regarding LC antenna and their tuning. Please refer to “Low Frequency Magnetic Transmitter Design Application Note”, AN232, for appropriate LF antenna design details. Note: Sensor tuning A properly tuned sensor's relative sensitivity 2000-2013 Microchip Technology Inc. Preliminary Microchip also has a confidential Application Note on Magnetic Sensors (AN832C). Contact Microchip for a Non-Disclosure Agreement in order to obtain this application note. DS40035D-page 5 HCS473 FIGURE 2-1: HCS473 3-AXIS APPLICATION FIGURE 2-3: S0/S1/S2 PIN DIAGRAM VDD 1F S0, S1, S2 Inputs 100nF RPD HCS473 S0 VDD S1 LED S2 DATA S3/RFEN VSS RF FIGURE 2-4: Circuit VSST VDDT VDD LCX LCCOM LCY S3/RFEN PIN DIAGRAM LCZ RFEN PFET LX CX LY CY LZ CZ NFET 680pF Note: S3 Input/ RFEN Output The 680pF capacitor prevents device instability - self resonance. FIGURE 2-2: RPD HCS473 1-AXIS APPLICATION Note: RPD is disabled when driving RFEN. VDD FIGURE 2-5: 1F DATA PIN DIAGRAM 100nF VDD HCS473 S0 VDD S1 LED S2 DATA S3/RFEN VSS VDDT PFET RF Circuit VSST LCX LCCOM LCY DATA OUT NFET LCZ DATA LX CX 100 100 RDATA Note: 660 pF Note: RDATA is disabled when the DATA line is driven. Connect unused LC antenna inputs to LCCOM through a 100 resistor for proper bias conditions. DS40035D-page 6 Preliminary 2000-2013 Microchip Technology Inc. HCS473 FIGURE 2-6: LED PIN DIAGRAM 2.3 VDD 2.3.1 Weak The HCS473 automatically goes into a low-power Standby mode once connected to a supply voltage. Power is supplied to the minimum circuitry required to detect a wake-up condition; button activation or LC signal detection. LED LED Program Mode LCX only A button input activation places the device into Encoder mode. A signal detected on the transponder input places the device into Transponder mode. Encoder mode has priority over Transponder mode such that communication on the transponder input would be ignored or perhaps interrupted if it occurred simultaneously to a button activation; ignored until the button input is released. LCCOM/LCX/LCY/LCZ/ VSST PIN DIAGRAM RECTIFIER and REGULATOR WAKE-UP LOGIC The HCS473 will wake from Low-power mode when a button input is pulled high or a signal is detected on a LC low frequency antenna input pin. Waking involves powering the main logic circuitry that controls device operation. The button and transponder inputs are then sampled to determine which input activated the device. HV Detect FIGURE 2-7: Architectural Overview VSST 2.3.2 ENCODER INTERFACE Using the four button inputs, up to 15 unique control codes may be transmitted. LCX/LCY/ LCZ Inputs AMP and DET 100 LC Input Note: S3 may not be used as a button input if the RFEN option is enabled. 10V DAMP CLAMP RDAMP LCCOM BIAS CURRENT 100 10V 2000-2013 Microchip Technology Inc. Preliminary DS40035D-page 7 HCS473 2.3.3 TRANSPONDER INTERFACE FIGURE 2-8: The transponder interface on the HCS473 consists of the following: • The internal transponder circuitry has separate power supply (VDDT) and ground (VSST) connections. - The VDDT pin supplies power to the transponder circuitry and also outputs a regulated voltage if the LCX antenna input is receiving a strong signal; transponder is placed in a strong LF field. - The VSST pin supplies the ground reference to the transponder circuitry and must be connected to the VSS pin. • LF input amplifier and envelope detector to detect and shape the incoming low frequency excitation signal. • Three sensitive transponder inputs with over-voltage protection (LCX, LCY, LCZ). • Incoming LF energy rectification and regulation on the LCX input to supplement the supply voltage in low-battery transponder instances. • 10V zener input protection from excessive antenna voltage resulting when proximate to very strong magnetic fields. • LCCOM pin used to bias the transponder resonant circuits for best sensitivity. • LF antenna clamping transistors for inductive responses back to the transponder reader. The antenna ends are shorted together, ‘clamped’, dissipating the oscillatory energy. The reader detects this as a momentary load on its excitation antenna. • Damping transistors to increase LF communication reliability when using high Q-factor LC antennae. The LCCOM pin functions to bias the LCX, LCY, and LCZ AGC amplifier inputs. The amplifier gain control sets the optimum level of amplification in respect to the incoming signal strength. The signal then passes through an envelope detector before interpretation in the logic circuit. A block diagram of the transponder circuit is shown in Figure 2-8. DS40035D-page 8 HCS473 TRANSPONDER CIRCUIT Rectifier/ Regulator VCCT LCX Noise Filter LCY Signal In LCZ Damp/Clamp Control LCCOM 2.3.4 INTERNAL EEPROM The HCS473 has an on-board non-volatile EEPROM which is used to store: • configuration options - encryption keys - serial number - vehicle ID’s - baud rates - ... see Section 3.1.4 and Section 3.2.1 • 64 bits of user memory • synchronization counter. All options are programmable during production, but many of the security related options are programmable only during production and are further read protected. The user area allows storage of general purpose information and is accessible only through the transponder communication path. During every EEPROM write, the device ensures that the internal programming voltage is at an acceptable level prior to performing the EEPROM write. Preliminary 2000-2013 Microchip Technology Inc. HCS473 2.3.5 INTERNAL RC OSCILLATOR The HCS473 runs on an internal RC oscillator. The internal oscillator may vary ±10% over the device’s rated voltage and temperature range for commercial temperature devices. A certain percentage of industrial temperature devices vary further on the slow side, -20%, when used at higher voltages (VDD > 3.5V) and cold temperature. The LF and RF communication timing values are subject to these variations. 2.3.6 LOW VOLTAGE DETECTOR The HCS473’s battery voltage detector detects when the supply voltage drops below a predetermined value. The value is selected by the Low Voltage Trip Point Select (VLOWSEL) configuration option (Section 3.3). The low voltage detector result is included in encoder transmissions (VLOW) allowing the receiver to indicate when the transmitter battery is low (Section 3.1.4.6). The HCS473 also indicates a low battery condition by changing the LED operation (Section 3.1.5). 2.3.7 THE S3/RFEN PIN The S3/RFEN pin may be used as a button input or RF enable output to a compatible PLL. Select between S3 button input and RFEN functionality with the RFEN configuration option (Table 2-2). TABLE 2-2: RFEN RFEN OPTION Resulting S3/RFEN Configuration 0 S3 button input pin with Schmitt Trigger detector and internal pull-down resistor. 1 RFEN output driver. S3 may not be used as a button input if the RFEN option is enabled 2000-2013 Microchip Technology Inc. Preliminary DS40035D-page 9 HCS473 NOTES: DS40035D-page 10 Preliminary 2000-2013 Microchip Technology Inc. HCS473 3.0 DEVICE OPERATION 3.1.2 TRANSMITTED CODE WORD HCS473 operation depends on how the device is activated. The device exits Low-power mode either when a switch input is pulled high or when a signal is detected on an LC antenna input pin. Once activated, the device determines the source of the activation and enters Encoder mode or Transponder mode. The HCS473 transmits a 69-bit code word in response to a button activation or proximity activation, Figure 31. The code word content varies with the two unique transmission types; Hopping or Seed. A button input activation places the device into Encoder mode. A signal detected on the transponder input places the device into Transponder mode. Encoder mode has priority over Transponder mode such that communication on the transponder input would be ignored or perhaps interrupted if it occurred simultaneously to a button activation; ignored until the button input is released. Hopping code words are those transmitted during normal operation. Each Hopping code word contains a preamble, header, 32 bits of encrypted data and up to 37 bits of fixed value data followed by a guard period before another code word begins. 3.1 3.1.1 3.1.1.1 Encoder mode ENCODER ACTIVATION Button Activation The main way to enter Encoder mode is when the wake-up circuit detects a button input activation; button input transition from GND to VDD. The HCS473 control logic wakes and delays a nominal switch debounce time (TDB) prior to sampling the button inputs. The button input states, cumulatively called the button status, determine whether the HCS473 transmits a code hopping or seed transmission. The transmission begins a time TPU after activation. It consists of a stream of code words transmitted as long as the switch input is held high or until a selectable TSEL timeout occurs (see Section 3.1.4.16 for TSEL options). A timeout returns the device to Low-power mode, protecting the battery in case a button is stuck. Additional button activations during a transmission will immediately reset the HCS473, perhaps leaving the current code word incomplete. The device will start a new transmission which includes the updated button status value. Buttons removed during a transmission will have no effect unless no buttons remain activated. If no button activations remain, the minimum number of complete code words will be completed (see Section 3.1.4.15 for MTX options) and the device will return to Low Power mode. 3.1.1.2 3.1.2.1 Hopping Code Word • The 32 bits of Encrypted Data include button status bits, discrimination bits and the synchronization counter value. The inclusion/omission of overflow bits and size of both synchronization counter and discrimination bit fields vary with the CNTSEL option, Figure 3-2 and Section 3.1.4.5. • The 37 bits of Fixed Code Data include queue bits (if enabled), CRC bits, low voltage status and serial number. The inclusion/omission of button status and size of the serial number field vary with the XSER option, Figure 3-2 and Section 3.1.4.3. 3.1.2.2 Seed Code Word Seed code words are required when the system implements secure key generation. Seed transmissions are activated when the button inputs match the value specified by the seed button code configuration option (SDBT), Section 3.1.4.9. Each Seed code word contains a preamble, header and up to 69 bits of fixed data followed by a guard period before another code word begins. • The 69 bits of Fixed Code Data include queue bits (if enabled), CRC bits, low voltage status, button status and the 60-bit seed value, Figure 3-2. . Note: For additional information on KEELOQ theory and implementation, please refer to the KEELOQ introductory Technical Brief (TB003). Proximity Activation A second way to enter Encoder mode is if the proximity activation option (PXMA) is enabled and the wake-up circuit detects a wake-up sequence on an LC antenna input pin. This form of activation is called Proximity Activation as a code hopping transmission would be initiated when the device was proximate to a LF field. 2000-2013 Microchip Technology Inc. Preliminary DS40035D-page 11 HCS473 FIGURE 3-1: GENERAL CODE WORD FORMAT Preamble FIGURE 3-2: Header Guard Time Data Bits CODE WORD ORGANIZATION Hopping Code: 28-bit Serial Number (XSER = 0) 16-bit Synchronization Counter (CNTSEL=0) Button Queuing enabled (QUEN=1) Fixed Code Portion (37 Bits) QUE 2 Bits CRC 2 Bits VLOW 1-Bit BUT 4 Bits SER 1 12 MSb’s Hopping Code Portion Message (32 Bits) Q1 Q0 C1 C0 MSb Synchronization Counter 16 Bits Counter BUT DISCRIM 4 Bits Overflow 10 Bits 2 Bits SER 0 Least Sig16 Bits 0 15 S2 S1 S0 S3 S2 S1 S0 S3 OVR1 LSb OVR0 69 Data bits Transmitted LSb first. Hopping Code: 32-bit Serial Number (XSER = 1) 20-bit Synchronization Counter (CNTSEL=1) Button Queuing disabled (QUEN=0) Fixed Code Portion (35 Bits) CRC 2 Bits SER 1 Most Sig 16 Bits VLOW 1-Bit Hopping Code Portion Message (32 Bits) SER 0 Least Sig 16 Bits BUT 4 Bits Synchronization Counter 20 Bits DISCRIM 8 Bits C1 C0 0 20 MSb S2 S1 LSb S0 S3 S3 67 Data bits Transmitted LSb first. Seed Code: Queuing enabled (QUE = 1) Fixed Code Portion (9 Bits) QUE 2 Bits CRC 2 Bits VLOW 1-Bit Seed Value (60 Bits) BUT 4 Bits SDVAL3 12 Most Sig Bits SDVAL2 16 Bits SDVAL1 16 Bits SDVAL0 16 Least Sig Bits Q1 Q0 C1 C0 MSb 1 1 1 LSb 1 69 Data bits Transmitted LSb first. Shaded 65 bits included in CRC calculation DS40035D-page 12 Preliminary 2000-2013 Microchip Technology Inc. HCS473 3.1.3 CODE HOPPING MODULATION FORMAT The same code word repeats as long as the same input pins remain active, until a timeout occurs or a delayed seed transmission is activated. The data modulation format is selectable between Pulse Width Modulation (PWM) and Manchester using the modulation select (MSEL) configuration option. The modulated data timing is typically referred to in multiples of a basic Timing Element (RFTE). ‘RF’ TE because the DATA pin output is typically sent through a RF transmitter to the decoder or transponder reader. Regardless of the modulation format, each code word contains a leading preamble and a synchronization header to wake the receiver and provide synchronization events for the receive routine. Each code word also contains a trailing guard time to separate code words. Manchester encoding further includes a leading data ‘1’ START pulse and closing 1 RFTE STOP pulse around each data block. FIGURE 3-3: RFTE may be selected using the RF Transmission Baud Rate (RFBSL) configuration option (Section 3.1.4.13). PWM TRANSMISSION FORMAT (MSEL = 0) 1 CODE WORD TOTAL TRANSMISSION: Preamble Sync Encrypt Fixed TE Guard TE Preamble Sync Encrypt TE LOGIC "0" LOGIC "1" Header Preamble Encrypted Portion Fixed Code Portion Guard Time CODE WORD FIGURE 3-4: MANCHESTER TRANSMISSION FORMAT (MSEL = 1) 1 CODE WORD TOTAL TRANSMISSION: Preamble Sync Encrypt Fixed Guard TE Preamble Sync Encrypt TE LOGIC “0” LOGIC “1” START bit bit 0 bit 1 bit 2 Preamble Header Encrypted Portion STOP bit Fixed Code Portion Guard Time CODE WORD 2000-2013 Microchip Technology Inc. Preliminary DS40035D-page 13 HCS473 3.1.4 ENCODER MODE OPTIONS 3.1.4.3 Extended Serial Number (XSER) The following HCS473 configuration options configure transmission characteristics of the information exiting the DATA pin: The Extended Serial Number option determines whether the HCS473 transmits a 28 or 32-bit serial number. • • • • • • • • • • • • • • • • • • • When configured for a 28-bit serial number, the Most Significant nibble of the 32 bits reserved for the serial number is replaced with a copy of the 4-bit button status, Figure 3-2. Modulation select (MSEL) Header select (HSEL) Extended serial number (XSER) Queue counter enable (QUEN) Counter select (CNTSEL) Low voltage trip point (VLOWSEL) PLL interface select (AFSK) RF enable output (RFEN) Seed button code (SDBT) Time before Seed (SDTM) Limited Seed (SDLM) Seed mode (SDMD) RF baud rate select (RFBSL) Guard time select (GSEL) Minimum code words (MTX) Timeout select (TSEL) Long preamble enable (LPRE) Long preamble length (LPRL) Preamble duty cycle (PRD) XSER options: • 28-bit serial number • 32-bit serial number 3.1.4.4 The QUE counter can be used to request secondary decoder functions using only a single transmitter button. Typically a decoder must keep track of incoming transmissions to determine when a double button press occurs, perhaps an unlock all doors request. The QUE counter removes this burden from the decoder by counting multiple button presses and including the QUE counter value in the last two bits of the 69-bit code word, (Figure 3-2). If QUEN is disabled, the transmission will consist only of 67 bits as the QUE bits field is not transmitted. The following sections detail each configuration’s available options. All timing values specified are subject to the specified oscillator variation. 