HCS362 KEELOQ® Code Hopping Encoder FEATURES PACKAGE TYPES Security PDIP, SOIC S0 1 S1 2 S2 3 S3/RFEN 4 TSSOP Operation • • • • • • 2.0V – 6.3V operation Four button inputs 15 functions available Selectable baud rates and code word blanking Programmable minimum code word completion Battery low signal transmitted to receiver with programmable threshold • Non-volatile synchronization data • PWM and Manchester modulation S2 S3/RFEN VSS DATA • • • • LED 7 LED/SHIFT 6 DATA 5 VSS S1 S0 VDD LED/SHIFT Power Latching and Switching Controller LED Driver RFEN PLL Driver EEPROM RF Enable output – PLL interface Easy to use programming interface On-chip EEPROM On-chip tunable oscillator and timing components Button inputs have internal pull-down resistors Current limiting on LED output Minimum component count Encoder DATA 32-bit Shift Register VSS SHIFT Button Input Port VDD S3 S2 S1 S0 Typical Applications 60-bit seed vs. 32-bit seed 2-bit CRC for error detection 28/32-bit serial number select Tunable oscillator (+/−10% over specified voltage ranges) Time bits option Queue bits TSSOP package Programmable Time-out and Guard Time 2002 Microchip Technology Inc. VDD Oscillator RESET Circuit Enhanced Features Over HCS300 • • • • 8 7 6 5 8 HCS362 BLOCK DIAGRAM Other • • • • • • • 1 2 3 4 HCS362 Programmable 28/32-bit serial number Two programmable 64-bit encryption keys Programmable 60-bit seed Each transmission is unique 69-bit transmission code length 32-bit hopping code 37-bit fixed code (28/32-bit serial number, 4/0-bit function code, 1-bit status, 2-bit CRC/time, 2-bit queue) • Encryption keys are read protected HCS362 • • • • • • • The HCS362 is ideal for Remote Keyless Entry (RKE) applications. These applications include: • • • • • • Automotive RKE systems Automotive alarm systems Automotive immobilizers Gate and garage door openers Identity tokens Burglar alarm systems Preliminary DS40189D-page 1 HCS362 GENERAL DESCRIPTION The HCS362 is a code hopping encoder designed for secure Remote Keyless Entry (RKE) systems. The HCS362 utilizes the KEELOQ® code hopping technology, which incorporates high security, a small package outline and low cost, to make this device a perfect solution for unidirectional remote keyless entry systems and access control systems. The HCS362 combines a 32-bit hopping code generated by a nonlinear encryption algorithm, with a 28/32-bit serial number and 9/5 status bits to create a 69-bit transmission stream. The length of the transmission eliminates the threat of code scanning. The code hopping mechanism makes each transmission unique, thus rendering code capture and resend (code grabbing) schemes useless. The crypt key, serial number and configuration data are stored in an EEPROM array which is not accessible via any external connection. The EEPROM data is programmable but read protected. The data can be verified only after an automatic erase and programming operation. This protects against attempts to gain access to keys or manipulate synchronization values. The HCS362 provides an easy to use serial interface for programming the necessary keys, system parameters and configuration data. 1.0 SYSTEM OVERVIEW Key Terms The following is a list of key terms used throughout this data sheet. For additional information on KEELOQ and Code Hopping, refer to Technical Brief 3 (TB003). • RKE - Remote Keyless Entry • Button Status - Indicates what button input(s) activated the transmission. Encompasses the 4 button status bits S3, S2, S1 and S0 (Figure 3-2). • Code Hopping - A method by which a code, viewed externally to the system, appears to change unpredictably each time it is transmitted. • Code word - A block of data that is repeatedly transmitted upon button activation (Figure 3-2). • Transmission - A data stream consisting of repeating code words (Figure 7-1). • Crypt key - A unique and secret 64-bit number used to encrypt and decrypt data. In a symmetrical block cipher such as the KEELOQ algorithm, the encryption and decryption keys are equal and will therefore be referred to generally as the crypt key. • Encoder - A device that generates and encodes data. • Encryption Algorithm - A recipe whereby data is scrambled using a crypt key. The data can only be interpreted by the respective decryption algorithm using the same crypt key. DS40189D-page 2 • Decoder - A device that decodes data received from an encoder. • Decryption algorithm - A recipe whereby data scrambled by an encryption algorithm can be unscrambled using the same crypt key. • Learn – Learning involves the receiver calculating the transmitter’s appropriate crypt key, decrypting the received hopping code and storing the serial number, synchronization counter value and crypt key in EEPROM. The KEELOQ product family facilitates several learning strategies to be implemented on the decoder. The following are examples of what can be done. - Simple Learning The receiver uses a fixed crypt key, common to all components of all systems by the same manufacturer, to decrypt the received code word’s encrypted portion. - Normal Learning The receiver uses information transmitted during normal operation to derive the crypt key and decrypt the received code word’s encrypted portion. - Secure Learn The transmitter is activated through a special button combination to transmit a stored 60-bit seed value used to generate the transmitter’s crypt key. The receiver uses this seed value to derive the same crypt key and decrypt the received code word’s encrypted portion. • Manufacturer’s code – A unique and secret 64bit number used to generate unique encoder crypt keys. Each encoder is programmed with a crypt key that is a function of the manufacturer’s code. Each decoder is programmed with the manufacturer code itself. The HCS362 code hopping encoder is designed specifically for keyless entry systems; primarily vehicles and home garage door openers. The encoder portion of a keyless entry system is integrated into a transmitter, carried by the user and operated to gain access to a vehicle or restricted area. The HCS362 is meant to be a cost-effective yet secure solution to such systems, requiring very few external components (Figure 2-1). Most low-end keyless entry transmitters are given a fixed identification code that is transmitted every time a button is pushed. The number of unique identification codes in a low-end system is usually a relatively small number. These shortcomings provide an opportunity for a sophisticated thief to create a device that ‘grabs’ a transmission and retransmits it later, or a device that quickly ‘scans’ all possible identification codes until the correct one is found. The HCS362, on the other hand, employs the KEELOQ code hopping technology coupled with a transmission length of 66 bits to virtually eliminate the use of code ‘grabbing’ or code ‘scanning’. The high security level of Preliminary 2002 Microchip Technology Inc. HCS362 the HCS362 is based on the patented KEELOQ technology. A block cipher based on a block length of 32 bits and a key length of 64 bits is used. The algorithm obscures the information in such a way that even if the transmission information (before coding) differs by only one bit from that of the previous transmission, the next coded transmission will be completely different. Statistically, if only one bit in the 32-bit string of information changes, greater than 50 percent of the coded transmission bits will change. • A crypt key • An initial 16-bit synchronization value • A 16-bit configuration value The crypt key generation typically inputs the transmitter serial number and 64-bit manufacturer’s code into the key generation algorithm (Figure 1-1). The manufacturer’s code is chosen by the system manufacturer and must be carefully controlled as it is a pivotal part of the overall system security. As indicated in the block diagram on page one, the HCS362 has a small EEPROM array which must be loaded with several parameters before use; most often programmed by the manufacturer at the time of production. The most important of these are: • A 28-bit serial number, typically unique for every encoder FIGURE 1-1: CREATION AND STORAGE OF CRYPT KEY DURING PRODUCTION Production Programmer HCS362 Transmitter Serial Number EEPROM Array Serial Number Crypt Key Sync Counter Manufacturer’s Code Key Generation Algorithm Crypt Key The 16-bit synchronization counter is the basis behind the transmitted code word changing for each transmission; it increments each time a button is pressed. Due to the code hopping algorithm’s complexity, each increment of the synchronization value results in greater than 50% of the bits changing in the transmitted code word. Figure 1-2 shows how the key values in EEPROM are used in the encoder. Once the encoder detects a button press, it reads the button inputs and updates the synchronization counter. The synchronization counter and crypt key are input to the encryption algorithm and the output is 32 bits of encrypted information. This data will change with every button press, its value appearing externally to ‘randomly hop around’, hence it is referred to as the hopping portion of the code word. The 32-bit hopping code is combined with the button information and serial number to form the code word transmitted to the receiver. The code word format is explained in greater detail in Section 3.1. . . . A transmitter must first be ‘learned’ by the receiver before its use is allowed in the system. Learning includes calculating the transmitter’s appropriate crypt key, decrypting the received hopping code and storing the serial number, synchronization counter value and crypt key in EEPROM. In normal operation, each received message of valid format is evaluated. The serial number is used to determine if it is from a learned transmitter. If from a learned transmitter, the message is decrypted and the synchronization counter is verified. Finally, the button status is checked to see what operation is requested. Figure 1-3 shows the relationship between some of the values stored by the receiver and the values received from the transmitter. A receiver may use any type of controller as a decoder, but it is typically a microcontroller with compatible firmware that allows the decoder to operate in conjunction with an HCS362 based transmitter. Section 6.0 provides detail on integrating the HCS362 into a system. 2002 Microchip Technology Inc. Preliminary DS40189D-page 3 HCS362 FIGURE 1-2: BUILDING THE TRANSMITTED CODE WORD (ENCODER) EEPROM Array KEELOQ Encryption Algorithm Crypt Key Sync Counter Serial Number Button Press Information Serial Number 32 Bits Encrypted Data Transmitted Information FIGURE 1-3: BASIC OPERATION OF RECEIVER (DECODER) 1 Received Information EEPROM Array Button Press Information Serial Number 2 32 Bits of Encrypted Data Manufacturer Code Check for Match Serial Number Sync Counter Crypt Key 3 KEELOQ Decryption Algorithm Decrypted Synchronization Counter 4 Check for Match Perform Function 5 Indicated by button press NOTE: Circled numbers indicate the order of execution. DS40189D-page 4 Preliminary 2002 Microchip Technology Inc. HCS362 2.0 DEVICE DESCRIPTION FIGURE 2-1: As shown in the typical application circuits (Figure 2-1), the HCS362 is a simple device to use. It requires only the addition of buttons and RF circuitry for use as the transmitter in your security application. See Table 2-1 for a description of each pin and Figure 2-1 for typical circuits. Figure 2-2 shows the device I/O circuits. TABLE 2-1: Pin Number S0 1 Switch input 0 S1 2 Switch input 1 S2 3 Switch input 2 / Clock pin when in Programming mode S3/ RFEN 4 Switch input 3 / RF enable output VSS DATA 5 6 LED/ SHIFT 7 VDD 8 VDD B0 S0 B1 S1 LED S2 DATA S3 VSS PIN DESCRIPTIONS Name Description TYPICAL CIRCUITS VDD Tx out a) Two button remote control VDD Ground reference connection Data output pin / DATA I/O pin for Programming mode Cathode connection for LED and DUAL mode SHIFT input Positive supply voltage B0 S0 B1 S1 LED B2 S2 DATA B3 S3 VSS VDD Tx out b) Four button remote control with PLL output (Note) Note: Up to 15 functions can be implemented by pressing more than one button simultaneously or by using a suitable diode array. VDD B3 B2 B1 B0 S0 VDD S1 LED S2 DATA RFEN Tx out VSS PLL control c) Four button remote control with RF Enable VDD B3 B2 B1 B0 S0 VDD S1 LED/SHIFT S2 DATA S3 VSS Tx out 1 KW SHIFT d) DUAL key, four buttons remote control 2002 Microchip Technology Inc. Preliminary DS40189D-page 5 HCS362 FIGURE 2-2: I/O CIRCUITS 2.1 Architectural Overview 2.1.1 S0, S1, S2 Inputs The HCS362 has an onboard non-volatile EEPROM, which is used to store user programmable data. The data can be programmed at the time of production and include the security-related information such as encoder keys, serial numbers, discrimination and seed values. All the security related options are read protected. The HCS362 has built in protection against counter corruption. Before every EEPROM write, the internal circuitry also ensures that the high voltage required to write to the EEPROM is at an acceptable level. ESD RS VDD RFEN PFET ONBOARD EEPROM 2.1.2 INTERNAL RC OSCILLATOR The HCS362 has an onboard RC oscillator that controls all the logic output timing characteristics. The oscillator frequency varies within ±10% of the nominal value (once calibrated over a voltage range of 2V – 3.5V or 3.5V – 6.3V). All the timing values specified in this document are subject to the oscillator variation. S3 Input/ RFEN Output ESD RS FIGURE 2-3: VDD PFET 1.10 TE 1.08 1.06 1.04 1.02 Typical TE 1.00 0.98 0.96 0.94 TE 0.92 0.90 -50-40 -30-20-10 0 10 20 30 40 50 6070 80 90 DATA