3.1.4.1 Modulation Format (MSEL) The Modulation format option selects the modulation format for data output from the DATA pin; most often transmitted via RF. MSEL options: • Pulse Width Modulation (PWM), Figure 3-3 • Manchester Modulation, Figure 3-4 3.1.4.2 Queue Counter (QUEN) Header Select (HSEL) The synchronization header is typically used by the receiver to adjust bit sampling appropriate to the transmitter’s current speed; as the transmitter’s RC oscillator varies with temperature and voltage, so will the transmission’s timing. Que counter functionality is enabled with the QUEN configuration option. The 2-bit QUE counter is incremented each time an active button input is released for at least the Debounce Time (TDB), then re-activated (button pressed again) within the Queue Time (TQUE), Figure 3-5. The counter increments up from 0 to a maximum of 3, returning to 0 only after a different button activation or after button activations spaced greater than the Queue Time (TQUE) apart. The current transmission aborts, after completing the minimum number of code words (Section 3.1.4.15), when the active button inputs are released. A button reactivation within the queue time (TQUE) then initiates a new transmission (new synchronization counter, encrypted data) using the updated QUE value. Button combinations are queued the same as individual buttons. HSEL options: • 4 RFTE • 10 RFTE DS40035D-page 14 Preliminary 2000-2013 Microchip Technology Inc. HCS473 FIGURE 3-5: QUE COUNTER TIMING DIAGRAM Button Input Sx 1st Button Press t TDB TDB Transmission: QUE1:0 = 012 Synch CNT = X+1 TDB t TQUE 3.1.4.7 Counter Select (CNTSEL) The counter select option selects between a 16-bit or 20-bit counter. This option changes the way the 32-bit hopping portion is constructed, as indicated in Figure 3-2. The 16-bit counter format additionally includes two overflow bits for increasing the synchronization counter range, see Section 3.1.7. CNTSEL options: • 16-bit synchronization counter • 20-bit synchronization counter 3.1.4.6 2nd Button Press Transmission: QUE1:0 = 002 Synch CNT = X Code Words Transmitted 3.1.4.5 All Buttons Released PLL Interface Select (PLLSEL) The S3/RFEN pin may be configured as an RF enable output to an RF PLL. The pin’s behavior is coordinated with the DATA pin to activate a typical PLL in either ASK or FSK mode. The PLL Interface (PLLSEL) configuration option controls the output as shown for Encoder operation in Figure 3-6. Please refer to Section 3.2.8 for RFEN behavior during LF communication. PLLSEL options: • ASK PLL Setup • FSK PLL Setup Low Voltage Trip Point Select (VLOWSEL) The HCS473’s battery voltage detector detects when the supply voltage drops below a predetermined value. The value is selected by the Low Voltage Trip Point Select (VLOWSEL) configuration option (Table 3-6). VLOWSEL options: • 2.2V trip point • 3.3V trip point The low voltage detector result (VLOW) is included in Hopping code transmissions allowing the receiver to indicate when the transmitter battery is low (Figure 32). The HCS473 also indicates a low battery condition by changing the LED operation (Section 3.1.5). 3.1.4.8 RF Enable Output (RFEN) The S3/RFEN pin of the HCS473 can be configured to function as an RF enable output signal. When enabled, the pin is driven high whenever data is transmitted through the DATA pin; the S3/RFEN pin can therefore not be used as an input in this configuration. The RF enable option bit functions in conjunction with the PLL interface select option, PLLSEL. RFEN options: • S3/RFEN pin functions as S3 switch input only • S3/RFEN pin functions as RFEN output only The HCS473 samples the internal low voltage detector at the end of each code word’s first preamble bit. The transmitted VLOW status will be a ‘0’ as long as the low voltage detector indicates VDD is above the selected low voltage trip point. VLOW will change to a ‘1’ if VDD drops below the selected low voltage trip point. TABLE 3-1: VLOW VLOW STATUS BIT Description 0 VDD is above selected trip voltage 1 VDD is below selected trip voltage 2000-2013 Microchip Technology Inc. Preliminary DS40035D-page 15 HCS473 FIGURE 3-6: ENCODER OPERATION: RF ENABLE/ASK/FSK OPTIONS SWITCH ASK: S3/RFEN DATA TPU FSK: Code Word Code Word Code Word Code Word Code Word Code Word Code Word TPLL S3/RFEN DATA 3.1.4.9 Code Word 3.1.4.11 SEED Button Code (SDBT) Limited Seed (SDLM) SDBT selects which switch input(s) activate a seed transmission. Seed transmissions are disabled by clearing all 4 bits. If a button combination is pressed that matches the 4-bit SDBT value, a seed code word is transmitted as configured by the SDTM, SDLM and SDMD options (see following sections). The limited seed option may be used to disable seed transmission capability after a configurable number of transmitter activations; limiting a transmitter’s ability to be learned into a receiver. Specifically, seed transmissions are disabled when the synchronization counter’s LSB increments from 7Fh to 80h. The binary bit order is S3-S2-S1-S0. For example, if you want the combination of S2 and S0 to activate a seed transmission, use SDBT=01012. SDLM options: • unlimited seed capability • limited seed capability - counter value dependent SDBT options: 3.1.4.12 • Seed is transmitted when SDBT flags match the button input flags • SDBT = 00002 disables seed capability. Note: 3.1.4.10 Configuring S3/RFEN as RFEN (see Section 3.1.4.8) prevents the use of S3 to trigger a seed transmission. Time Before Seed (SDTM) The time before seed option selects the delay from device activation until the seed code words are transmitted. If the delay is not zero, the HCS473 transmits hopping code words until the selected time, then transmits seed code words. As code words are always completed, the seed code word begins the first code word after the specified time. SDTM options: • • • • 0s - seed code words begin immediately 0.8s 1.6s 3.2s SEED Mode (SDMD) The Seed mode option selects between User and Production seed modes. Production mode functions as a special time before seed case (SDTM). With Production mode enabled, a seed button code activation triggers MTX hopping code words followed by MTX seed code words. Production mode functionality is disabled when the synchronization counter’s LSB increments from 7Fh to 80h. SDMD options: • User • Production 3.1.4.13 RF Baud Rate Select (RFBSL) The timing of code word data modulated on the DATA pin is referred to in multiples of a basic Timing Element RFTE. ‘RF’ TE because the DATA pin output is typically sent through a RF transmitter to the decoder or transponder reader. RFTE may be selected using the RF Baud Rate Select (RFBSL) configuration option. RFTE accuracy is subject to the oscillator variation over temperature and voltage. RFBSL options: • • • • DS40035D-page 16 100 s RFTE 200 s RFTE 400 s RFTE 800 s RFTE Preliminary 2000-2013 Microchip Technology Inc. HCS473 3.1.4.14 Guard Time Select (GSEL) 3.1.4.18 Long Preamble Length (LPRL) The guard time (TG) select option determines the time between consecutive code words when no data is transmitted. The guard time may be selected in conjuction with the RF baud rate and preamble duty cycle to control time-averaged power output for transmitter certification. The long preamble length option selects the first code word’s preamble length when the long preamble option (LPRE) is enabled. Only the first code word begins with the long preamble, subsequent code words begin with the standard 16 high pulses preamble. GSEL options: • 75 ms • 100 ms • • • • 3 RFTE 6.4 ms 51.2 ms 102.4 ms 3.1.4.15 3.1.4.19 Minimum Code Words (MTX) PRD options: MTX options: 1 code word 2 code words 4 code words 8 code words 3.1.4.16 The device will stop transmitting in Low-power mode but there will be leakage across the stuck button input’s internal pull-down resistor. The current draw will therefore be higher than if no button were stuck. TSEL options: 4s 8s 16s 32s 3.1.4.17 • 50% Duty Cycle • 33% Duty Cycle FIGURE 3-7: PREAMBLE FORMATS 50% Duty Cycle TE TE 33% Duty Cycle TE 2TE Timeout Select (TSEL) The HCS473’s Timeout function prevents battery drain should a switch input remain high (stuck button) longer than the selectable TSEL time. After the TSEL time, the device will return to Low-power mode. • • • • Preamble Duty Cycle (PRD) The preamble duty cycle can be set to either 33% or 50% to limit the average power transmitted, Figure 3-7. The Minimum Code Words (MTX) configuration option determines the minimum number of code words transmitted when a momentary switch input is taken high for more than TPU, or when a proximity activation occurs. • • • • LPRL options: 3.1.5 LED OPERATION The LED pin output varies depending on whether the device VDD is greater than VLOWSEL (a good battery) or below VLOWSEL (a flat battery). The LED pin will periodically be driven low as long as the device is transmitting and the battery is good. If the supply voltage drops below the specified VLOWSEL trip point, the LED pin will be driven low only once for any given device activation so long as the low battery condition remains (Figure 3-8). If the battery voltage recovers during the transmission, the LED will begin blinking again. Long Preamble Enable (LPRE) Enabling the Long Preamble configuration option extends the first code word’s preamble to a ‘long’ preamble time LPRL; allowing the receiver more time to wake and bias before the data bits arrive. The longer preamble will be a square wave at the selected RFTE. Subsequent code words begin with the standard preamble length. LPRE options: • Standard 16 high pulse preamble • Long preamble, duration defined by LPRL 2000-2013 Microchip Technology Inc. Preliminary DS40035D-page 17 HCS473 FIGURE 3-8: LED OPERATION SWITCH Sx DATA LED - VDD>VLOWSEL (good battery) LED - VDDVLOWSEL (flat battery) 3.1.6 Code Word Code Word TLEDON TLEDOFF TLEDON 3.1.8 CYCLE REDUNDANCY CHECK (CRC) The decoder can use the CRC bits to check the data integrity before processing begins. The CRC is calculated on the previously transmitted bits (Figure 3-2), detecting all single bit and 66% of all double bit errors. EQUATION 3-1: Code Word CRC CALCULATION CRC 1 n + 1 = CRC 0 n Di n and CRC 0 n + 1 = CRC 0 n Din CRC 1 n with DISCRIMINATION VALUE (DISC) The Discrimination Value is typically used by the decoder in a post-decryption check. It may be any value, but in a typical system it will be programmed equal to the Least Significant bits of the serial number. The discrimination bits are part of the information that form the encrypted portion of the transmission (Figure 3-2). After the receiver has decrypted a transmission, the discrimination bits are checked against the receiver’s stored value to verify that the decryption process was valid; appropriate decryption key was used. If the discrimination value was programmed as the LSb’s of the serial number then it may merely be compared to the respective bits of the received serial number. The discrimination bit field size varies with the counter select (CNTSEL) option (Figure 3-2). CRC 1 0 0 = 0 and Din the nth transmission bit 0 n 64 3.2 3.1.7 The HCS473’s Transponder mode allows it to function as a bi-directional communication transponder. Commands are received on the LC pins, responses may be returned on either the LC pins or DATA pin for short range LF or long range RF responses, respectively. COUNTER OVERFLOW BITS (OVR1, OVR0) The Counter Overflow Bits may be utilized to increase the 16-bit synchronization counter range from the nominal 65,535 to 131,070 or 196,605. The bits do not exist when the device is configured for 20-bit counter operation. The bits must be programmed during production as ‘1’s to be utilized. OVR0 is cleared the first time the synchronization counter wraps from FFFFh to 0000h. OVR1 is cleared the second time the synchronization counter wraps to zero. The two bits remain at ‘0’ after all subsequent counter wraps. Note: See Section 4.0, Programming Specs, for information on programming OVR bits. DS40035D-page 18 Transponder Mode Transponder mode capabilities include: • A bi-directional challenge and response sequence for IFF validation. • Read selected EEPROM areas. • Write selected EEPROM areas. • Request a code hopping transmission. • Proximity Activation of a code hopping transmission. • Address an individual transponder when multiple units are within the LF field; device selection for anticollision communication purposes. Preliminary 2000-2013 Microchip Technology Inc. HCS473 3.2.1 TRANSPONDER OPTIONS The following HCS473 configuration options influence the device behavior when in Transponder mode: • • • • • • • • • Preamble length select (TPRLS) LF Demodulator (LFDEMOD) LF Baud rate select (LFBSL) Anticollision (ACOL) Proximity Activation (PXMA) Intelligent Damping (DAMP) LC response Enable (LCRSP) RF response Enable (RFRSP) Skip Field Acknowledge (SKIPACK) The demodulated signal on the LED pin is accurate to within +/-10s of the signal on the LC pins. The injected signal will have baud rate limitations based on the HCS473’s internal filter charge and discharge times, Section 3.2.6. The filter times discussed in Section 3.2.6 will be easily seen in Demodulator mode. The internal filter delay may be isolated by communicating to the HCS473 inputting the digital signal into LCX and observing the signal plus internal filter delays on the LED pin. LFDEMOD options: The following sections describe these options in detail. • Disabled - device functions normally • Enabled - device demodulates signal on LC pins, outputting digital result on the LED pin. Note: 3.2.1.1 Transponder Preamble Length Select (TPRLS) Data responses through the DATA pin use the format determined by the Encoder mode options, with one exception/option to shorten the response time. The response’s preamble can be reduced to 4 high pulses by setting the transponder preamble length select option. This only affects the responses as a result of transponder communication (proximity activation transmissions included), not responses resulting from button input activations. The 4 high pulse short preamble will be at the same duty cycle defined by the preamble duty cycle Encoder mode option (PRD). Note: The long preamble enable Encoder mode option (LPRE) holds priority over the transponder preamble length option. TABLE 3-2: TRANSPONDER PREAMBLE LENGTH SELECT (TPRLS) TPLS LPRE 0 0 Normal - 16 high pulses X 1 Long - LPRL determines length 1 0 Short - 4 high pulses 3.2.1.2 Description LF Demodulator (LFDEMOD) The HCS473 has a LF Demodulator mode useful for debugging antenna hardware. Enabling LFDEMOD limits the device to demodulator only mode. After receiving an appropriate wake-up sequence, the device enters a loop demodulating the signal on the LC pins and outputting the resulting digital representation on the LED pin. The HCS473 remains in this mode until no edges are detected on the LC pins for TDEMOD, upon which it will return to Low-power mode; requiring another wake-up sequence to further demodulate data. 2000-2013 Microchip Technology Inc. 3.2.1.3 Damping is disabled when in Demodulator mode. LF Baud Rate Select (LFBSL) The LF Baud rate select option allows the user to adjust the basic pulse width element (LFTE) used for transponder communication. LFBSL options: • • • • 100 s LFTE 200 s LFTE 400 s LFTE 800 s LFTE All communication to and from the HCS473 through the LC transponder pins will use the selected LFTE. RF acknowledges to LF communication, through the DATA pin, will also use the selected LFTE. 3.2.1.4 Anticollision (ACOL) Multiple transponders in the same inductive field will simultaneously respond to inductive commands. Enabling anticollision prevents multiple HCS473 responses from 'colliding'. Hence the term ‘anticollision.’ When anticollision (ACOL) is enabled, the first command received after the device wakes must be either the SELECT TRANSPONDER or ANTICOLLISION OFFcommand before the HCS473 will respond to any other command. The ANTICOLLISION OFF command may be used to temporarily bypass anticollision requirements for a single communication sequence. It allows communication with an anticollision enabled HCS473 if the VID and TID are not known (perhaps during a learning sequence). See Section 3.2.3.7 for further anticollision off details. The SELECT TRANSPONDER command allows the addressing of and communication to an individual HCS473, regardless if multiple devices are in the field (Section 3.2.3.1). Preliminary DS40035D-page 19 HCS473 The HCS473 anticollision method is that all devices trained to a given vehicle will have the same 12-bit vehicle identifier (VID); Most Significant 12 bits of the device identifier, Table 3-3. The device identifier of up to 16 transponders trained to access a given vehicle will differ only in the 4 LSb’s. These 4 bits are referred to as the token identifier (TID). 3.2.1.6 TABLE 3-3: The Intelligent damping option enables a pulsed, resistive short from the LC pins to LCCOM when the HCS473 is expecting the incoming LC signal level to go low. These pulses damp the antenna, dissipating resonant energy for a quicker decay time when the field is switched off. DEVICE ID 16-bit Device ID (DEVID) 15 14 13 12 11 10 9 8 7 6 5 4 3 VID 11 10 9 8 7 6 2 1 0 TID 5 4 3 2 1 0 3 2 1 0 The vehicle ID associates the HCS473 with a given vehicle and the token ID makes it a uniquely addressable (selectable) 1 of 16 possible devices authorized to access the vehicle. Two unique device identifiers are available allowing the HCS473 to be used with two different vehicles. The HCS473 responds if the presented VID and TID match either of the two programmed identifiers. SELECT TRANSPONDER may still be performed on devices not configured to require anticollision; communication can still be isolated to one of multiple devices in the field. Equally, the same devices will respond to all command sequences not preceded by the SELECT TRANSPONDER sequence. 3.2.1.5 Proximity Activation (PXMA) Enabling the Proximity Activation configuration option allows the HCS473 to transmit a hopping code transmission in response to detecting an appropriate wakeup pulse on an LC input pin. The HCS473 sends a wake-up sequence Acknowledge in response to detecting the LF field (Figure 311). The device then waits TCMD for the LF field’s falling edge followed by the normal TCMD window waiting for a transponder command to begin. If no command is received, a code hopping transmission is generated and the minimum code words (set with MTX option) are transmitted. When the transmission completes, the HCS473 waits a TCMD window for a new command to begin. If no command is received the device returns to SLEEP. Proximity activations are not repeatedly activated when the device is in the presence of a continuous LF field (computer monitor, tv,...). The HCS473 must receive an appropriate wake-up sequence to activate each transmission. The button status used in the proximity activated code hopping transmission clears the S0, S1, S2 and S3 button status flags. DS40035D-page 20 Intelligent Damping (DAMP) A high Q-factor LC antenna circuit connected to the HCS473 will continue to resonate after a strong LF field is removed, slowly decaying. The slow decay makes fast communication near the reader difficult as the resulting extended high time makes the following low time disappear. The damping pulses are applied between the LCCOM pin and the individual LC pins, starting 1.2 LFTE from detecting the bit’s rising edge and repeating until the LC input goes low. Damp pulse width is 6 s, beginning every 44 s as shown in Figure 3-9. Note: Damping will not reduce the HCS473 internal LF analog filter discharge time, TFILTF (Section 3.2.6). FIGURE 3-9: INTELLIGENT DAMPING No Damping With Damping Field on LC pins LC Output Signal Level TDAMP 3.2.1.7 Damping Pulses Response Options (RFRSP, LCRSP) HCS473 responses may optionally be returned on the DATA pin for long-range RF responses and/or LC pins for short-range LF responses (Table 3-4). Responses include both Acknowledge sequences and data responses. The options controlling the response path are: • LC response option (LCRSP) • RF response option (RFRSP) If both RF and LF responses are enabled, Acknowledge pulses will occur simultaneously on the DATA and LC pins; using the LFTE baud rate (Figure 3-11, Figure 3-19). Data responses will not occur simultaneously. The RF response on the DATA pin will occur first (following the designated Encoder mode format), immediately followed by the LF response on the LC pins (Figure 3-20). Preliminary 2000-2013 Microchip Technology Inc. HCS473 TABLE 3-4: HCS473 RESPONSE OPTIONS RFRSP LCRSP FIGURE 3-10: Description 0 0 No response ‘0’ 0 1 Response over the LC pins 125kHz 1 0 Response through the DATA pin 1 1 Response through the DATA pin first and then the LC pins 3.2.1.8 Skip Field Acknowledge (SKIPACK) The initial Field Acknowledge sequence, occurring during the wake-up pulse, may be disabled by enabling the Skip Field Acknowledge configuration option (SKIPACK=1). Omitting the ACK slightly minimizes a HCS473’s average communication current draw, but conversely will increase average authentication time as the wake-up pulse must then be the maximum start-up filter charge time, TSFMAX. 3.2.2 TRANSPONDER COMMUNICATION Data to and from the HCS473 is always sent Least Significant bit first. The data length and modulation format vary with the particular command sequence and the transmission path. 3.2.2.1 Digital Representation LC Communication Format Commands from the transponder reader to the HCS473 as well as the responses from the HCS473 over the low frequency path (LC pins) are Pulse Position Modulated (PPM) according to Figure 3-10. Communication from the transponder reader to a HCS473 is via the reader amplitude shifting a 125kHz low frequency (LF) field. LF responses back to the transponder reader are achieved by the HCS473 applying a low-resistance short from the LC pins to LCCOM (configuration option LCRSP enables LF talkback). This short across the antenna inputs is detected by the reader as a load on its 125kHz transmitting antenna. See Section 5.4 for further details on inductive communication principles. LC PIN PULSE POSITION MODULATION (PPM) 1LFTE 1LFTE START or previous bit ‘1’ 125kHz Digital Representation 3.2.2.2 2LFTE 1LFTE RF DATA Communication Format The RF responses on the DATA pin vary with the information being returned. • Acknowledge responses are based on the LFTE. • Data code words responses are based on the RFTE, using the format determined by the Encoder mode options, Section 3.1.4. 3.2.2.3 Wake-up Sequence The transponder reader initiates each communication sequence by turning on the low frequency field, then waits for a HCS473 to Acknowledge the field. The HCS473 enters Transponder Mode after detecting a signal on any LC low frequency antenna input pin that has remained high for at least the start-up filter time TSF, Table 7-5. The device then responds with a Field Acknowledge sequence indicating that it has detected the LF field, is in Transponder Mode and is ready to receive commands (Figure 3-11). The wake-up pulse’s falling edge must then occur within TCMD of the end of the Field Acknowledge sequence. The Field Acknowledge sequence may optionally be disabled by enabling the Skip Field ACK configuration option, Section 3.2.1.8. In both cases, the first command bit must begin within TCMD of the wake-up pulse’s falling edge or the HCS473 will return to Low Power mode. 2000-2013 Microchip Technology Inc. Preliminary DS40035D-page 21 HCS473 3.2.2.4 Command Sequence The transponder reader follows the HCS473’s Field Acknowledge by sending the desired 3-bit command, 3-bit option or address, associated data and CRC; each as required. LF commands are Pulse Position Modulated (PPM) as shown in Figure 3-10. The last bit (CRC bit) should be followed by leaving the field on for TFINH. FIGURE 3-11: TFINH should be appropriately adjusted to receive consecutive commands or LF responses. See Section 3.2.4 and Section 3.2.5 for LF response and consecutive command considerations. HCS473 TRANSPONDER WAKE-UP SEQUENCE SKIPACK = 0 - Field Acknowledge sent when device wakes 125kHz Field (on LC pins) Simultaneous LF Acknowledge (LFRSP=1) bit2 bit1 TCMD bit0 TSF Command Inductive (LC) TCMD 3LFTE 3LFTE 3LFTE RF Response (DATA) RF Acknowledge (RFRSP=1) Command SKIPACK = 1 - Field Acknowledge is not sent bit2 bit1 bit0 TSFMAX Inductive (LC) TCMD Communication from reader to HCS473 Communication from HCS473 to reader DS40035D-page 22 Preliminary 2000-2013 Microchip Technology Inc. HCS473 3.2.3 TRANSPONDER COMMANDS TABLE 3-5: LIST OF AVAILABLE TRANSPONDER COMMANDS Command Option Description Select Transponder (Section 3.2.3.1) - 0002 Select HCS473, used to isolate communication to a single HCS473 Present Transport Code (1) (Section 3.2.3.2) 0012 - Used to gain write access to the device EEPROM memory locations Identify Friend or Foe (IFF) (1) (Section 3.2.3.3) 0102 0002 32-bit IFF using the Transponder Key 0012 16-bit IFF using the Transponder Key 0102 32-bit IFF using the Encoder Key 0112 16-bit IFF using the Encoder Key 0002 Read 16-bit User EEPROM 0 0012 Read 16-bit User EEPROM 1 0102 Read 16-bit User EEPROM 2 0112 Read 16-bit User EEPROM 3 1002 Read Most Significant 16 bits of the Serial Number 1012 Read Least Significant 16 bits of the Serial Number 1102 Read 16-bit Device Identifier #1 (12-bit Vehicle ID #1 and 4-bit Token ID #1) 1112 Read 16-bit Device Identifier #2 (12-bit Vehicle ID #2 and 4-bit Token ID #1) 0002 Write 16-bit User EEPROM 0 0012 Write 16-bit User EEPROM 1 0102 Write 16-bit User EEPROM 2 0112 Write 16-bit User EEPROM 3 1002 Write Most Significant 16 bits of the Serial Number 1012 Write Least Significant 16 bits of the Serial Number 1102 Write 16-bit Device Identifier #1 (12-bit Vehicle ID #1 and 4-bit Token ID #1) 1112 Write 16-bit Device Identifier #2 (12-bit Vehicle ID #2 and 4-bit Token ID #1) Read EEPROM (1) (Section 3.2.3.4) 1002 Write EEPROM (1) (2) (Section 3.2.3.5) 1012 Request Hopping Code (1) (Section 3.2.3.6) 1102 - Request Hopping Code transmission - Temporarily bypass a HCS473’s anticollision requirements. Anticollision OFF (Section 3.2.3.7) 1112 Note 1: Command must be preceded by successful Select Transponder or Anticollision Off sequence if anticollision is enabled. 2: A successful Present Transport Code sequence must first occur to gain write access. 2000-2013 Microchip Technology Inc. Preliminary DS40035D-page 23 HCS473 SELECT TRANSPONDER Any HCS473 that did not match both the presented VID and TID will return to SLEEP, unselected, remaining that way until the next wake-up pulse occurs. The SELECT TRANSPONDER sequence must immediately follow the HCS473 wake-up. A 12-bit Vehicle ID (VID) follows the 3-bit command. The 4-bit Token ID (TID) is sent by pulsing the field to identify which transponder should respond. The next command must begin TTSCMD after the Acknowledge. If the LC input is high a point TTSCMDMIN after the Acknowledge ends, the HCS473 will return to SLEEP, unselected, assuming the transponder reader is sending additional TID pulse(s) to select a different device. A device of any TID value may therefore be uniquely selected, regardless if a device with lower TID has already acknowledged. The HCS473 counts each time the field is pulsed (6 LFTE period), the first pulse setting the counter equal to 0. If the VID matched, the HCS473 will send an Acknowledge when the TID matches the counter. Any further TID pulses after the Acknowledge occurs will deselect the device, putting it back to SLEEP - again requires a wake-up sequence to communicate. TRANSPONDER SELECT SEQUENCE (RF RESPONSE EXAMPLE) 12-Bit VID TID ACK CMD Next Command TID=0 TID=1 TID=2 TID=3 bit11 ‘0’ ‘0’ ‘0’ bit0 Command TSF VID bit2 CMD ‘XXX’ TTSCMD bit0 TCMD bit1 WAKE ACK 1-16 ‘0002’ 12 bits Pulses bit10 FIGURE 3-12: bit1 3.2.3.1 MSb LSb MSb LSb Inductive In (LC Pins) TCMD TTSACK 6 LFTE TCMD RF Response (DATA Pin) TTSCMD ACK Transponder Select ACK Example for TID=’0011’ DID [ 12-bit Vehicle ID ] [ 4-bit Token ID ] MSb bit11 bit10 bit9 bit8 bit7 bit6 bit5 bit4 bit3 bit2 bit1 LSb bit0 MSb bit3 bit2 bit1 LSb bit0 = MSb bit15 bit14 bit13 bit12 bit11 bit10 bit9 bit8 bit7 bit6 bit5 bit4 bit3 bit2 bit1 LSb bit0 16-bit Device Identifier DS40035D-page 24 5 LFTE Preliminary VID TID 2000-2013 Microchip Technology Inc. HCS473 3.2.3.2 PRESENT TRANSPORT CODE The present transport code sequence must precede a write sequence but not necessarily immediately. Perhaps all four user memory locations will be written and verified. The present transport code sequence must precede only the first write to gain write access. The system may then alternately write and read (verify) multiple memory locations. Write access remains until the next time the device returns to Low Power mode communication error or TCMD time out without receiving another command. Prior to modifying the device EEPROM, the correct 32bit transport code (password) must be presented to gain write access. This is done with the PRESENT TRANSPORT CODE command followed by the 32-bit transport code and CRC calculated on the 3-bit command and 32 bits of data. The HCS473 will return an Acknowledge if the transport code matches the value programmed in production; write access has been granted. The next command (usually a write) must begin TCMD after the Acknowledge, Figure 3-13. PRESENT TRANSPORT CODE SEQUENCE (RF RESPONSE EXAMPLE) Address 16-Bit Write Data bit15 ‘1’ DATA bit1 Write Command CRC1 bit31 ‘0’ ‘0’ MSb bit0 ‘1’ LSb TSF ADR bit14 CRC CMD bit0 32-Bit Transport Command ACK bit1 CRC bit2 TCODE WRITE Sequence TCMD ‘1’ CMD 2 bits bit0 32 bits ‘0’ ‘0012’ CRC0 TCMD bit30 Wake Sequence or Previous Command Response bit1 FIGURE 3-13: MSb LSb MSb LSb Inductive In (LC Pins) TFINH TCMD TCMD TCMD RF Response (DATA Pin) ACK 2000-2013 Microchip Technology Inc. TTPACK TCMD 5 LFTE Transport ACK Preliminary DS40035D-page 25 HCS473 IFF CHALLENGE AND RESPONSE If 16-bit IFF is selected, the 32-bit response consists of two copies of the 16-bit challenge. The HCS473 can perform a 16-bit or 32-bit challenge and response (IFF) based on the KEELOQ encryption algorithm. RFRSP determines if the response will be transmitted on the DATA pin. If enabled, the response will follow the selected Encoder mode code hopping format with the hopping code replaced with the 32-bit response. The transmissions will contain a button code of ‘0000’. The transponder reader follows the 3-bit IFF command with one of four possible options indicating a 16 or 32bit challenge and whether to use the encoder or transponder crypto key to create the response (Table 3-5). LFRSP determines if the response will be transmitted on the LC pins. The LC pin response will be the 32-bit result, modulated PPM format. The 3-bit option is followed by the appropriate 16 or 32bit challenge; typically a random number. The sequence ends with a CRC calculated over the command, option and challenge bits, (Figure 3-14). If both RFRSP and LFRSP are enabled, the HCS473 will send the response on the DATA pin immediately followed by the PPM response on the LC pins. Refer to Section 3.2.1.7 for further response path details. The HCS473 encrypts the challenge using the designated crypto key and responds with a 32-bit result. The reader authenticates the response by decrypting it and verifying it matches the original challenge. IFF SEQUENCE (RF RESPONSE EXAMPLE) 16/32 bits 2 bits CMD CHAL CRC TCMD CRC0 CRC1 MSb LF must remain on if following with consecutive command or if waiting for LF response TFINH TIFF TCMD RF Response (RFRSP=1) Preliminary Header Preamble ACK DS40035D-page 26 Optional Next Command Fixed Code bit15/31 TCMD RF Response (DATA Pin) RESPONSE CRC LSb LSb MSb LSb MSb LSb Inductive In (LC Pins) bit1 ‘0’ 16/32-Bit Challenge Option bit0 ‘0’ TSF ‘1’ Command TIFF IFF Response (32 bits) OPT bit0 TCMD ‘0102’ 3 bits bit1 Wake Sequence or Previous Command Response bit2 FIGURE 3-14: The next command must begin TCMD after the response. MSb 3.2.3.3 2000-2013 Microchip Technology Inc. HCS473 READ Command LFRSP determines if the response will be transmitted on the LC pins. The LC pin response will be the 32-bit result, modulated PPM format. The transponder reader follows the 3-bit READ command with one of eight possible 3-bit address options indicating which 16-bit EEPROM word to retrieve (Table 3-5) and a 2-bit CRC calculated over the command and address bits. If both RFRSP and LFRSP are enabled, the