NFET DATA I/O ESD RDATA Temperature °C Note: LED output SHIFT ESD RL RH LEDL DS40189D-page 6 LEDH NFET 2.1.3 VDD Legend = 2.0V = 3.0V = 6.0V Values are for calibrated oscillator LOW VOLTAGE DETECTOR A low battery voltage detector onboard the HCS362 can indicate when the operating voltage drops below a predetermined value. There are eight options available depending on the VLOW[0..2] configuration options. The options provided are: 000 - 2.0V 100 - 4.0V SHIFT input NFET HCS362 NORMALIZED TE VS. TEMPERATURE 001 - 2.1V 101 - 4.2V 010 - 2.2V 110 - 4.4V 011 - 2.3V 111 - 4.6V Preliminary 2002 Microchip Technology Inc. HCS362 FIGURE 2-4: HCS362 VLOW DETECTOR (TYPICAL) 2.2 The HCS362 contains two crypt keys (possibly derived from two different Manufacturer’s Codes), but only one Serial Number, one set of Discrimination bits, one 16bit Synchronization Counter and a single 60-bit Seed value. For this reason the HCS362 can be used as an encoder in multiple (two) applications as far as they share the same configuration: transmission format, baud rate, header and guard settings. The SHIFT input pin (multiplexed with the LED output) is used to select between the two crypt keys. 2.7 VDD (V) 2.5 2.3 2.1 1.9 1.7 1.5 -40 -25 -10 5 20 35 50 65 Dual Encoder Operation 80 A logic 1 on the SHIFT input pin selects the first crypt key. A logic 0 on the SHIFT input pin will select the second crypt key. Temperature (°C) VDD Legend = = = ✖ = ◆ ■ ▲ VDD (V) FIGURE 2-5: 000 001 010 011 HCS362 VLOW DETECTOR (TYPICAL) 5.5 5.3 5.1 4.9 4.7 4.5 4.3 4.1 3.9 3.7 3.5 -40 -25 -10 5 20 35 50 65 80 Temperature (°C) VDD Legend = = = ✖ = ◆ ■ ▲ 000 001 010 011 The output of the low voltage detector is transmitted in each code word, so the decoder can give an indication to the user that the transmitter battery is low. Operation of the LED changes as well to further indicate that the battery is low and needs replacing. 2002 Microchip Technology Inc. Preliminary DS40189D-page 7 HCS362 3.0 DEVICE OPERATION FIGURE 3-1: The HCS362 will wake-up upon detecting a switch closure and then delay for switch debounce (Figure 3-1). The synchronization information, fixed information and switch information will be encrypted to form the hopping code. The encrypted or hopping code portion of the transmission will change every time a button is pressed, even if the same button is pushed again. Keeping a button pressed for a long time will result in the same code word being transmitted until the button is released or time-out occurs. BASIC FLOW DIAGRAM OF THE DEVICE OPERATION START Sample Buttons Get Config. The time-out time can be selected with the Time-out (TIMOUT[0..1]) configuration option. This option allows the time-out to be disabled or set to 0.8 s, 3.2 s or 25.6 s. When a time-out occurs, the device will go into SLEEP mode to protect the battery from draining when a button gets stuck. Yes Seed TX? Read Seed No Increment Counter If in the transmit process, it is detected that a new button is pressed, the current code word will be aborted. A new code word will be transmitted and the time-out counter will RESET. If all the buttons are released, the minimum code words will be completed. The minimum code words can be set to 1,2,4 or 8 using the Minimum Code Words (MTX[0..1]) configuration option. If the time for transmitting the minimum code words is longer than the time-out time, the device will not complete the minimum code words. Encrypt Transmit Yes Note: Buttons removed will not have any effect on the code word unless no buttons remain pressed in which case the current code word will be completed and the power-down will occur. Time-out No No MTX A code that has been transmitted will not occur again for more than 64K transmissions. This will provide more than 18 years of typical use before a code is repeated based on 10 operations per day. Overflow information programmed into the encoder can be used by the decoder to extend the number of unique transmissions to more than 192K. STOP Yes No Buttons Yes No Yes Seed Time No No Seed Button Yes No New Buttons Yes DS40189D-page 8 Preliminary 2002 Microchip Technology Inc. HCS362 3.1 Transmission Modulation Format The HCS362 transmission is made up of several code words. Each code word starts with a preamble and a header, followed by the data (see Figure 3-1 and Figure 3-2). The code words are separated by a Guard Time that can be set to 0 ms, 6.4 ms, 25.6 ms or 76.8 ms with the Guard Time Select (GUARD[0..1]) configuration option. All other timing specifications for the modulation formats are based on a basic timing element (TE). This Timing Element can be set to 100 µs, 200 µs, 400 µs or 800 µs with the Baud Rate Select (BSEL[0..1]) FIGURE 3-2: configuration option. The Header Time can be set to 3 TE or 10 TE with the Header Select (HEADER) Configuration option. There are two different modulation formats available on the HCS362 that can be set according to the Modulation Select (MOD) configuration option: • Pulse Width Modulation (PWM) • Manchester Encoding The various formats are shown in Figure 3-3 and Figure 3-4. CODE WORD TRANSMISSION SEQUENCE 1 CODE WORD Preamble FIGURE 3-3: Header Encrypt Fixed Guard Preamble Header Encrypt TRANSMISSION FORMAT (PWM) TE TE TE LOGIC "0" LOGIC "1" TBP 1 16 3-10 TE Header 31 TE Preamble FIGURE 3-4: Encrypted Portion Fixed Code Portion Guard Time TRANSMISSION FORMAT (MANCHESTER) TE TE LOGIC "0" LOGIC "1" TBP START bit bit 0 bit 1 bit 2 1 2 Preamble STOP bit 16 Header 2002 Microchip Technology Inc. Encrypted Portion Fixed Code Portion Preliminary Guard Time DS40189D-page 9 HCS362 3.1.1 CODE HOPPING DATA 3.1.3.3 The hopping portion is calculated by encrypting the counter, discrimination value and function code with the Encoder Key (KEY). The counter is a 16-bit counter. The discrimination value is 10 bits long and there are 2 counter overflow bits (OVR) that are cleared when the counter wraps to 0. The rest of the 32 bits are made up of the function code also known as the button inputs. 3.1.2 EQUATION 3-1: and CRC [ 0 ] n + 1 = ( CRC [ 0 ] n ⊕ Di n ) ⊕ CRC [ 1 ] n with CRC [ 1, 0 ] 0 = 0 and Din the nth transmission bit 0 ≤ n ≤ 64 STATUS INFORMATION Note: Low Voltage Detector Status (VLOW) The output of the low voltage detector is transmitted with each code word. If VDD drops below the selected voltage, a logic ‘1’ will be transmitted. The output of the detector is sampled before each code word is transmitted. 3.1.3.2 CRC Calculation CRC [ 1 ] n + 1 = CRC [ 0 ] n ⊕ Din The status bits will always contain the output of the Low Voltage detector (VLOW), the Cyclic Redundancy Check (CRC) bits (or TIME bits depending on CTSEL) and the Button Queue information. 