HCS473 will send the response on the DATA pin immediately followed by the PPM response on the LC pins. Refer to Section 3.2.1.7 for further response path details. The HCS473 retrieves the data and returns the 16-bit response by creating a 32-bit value containing two copies of the response (Figure 3-15). The following locations are available to read: • The 64-bit general purpose user EEPROM. • The 32-bit serial number. The serial number is also transmitted in each code hopping transmission. • The16-bit device identifiers #1 and #2. RFRSP determines if the response will be transmitted on the DATA pin. If enabled, the response will follow the selected Encoder mode code hopping format with the hopping code replaced with the 32-bit response. The transmissions will contain a button code of ‘0000’. READ SEQUENCE (RF RESPONSE EXAMPLE) CMD ADR MSb LSb MSb LSb bit0 LF must remain on if following with consecutive command or if waiting for LF response TCMD TFINH TREAD RF Response (RFRSP=1) TCMD Preliminary Header Preamble ACK 2000-2013 Microchip Technology Inc. Optional Next Command Fixed Code TCMD RF Response (DATA Pin) TCMD Next Command Inductive In (LC Pins) TCMD RESPONSE CRC CRC1 ‘1’ MSb Address CRC0 ‘0’ ‘0’ TSF LSb Command TREAD CRC bit2 3 bits 2 bits bit1 ‘1002’ bit2 TCMD bit1 Wake Sequence or Previous Command Response bit0 FIGURE 3-15: The next command must begin TCMD after the read response. Read Data (32 bits) 3.2.3.4 DS40035D-page 27 HCS473 WRITE Command cessful PRESENT TRANSPORT CODE sequence. Only a correct match with the transport code programmed during production will allow write access to the memory locations. The transponder reader follows the 3-bit WRITE command with one of eight possible 3-bit address options indicating which 16-bit EEPROM word to write to (Table 3-5) and a 2-bit CRC calculated over the command, address and data bits. The next command must begin TCMD after the write Acknowledge. The PRESENT TRANSPORT CODE sequence must precede a WRITE sequence but not necessarily immediately. Perhaps all four user memory locations will be written and verified. The PRESENT TRANSPORT CODE sequence must precede only the first write. The system may then alternately write and read (verify) multiple memory locations. Write access status remains until the next time the device returns to sleep communication error or TCMD without receiving another command. The HCS473 will attempt to write the value into EEPROM, responding with an Acknowledge sequence if successful (Figure 3-15). The following locations are available to write: • The 64-bit general purpose user EEPROM. • The 32-bit serial number. • The16-bit Device Identifiers #1 and #2. A Transport Code, write access password, protects the memory locations from undesired modification. The reader must precede the Write sequence with a suc- WRITE SEQUENCE (RF RESPONSE EXAMPLE) CMD ADR TWRT CRC bit15 CRC0 CRC1 LSb MSb LSb MSb LSb MSb LSb Inductive In (LC Pins) TCMD RF Response (DATA Pin) ACK TCMD Optional Next Command Next Command CRC MSb bit1 bit14 16-Bit Write Data Address bit0 ‘1’ ‘1’ Previous Command Sequence ‘0’ Command DATA LF must remain on if following with consecutive command or if waiting for LF response bit2 3 bits 16 bits 2 bits bit1 ‘1012’ bit1 TCMD bit2 Previous Command Sequence bit0 FIGURE 3-16: bit0 3.2.3.5 TCMD TFINH TWRT TCMD TCMD 5 LFTE Write ACK DS40035D-page 28 Preliminary 2000-2013 Microchip Technology Inc. HCS473 REQUEST HOPPING CODE COMMAND Encoder mode options. The code word will contain a button code of ‘00002’, indicating the transmission did not result from a button press. The REQUEST HOPPING CODE command tells the HCS473 to increment the synchronization counter and build the 32-bit code hopping portion of the encoder code word. LFRSP determines if the response will be transmitted on the LC pins. The LC pin response will be the 32-bit hopping portion of the code word, modulated PPM format. A delay of THOP occurs while the HCS473 increments the counter (updating EEPROM values) and encrypts the response. If both RFRSP and LFRSP are enabled, the HCS473 will send the response on the DATA pin immediately followed by the PPM response on the LC pins. Refer to Section 3.2.1.7 for further response path details. RFRSP determines if the response will be transmitted on the DATA pin. If enabled, the response will be a single KEELOQ code hopping code word, based on REQUEST HOPPING CODE SEQUENCE (RF RESPONSE EXAMPLE) 2 bits CMD CRC ‘1’ ‘0’ TSF ‘1’ Command THOP MSb LSb MSb LSb TCMD RF Response (DATA Pin) TCMD Optional Next Command Next Command CRC LF must remain on if following with consecutive command or if waiting for LF response Inductive In (LC Pins) TCMD RESPONSE bit2 ‘1102’ bit1 TCMD CRC1 Wake Sequence or Previous Command Response CRC0 FIGURE 3-17: The next command must begin TCMD after the code hopping response. bit0 3.2.3.6 TCMD TFINH THOP RF Response (RFRSP=1) TCMD 2000-2013 Microchip Technology Inc. Preliminary Fixed Code Hop Code (32 bits) Header Preamble ACK DS40035D-page 29 HCS473 ANTI-COLLISION OFF even if the anticollision (ACOL) configuration option is enabled and a SELECT TRANSPONDER sequence has not been performed. Anticollision is enabled/disabled for a given device by the ACOL configuration option. The ANTICOLLISION OFF command may be used to temporarily bypass anticollision requirements for a single communication sequence. It allows communication to an anticollision enabled HCS473 if the VID and TID are not known (perhaps during a learning sequence). The next command must begin TCMD after the Acknowledge. The HCS473 remains in this anticollision off state until the next time the device returns to SLEEP - communication error or TCMD without receiving another command. Multiple commands may therefore be sent without sending the ANTICOLLISION OFF command prior to each command. The command must immediately follow the wake-up sequence, Figure 3-18. The HCS473 acknowledges the command receipt, then reacts to all commands CMD CRC Command CRC LSb Inductive In (LC Pins) ‘XXX’ ACK TCMD Next Command CMD bit2 bit0 TFINH bit1 Next Command CRC1 TSF ‘1’ 2 bits ‘1’ ‘1112’ TCMD MSb LSb WAKE ACK CRC0 ANTICOLLISION OFF SEQUENCE (RF RESPONSE EXAMPLE) ‘1’ FIGURE 3-18: MSb 3.2.3.7 TCMD TCMD TCMD TAOACK TCMD RF Response (DATA Pin) 5 LFTE ACK ACOL Off ACK 3.2.4 LF RESPONSE CONSIDERATIONS As LF responses are transmitted by the HCS473 placing a short across the LC antenna inputs, dissipating the antenna resonance, the transponder reader must still be sending the 125 kHz field for LF responses to work. The low frequency field on-time (TFINH) must therefore be approriately adjusted to receive an LF Acknowledge sequence or LF data response, Figure 319 and Figure 3-20. 3.2.5 CONSECUTIVE COMMAND CONSIDERATIONS Transponder commands may consecutively follow one another to minimize communication time as the wakeup sequence, device selection, anticollision off and transport code presentation need not be repeated for every command. The reason is that the HCS473’s analog LF antenna input circuitry will return to Low-power mode when the 125 kHz field remains absent; requiring a new wake-up sequence to continue communication. The HCS473’s analog section will never return to Lowpower mode during any TCMD window waiting for an LC input communication edge, so long as the LF signal existed up to the beginning of the TCMD window. Please refer to Figure 3-19 and Figure 3-20 for examples on adjusting TFINH for consecutive commands and LF responses. 3.2.6 LF COMMUNICATION ANALOG DELAYS LF communication edge delays result from the HCS473’s internal analog circuit as well as the external LC resonant antennas, Figure 3-21. Consideration must be given to how long the transponder reader keeps the LF signal on after the last data bit’s rising edge (TFINH) when a command sequence... The rising and falling edge delays inherent to the HCS473’s internal filtering are known and specified in Table 7-5, TFILTR and TFILTF. • will be followed by another command sequence • will result in a LF response The cumulative rising and falling edge delays inherent to both the series LC transmitting antenna and parallel LC receiving antennas are design dependent, not a HCS473 specification. DS40035D-page 30 Preliminary 2000-2013 Microchip Technology Inc. HCS473 Table 7-5 timing values are compensated only for HCS473 internal filter delays. The transponder reader designer must compensate communication timing accordingly for the cumulative antenna delays. It must be clearly understood that the HCS473 core does not see the LF field immediately upon the base station turning it on, nor does it immediately detect its removal. If the internal analog delay and cumulative antenna delays are greater than a given low time, the HCS473 will obviously never “see” the low. Use LF Demodulator mode to see the effects of the internal filters and the LC antennae, Section 3.2.1.2. FIGURE 3-19: LF ACK RESPONSE ADJUSTMENTS (LFRSP=1) Transponder Select Sequence 12-Bit VID Command Simultaneous LF ACK TID=0 TID=1 TID=2 Next Command MSb LSb LSb MSb Inductive (LC Pins) TTSACK 6 LFTE TCMD TTSCMD RF Response (DATA Pin) 5 LFTE Transponder Select ACK Present Transport Code Sequence 32-Bit Transport TCMD MSb LSb MSb CRC LSb LSb Inductive (LC Pins) MSb Command Simultaneous LF ACK Next Command TFINH TCMD TTPACK TCMD RF Response (DATA Pin) 5 LFTE Transport ACK Write Sequence Simultaneous LF ACK MSb CRC MSb LSb MSb LSb Address LSb MSb Inductive (LC Pins) LSb Command 16-Bit Write Data TCMD Next Command TFINH TWRT TCMD TCMD RF Response (DATA Pin) 5 LFTE Write ACK Anticollision Off Sequence TCMD MSb LSb Inductive (LC Pins) CRC MSb LSb Command Simultaneous LF ACK Next Command TFINH TCMD TAOACK TCMD RF Response (DATA Pin) 5 LFTE ACOL Off ACK 2000-2013 Microchip Technology Inc. Preliminary DS40035D-page 31 HCS473 FIGURE 3-20: LF DATA RESPONSE ADJUSTMENTS (LFRSP=1) IFF, Read and Request Hop CRC Next Command 32-Bit LF Response (LFRSP=1) RF Response (RFRSP=1) 1 LFTE MSb LSb Inductive (LC Pins) TCMD Fixed Code (37 bits) Response (32 bits) Header Preamble RF Response (DATA Pin) FIGURE 3-21: TCMD TFINH LF COMMUNICATION ANALOG DELAYS Bit ‘1’, 200 s LFTE 600 s Bit ‘0’, 200 s LFTE 400 s Digital Representation of Communication from Transponder Reader Resulting 125 kHz on Transponder Reader Antenna (TX) Resulting 125 kHz on Transponder Card Antenna (RX) TANTR Resulting digital signal processed by HCS473, after analog filter TANTF TFILTR TFILTF 600 s 3.2.7 RECEIVE STABILITY CALCULATING COMMUNICATION TE The HCS473’s internal oscillator may vary ±10% over the device’s rated voltage and temperature range for commercial temperature devices. A certain percentage of industrial temperature devices vary further on the slow side, -20%, when used at higher voltages (VDD > 3.5V) and cold temperature. When the internal oscillator varies, both its transmitted TE and expected TE when receiving will vary. The HCS473 receive capability is ensured over a ±10% oscillator variance, with receive capability no longer robust as oscillator variance approaches ±15%. Industrial devices operating at VDD voltages greater than 3.5V (and cold temperature) are therefore not guaranteed to be able to properly receive when communicated to using an exact TE. When designing for these specific operating conditions, the system designer must implement a method to adjust communication timing to the speed of the HCS473. DS40035D-page 32 400 s Communication reliability with the transponder may be improved by the transponder reader calculating the HCS473’s TE from the Field Acknowledge sequence and using this exact time element in communication to and in reception routines from the transponder. Always begin and end the time measurement on rising edges. Whether LF or RF, the falling edge decay rates may vary but the rising edge relationships should remain consistent. A common TE calculation method would be to time an 8TE sequence from the first Field Acknowledge, then divide the value down to determine the single TE value. An 8 TE measurement will give good resolution and may be easily right-shifted (divide by 2) three times for the math portion of the calculation (Figure 3-22). Preliminary 2000-2013 Microchip Technology Inc. HCS473 FIGURE 3-22: Calculating Communication TE SKIPACK = 0 - Field Acknowledge sent when device wakes 125 kHz Field (on LC pins) Simultaneous LF Acknowledge (LFRSP=1) bit2 bit1 TCMD bit0 TSF Command Inductive (LC) TCMD 8LFTE 3LFTE 3LFTE 3LFTE RF Response (DATA) 8LFTE RF Acknowledge (RFRSP=1) Communication from reader to HCS473 Communication from HCS473 to reader 3.2.8 3.2.8.1 RFEN DURING LF COMMUNICATION (Figure 3-23) 3.2.8.4 Wake-up Sequence The wake-up Acknowledge sequence has the shortest, but fixed, PLL setup time, 1LFTE. 3.2.8.2 Transponder Select Sequence PLL setup occurs on the rising edge of the first VID bit in anticipation of the TID Acknowledge. The setup time before the ACK begins is therefore a function of... • LF baud rate • VID value • TID value 3.2.8.3 Data Response Sequences Concluding with CRC Command sequences ending with CRC bits and expecting data response (code hopping word) have a similar PLL setup sequence. This includes “IFF”, “Read” and “Request Hopping Code”. PLL setup occurs on the rising edge of the first CRC bit in anticipation of the data transmission. The setup time is therefore a function of... • LF baud rate • CRC value • Response time: TIFF, TREAD, THOP. ACK Response Sequences Concluding with CRC Command sequences ending with CRC bits and expecting an Acknowledge response have a similar PLL setup sequence. This includes “Present Transport Code”, “Write” and “Anticollision Off”. PLL setup occurs on the rising edge of the first CRC bit in anticipation of the Acknowledge. The setup time is therefore a function of... • LF baud rate • CRC value • Response time: TTPACK, TWRT, TAOACK. 2000-2013 Microchip Technology Inc. Preliminary DS40035D-page 33 HCS473 FIGURE 3-23: RFEN BEHAVIOR DURING LF COMMUNICATION Wake-up Sequence TSF TCMD Command Inductive In (LC) 1 LFTE 1 LFTE TCMD ASK RF (DATA) PLL (RFEN) FSK RF (DATA) PLL (RFEN) Transponder Select Sequence 12-Bit VID TID=0 TID=1 TID=2 TID=3 Next Command Inductive In (LC) ASK RF (DATA) PLL (RFEN) 1 LFTE FSK RF (DATA) PLL (RFEN) ACK Response Sequences Concluding with CRC - Present Transport Code - Write CRC - Anticollision Off Command Inductive In (LC) Response Time ASK RF (DATA) PLL (RFEN) 1 LFTE FSK RF (DATA) PLL (RFEN) Data Response Sequences Concluding with CRC - IFF - Read CRC - Request Hopping Code Command Inductive In (LC) Response Time ASK RF (DATA) PLL (RFEN) FSK RF (DATA) PLL (RFEN) DS40035D-page 34 Preliminary 2000-2013 Microchip Technology Inc. HCS473 3.3 CONFIGURATION SUMMARY TABLE 3-6: Symbol CONFIGURATION SUMMARY Reference Section Description(1) Address: Bits USR 0 00: 16 bits User EEPROM Area USR 1 02: 16 bits User EEPROM Area USR 2 04: 16 bits User EEPROM Area 3.2.3.4, 3.2.3.5 USR 3 06: 16 bits User EEPROM Area SER 08: 32 bits Encoder Serial Number DEVID 1 0C: 16 bits Device Identifier #1 - Vehicle/Token ID Number #1 DEVID 2 0E: 16 bits Device Identifier #2 - Vehicle/Token ID Number #2 3.2.1.4 IFF KEY 10: 64 bits IFF Key COUNT 18: 64 bits Encoder Synchronization Counter and Checksum 3.2.3.3 KEY 20: 64 bits Encoder Key SEED 28: 60 bits Encoder Seed Value 3.1.2.2 3.2.3.2 TCODE 30: 32 bits Transport Code DISC 34: 10 bits Encoder Discrimination Value RFEN 36: 7 - - - - - - - RF Enable Pin PLLSEL 36: - 6 - - - - - - PLL Interface Select 1.2.3 3.1.8 ( 2) 0 - S3 1 - RF Enable 0 - ASK 1 - FSK 3.1.4.8 3.1.4.7 0 - 2.2V 1 - 3.3V 3.1.4.6 1 - 20 bits 3.1.4.5 VLOWSEL 36: - - 5 - - - - - Low Voltage Trip Point Select CNTSEL 36: - - - 4 - - - - Counter Select 0 - 16 bits QUEN 36: - - - - 3 - - - Queue Counter Enable 0 - Disable 1 - Enable 3.1.4.4 XSER 36: - - - - - 2 - - Extended Serial Number 0 - 28 bits 1 - 32 bits 3.1.4.3 ( 1) HSEL 36: - - - - - - 1 - Header Select MSEL 36: - - - - - - - 0 Modulation Format SDMD 37: 7 - - - - - - - Seed Mode SDLM 37: - 6 - - - - - - Limited Seed SDTM 37: - - 5 4 - - - - Time Before Seed code word SDBT 37: - - - - 3 2 1 0 Seed Button Code TSEL ( 1) MTX 38: 7 6 - - - - - - Timeout Select ( 1) 38: - - 5 4 - - - - Minimum Code Words 2000-2013 Microchip Technology Inc. Preliminary 0 - 4 TE 1 - 10 TE 3.1.4.2 0 - PWM 1 - Manchester 3.1.4.1 0 - User 1 - Production 3.1.4.12 0 - Unlimited 1 - Limited 3.1.4.11 Value Time (s) 3.1.4.10 002 0.0 012 0.8 102 1.6 112 3.2 Bit order = S3-S2-S1-S0 3.1.4.9 Value Time (s) 3.1.4.16 002 4 012 8 102 16 112 32 Value Value 002 1 012 2 102 4 112 8 3.1.4.15 DS40035D-page 35 HCS473 TABLE 3-6: Symbol GSEL RFBSL CONFIGURATION SUMMARY Reference Section Description(1) Address: Bits 38: - - - - 3 2 - - Guard Time Select ( 1) 38: - - - - - - 1 0 RF Transmission Baud Rate Select ( 1) Value Time (ms) 002 0.0 012 6.4 102 51.2 112 102.4 Value TE (s) 002 100 012 200 102 400 3.1.4.14 3.1.4.13 112 800 LFDEMOD 39: 7 - - - - - - - LF Demodulator 0 - Normal 1 - Demod TPLS 39: - - - - 3 - - - Transponder Preamble Length 0 - Normal 1 - Short 3.2.1.1 PRD 39: - - - - - 2 - - Preamble Duty Cycle ( 1) 0 - 33% 1 - 50% 3.1.4.19 LPRL 39: - - - - - - 1 - Long Preamble Length ( 1) 0 - 75ms 1 - 100ms 3.1.4.18 LPRE 39: - - - - - - - 0 Long Preamble Enable 0 - Disable 1 - Enable 3.1.4.17 3.2.1.2 SKIPACK 3A: 7 - - - - - - - Skip First ACK 0 - Disable 1 - Enable 3.2.1.8 RFRSP 3A: - 6 - - - - - - RF Response 0 - Disable 1 - Enable 3.2.1.7 LCRSP 3A: - - 5 - - - - - LC Response 0 - Disable 1 - Enable 3.2.1.7 DAMP 3A: - - - 4 - - - - Intelligent LC Damping 0 - Disable 1 - Enable 3.2.1.6 PXMA 3A: - - - - 3 - - - Proximity Activation 0 - Disable 1 - Enable 3.2.1.5 ACOL 3A: - - - - - 2 - - Anticollision 0 - Disable 1 - Enable 3.2.1.4 LFBSL 3A: - - - - - - 1 0 LF Transmission Baud Rate Select ( 1) Value TE (s) 3.2.1.3 002 100 012 200 102 400 112 800 END 3F 01011010 Unused, always set = 5A Note 1: All Timing values vary ±10%. Industrial temperature devices operating at cold and 3.5V < VDD < 5.5V vary +10%, -20%. 