3.1.3.1 The CRC bits are calculated on the 65 previously transmitted bits. The decoder can use the CRC bits to check the data integrity before processing starts. The CRC can detect all single bit errors and 66% of double bit errors. The CRC is computed as follows: FIXED CODE DATA The 32 bits of fixed code consist of 28 bits of the serial number (SER) and another copy of the function code. This can be changed to contain the whole 32-bit serial number with the Extended Serial Number (XSER) configuration option. 3.1.3 Cyclic Redundancy Check (CRC) Button Queue Information (QUEUE) The queue bits indicate a button combination was pressed again within 2 s after releasing the previous activation. Queuing or repeated pressing of the same buttons (or button combination) is detected by the HCS362 button debouncing circuitry. The CRC may be wrong when the battery voltage is around either of the VLOW trip points. This may happen because VLOW is sampled twice each transmission, once for the CRC calculation (PWM is LOW) and once when VLOW is transmitted (PWM is HIGH). VDD tends to move slightly during a transmission which could lead to a different value for VLOW being used for the CRC calculation and the transmission. Work around: If the CRC is incorrect, recalculate for the opposite value of VLOW. The Queue bits are added as the last two bits of the standard code word. The queue bits are a 2-bit counter that does not wrap. The counter value starts at ‘00b’ and is incremented, if a button is pushed within 2 s of the previous button press. The current code word is terminated when the buttons are queued. This allows additional functionality for repeated button presses. The button inputs are sampled every 6.4 ms during this 2 s period. 00 - first activation 01 - second activation 10 - third activation 11 - from fourth activation on DS40189D-page 10 Preliminary 2002 Microchip Technology Inc. HCS362 FIGURE 3-5: CODE WORD DATA FORMAT With XSER = 0, CTSEL = 0 Fixed Code Portion (32 bits) Status Information (5 bits) QUE 2 bits CRC 2 bits VLOW 1-bit Q1 Q0 C1 C0 BUT 4 bits S2 S1 S0 Encrypted Portion (32 bits) Counter BUT Overflow 2 bits 4 bits SERIAL NUMBER (28 bits) S3 S2 S1 S0 S3 OVR1 DISC 10 bits Synchronization Counter 16 bits 0 15 OVR0 With XSER = 1, CTSEL = 0 Fixed Portion (32 bits) Status Information (5 bits) QUE 2 bits CRC 2 bits Encrypted Portion (32 bits) Counter BUT Overflow 4 bits 2 bits SERIAL NUMBER (32 bits) VLOW 1-bit Q1 Q0 C1 C0 S2 S1 S0 S3 OVR1 DISC 10 bits Synchronization Counter 16 bits 0 15 OVR0 With XSER = 0, CTSEL = 1 Fixed Portion (32 bits) Status Information (5 bits) QUE 2 bits TIME 2 bits Q1 Q0 T1 T0 VLOW 1-bit BUT 4 bits S2 S1 S0 Encrypted Portion (32 bits) Counter BUT Overflow 4 bits 2 bits SERIAL NUMBER (28 bits) S2 S3 S1 S0 S3 OVR1 DISC 10 bits Synchronization Counter 16 bits 0 15 OVR0 With XSER = 1, CTSEL = 1 Status Information (5 bits) QUE 2 bits TIME 2 bits Q1 Q0 T1 VLOW 1-bit T0 Encrypted Portion (32 bits) Fixed Portion (32 bits) Counter BUT Overflow 4 bits 2 bits SERIAL NUMBER (32 bits) S2 S1 S0 S3 OVR1 DISC 10 bits Synchronization Counter 16 bits 0 15 OVR0 Transmission Direction LSB First 2002 Microchip Technology Inc. Preliminary DS40189D-page 11 HCS362 3.1.4 MINIMUM CODE WORDS 3.1.5 MTX[0..1] configuration bits selects the minimum number of code words that will be transmitted. If the button is released after 1.6 s (or greater) and MTX code words have been transmitted, the code word being transmitted will be terminated. The possible values are: The time bits indicate the duration that the inputs were activated: 00 - immediate 01 - after 0.8 s 10 - after 1.6 s 11 - after 2.4 s 00 - 1 01 - 2 TIME BITS The TIME bits are incremented every 0.8 s and does not wrap once it reaches ‘11’. 10 - 4 Time information is alternative to the CRC bits availability and is selected by the CTSEL configuration bit. 11 - 8 FIGURE 3-6: TIME BITS OPERATION S[3210] Time bits = 00 Time bits set internally to 01 Time bits set internally to 10 Time bits actually output Time bits actually output DATA TTD Time 0s 1.6 s 0.8 s 2.4 s = One Code Word 3.2 FIGURE 3-8: LED Output The LED pin will be driven LOW periodically while the HCS362 is transmitting data, in order to switch on an external LED. The duty cycle (TLEDON/TLEDOFF) can be selected between two possible values by the configuration option (LED). FIGURE 3-7: LED OPERATION (LED = 1) LED OPERATION (LED = 0) S[3210] VDD > VLOW TLEDON TLEDOFF LED TLEDON = 200 ms TLEDOFF = 800 ms VDD < VLOW LED S[3210] VDD > VLOW TLEDON TLEDOFF Note: LED TLEDON = 25 ms TLEDOFF = 500 ms VDD < VLOW LED The same configuration option determines whether when the VDD Voltage drops below the selected VLOW trip point, the LED will blink only once or stop blinking. DS40189D-page 12 Preliminary When the HCS362 encoder is used as a Dual Encoder the LED pin is used as a SHIFT input (Figure 2-2). In such a configuration the LED is always ON during transmission. To keep power consumption low, it is recommended to use a series resistor of relatively high value. VLOW information is not available when using the second Encryption Key. 2002 Microchip Technology Inc. HCS362 3.3 Seed Code Word Data Format Seed code words can be configured as follows: A seed transmission transmits a code word that consists of 60 bits of fixed data that is stored in the EEPROM. This can be used for secure learning of encoders or whenever a fixed code transmission is required. The seed code word further contains the function code and the status information (VLOW, CRC and QUEUE) as configured for normal code hopping code words. The seed code word format is shown in Figure 3-9. The function code for seed code words is always ‘1111b’. FIGURE 3-9: • Enabled permanently. • Disabled permanently. • Enabled until the synchronization counter is greater than 7Fh, this configuration is often referred to as Limited Seed. • The time before the seed code word is transmitted can be set to 1.6 s or 3.2 s, this configuration is often referred to as Delayed Seed. When this option is selected, the HCS362 will transmit a code hopping code word for 1.6 s or 3.2 s, before the seed code word is transmitted. SEED CODE WORD FORMAT With QUEN = 1 Fixed Portion (9 bits) QUE CRC VLOW (2 bits) (2 bits) (1-bit) Q1 Q0 C1 C0 SEED Code (60 bits) SEED BUT (4 bits) S2 S1 S0 S3 Transmission Direction LSB First 3.3.1 SEED OPTIONS The button combination (S[3210]) for transmitting a Seed code word can be selected with the Seed and SeedC (SEED[0..1] and SEEDC) configuration options as shown in Table 3-1 and Table 3-2: TABLE 3-1: SEED OPTIONS (SEEDC = 0) Seed 1.6 s Delayed Seed SEED S[3210] S[3210] 00 - - 01 0101* 0001* 10 0101 0001 11 0101 - Note: Example B): Selecting SEEDC = 0 and SEED = 01: makes SEED transmission available only for a limited time (only up to 128 times). The combination of buttons S2 and S0 produces an immediate transmission of the SEED code. Pressing and holding for more than 1.6 seconds the S0 button alone, produces the SEED code word transmission (Delayed Seed). *Limited Seed TABLE 3-2: SEED OPTIONS (SEEDC = 1) Seed 3.2 s Delayed Seed SEED S[3210] S[3210] 00 - - 01 1001* 0011* 10 1001 0011 11 1001 - Note: Example A): Selecting SEEDC = 1 and SEED = 11: makes SEED transmission available every time the combination of buttons S3 and S0 is pressed simultaneously, but Delayed Seed mode is not available. *Limited Seed 2002 Microchip Technology Inc. Preliminary DS40189D-page 13 HCS362 3.4 RF Enable and PLL Interface The S3/RFEN pin of the HCS362 can be configured to function as an RF Enable output signal. This is selected by the RF Enable Output (RFEN) configuration option. When enabled, this pin will be driven HIGH before data is transmitted through the DATA pin. Note: The RF Enable and DATA output are synchronized so to interface with RF PLL circuits operating in ASK mode. Figure 3-10 shows the startup sequence. The RFEN signal will go LOW at the end of the last code word, including the Guard time. When the RF Enable output feature is used and a four (or more) buttons input configuration is required, the use of a scheme similar to Figure 2-1 (scheme C) is recommended. When the RF Enable output is selected, the S3 pin can still be used as a button input. The debouncing logic will be affected though, considerably reducing the responsiveness of the button input. FIGURE 3-10: PLL INTERFACE Button Press Button Release S[3210] RFEN DATA TRFON TTD TG 1st CODE WORD 2nd CODE WORD Guard Time DS40189D-page 14 Preliminary 2002 Microchip Technology Inc. HCS362 4.0 EEPROM MEMORY ORGANIZATION 4.1 KEY_0 - KEY_3 (64-bit Crypt Key) Word Address Field Description 0 KEY1_0 64-bit Encryption Key1 (Word 0) LSB The 64-bit crypt key is used to create the encrypted message transmitted to the receiver. This key is calculated and programmed during production using a key generation algorithm. The key generation algorithm may be different from the KEELOQ algorithm. Inputs to the key generation algorithm are typically the transmitter’s serial number and the 64-bit manufacturer’s code. While the key generation algorithm supplied from Microchip is the typical method used, a user may elect to create their own method of key generation. This may be done providing that the decoder is programmed with the same means of creating the key for decryption purposes. 1 KEY1_1 64-bit Encryption Key1 (Word 1) 4.2 The HCS362 contains 288 bits (18 x 16-bit words) of EEPROM memory (Table 4-1). This EEPROM array is used to store the encryption key information and synchronization value. Further descriptions of the memory array is given in the following sections. TABLE 4-1: EEPROM MEMORY MAP 2 KEY1_2 64-bit Encryption Key1 (Word 2) 3 KEY1_3 64-bit Encryption Key1 (Word 3) MSB 4 KEY2_0 64-bit Encryption Key2 (Word 0) LSB 5 KEY2_1 64-bit Encryption Key2 (Word 1) 6 KEY2_2 64-bit Encryption Key2 (Word 2) 7 KEY2_3 64-bit Encryption Key2 (Word 3) MSB 8 SEED_0 Seed value (Word 0) LSB 9 SEED_1 Seed value (Word 1) 10 SEED_2 Seed value (Word 2) 11 SEED_3 Seed value (Word 3) MSB 12 CONFIG_0 Configuration Word (Word 0) 13 CONFIG_1 Configuration Word (Word 1) 14 SERIAL_0 Serial Number (Word 0) LSB 15 SERIAL_1 Serial Number (Word 1) MSB 16 SYNC Synchronization counter 17 RES Reserved – Set to zero 2002 Microchip Technology Inc. SYNC (Synchronization Counter) This is the 16-bit synchronization value that is used to create the hopping code for transmission. This value will be incremented after every transmission. 4.3 SEED_0, SEED_1, SEED_2, and SEED 3 (Seed Word) This is the four word (60 bits) seed code that will be transmitted when seed transmission is selected. This allows the system designer to implement the secure learn feature or use this fixed code word as part of a different key generation/tracking process or purely as a fixed code transmission. Note: 4.4 Upper four Significant bits of SEED_3 contains extra configuration information (see Table 4-4). SERIAL_0, SERIAL_1 (Encoder Serial Number) SER_0 and SER_1 are the lower and upper words of the device serial number, respectively. There are 32 bits allocated for the serial number and a selectable configuration bit determines whether 32 or 28 bits will be transmitted. The serial number is meant to be unique for every transmitter. Preliminary DS40189D-page 15 HCS362 4.5 Configuration Words are There are 36 configuration bits stored in the EEPROM array. They are used by the device to determine transmission speed, format, delays and Guard times. They TABLE 4-2: grouped in CONFIG_0 Description 0 OSC_0 Oscillator adjust 1 OSC_1 2 0000 - nominal 1000 - fastest 0111 - slowest OSC_2 VLOW select nominal values 3 OSC_3 4 VLOW_0 5 VLOW_1 6 VLOW_2 7 BSEL_0 8 BSEL_1 Values 100 - 4.0V 000 - 2.0V 001 - 2.1V 101 - 4.2V 010 - 2.2V 110 - 4.4V 011 - 2.3V 111 - 4.6V 00 - TE = 100 µs 01 - TE = 200 µs 10 - TE = 400 µs 11 - TE = 800 µs 00 - 1 01 - 2 10 - 4 11 - 8 00 - 0 ms (1 TE) 01 - 6.4 ms + 2 TE 10 - 25.6 ms + 2 TE 11 - 76.8 ms + 2 TE 00 - No Time-out 01 - 0.8 s to 0.8 s + 1 code word 10 - 3.2 s to 3.2 s + 1 code word 11 - 25.6 s to 25.6 s + 1 code word 0 = TIME bits 1 = CRC bits Bitrate select 9 MTX_0 10 MTX_1 Minimum number of code words 11 GUARD_0 Guard time select 12 GUARD_1 13 TIMOUT_0 14 TIMOUT_1 15 CTSEL Time-out select CTSEL OSC The internal oscillator can be tuned to ±10%. (0000 selects the nominal value, 1000 the fastest value and 0111 the slowest). When programming the device, it is the programmer’s responsibility to determine the optimal calibration value. VLOW[0..2] The low voltage threshold can be programmed to be any of the values shown in the following table: 4.5.3 Words: word. A description of each of the bits follows this section. Field 4.5.2 Configuration SEED_3 Bit Address 4.5.1 three CONFIG_0, CONFIG_1 and the upper nibble of the selection and the Guard time selection, from approximately 40 ms up to 220 ms. Refer to Table 7-4 and Table 7-5 for a more complete description. 4.5.4 MTX[0..1] MTX selects the minimum number of code words that will be transmitted. A minimum of 1, 2, 4 or 8 code words will be transmitted. Note: BSEL[0..1] If MTX and BSEL settings in combination require a transmission sequence to exceed the TIMOUT setting, TIMOUT will take priority. The basic timing element TE, determines the actual transmission Baud Rate. This translates to different code word lengths depending on the encoding format selected (Manchester or PWM), the Header length DS40189D-page 16 Preliminary 2002 Microchip Technology Inc. HCS362 4.5.5 GUARD 4.5.6 The Guard time between code words can be set to 0 ms, 6.4 ms, 25.6 ms and 76.8 ms. If during a series of code words, the output changes from Hopping Code to Seed the Guard time will increase by 3 x TE. TABLE 4-3: TIMOUT[0..1] The transmission time-out can be set to 0.8 s, 3.2 s, 25.6 s or no time-out. After the time-out period, the encoder will stop transmission and enter a low power Shutdown mode. CONFIG_1 Bit Address Field Description 0 DISC_0 Discrimination bits 1 DISC_1 2 DISC_2 ... ... 