2: Voltage thresholds should be ±250 mV for the low voltage range and ±400 mV for the high voltage range. DS40035D-page 36 Preliminary 2000-2013 Microchip Technology Inc. HCS473 4.0 PROGRAMMING SPECIFICATION The HCS473 programming specification is extensively covered in document DS41163 and will not be duplicated here. 2000-2013 Microchip Technology Inc. Preliminary DS40035D-page 37 HCS473 NOTES: DS40035D-page 38 Preliminary 2000-2013 Microchip Technology Inc. HCS473 5.0 INTEGRATING THE HCS473 INTO A SYSTEM FIGURE 5-1: TYPICAL LEARN SEQUENCE Enter Learn Mode Use of the HCS473 in a system requires a compatible decoder. This decoder is typically a microcontroller with a low frequency coil antenna and radio frequency receiver. Example firmware routines that accept and decrypt KEELOQ transmissions can be found in Application Notes and the KEELOQ license disk. Wait for Reception of a Valid Code & Seed Generate Key 5.1 Training the Receiver Use Generated Key to Decrypt In order for a transmitter to be used with a decoder, the transmitter must first be ‘learned’. When a decoder learns a transmitter, it is suggested that the decoder stores the serial number and current synchronization value in EEPROM. Some learning strategies have been patented and care must be taken not to infringe on them. The decoder must keep track of these values for every transmitter that is learned (see Figure 5-1). Compare Discrimination Value with Fixed Value Equal ? The maximum number of transmitters that can be learned is limited only by the available EEPROM memory. The decoder must also store the manufacturer’s code in order to learn a transmitter. This value will not change in a typical system, so it is usually stored as part of the microcontroller ROM code. Storing the manufacturer’s code as part of the ROM code improves security by keeping it off the external bus to the EEPROM. No Yes Wait for Reception of Second Valid Code (Optional) Counters Sequential ? Yes No Learn Successful Store: Serial Number Encoder Key Synchronization Counter Learn Unsuccessful Exit 5.2 Decoder Operation In a typical decoder operation (Figure 5-2), the key generation on the decoder side is performed by taking the serial number from a transmission and combining that with the manufacturer’s code to create the same secret key that was used by the transmitter. Once the secret key is obtained, the rest of the transmission can be decrypted. The decoder waits for a transmission and immediately can check the serial number to determine if it is a learned transmitter. If it is, the encrypted portion of the transmission is decrypted using the stored key. It uses the discrimination bits to determine if the decryption was valid. If everything up to this point is valid, the synchronization value is evaluated. 2000-2013 Microchip Technology Inc. Preliminary DS40035D-page 39 HCS473 FIGURE 5-2: TYPICAL DECODER OPERATION counter had just gotten out of the single operation ‘window’. Since it is now back in sync, the new synchronization value is stored and the command executed. Start No If a transmitter has somehow gotten out of the double operation window, the transmitter will not work and must be relearned. Since the entire window rotates after each valid transmission, codes that have been used are part of the ‘blocked’ (32K) codes and are no longer valid. This eliminates the possibility of grabbing a previous code and retransmitting to gain entry. Transmission Received ? Yes Note: Does Serial Number Match ? Yes Decrypt Transmission No No FIGURE 5-3: Is Decryption Valid ? Is Counter Within 16 ? Yes Execute Command and Update Counter Blocked (32K Codes) No No SYNCHRONIZATION WINDOW (16-BIT COUNTER) Entire Window rotates to eliminate use of previously used codes Yes No The synchronization method described in this section is only a typical implementation and because it is usually implemented in firmware, it can be altered to fit the needs of a particular system Current Position Double Operation (32K Codes) Is Counter Within 32K ? Single Operation Window (16 Codes) Yes 5.4 Save Counter in Temp Location 5.3 Synchronization with Decoder The technology features a sophisticated synchronization technique (Figure 5-3) which does not require the calculation and storage of future codes. If the stored counter value for that particular transmitter and the counter value that was just decrypted are within a window of 16 codes, the counter is stored and the command is executed. If the counter value was not within the single operation window, but is within the double operation window of 32K codes (when using a 16-bit counter), the transmitted synchronization value is stored in temporary location and it goes back to waiting for another transmission. When the next valid transmission is received, it will check the new value with the one in temporary storage. If the two values are sequential, it is assumed that the DS40035D-page 40 Inductive Communication Communication between a base station and a HCS473 transponder occurs via magnetic coupling between the transponder coil and base station coil. The base station coil forms part of a series RLC circuit. The base station communicates to the transponder by switching the 125 kHz signal to the series RLC circuit on and off. Thus, the base station magnetic field is switched on and off. The transponder coil is connected in parallel with a resonating capacitor (125 kHz) and the HCS473. When the transponder is brought into the base station magnetic field, it magnetically couples with this field and draws energy from it. This loading effect can be observed as a decrease in voltage across the base station resonating capacitor. The KEELOQ transponder communicates to the base station by “shorting out” its parallel LC circuit. This detunes the transponder and removes the load, which is observed as an increase in voltage across the base station resonating capacitor. The base station capacitor voltage is the input to the base station AM demodulator circuit. The demodulator extracts the transponder data for further processing by the base station software. Preliminary 2000-2013 Microchip Technology Inc. HCS473 5.5 Transponder Design You must initially decide if a ferrite core or an air core antenna will be used. There are advantages and disadvantages to using each. One advantage of using a ferrite core is that the coil can have a larger inductance for a given volume. Volume will usually be the primary constraint as it will need to fit into a: • key fob • credit card • other small package. First step: choose the transponder coil external dimensions because packaging places large constraints on antenna design. Second step: properties of the core, coil windings, as well as the equivalent load placed across the coil must be determined. Calculations from the first two steps will fix the initial coil specification. The initial coil specification includes: • • • • • Minimum number of wire turns on the coil Wire diameter Wire resistance Coil inductance Required resonating capacitor. Note: The exact number of turns may be tweaked such that a standard value resonant capacitor may be used. Build the initial coil and take appropriate measurements to determine the coil quality factor. The data gathered to this point may then be used to calculate an Optimum Coil Specification. It is not this data sheet’s purpose to present in-depth details regarding LC antennae and their tuning. Please refer to “Low Frequency Magnetic Transmitter Design Application Note”, AN232, for appropriate LF antenna design details. Note: 5.6 Microchip also has a confidential Application Note on Magnetic Sensors (AN832C). Contact Microchip for a Non-Disclosure Agreement in order to obtain this application note. Security Considerations The strength of this security is based on keeping a secret inside the transmitter that can be verified by encrypted transmissions to a trained receiver. The transmitter's secret is the manufacturer's key, not the encryption algorithm. If that key is compromised, then a smart transceiver can: The key cannot be read from the EEPROM without costly die probing, but it can be calculated by brute force decryption attacks on transmitted code words. The cost for these attacks should exceed what you would want to protect. To protect the security of other receivers with the same manufacturer's code, you need to use the random seed for secure learn. It is a second secret that is unique for each transmitter. It’s transmission on a special button press combination can be disabled if the receiver has another way to find it, or is limited to the first 127 transmissions for the receiver to learn it. This way it is very unlikely to ever be captured. Now if a manufacturer's key is compromised, new transmitters can be created. But without the unique seed, they must be relearned by the receiver. In the same way, if the transmissions are decrypted by brute force on a computer, the random seed hides the manufacturer's key and prevents more than one transmitter from being compromised. The length of the code word at these baud rates makes brute force attacks that guess the hopping code require years to perform. To make the receiver less susceptible to this attack, make sure that you test all the bits in the decrypted code for the correct value. Do not just test low counter bits for sync and the bit for the button input of interest. The main benefit of hopping codes is to prevent the retransmission of captured code words. This works very well for code words that the receiver decodes. Its weakness is if a code is captured when the receiver misses it, the code may trick the receiver once if it is used before the next valid transmission. To make the receiver more secure it could increment the counter on questionable code word receptions. To make the transmitter more secure it could use separate buttons for lock and unlock functions. Another way would be to require two different buttons in sequence to gain access. There are other ways to make KEELOQ systems more secure, but these are all trade-offs. You need to find a balance between: • Security • Design effort • Usability (particularly in failure modes). For example, if a button sticks or someone plays with it, the counter should not end up in the blocked code window, rendering the transmitter useless or requiring the receiver to relearn the transmitter. • capture any serial number • create a valid code word • trick all receivers trained with that serial number. 2000-2013 Microchip Technology Inc. Preliminary DS40035D-page 41 HCS473 NOTES: DS40035D-page 42 Preliminary 2000-2013 Microchip Technology Inc. HCS473 6.0 DEVELOPMENT SUPPORT The MPLAB IDE allows you to: The PIC® microcontrollers are supported with a full range of hardware and software development tools: • Integrated Development Environment - MPLAB® IDE Software • Assemblers/Compilers/Linkers - MPASMTM Assembler - MPLAB C17 and MPLAB C18 C Compilers - MPLINKTM Object Linker/ MPLIBTM Object Librarian • Simulators - MPLAB SIM Software Simulator • Emulators - MPLAB ICE 2000 In-Circuit Emulator - ICEPIC™ In-Circuit Emulator • In-Circuit Debugger - MPLAB ICD • Device Programmers - PRO MATE® II Universal Device Programmer - PICSTART® Plus Entry-Level Development Programmer • Low Cost Demonstration Boards - PICDEMTM 1 Demonstration Board - PICDEM 2 Demonstration Board - PICDEM 3 Demonstration Board - PICDEM 17 Demonstration Board - KEELOQ® Demonstration Board 6.1 The ability to use MPLAB IDE with multiple debugging tools allows users to easily switch from the costeffective simulator to a full-featured emulator with minimal retraining. 6.2 The MPASM assembler has a command line interface and a Windows shell. It can be used as a stand-alone application on a Windows 3.x or greater system, or it can be used through MPLAB IDE. The MPASM assembler generates relocatable object files for the MPLINK object linker, Intel® standard HEX files, MAP files to detail memory usage and symbol reference, an absolute LST file that contains source lines and generated machine code, and a COD file for debugging. The MPASM assembler features include: The MPLAB IDE software brings an ease of software development previously unseen in the 8-bit microcontroller market. The MPLAB IDE is a Windows®-based application that contains: 2000-2013 Microchip Technology Inc. MPASM Assembler The MPASM assembler is a full-featured universal macro assembler for all PIC MCU’s. MPLAB Integrated Development Environment Software • An interface to debugging tools - simulator - programmer (sold separately) - emulator (sold separately) - in-circuit debugger (sold separately) • A full-featured editor • A project manager • Customizable toolbar and key mapping • A status bar • On-line help • Edit your source files (either assembly or ‘C’) • One touch assemble (or compile) and download to PIC emulator and simulator tools (automatically updates all project information) • Debug using: - source files - absolute listing file - machine code • Integration into MPLAB IDE projects. • User-defined macros to streamline assembly code. • Conditional assembly for multi-purpose source files. • Directives that allow complete control over the assembly process. 6.3 MPLAB C17 and MPLAB C18 C Compilers The MPLAB C17 and MPLAB C18 Code Development Systems are complete ANSI ‘C’ compilers for Microchip’s PIC17CXXX and PIC18CXXX family of microcontrollers, respectively. These compilers provide powerful integration capabilities and ease of use not found with other compilers. For easier source level debugging, the compilers provide symbol information that is compatible with the MPLAB IDE memory display. Preliminary DS40035D-page 43 HCS473 6.4 MPLINK Object Linker/ MPLIB Object Librarian 6.6 The MPLINK object linker combines relocatable objects created by the MPASM assembler and the MPLAB C17 and MPLAB C18 C compilers. It can also link relocatable objects from pre-compiled libraries, using directives from a linker script. The MPLIB object librarian is a librarian for precompiled code to be used with the MPLINK object linker. When a routine from a library is called from another source file, only the modules that contain that routine will be linked in with the application. This allows large libraries to be used efficiently in many different applications. The MPLIB object librarian manages the creation and modification of library files. The MPLINK object linker features include: • Integration with MPASM assembler and MPLAB C17 and MPLAB C18 C compilers. • Allows all memory areas to be defined as sections to provide link-time flexibility. The MPLIB object librarian features include: • Easier linking because single libraries can be included instead of many smaller files. • Helps keep code maintainable by grouping related modules together. • Allows libraries to be created and modules to be added, listed, replaced, deleted or extracted. 