8 DISC_8 9 DISC_9 10 OVR_0 11 OVR_1 12 XSER Extended Serial Number 13 SEEDC Seed Control Overflow Values DISC[9:0] OVR[1:0] 0 - Disable 1 - Enable 0 = Seed transmission on: S[3210] = 0001 (delay 1.6 s) S[3210] = 0101 (immediate) 1 = Seed transmission on: S[3210] = 0011 (delay 3.2 s) S[3210] = 1001 (immediate) 4.5.7 14 SEED_0 15 SEED_1 Seed options DISC[0..9] OVR[0..1] The overflow bits are used to extend the possible code combinations to 192K. If the overflow bits are not going to be used they can be programmed to zero. 4.5.9 If XSER is enabled a 32-bit serial number is transmitted. If XSER is disabled a 28-bit serial number and a 4bit function code are transmitted. No Seed Limited Seed (Permanent and Delayed) Permanent and Delayed Seed Permanent Seed only SEED[0..1] The seed value which is transmitted on key combinations (0011) and (1001) can be disabled, enabled or enabled for a limited number of transmissions determined by the initial counter value. In limited Seed mode, the device will output the seed if the sync counter (Section 4.2) is from 00hex to 7Fhex. For a counter higher than 7F, a normal hopping code will be output. Note: XSER 2002 Microchip Technology Inc. - 4.5.10 The discrimination bits are used to validate the decrypted code word. The discrimination value is typically programmed with the 10 Least Significant bits of the serial number or a fixed value. 4.5.8 00 01 10 11 4.5.11 Whenever a SEED code word is output, the 4 function bits (Figure 7-4) will be set to all ones [1,1,1,1]. SEEDC SEEDC selects between seed transmission on 0001 and 0101 (SEEDC = 0) and 0011 and 1001 (SEEDC = 1). The delay before seed transmission is 1.6 s for (SEEDC = 0) and 3.2 s for (SEEDC = 1). Preliminary DS40189D-page 17 HCS362 TABLE 4-4: SEED_3 Bit Address Field Description 0 SEED_48 Seed Most Significant word 1 SEED_49 2 SEED_50 ... ... 9 SEED_57 10 SEED_58 11 SEED_59 12 LED LED output timing Values — 0 = VBOT>VLOW LED blink 200/800 ms VBOT<VLOW LED not blinking 1 = VBOT>VLOW LED blink 25/500 ms VBOT<VLOW LED blink once 13 MOD Modulation Format 14 RFEN RF Enable/S3 multiplexing 0 = PWM 1 = MANCHESTER 0 - Enabled (S3 only sensed 2 seconds after the last button is released) 1 - Disabled (S3 same as other S inputs) 15 4.5.12 HEADER Header Length 0 = short Header, TH = 3 x TE 1 = standard Header, TH = 10 x TE HEADER When PWM mode is selected the header length (low time between preamble and data bits start) can be set to 10 x TE or 3 x TE. The 10 x TE mode is recommended for compatibility with previous KEELOQ encoder models. In Manchester mode, the header length is fixed and set to 4 x TE. 4.5.13 RFEN RFEN selects whether the RFEN output is enabled or disabled. If enabled, S3 is only sampled 2 s after the last button is released and at the start of the first transmission. If disabled S3 functions the same as the other S inputs. DS40189D-page 18 Preliminary 2002 Microchip Technology Inc. HCS362 4.6 SYNCHRONOUS MODE In Synchronous mode, the code word can be clocked out on DATA using S2 as a clock. To enter Synchronous mode, DATA and S0 must be taken HIGH and then S2 is taken HIGH. After Synchronous mode is FIGURE 4-1: TPS entered, S0 must be taken LOW. The data is clocked out on DATA on every rising edge of S2. Auto-shutoff timer is not disabled in Synchronous mode. This can be used to implement RF testing. SYNCHRONOUS TRANSMISSION MODE TPH1 TPH2 t = 50ms Preamble Header Data DATA S2 “01,10,11” S[1:0] TRFON RFEN FIGURE 4-2: CODE WORD ORGANIZATION (SYNCHRONOUS TRANSMISSION MODE) Fixed Portion QUEUE (2 bits) CRC (2 bits) Vlow (1-bit) Button Status S2 S1 S0 S3 Encrypted Portion Serial Number (28 bits) DISC+ OVR (12 bits) Sync Counter (16 bits) 69 Data bits Transmitted LSb first. MSb 2002 Microchip Technology Inc. Button Status S2 S1 S0 S3 Preliminary LSb DS40189D-page 19 HCS362 5.0 PROGRAMMING THE HCS362 cycle to complete. This delay can take up to Twc. At the end of the programming cycle, the device can be verified (Figure 5-2) by reading back the EEPROM. Reading is done by clocking the S2 line and reading the data bits on DATA. For security reasons, it is not possible to execute a verify function without first programming the EEPROM. A Verify operation can only be done once, immediately following the Program cycle. When using the HCS362 in a system, the user will have to program some parameters into the device, including the serial number and the secret key before it can be used. The programming cycle allows the user to input all 288 bits in a serial data stream, which are then stored internally in EEPROM. Programming will be initiated by forcing the DATA line HIGH, after the S2 line has been held HIGH for the appropriate length of time (Table 5-1 and Figure 5-1). After the Program mode is entered, a delay must be provided to the device for the automatic bulk write cycle to complete. This will write all locations in the EEPROM to an all zeros pattern including the OSC calibration bits. Note: To ensure that the device does not accidentally enter Programming mode, PWM should never be pulled high by the circuit connected to it. Special care should be taken when driving PNP RF transistors. The device can then be programmed by clocking in 16 bits at a time, using S2 as the clock line and DATA as the data in-line. After each 16-bit word is loaded, a programming delay is required for the internal program FIGURE 5-1: PROGRAMMING WAVEFORMS Enter Program Mode TPBW TDS TCLKH TWC S2 (S3) (Clock) TPS TPH1 TDH TCLKL DATA (Data) Bit 0 Bit 1 Bit 2 Bit 3 Bit 14 Bit 15 Bit 16 Data for Word 1 Data for Word 0 (KEY_0) Repeat for each word (18 times) TPH2 Bit 17 Note 1: Unused button inputs to be held to ground during the entire programming sequence. 2: The VDD pin must be taken to ground after a Program/Verify cycle. FIGURE 5-2: VERIFY WAVEFORMS End of Programming Cycle Beginning of Verify Cycle Data from Word 0 DATA (Data) Bit286 Bit287 Bit 0 TWC Bit 1 Bit 2 Bit 3 Bit 14 Bit 15 Bit 16 Bit 17 Bit286 Bit287 TDV S2 (S3) (Clock) Note: If a Verify operation is to be done, then it must immediately follow the Program cycle. DS40189D-page 20 Preliminary 2002 Microchip Technology Inc. HCS362 TABLE 5-1: PROGRAMMING/VERIFY TIMING REQUIREMENTS VDD = 5.0V ± 10% 25 °C ± 5 °C Parameter Program mode setup time Hold time 1 Hold time 2 Bulk Write time Program delay time Program cycle time Clock low time Clock high time Data setup time Data hold time Data out valid time 2002 Microchip Technology Inc. Symbol Min. Max. Units TPS TPH1 TPH2 TPBW TPROG TWC TCLKL TCLKH TDS TDH TDV 3.5 3.5 50 4.0 4.0 50 50 50 0 30 — 4.5 — — — — — — — — — 30 ms ms µs ms ms ms µs µs µs µs µs Preliminary DS40189D-page 21 HCS362 6.0 INTEGRATING THE HCS362 INTO A SYSTEM FIGURE 6-1: Use of the HCS362 in a system requires a compatible decoder. This decoder is typically a microcontroller with compatible firmware. Microchip will provide (via a license agreement) firmware routines that accept transmissions from the HCS362 and decrypt the hopping code portion of the data stream. These routines provide system designers the means to develop their own decoding system. 6.1 TYPICAL LEARN SEQUENCE Enter Learn Mode Wait for Reception of a Valid Code Generate Key from Serial Number Use Generated Key to Decrypt Learning a Transmitter to a Receiver A transmitter must first be ’learned’ by a decoder before its use is allowed in the system. Several learning strategies are possible, Figure 6-1 details a typical learn sequence. Core to each, the decoder must minimally store each learned transmitter’s serial number and current synchronization counter value in EEPROM. Additionally, the decoder typically stores each transmitter’s unique crypt key. The maximum number of learned transmitters will therefore be relative to the available EEPROM. A transmitter’s serial number is transmitted in the clear but the synchronization counter only exists in the code word’s encrypted portion. The decoder obtains the counter value by decrypting using the same key used to encrypt the information. The KEELOQ algorithm is a symmetrical block cipher so the encryption and decryption keys are identical and referred to generally as the crypt key. The encoder receives its crypt key during manufacturing. The decoder is programmed with the ability to generate a crypt key as well as all but one required input to the key generation routine; typically the transmitter’s serial number. Figure 6-1 summarizes a typical learn sequence. The decoder receives and authenticates a first transmission; first button press. Authentication involves generating the appropriate crypt key, decrypting, validating the correct key usage via the discrimination bits and buffering the counter value. A second transmission is received and authenticated. A final check verifies the counter values were sequential; consecutive button presses. If the learn sequence is successfully complete, the decoder stores the learned transmitter’s serial number, current synchronization counter value and appropriate crypt key. From now on the crypt key will be retrieved from EEPROM during normal operation instead of recalculating it for each transmission received. Compare Discrimination Value with Fixed Value Equal ? No Yes Wait for Reception of Second Valid Code Use Generated Key to Decrypt Compare Discrimination Value with Fixed Value Equal ? No Yes Counters Sequential ? Yes No Learn successful Store: Learn Unsuccessful Serial number Encryption key Synchronization counter Exit Certain learning strategies have been patented and care must be taken not to infringe. DS40189D-page 22 Preliminary 2002 Microchip Technology Inc. HCS362 6.2 Decoder Operation 6.3 Figure 6-2 summarizes normal decoder operation. The decoder waits until a transmission is received. The received serial number is compared to the EEPROM table of learned transmitters to first determine if this transmitter’s use is allowed in the system. If from a learned transmitter, the transmission is decrypted using the stored crypt key and authenticated via the discrimination bits for appropriate crypt key usage. If the decryption was valid the synchronization value is evaluated. FIGURE 6-2: TYPICAL DECODER OPERATION Start No Transmission Received ? Yes No Is Decryption Valid ? Yes No Is Counter Within 16 ? Yes No No Is Counter Within 32K ? The KEELOQ technology patent scope includes a sophisticated synchronization technique that does not require the calculation and storage of future codes. The technique securely blocks invalid transmissions while providing transparent resynchronization to transmitters inadvertently activated away from the receiver. Figure 6-3 shows a 3-partition, rotating synchronization window. The size of each window is optional but the technique is fundamental. Each time a transmission is authenticated, the intended function is executed and the transmission’s synchronization counter value is stored in EEPROM. From the currently stored counter value there is an initial "Single Operation" forward window of 16 codes. If the difference between a received synchronization counter and the last stored counter is within 16, the intended function will be executed on the single button press and the new synchronization counter will be stored. Storing the new synchronization counter value effectively rotates the entire synchronization window. A "Double Operation" (resynchronization) window further exists from the Single Operation window up to 32K codes forward of the currently stored counter value. It is referred to as "Double Operation" because a transmission with synchronization counter value in this window will require an additional, sequential counter transmission prior to executing the intended function. Upon receiving the sequential transmission the decoder executes the intended function and stores the synchronization counter value. This resynchronization occurs transparently to the user as it is human nature to press the button a second time if the first was unsuccessful. Does Serial Number Match ? Yes Decrypt Transmission No Execute Command and Update Counter The third window is a "Blocked Window" ranging from the double operation window to the currently stored synchronization counter value. Any transmission with synchronization counter value within this window will be ignored. This window excludes previously used, perhaps code-grabbed transmissions from accessing the system. Note: Yes Save Counter in Temp Location 2002 Microchip Technology Inc. Synchronization with Decoder (Evaluating the Counter) Preliminary The synchronization method described in this section is only a typical implementation and because it is usually implemented in firmware, it can be altered to fit the needs of a particular system. DS40189D-page 23 HCS362 FIGURE 6-3: SYNCHRONIZATION WINDOW Entire Window rotates to eliminate use of previously used codes Blocked Window (32K Codes) Stored Synchronization Counter Value Double Operation (resynchronization) Window (32K Codes) DS40189D-page 24 Preliminary Single Operation Window (16 Codes) 2002 Microchip Technology Inc. HCS362 7.0 ELECTRICAL CHARACTERISTICS TABLE 7-1: ABSOLUTE MAXIMUM RATINGS Symbol Item Rating Units VDD VIN Supply voltage -0.3 to 6.6 V Input voltage -0.3 to VDD + 0.3 V VOUT Output voltage -0.3 to VDD + 0.3 V IOUT Max output current 20 mA TSTG Storage temperature -55 to +125 °C TLSOL Lead soldering temperature 300 °C VESD ESD rating 4,000 V Note: Stresses above those listed under “ABSOLUTE MAXIMUM RATINGS” may cause permanent damage to the device. TABLE 7-2: Industrial DC CHARACTERISTICS (I): TAMB = -40 °C to +85 °C 2.0V < VDD < 6.3 Parameter Sym. Min. Typ.