6.5 The MPLAB ICE universal in-circuit emulator is intended to provide the product development engineer with a complete microcontroller design tool set for PIC microcontrollers (MCUs). Software control of the MPLAB ICE in-circuit emulator is provided by the MPLAB Integrated Development Environment (IDE), which allows editing, building, downloading and source debugging from a single environment. The MPLAB ICE 2000 is a full-featured emulator system with enhanced trace, trigger and data monitoring features. Interchangeable processor modules allow the system to be easily reconfigured for emulation of different processors. The universal architecture of the MPLAB ICE in-circuit emulator allows expansion to support new PIC microcontrollers. The MPLAB ICE in-circuit emulator system has been designed as a real-time emulation system, with advanced features that are generally found on more expensive development tools. The PC platform and Microsoft® Windows environment were chosen to best make these features available to you, the end user. 6.7 MPLAB SIM Software Simulator The MPLAB SIM software simulator allows code development in a PC-hosted environment by simulating the PIC series microcontrollers on an instruction level. On any given instruction, the data areas can be examined or modified and stimuli can be applied from a file, or user-defined key press, to any of the pins. The execution can be performed in single step, execute until break, or Trace mode. MPLAB ICE High Performance Universal In-Circuit Emulator with MPLAB IDE ICEPIC In-Circuit Emulator The ICEPIC low cost, in-circuit emulator is a solution for the Microchip Technology PIC16C5X, PIC16C6X, PIC16C7X and PIC16CXXX families of 8-bit OneTime-Programmable (OTP) microcontrollers. The modular system can support different subsets of PIC16C5X or PIC16CXXX products through the use of interchangeable personality modules, or daughter boards. The emulator is capable of emulating without target application circuitry being present. The MPLAB SIM simulator fully supports symbolic debugging using the MPLAB C17 and the MPLAB C18 C compilers and the MPASM assembler. The software simulator offers the flexibility to develop and debug code outside of the laboratory environment, making it an excellent multiproject software development tool. DS40035D-page 44 Preliminary 2000-2013 Microchip Technology Inc. HCS473 6.8 MPLAB ICD In-Circuit Debugger Microchip's In-Circuit Debugger, MPLAB ICD, is a powerful, low cost, run-time development tool. This tool is based on the FLASH PIC MCUs and can be used to develop for this and other PIC microcontrollers. The MPLAB ICD utilizes the in-circuit debugging capability built into the FLASH devices. This feature, along with Microchip's In-Circuit Serial ProgrammingTM protocol, offers cost-effective in-circuit FLASH debugging from the graphical user interface of the MPLAB Integrated Development Environment. This enables a designer to develop and debug source code by watching variables, single-stepping and setting break points. Running at full speed enables testing hardware in real-time. 6.9 PRO MATE II Universal Device Programmer The PRO MATE II universal device programmer is a full-featured programmer, capable of operating in Stand-alone mode, as well as PC-hosted mode. The PRO MATE II device programmer is CE compliant. The PRO MATE II device programmer has programmable VDD and VPP supplies, which allow it to verify programmed memory at VDD min and VDD max for maximum reliability. It has an LCD display for instructions and error messages, keys to enter commands and a modular detachable socket assembly to support various package types. In Stand-alone mode, the PRO MATE II device programmer can read, verify, or program PIC devices. It can also set code protection in this mode. 6.10 PICSTART Plus Entry Level Development Programmer The PICSTART Plus development programmer is an easy-to-use, low cost, prototype programmer. It connects to the PC via a COM (RS-232) port. MPLAB Integrated Development Environment software makes using the programmer simple and efficient. The PICSTART Plus development programmer supports all PIC devices with up to 40 pins. Larger pin count devices, such as the PIC16C92X and PIC17C76X, may be supported with an adapter socket. The PICSTART Plus development programmer is CE compliant. 2000-2013 Microchip Technology Inc. 6.11 PICDEM 1 Low Cost PIC MCU Demonstration Board The PICDEM 1 demonstration board is a simple board which demonstrates the capabilities of several of Microchip’s microcontrollers. The microcontrollers supported are: PIC16C5X (PIC16C54 to PIC16C58A), PIC16C61, PIC16C62X, PIC16C71, PIC16C8X, PIC17C42, PIC17C43 and PIC17C44. All necessary hardware and software is included to run basic demo programs. The user can program the sample microcontrollers provided with the PICDEM 1 demonstration board on a PRO MATE II device programmer, or a PICSTART Plus development programmer, and easily test firmware. The user can also connect the PICDEM 1 demonstration board to the MPLAB ICE incircuit emulator and download the firmware to the emulator for testing. A prototype area is available for the user to build some additional hardware and connect it to the microcontroller socket(s). Some of the features include an RS-232 interface, a potentiometer for simulated analog input, push button switches and eight LEDs connected to PORTB. 6.12 PICDEM 2 Low Cost PIC16CXX Demonstration Board The PICDEM 2 demonstration board is a simple demonstration board that supports the PIC16C62, PIC16C64, PIC16C65, PIC16C73 and PIC16C74 microcontrollers. All the necessary hardware and software is included to run the basic demonstration programs. The user can program the sample microcontrollers provided with the PICDEM 2 demonstration board on a PRO MATE II device programmer, or a PICSTART Plus development programmer, and easily test firmware. The MPLAB ICE in-circuit emulator may also be used with the PICDEM 2 demonstration board to test firmware. A prototype area has been provided to the user for adding additional hardware and connecting it to the microcontroller socket(s). Some of the features include a RS-232 interface, push button switches, a potentiometer for simulated analog input, a serial EEPROM to demonstrate usage of the I2CTM bus and separate headers for connection to an LCD module and a keypad. Preliminary DS40035D-page 45 HCS473 6.13 PICDEM 3 Low Cost PIC16CXXX Demonstration Board The PICDEM 3 demonstration board is a simple demonstration board that supports the PIC16C923 and PIC16C924 in the PLCC package. It will also support future 44-pin PLCC microcontrollers with an LCD Module. All the necessary hardware and software is included to run the basic demonstration programs. The user can program the sample microcontrollers provided with the PICDEM 3 demonstration board on a PRO MATE II device programmer, or a PICSTART Plus development programmer with an adapter socket, and easily test firmware. The MPLAB ICE in-circuit emulator may also be used with the PICDEM 3 demonstration board to test firmware. A prototype area has been provided to the user for adding hardware and connecting it to the microcontroller socket(s). Some of the features include a RS-232 interface, push button switches, a potentiometer for simulated analog input, a thermistor and separate headers for connection to an external LCD module and a keypad. Also provided on the PICDEM 3 demonstration board is a LCD panel, with 4 commons and 12 segments, that is capable of displaying time, temperature and day of the week. The PICDEM 3 demonstration board provides an additional RS-232 interface and Windows software for showing the demultiplexed LCD signals on a PC. A simple serial interface allows the user to construct a hardware demultiplexer for the LCD signals. DS40035D-page 46 6.14 PICDEM 17 Demonstration Board The PICDEM 17 demonstration board is an evaluation board that demonstrates the capabilities of several Microchip microcontrollers, including PIC17C752, PIC17C756A, PIC17C762 and PIC17C766. All necessary hardware is included to run basic demo programs, which are supplied on a 3.5-inch disk. A programmed sample is included and the user may erase it and program it with the other sample programs using the PRO MATE II device programmer, or the PICSTART Plus development programmer, and easily debug and test the sample code. In addition, the PICDEM 17 demonstration board supports downloading of programs to and executing out of external FLASH memory on board. The PICDEM 17 demonstration board is also usable with the MPLAB ICE in-circuit emulator, or the PICMASTER emulator and all of the sample programs can be run and modified using either emulator. Additionally, a generous prototype area is available for user hardware. 6.15 KEELOQ Evaluation and Programming Tools KEELOQ evaluation and programming tools support Microchip’s HCS Secure Data Products. The HCS evaluation kit includes a LCD display to show changing codes, a decoder to decode transmissions and a programming interface to program test transmitters. Preliminary 2000-2013 Microchip Technology Inc. Software Tools Programmers Debugger Emulators PIC12CXXX PIC14000 PIC16C5X PIC16C6X PIC16CXXX PIC16F62X PIC16C7X PIC16C7XX PIC16C8X PIC16F8XX PIC16C9XX 2000-2013 Microchip Technology Inc. Preliminary ** † † MCP2510 * Contact the Microchip Technology Inc. web site at www.microchip.com for information on how to use the MPLAB® ICD In-Circuit Debugger (DV164001) with PIC16C62, 63, 64, 65, 72, 73, 74, 76, 77. ** Contact Microchip Technology Inc. for availability date. † Development tool is available on select devices. MCP2510 CAN Developer’s Kit 13.56 MHz Anticollision microIDTM Developer’s Kit 125 kHz Anticollision microIDTM Developer’s Kit 125 kHz microIDTM Developer’s Kit MCRFXXX microIDTM Programmer’s Kit † * ** ** PIC18FXXX 24CXX/ 25CXX/ 93CXX KEELOQ® Transponder Kit HCSXXX KEELOQ® Evaluation Kit PICDEMTM 17 Demonstration Board PICDEMTM 14A Demonstration Board PICDEMTM 3 Demonstration Board PICDEMTM 2 Demonstration Board PICDEMTM 1 Demonstration Board PRO MATE® II Universal Device Programmer PICSTART® Plus Entry Level Development Programmer * ICEPICTM In-Circuit Emulator MPLAB® ICD In-Circuit Debugger MPLAB® ICE In-Circuit Emulator PIC17C4X PIC17C7XX MPASMTM Assembler/ MPLINKTM Object Linker PIC18CXX2 MPLAB® C18 C Compiler MPLAB® C17 C Compiler TABLE 6-1: Demo Boards and Eval Kits MPLAB® Integrated Development Environment HCS473 DEVELOPMENT TOOLS FROM MICROCHIP DS40035D-page 47 HCS473 NOTES: DS40035D-page 48 Preliminary 2000-2013 Microchip Technology Inc. HCS473 7.0 ELECTRICAL CHARACTERISTICS 7.1 Absolute Maximum Ratings † Ambient temperature under bias.......................................................................................................... -40°C to +125°C Storage temperature ........................................................................................................................... -65°C to +150°C Voltage on VDD w/respect to VSS .......................................................................................................... -0.3V to +7.5V Voltage on LED w/respect to VSS .............................................................................................................-0.3V to +11V Voltage on all other pins w/respect to VSS .......................................................................................-0.3V to VDD+0.3V Total power dissipation(1) .................................................................................................................................. 500 mW Maximum current out of VSS pin ........................................................................................................................ 100 mA Maximum current into VDD pin ........................................................................................................................... 100 mA Input clamp current, IIK (VI < 0 or VI > VDD) ....................................................................................................... ±20 mA Output clamp current, IOK (Vo < 0 or Vo >VDD).................................................................................................. ±20 mA Maximum output current sunk by any Output pin................................................................................................. 25 mA Maximum output current sourced by any Output pin ........................................................................................... 25 mA Note 1: Power dissipation is calculated as follows: PDIS=VDD x {IDD - Â IOH} + Â {(VDD-VOH) x IOH} + Â(VOl x IOL). † NOTICE: Stresses above those listed under “Absolute Maximum Ratings” may cause permanent damage to the device. This is a stress rating only and functional operation of the device at those or any other conditions above those indicated in the operation listings of this specification is not implied. Exposure to maximum rating conditions for extended periods may affect device reliability. 2000-2013 Microchip Technology Inc. Preliminary DS40035D-page 49 HCS473 TABLE 7-1: DC CHARACTERISTICS: HCS473 DC Characteristics All pins except power supply pins Param No. D001 Sym VDD Characteristic Supply Voltage Standard Operating Conditions (unless otherwise stated) Operating Temperature 0C TA +70C (Commercial) -20C TA +85C (Industrial) Min Typ† Max Units 2.05(2) — 5.5 V Conditions D003 VPOR VDD Start Voltage to ensure internal Power-on Reset signal — VSS — V D004 SVDD VDD Rise Rate to ensure internal Power-on Reset signal 0.05* — — V/ms D005 VBOR Brown-out Reset Voltage — 1.9 2 V — 1.0 5 mA FOSC = 4 MHz, VDD = 5.5V(3) — — 2.0 mA FOSC = 4 MHz, VDD = 3.5V(3) — 0.1 1.0 A VDD = 5.5V — 4.2 8 A VDD = VDDT = 5.5V, no LC signals 3.5 6 A VDD = VDDT = 3.0V, no LC signals 7.5 25 A VDD = VDDT = 3V, Active LC signals IDD Supply Current(2) D010 D010B D021A ISS IDD Shutdown Current Transponder Current D022 D022A VIL Cold RESET Input Low Voltage Input Pins D030 With TTL Buffer D030A Vss — 0.8 V 4.5V VDD 5.5V Vss — 0.15VD V Otherwise D D031 With Schmitt Trigger Buffer VIH Vss — 0.2VDD V 2.0 (0.25 VDD+0.8) — — VDD VDD V V 0.8 VDD — VDD V — — +250 mV VLOWSEL = 2.2V — — +400 mV VLOWSEL = 3.3V Input Pins — — 1 A Vss VPIN VDD, Pin at Hiimpedance, no pull-downs enabled LED — — 5 A Vss VPIN VDD — — 0.6 V IOL = 8.5 mA, VDD = 4.5V Input High Voltage Input Pins D040 D040A With TTL Buffer D041 With Schmitt Trigger Buffer VTOL D053 IIL D061 VOL D080 Input Leakage Current Output Low Voltage Output Pins VOH Output High Voltage D090 Output Pins D091 LED DS40035D-page 50 4.5V VDD 5.5V Otherwise Input Threshold Voltage VLOW detect tolerance D060 — VDD-0.7 — — V IOH = -3.0 mA, VDD = 4.5V 1.5 — — V IOH = -0.5 mA, VDD = 4.5V Preliminary 2000-2013 Microchip Technology Inc. HCS473 TABLE 7-1: DC CHARACTERISTICS: HCS473 (CONTINUED) Standard Operating Conditions (unless otherwise stated) Operating Temperature 0C TA +70C (Commercial) -20C TA +85C (Industrial) DC Characteristics All pins except power supply pins Param No. Sym RPD D100 Characteristic Min Typ† Max Units Conditions 40 75 100 K If enabled 25C at 5V Internal Pull-down Resistance S0 - S3 Data EEPROM Memory D120 ED Endurance 200K 1000K — E/W D121 VDRW VDD for Read/Write 2.05 — 5.5 V D122 TDEW Erase/Write Cycle Time(1) — 4 10 ms * † These parameters are characterized but not tested. "Typ" column data is at 5.0V, 25°C unless otherwise stated. These parameters are for design guidance only and are not tested. Note 1: The supply current is mainly a function of the operating voltage and frequency. Other factors such as I/O pin loading and switching rate, oscillator type, internal code execution pattern, and temperature also have an impact on the current consumption. 2: Should operate down to VBOR but not tested below 2.0V. 3: The test conditions for all IDD measurements in active Operation mode are: all I/O pins tristated, pulled to VDD. MCLR = VDD; WDT enabled/disabled as specified. The power-down/shutdown current in SLEEP mode does not depend on the oscillator frequency. Power-down current is measured with the part in SLEEP mode, with all I/O pins in hi-impedance state and tied to VDD or VSS. The current is the additional current consumed when the WDT is enabled. This current should be added to the base IDD or IPD measurement. TABLE 7-2: TRANSPONDER CHARACTERISTICS DC Characteristics All pins except power supply pins Standard Operating Conditions (unless otherwise stated) Operating Temperature 0C TA +70C (Commercial) -20C TA +85C (Industrial) 2.05V < VDD < 5.5V Symbol Symbol Min Typ(1) Max Unit 10 — V ILC < 1mA 10 V < VLCC, IDD = 2 mA Vlcc LC input clamp voltage — VDDTV LC induced output voltage — 3.5 — V fC Carrier frequency — 125 — kHz VLCS LC Input Sensitivity — — 15 18 30 35 mVRMS LCCOM Output Voltage — 600 — mV VLCC Note: Conditions VDD = 5.5V VDD = 3.0V ILCCOM = 0 mA These parameters are characterizied but not tested. 2000-2013 Microchip Technology Inc. Preliminary DS40035D-page 51 HCS473 AC CHARACTERISTICS, FOSC = 4 MHz(1) TABLE 7-3: FOSC = 4 MHz(1) The min and max values below are due to HCS473 algorithm tolerances, not variations due to supply voltage and temperature. AC Characteristics Symbol Min Typ Max Description General HCS473 Timing TDB — 10 ms — Debounce Time TQUE — 2s — Que Window TPU — 10.9 ms — Power-up Delay Time (includes button debounce) TPLL — 19 ms — Encoder Mode PLL activation to first code word TLEDON — 100 ms — LED ON Time TLEDOFF — 500 ms — LED OFF Time Communication from Transponder Reader to HCS473 TCMD 1LFTE+100 s — 10.2 ms TTSCMD 1LFTE+100 s — 10.2 ms 100 s 1LFTE — TFINH Delay from Transponder Select ACK to next command Time to leave LF on after last data bit’s rising edge Response from HCS473 to Transponder Reader TSF 1ms+1LFTE 3.5ms+1LFTE 10ms+1LFTE Delay to wake-up Acknowledge sequence 1LFTE+16 s 1LFTE-11 s 1LFTE+30 s 1 LFTE 1LFTE+44 s 1LFTE+11 s Delay from TID pulse rising edge to TID Acknowledge TID = 0 TID > 0 157 s 179 s 212 s — 4 ms 10 ms Delay to Write Acknowledge 67 s 89 s 122 s Delay to anticollision off Acknowledge — 5.64ms — TREAD 205 s 227 s 260 s THOP — 19 ms — TDAMP — 1.2 LFTE — Delay from detecting LC rising edge to first damp pulse TDEMOD — 16.4 ms — Demodulator mode window looking for edge on LC pin 90 180 360 720 100 200 400 800 110 220 440 880 TFILTR — 15 s — TFILTF — 70 s — TTSACK TTPACK TWRT TAOACK TIFF Delay to Transport Code Acknowledge Delay to IFF response - RF or LF response Delay to read response - RF or LF response Delay to hopping code response - RF or LF response Timing Element TE TE RFTE or LFTE RFBSL = LFBSL = 002 RFBSL = LFBSL = 012 RFBSL = LFBSL = 102 RFBSL = LFBSL = 112 Analog delays HCS473 analog LF filter charge time HCS473 analog LF filter discharge time TANTR Hardware design dependent Cumulative LF antenna delay when field is turned on TANTF Hardware design dependent Cumulative LF antenna delay when field is turned off Note 1: FOSC = 4 MHz may be centered at the designer’s choice of supply voltage (VDD) and temperature. 2: LFTE is based on the HCS473’s timing, not the timing of the transponder reader. Therefore LFTE is subject to HCS473 oscillator variation. 3: Response timing accounts for TFILTR but not for TANTR or TANTF, as they are design dependent. The system designer must compensate communication accordingly for TANTR and TANTF. 4: Timing parameters are characterized but not tested. DS40035D-page 52 Preliminary 2000-2013 Microchip Technology Inc. HCS473 TABLE 7-4: AC CHARACTERISTICS, Commercial Temperature Devices Tamb = 0°C to 70°C, 2.05V < VDD < 5.5V FOSC = 4 MHz ±10% AC Characteristics Symbol Min Typ (1) Max Description General HCS473 Timing TDB 9 ms 10 ms 11 ms TQUE 1.8s 2s 2.2s TPU 9.81 ms 10.9 ms 12 ms TPLL 17.1 ms 19 ms 20.9 ms Debounce Time Que Window Power-up Delay Time (includes button debounce) Encoder Mode PLL activation to first code word TLEDON 90 ms 100 ms 110 ms LED ON Time TLEDOFF 450 ms 500 ms 550 ms LED OFF Time Communication from Transponder Reader to HCS473 TCMD 1.1 LFTE+100 s — 9.18 ms TTSCMD 1.1 LFTE+100 s — 9.18 ms 100 s 1 LFTE — TFINH Delay from Transponder Select ACK to next command Time to leave LF on after last data bit’s rising edge Response from HCS473 to Transponder Reader TSF 1 ms+.9 LFTE 3.5 ms+1 LFTE 10 ms+1. 1LFTE Delay to wake-up Acknowledge sequence Delay from TID pulse rising edge to TID acknowledge TID = 0 TID > 0 TTSACK .9 LFTE+14 s .9 LFTE-12 s 1 LFTE+30 s 1 LFTE 1.1 LFTE+49 s 1.1 LFTE+12 s 141 s 179 s 234 s Delay to Transport Code Acknowledge Delay to Write Acknowledge TTPACK — 4 ms 10ms 60 s 89 s 135 s Delay to anticollision off Acknowledge TIFF 5.07 ms 5.64 ms 6.2 ms Delay to IFF response - RF or LF response TREAD 184 s 227 s 286 s Delay to read response - RF or LF response Delay to hopping code response - RF or LF response TWRT TAOACK THOP 17.1 ms 19 ms 20.9 ms TDAMP 1.08 LFTE 1.2 LFTE 1.32 LFTE Delay from detecting LC rising edge to first damp pulse TDEMOD 14.76 ms 16.4 ms 18 ms Demodulator mode window looking for edge on LC pin 90 180 360 720 100 200 400 800 110 220 440 880 TFILTR — 15 s — TFILTF — 70 s — Timing Element TE TE RFTE or LFTE RFBSL = LFBSL = 002 RFBSL = LFBSL = 012 RFBSL = LFBSL = 102 RFBSL = LFBSL = 112 Analog delays HCS473 analog LF filter charge time HCS473 analog LF filter discharge time TANTR Hardware design dependent Cumulative LF antenna delay when field is turned on TANTF Hardware design dependent Cumulative LF antenna delay when field is turned off Note 1: Fosc = 4 MHz. FOSC = 4 MHz may be centered at the designer’s choice of supply voltage (VDD) and temperature. 2: LFTE is based on the HCS473’s timing, not the timing of the transponder reader. Therefore LFTE is subject to HCS473 oscillator variation. 3: Response timing accounts for TFILTR but not for TANTR or TANTF, as they are design dependent. The system designer must compensate communication accordingly for TANTR and TANTF. 4: Timing parameters are characterized but not tested. 2000-2013 Microchip Technology Inc. Preliminary DS40035D-page 53 HCS473 AC CHARACTERISTICS, Industrial Temperature Devices(4) TABLE 7-5: Tamb = -20°C to 85°C, 2.05V < VDD 3.5V unless stated otherwise FOSC = 4 MHz ±10% AC Characteristics Symbol Min Typ(1) Max Description General HCS473 Timing TDB 9 ms 9 ms 10 ms 10 ms 11 ms 12 ms Debounce Time 3.5V < VDD < 5.5V(4) TQUE 1.8s 1.8s 2s 2s 2.2s 2.4s Que Window 3.5V < VDD < 5.5V(4) TPU 9.81 ms 9.81 ms 10.9 ms 10.9 ms 12 ms 13.08 ms Power-up Delay Time (includes button debounce) 3.5V < VDD < 5.5V(4) TPLL 17.1 ms 17.1 ms 19 ms 19 ms 20.9 ms 22.8 ms Encoder Mode PLL activation to first code word 3.5V < VDD < 5.5V(4) TLEDON 90 ms 90 ms 100 ms 100 ms 110 ms 120 ms LED ON Time 3.5V < VDD < 5.5V(4) TLEDOFF 450 ms 450 ms 500 ms 500 ms 550 ms 600 ms LED OFF Time 3.5V < VDD < 5.5V(4) Communication from Transponder Reader to HCS473 TCMD TTSCMD TFINH 1.1 LFTE+100 s 1.2 LFTE+100 s — — 9.18 ms 9.18 ms 3.5V < VDD < 5.5V(4) 1.1 LFTE+100 s 1.2 LFTE+100 s — — 9.18 ms 9.18 ms Delay from Transponder Select ACK to next command 3.5V < VDD < 5.5V(4) 100 s 1LFTE — Time to leave LF on after last data bit’s rising edge Response from HCS473 to Transponder Reader Delay to wake-up ACK(4) 1 ms+.9 LFTE 1 ms+.9 LFTE 3.5 ms+1 LFTE 3.5 ms+1 LFTE 10 ms+1.1 LFTE 10 ms+1.2 LFTE .9 LFTE+14 s .9 LFTE+14 s 1 LFTE+30 s 1 LFTE+30 s 1.1 LFTE+49 s 1.2 LFTE+53 s .9 LFTE-10 s .9 LFTE-10 s 1 LFTE 1 LFTE 141 s 141 s 179 s 179 s 234 s 255 s Delay to Transport Code Acknowledge 3.5V < VDD < 5.5V(4) — 4 ms 10 ms Delay to Write Acknowledge 60 s 60 s 89 s 89 s 135 s 147 s Delay to anticollision off Acknowledge 3.5V < VDD < 5.5V(4) TIFF 5.07 ms 5.07 ms 5.64 ms 5.64 ms 6.2 ms 6.8 ms Delay to IFF response - RF or LF response 3.5V < VDD < 5.5V(4) TREAD 184 s 184 s 227 s 227 s 286 s 312 s Delay to read response - RF or LF response 3.5V < VDD < 5.5V(4) THOP 17.1 ms 17.1 ms 19 ms 19 ms 20.9 ms 22.8 ms Delay to hopping code response - RF or LF response 3.5V < VDD < 5.5V(4) TDAMP 1.08 LFTE 1.08 LFTE 1.2 LFTE 1.2 LFTE 1.32 LFTE 1.44 LFTE Delay from detecting LC rising edge to first damp pulse 3.5V < VDD < 5.5V(4) TDEMOD 14.76 ms 14.76 ms 16.4 ms 16.4 ms 18 ms 19.7 ms Demodulator mode window looking for edge on LC pin 3.5V < VDD < 5.5V(4) 100 200 400 800 110 220 440 880 TSF TTSACK TTPACK TWRT TAOACK Delay from TID pulse rising edge to TID Acknowledge TID = 0 3.5V < VDD < 5.5V(4) 1.1 LFTE+12 s TID > 0 1.2 LFTE+13.2 s 3.5V < VDD < 5.5V(4) Timing Element TE TE 90 180 360 720 DS40035D-page 54 RFTE or LFTE RFBSL = LFBSL = 002 RFBSL = LFBSL = 012 RFBSL = LFBSL = 102 RFBSL = LFBSL = 112 Preliminary 2000-2013 Microchip Technology Inc. HCS473 Analog delays TFILTR — 15 s — TFILTF — 70 s — HCS473 analog LF filter charge time HCS473 analog LF filter discharge time TANTR Hardware design dependent Cumulative LF antenna delay when field is turned on TANTF Hardware design dependent Cumulative LF antenna delay when field is turned off Note 1: Fosc = 4 MHz. FOSC = 4 MHz may be centered at the designer’s choice of supply voltage (VDD) and temperature. 2: LFTE is based on the HCS473’s timing, not the timing of the transponder reader. Therefore LFTE is subject to HCS473 oscillator variation. 3: Response timing accounts for TFILTR but not for TANTR or TANTF, as they are design dependent. The system designer must compensate communication accordingly for TANTR and TANTF. 4: Min and Max values modified for FOSC = 4 MHz + 10%, -20%. Timing parameters are characterized but not tested. Very Important: Refer to Section 3.2.7 for communication requirements when using an Industrial temperature device at 3.5V < VDD < 5.5V. 2000-2013 Microchip Technology Inc. Preliminary DS40035D-page 55 HCS473 NOTES: DS40035D-page 56 Preliminary 2000-2013 Microchip Technology Inc. HCS473 8.0 PACKAGING INFORMATION 8.1 Package Marking Information 14-Lead PDIP (300 mil) Example XXXXXXXXXXXXXX XXXXXXXXXXXXXX HCS473 XXXXXXXXXXXXXX YYWWNNN 9904NNN 14-Lead SOIC (150 mil) Example XXXXXXXXXXX XXXXXXXXXXX YYWWNNN Legend: XX...X Y YY WW NNN e3 * Note: HCS473 XXXXXXXXXXX 9904NNN Customer-specific information Year code (last digit of calendar year) Year code (last 2 digits of calendar year) Week code (week of January 1 is week ‘01’) Alphanumeric traceability code Pb-free JEDEC designator for Matte Tin (Sn) This package is Pb-free. The Pb-free JEDEC designator ( e3 ) can be found on the outer packaging for this package. In the event the full Microchip part number cannot be marked on one line, it will be carried over to the next line, thus limiting the number of available characters for customer-specific information. 2000-2013 Microchip Technology Inc. Preliminary DS40035D-page 57 HCS473 14-Lead Plastic Dual In-line (P) – 300 mil (PDIP) Note: For the most current package drawings, please see the Microchip Packaging Specification located at http://www.microchip.com/packaging E1 D 2 n 1 E A2 A L c A1 B1 eB p B Units Dimension Limits n p MIN INCHES* NOM 14 .100 .155 .130 MAX MILLIMETERS NOM 14 2.54 3.56 3.94 2.92 3.30 0.38 7.62 7.94 6.10 6.35 18.80 19.05 3.18 3.30 0.20 0.29 1.14 1.46 0.36 0.46 7.87 9.40 5 10 5 10 MIN Number of Pins Pitch Top to Seating Plane A .140 .170 Molded Package Thickness A2 .115 .145 Base to Seating Plane .015 A1 Shoulder to Shoulder Width E .300 .313 .325 Molded Package Width E1 .240 .250 .260 Overall Length D .740 .750 .760 Tip to Seating Plane L .125 .130 .135 c Lead Thickness .008 .012 .015 Upper Lead Width B1 .045 .058 .070 Lower Lead Width B .014 .018 .022 Overall Row Spacing § eB .310 .370 .430 Mold Draft Angle Top 5 10 15 Mold Draft Angle Bottom 5 10 15 * Controlling Parameter § Significant Characteristic Notes: Dimensions D and E1 do not include mold flash or protrusions. Mold flash or protrusions shall not exceed .010” (0.254 mm) per side. JEDEC Equivalent: MS-001 Drawing No. C04-005 DS40035D-page 58 Preliminary MAX 4.32 3.68 8.26 6.60 19.30 3.43 0.38 1.78 0.56 10.92 15 15 2000-2013 Microchip Technology Inc. HCS473 14-Lead Plastic Small Outline (SL) – Narrow, 150 mil (SOIC) Note: For the most current package drawings, please see the Microchip Packaging Specification located at http://www.microchip.com/packaging E E1 p D 2 B n 1 h 45 c A2 A A1 L Units Dimension Limits n p Number of Pins Pitch Overall Height Molded Package Thickness Standoff§ Overall Width Molded Package Width Overall Length Chamfer Distance Foot Length Foot Angle Lead Thickness Lead Width Mold Draft Angle Top Mold Draft Angle Bottom * Controlling Parameter § Significant Characteristic A A2 A1 E E1 D h L c B MIN .053 .052 .004 .228 .150 .337 .010 .016 0 .008 .014 0 0 INCHES* NOM 14 .050 .061 .056 .007 .236 .154 .342 .015 .033 4 .009 .017 12 12 MAX .069 .061 .010 .244 .157 .347 .020 .050 8 .010 .020 15 15 MILLIMETERS NOM 14 1.27 1.35 1.55 1.32 1.42 0.10 0.18 5.79 5.99 3.81 3.90 8.56 8.69 0.25 0.38 0.41 0.84 0 4 0.20 0.23 0.36 0.42 0 12 0 12 MIN MAX 1.75 1.55 0.25 6.20 3.99 8.81 0.51 1.27 8 0.25 0.51 15 15 Notes: Dimensions D and E1 do not include mold flash or protrusions. Mold flash or protrusions shall not exceed .010” (0.254 mm) per side. JEDEC Equivalent: MS-012 Drawing No. C04-065 2000-2013 Microchip Technology Inc. Preliminary DS40035D-page 59 HCS473 NOTES: DS40035D-page 60 Preliminary 2000-2013 Microchip Technology Inc. HCS473 INDEX A AC Characteristics .............................................................. 52 Anti-Collision Off ................................................................. 30 Assembler MPASM Assembler ..................................................... 43 C CODE HOPPING COMMAND ('110') ................................. 29 Code Hopping Modulation Format ...................................... 13 Configuration Summary ...................................................... 35 Consecutive Command Considerations.............................. 30 Counter Overflow Bits (OVR1, OVR0) ................................ 18 Cycle Redundancy Check (CRC) ....................................... 18 D MPLAB ICE High Performance Universal In-Circuit Emulator with MPLAB IDE ................................................................. 44 MPLAB Integrated Development Environment Software.... 43 MPLINK Object Linker/MPLIB Object Librarian .................. 44 P Packaging Information ........................................................ 57 Peripherals ........................................................................... 1 PICDEM 1 Low Cost PIC MCU Demonstration Board........ 45 PICDEM 17 Demonstration Board...................................... 46 PICDEM 2 Low Cost PIC16CXX Demonstration Board ..... 45 PICDEM 3 Low Cost PIC16CXXX Demonstration Board ... 46 PICSTART Plus Entry Level Development Programmer.... 45 Present Transport Code ..................................................... 25 PRO MATE II Universal Device Programmer ..................... 45 Product Identification System ............................................. 64 Programming Specification................................................. 37 DATA .................................................................................... 6 DC Characteristics .............................................................. 50 Development Support ......................................................... 43 Device Description ................................................................ 5 Device Operation ................................................................ 11 Discrimination Value (DISC) ............................................... 18 R E S Electrical Characteristics Absolute Maximum Ratings ........................................ 49 Encoder Activation .............................................................. 11 Encoder Interface.................................................................. 7 Encoder Mode Options ....................................................... 14 Encoder Operation ................................................................ 1 Encoder Security................................................................... 1 Errata .................................................................................... 2 S0 ......................................................................................... 6 s3 .......................................................................................... 6 Select Transponder ............................................................ 24 Software Simulator (MPLAB SIM) ...................................... 44 Read Sequence .................................................................. 27 Receive Stability - Calculating Communiction .................... 32 Request Hopping Code Command..................................... 29 RFEN During LF Communication ....................................... 33 T HCS473 Hopping Code ........................................................ 4 HCS473 Security .................................................................. 4 HCS473 Transponder Start Sequence ............................... 22 Transmitted Code Word...................................................... 11 Transponder Characteristics............................................... 51 Transponder Commands .................................................... 23 Transponder Communication ............................................. 21 Transponder Interface .......................................................... 8 Transponder Mode ............................................................. 18 Transponder Operation......................................................... 1 Transponder Options .......................................................... 19 Transponder Security ........................................................... 1 Typical Applications .............................................................. 1 I W ICEPIC In-Circuit Emulator ................................................. 44 IFF Challenge and Response ............................................. 26 Integrating the HCS473 Into A System ............................... 39 Internal RC Oscillator ............................................................ 9 Wake-Up Logic ..................................................................... 7 WWW, On-Line Support ....................................................... 2 G General Description .............................................................. 3 H K KEELOQ Evaluation and Programming Tools .................... 46 Key Terms............................................................................. 3 L lccom..................................................................................... 7 LED ....................................................................................... 7 LED Operation .................................................................... 17 LF Communication Analog Delays...................................... 30 LF Response Considerations.............................................. 30 Low Voltage Detector............................................................ 9 Low-End System Security Risks ........................................... 4 M MPLAB C17 and MPLAB C18 C Compilers........................ 43 MPLAB ICD In-Circuit Debugger ........................................ 45 2000-2013 Microchip Technology Inc. Preliminary DS40035D-page 61 HCS473 DS40035D-page 62 Preliminary 2000-2013 Microchip Technology Inc. THE MICROCHIP WEB SITE CUSTOMER SUPPORT Microchip provides online support via our WWW site at www.microchip.com. This web site is used as a means to make files and information easily available to customers. Accessible by using your favorite Internet browser, the web site contains the following information: Users of Microchip products can receive assistance through several channels: • Product Support – Data sheets and errata, application notes and sample programs, design resources, user’s guides and hardware support documents, latest software releases and archived software • General Technical Support – Frequently Asked Questions (FAQ), technical support requests, online discussion groups, Microchip consultant program member listing • Business of Microchip – Product selector and ordering guides, latest Microchip press releases, listing of seminars and events, listings of Microchip sales offices, distributors and factory representatives • • • • Distributor or Representative Local Sales Office Field Application Engineer (FAE) Technical Support Customers should contact their distributor, representative or field application engineer (FAE) for support. Local sales offices are also available to help customers. A listing of sales offices and locations is included in the back of this document. Technical support is available through the web site at: http://microchip.com/support CUSTOMER CHANGE NOTIFICATION SERVICE Microchip’s customer notification service helps keep customers current on Microchip products. Subscribers will receive e-mail notification whenever there are changes, updates, revisions or errata related to a specified product family or development tool of interest. To register, access the Microchip web site at www.microchip.com. Under “Support”, click on “Customer Change Notification” and follow the registration instructions. 2000-2013 Microchip Technology Inc. Preliminary DS40035D-page 63 READER RESPONSE It is our intention to provide you with the best documentation possible to ensure successful use of your Microchip product. If you wish to provide your comments on organization, clarity, subject matter, and ways in which our documentation can better serve you, please FAX your comments to the Technical Publications Manager at (480) 792-4150. Please list the following information, and use this outline to provide us with your comments about this document. TO: Technical Publications Manager RE: Reader Response Total Pages Sent ________ From: Name Company Address City / State / ZIP / Country Telephone: (_______) _________ - _________ FAX: (______) _________ - _________ Application (optional): Would you like a reply? Y N Literature Number: DS40035D Device: Questions: 1. What are the best features of this document? 2. How does this document meet your hardware and software development needs? 3. Do you find the organization of this document easy to follow? If not, why? 4. What additions to the document do you think would enhance the structure and subject? 5. What deletions from the document could be made without affecting the overall usefulness? 6. Is there any incorrect or misleading information (what and where)? 7. How would you improve this document? DS40035D-page 64 Preliminary 2000-2013 Microchip Technology Inc. HCS473 PRODUCT IDENTIFICATION SYSTEM To order or obtain information, e.g., on pricing or delivery, refer to the factory or the listed sales office. PART NO. Device X Temperature Range /XX XXX Package Pattern Device HCS473 Temperature Range I Package P SL Pattern QTP, SQTP, ROM Code (factory specified) or Special Requirements . Blank for OTP and Windowed devices. = = Examples: a) To be supplied. 0C to +70C -20C to +85C = = PDIP SOIC * JW Devices are UV erasable and can be programmed to any device configuration. JW Devices meet the electrical requirement of each oscillator type. Sales and Support Data Sheets Products supported by a preliminary Data Sheet may have an errata sheet describing minor operational differences and recommended workarounds. To determine if an errata sheet exists for a particular device, please contact one of the following: 1. 2. Your local Microchip sales office The Microchip Worldwide Site (www.microchip.com) DS40035D-page 65 Preliminary 2000-2013 Microchip Technology Inc. HCS473 NOTES: 2000-2013 Microchip Technology Inc. Preliminary DS40035D-page 66 Note the following details of the code protection feature on Microchip devices: • Microchip products meet the specification contained in their particular Microchip Data Sheet. • Microchip believes that its family of products is one of the most secure families of its kind on the market today, when used in the intended manner and under normal conditions. • There are dishonest and possibly illegal methods used to breach the code protection feature. All of these methods, to our knowledge, require using the Microchip products in a manner outside the operating specifications contained in Microchip’s Data Sheets. Most likely, the person doing so is engaged in theft of intellectual property. • Microchip is willing to work with the customer who is concerned about the integrity of their code. • Neither Microchip nor any other semiconductor manufacturer can guarantee the security of their code. Code protection does not mean that we are guaranteeing the product as “unbreakable.” Code protection is constantly evolving. We at Microchip are committed to continuously improving the code protection features of our products. Attempts to break Microchip’s code protection feature may be a violation of the Digital Millennium Copyright Act. If such acts allow unauthorized access to your software or other copyrighted work, you may have a right to sue for relief under that Act. Information contained in this publication regarding device applications and the like is provided only for your convenience and may be superseded by updates. It is your responsibility to ensure that your application meets with your specifications. MICROCHIP MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND WHETHER EXPRESS OR IMPLIED, WRITTEN OR ORAL, STATUTORY OR OTHERWISE, RELATED TO THE INFORMATION, INCLUDING BUT NOT LIMITED TO ITS CONDITION, QUALITY, PERFORMANCE, MERCHANTABILITY OR FITNESS FOR PURPOSE. Microchip disclaims all liability arising from this information and its use. Use of Microchip devices in life support and/or safety applications is entirely at the buyer’s risk, and the buyer agrees to defend, indemnify and hold harmless Microchip from any and all damages, claims, suits, or expenses resulting from such use. No licenses are conveyed, implicitly or otherwise, under any Microchip intellectual property rights. Trademarks The Microchip name and logo, the Microchip logo, dsPIC, FlashFlex, KEELOQ, KEELOQ logo, MPLAB, PIC, PICmicro, PICSTART, PIC32 logo, rfPIC, SST, SST Logo, SuperFlash and UNI/O are registered trademarks of Microchip Technology Incorporated in the U.S.A. and other countries. FilterLab, Hampshire, HI-TECH C, Linear Active Thermistor, MTP, SEEVAL and The Embedded Control Solutions Company are registered trademarks of Microchip Technology Incorporated in the U.S.A. Silicon Storage Technology is a registered trademark of Microchip Technology Inc. in other countries. Analog-for-the-Digital Age, Application Maestro, BodyCom, chipKIT, chipKIT logo, CodeGuard, dsPICDEM, dsPICDEM.net, dsPICworks, dsSPEAK, ECAN, ECONOMONITOR, FanSense, HI-TIDE, In-Circuit Serial Programming, ICSP, Mindi, MiWi, MPASM, MPF, MPLAB Certified logo, MPLIB, MPLINK, mTouch, Omniscient Code Generation, PICC, PICC-18, PICDEM, PICDEM.net, PICkit, PICtail, REAL ICE, rfLAB, Select Mode, SQI, Serial Quad I/O, Total Endurance, TSHARC, UniWinDriver, WiperLock, ZENA and Z-Scale are trademarks of Microchip Technology Incorporated in the U.S.A. and other countries. SQTP is a service mark of Microchip Technology Incorporated in the U.S.A. GestIC and ULPP are registered trademarks of Microchip Technology Germany II GmbH & Co. & KG, a subsidiary of Microchip Technology Inc., in other countries. All other trademarks mentioned herein are property of their respective companies. © 2000-2013, Microchip Technology Incorporated, Printed in the U.S.A., All Rights Reserved. Printed on recycled paper. ISBN: 9781620769744 QUALITY MANAGEMENT SYSTEM CERTIFIED BY DNV == ISO/TS 16949 == 2000-2013 Microchip Technology Inc. Microchip received ISO/TS-16949:2009 certification for its worldwide headquarters, design and wafer fabrication facilities in Chandler and Tempe, Arizona; Gresham, Oregon and design centers in California and India. The Company’s quality system processes and procedures are for its PIC® MCUs and dsPIC® DSCs, KEELOQ® code hopping devices, Serial EEPROMs, microperipherals, nonvolatile memory and analog products. In addition, Microchip’s quality system for the design and manufacture of development systems is ISO 9001:2000 certified. Preliminary DS40035D-page 67 Worldwide Sales and Service AMERICAS ASIA/PACIFIC ASIA/PACIFIC EUROPE Corporate Office 2355 West Chandler Blvd. Chandler, AZ 85224-6199 Tel: 480-792-7200 Fax: 480-792-7277 Technical Support: http://www.microchip.com/ support Web Address: www.microchip.com Asia Pacific Office Suites 3707-14, 37th Floor Tower 6, The Gateway Harbour City, Kowloon Hong Kong Tel: 852-2401-1200 Fax: 852-2401-3431 India - Bangalore Tel: 91-80-3090-4444 Fax: 91-80-3090-4123 India - New Delhi Tel: 91-11-4160-8631 Fax: 91-11-4160-8632 Austria - Wels Tel: 43-7242-2244-39 Fax: 43-7242-2244-393 Denmark - Copenhagen Tel: 45-4450-2828 Fax: 45-4485-2829 India - Pune Tel: 91-20-2566-1512 Fax: 91-20-2566-1513 France - Paris Tel: 33-1-69-53-63-20 Fax: 33-1-69-30-90-79 Japan - Osaka Tel: 81-6-6152-7160 Fax: 81-6-6152-9310 Germany - Munich Tel: 49-89-627-144-0 Fax: 49-89-627-144-44 Atlanta Duluth, GA Tel: 678-957-9614 Fax: 678-957-1455 Boston Westborough, MA Tel: 774-760-0087 Fax: 774-760-0088 Chicago Itasca, IL Tel: 630-285-0071 Fax: 630-285-0075 Cleveland Independence, OH Tel: 216-447-0464 Fax: 216-447-0643 Dallas Addison, TX Tel: 972-818-7423 Fax: 972-818-2924 Detroit Farmington Hills, MI Tel: 248-538-2250 Fax: 248-538-2260 Indianapolis Noblesville, IN Tel: 317-773-8323 Fax: 317-773-5453 Los Angeles Mission Viejo, CA Tel: 949-462-9523 Fax: 949-462-9608 Santa Clara Santa Clara, CA Tel: 408-961-6444 Fax: 408-961-6445 Toronto Mississauga, Ontario, Canada Tel: 905-673-0699 Fax: 905-673-6509 Australia - Sydney Tel: 61-2-9868-6733 Fax: 61-2-9868-6755 China - Beijing Tel: 86-10-8569-7000 Fax: 86-10-8528-2104 Netherlands - Drunen Tel: 31-416-690399 Fax: 31-416-690340 Korea - Daegu Tel: 82-53-744-4301 Fax: 82-53-744-4302 China - Chongqing Tel: 86-23-8980-9588 Fax: 86-23-8980-9500 Spain - Madrid Tel: 34-91-708-08-90 Fax: 34-91-708-08-91 China - Hangzhou Tel: 86-571-2819-3187 Fax: 86-571-2819-3189 Korea - Seoul Tel: 82-2-554-7200 Fax: 82-2-558-5932 or 82-2-558-5934 China - Hong Kong SAR Tel: 852-2943-5100 Fax: 852-2401-3431 Malaysia - Kuala Lumpur Tel: 60-3-6201-9857 Fax: 60-3-6201-9859 China - Nanjing Tel: 86-25-8473-2460 Fax: 86-25-8473-2470 Malaysia - Penang Tel: 60-4-227-8870 Fax: 60-4-227-4068 China - Qingdao Tel: 86-532-8502-7355 Fax: 86-532-8502-7205 Philippines - Manila Tel: 63-2-634-9065 Fax: 63-2-634-9069 China - Shanghai Tel: 86-21-5407-5533 Fax: 86-21-5407-5066 Singapore Tel: 65-6334-8870 Fax: 65-6334-8850 China - Shenyang Tel: 86-24-2334-2829 Fax: 86-24-2334-2393 Taiwan - Hsin Chu Tel: 886-3-5778-366 Fax: 886-3-5770-955 China - Shenzhen Tel: 86-755-8864-2200 Fax: 86-755-8203-1760 Taiwan - Kaohsiung Tel: 886-7-213-7828 Fax: 886-7-330-9305 China - Wuhan Tel: 86-27-5980-5300 Fax: 86-27-5980-5118 Taiwan - Taipei Tel: 886-2-2508-8600 Fax: 886-2-2508-0102 China - Xian Tel: 86-29-8833-7252 Fax: 86-29-8833-7256 Thailand - Bangkok Tel: 66-2-694-1351 Fax: 66-2-694-1350 UK - Wokingham Tel: 44-118-921-5869 Fax: 44-118-921-5820 China - Xiamen Tel: 86-592-2388138 Fax: 86-592-2388130 China - Zhuhai Tel: 86-756-3210040 Fax: 86-756-3210049 DS40035D-page 68 Italy - Milan Tel: 39-0331-742611 Fax: 39-0331-466781 Japan - Tokyo Tel: 81-3-6880- 3770 Fax: 81-3-6880-3771 China - Chengdu Tel: 86-28-8665-5511 Fax: 86-28-8665-7889 11/29/12 Preliminary 2000-2013 Microchip Technology Inc.