(1) Max. Unit Conditions Operating current (avg.) ICC — 0.3 1.2 mA VDD = 6.3V Standby current ICCS — 0.1 1.0 µA VDD = 6.3V current(2,3) ICCS — 40 75 µA — High level Input voltage VIH 0.65 VDD — VDD + 0.3 V VDD = 2.0V Low level input voltage VIL -0.3 — 0.15 VDD V VDD = 2.0V High level output voltage VOH 0.7 VDD 0.7 VDD — — V IOH = -1.0 mA, VDD = 2.0V IOH = -2.0 mA, VDD = 6.3V Low level output voltage VOL — — 0.15 VDD 0.15 VDD V IOL = 1.0 mA, VDD = 2.0V IOL = 2.0 mA, VDD = 6.3V RFEN pin high drive IRFEN 0.5 1.0 1 2.5 3.0 5.0 mA VRFEN = 1.4V VDD = 2.0V VRFEN = 4.4V VDD = 6.3V LED sink current ILEDL ILEDH 1.0 2.0 3.5 4.5 6.0 7.0 mA mA VLED = 1.5V, VDD = 3.0V VLED = 1.5V, VDD = 6.3V Pull-down Resistance; S0-S3 RS0-3 40 60 80 KΩ VDD = 4.0V Pull-down Resistance; PWM RPWM 80 120 160 KΩ VDD = 4.0V Auto-shutoff Note 1: Typical values are at 25 °C. 2: Auto-shutoff current specification does not include the current through the input pull-down resistors. 3: These values are characterized but not tested. 2002 Microchip Technology Inc. Preliminary DS40189D-page 25 HCS362 FIGURE 7-1: POWER-UP AND TRANSMIT TIMING 1 TE RFEN TRFON LED TLED TTD TDB Code Word Code Word Code Word 1 2 3 DATA Code Word n TTP TTO Code Word from previous button press SN Button Press Detect POWER-UP AND TRANSMIT TIMING REQUIREMENTS(3) TABLE 7-3: VDD = +2.0 to 6.3V Industrial (I): TAMB = -40 °C to +85 °C Parameter Symbol Min. Typical Max. Unit Remarks Transmit delay from button detect TTD 26 30 40 ms (Note 1) Debounce delay TDB 18 20 22 ms — Auto-shutoff time-out period (TIMO=10) TTO 23.4 25.6 28.16 s (Note 2) TRFON 22 26 36 ms — LED on after key press RFEN after key press TLED 25 — 45 ms — Time to terminate code word from previous button press TTP — — 10 ms — — Note 1: Transmit delay maximum value if the previous transmission was successfully transmitted. 2: The Auto-shutoff time-out period is not tested. 3: These values are characterized but not tested DS40189D-page 26 Preliminary 2002 Microchip Technology Inc. HCS362 FIGURE 7-2: PWM FORMAT SUMMARY (MOD=0) TE TE TE LOGIC "0" LOGIC "1" 50% Duty Cycle Preamble 1 TBP 16 31XTE Preamble 10xTE Header FIGURE 7-3: Encrypted Portion of Transmission P16 31xTE 50% Duty Cycle Preamble MSB LSB Bit 0 Bit 1 Header Bit 0 Bit 1 3 or 10xTE Header Data Bits PWM DATA FORMAT (MOD = 0) Serial Number LSB Guard Time PWM PREAMBLE/HEADER FORMAT (MOD=0) P1 FIGURE 7-4: Fixed Portion of Transmission Function Code MSB S3 S0 S1 S2 Status CRC/TIME QUEUE VLOW CRC0 CRC1 Q0 Q1 Bit 30 Bit 31 Bit 32 Bit 33 Bit 58 Bit 59 Bit 60 Bit 61 Bit 62 Bit 63 Bit 64 Bit 65 Bit 66 Bit 67 Bit 68 Encrypted Portion 2002 Microchip Technology Inc. Fixed Portion of Transmission Preliminary Guard Time DS40189D-page 27 HCS362 FIGURE 7-5: MANCHESTER FORMAT SUMMARY (MOD=1) TPB TE TE LOGIC "0" LOGIC "1" 50% Duty Cycle Preamble 1 START bit bit 0 bit 1 STOP bit bit 2 16 2 31XTE Preamble FIGURE 7-6: Encrypted Portion of Transmission 4XTE Header Fixed Portion of Transmission Guard Time MANCHESTER PREAMBLE/HEADER FORMAT (MOD=1) P1 P16 31 x TE Preamble DS40189D-page 28 Preliminary Bit 0 Bit 1 4 x TE Header Data Word Transmission 2002 Microchip Technology Inc. HCS362 TABLE 7-4: CODE WORD TRANSMISSION TIMING PARAMETERS – PWM MODE(1,3) VDD = +2.0V to 6.3V Commercial (C): TAMB = 0 °C to +70 °C Industrial (I): TAMB = -40 °C to +85 °C Symbol TE Characteristic BSEL Value 11 10 01 00 Typical Typical Typical Typical Units 800 400 200 100 µs 3 3 3 3 TE 31 31 31 31 TE Basic pulse element TBP Bit width TP Preamble duration TH (4) Header duration 10 10 10 10 TE TC Data duration 207 207 207 207 TE TG Guard time(2) 27.2 26.4 26 25.8 ms — Total transmit time 220 122 74 50 ms — Data Rate 417 833 1667 3334 bps Note 1: 2: 3: 4: The timing parameters are not tested but derived from the oscillator clock. Assuming GUARD = 10 option selected in CONFIG_0 Configuration Word. Allow for a +/- 10% tolerance on the encoder internal oscillator after calibration. Assuming HEADER = 1 option selected in SEED_3 Configuration Word. TABLE 7-5: CODE WORD TRANSMISSION TIMING PARAMETERS—MANCHESTER MODE(1,3) VDD = +2.0V to 6.3V Commercial (C): TAMB = 0 °C to +70 °C Industrial (I): TAMB = -40 °C to +85 °C Symbol TE Characteristic Basic pulse element(3) BSEL Value 11 10 01 00 Typical Typical Typical Typical Units 800 400 200 100 µs TBP Bit width 2 2 2 2 TE TP Preamble duration 31 31 31 31 TE TH Header duration 4 4 4 4 TE TC Data duration 138 138 138 138 TE TG Guard time(2) 26.8 26.4 26 25.8 ms — Total transmit time 166 96 61 43 ms — Data Rate 625 1250 2500 5000 bps Note 1: The timing parameters are not tested but derived from the oscillator clock. 2: Assuming GUARD = 10 option selected in CONFIG_0 Configuration Word. 3: Allow for a +/- 10% tolerance on the encoder internal oscillator after calibration. 2002 Microchip Technology Inc. Preliminary DS40189D-page 29 HCS362 8.0 PACKAGING INFORMATION 8.1 Package Marking Information 8-Lead PDIP (300 mil) Example: HCS362 XXXXXNNN 0025 XXXXXXXX XXXXXNNN YYWW 8-Lead SOIC (150 mil) Example: HCS362 XXXX0025 NNN XXXXXXXX XXXXYYWW NNN Example: 8-Lead TSSOP XXXX XYWW NNN Legend: Note: * XX...X Y YY WW NNN 362 0025 NNN Customer specific information* Year code (last digit of calendar year) Year code (last 2 digits of calendar year) Week code (week of January 1 is week ‘01’) Alphanumeric traceability code In the event the full Microchip part number cannot be marked on one line, it will be carried over to the next line thus limiting the number of available characters for customer specific information. Standard PICmicro device marking consists of Microchip part number, year code, week code, and traceability code. For PICmicro device marking beyond this, certain price adders apply. Please check with your Microchip Sales Office. For SQTP devices, any special marking adders are included in SQTP price. DS40189D-page 30 Preliminary 2002 Microchip Technology Inc. HCS362 8.2 Package Details 8-Lead Plastic Dual In-line (P) – 300 mil (PDIP) E1 D 2 n 1 α E A2 A L c A1 β B1 p eB B Units Dimension Limits n p Number of Pins Pitch Top to Seating Plane Molded Package Thickness Base to Seating Plane Shoulder to Shoulder Width Molded Package Width Overall Length Tip to Seating Plane Lead Thickness Upper Lead Width Lower Lead Width Overall Row Spacing Mold Draft Angle Top Mold Draft Angle Bottom * Controlling Parameter § Significant Characteristic A A2 A1 E E1 D L c § B1 B eB α β MIN .140 .115 .015 .300 .240 .360 .125 .008 .045 .014 .310 5 5 INCHES* NOM MAX 8 .100 .155 .130 .170 .145 .313 .250 .373 .130 .012 .058 .018 .370 10 10 .325 .260 .385 .135 .015 .070 .022 .430 15 15 MILLIMETERS NOM 8 2.54 3.56 3.94 2.92 3.30 0.38 7.62 7.94 6.10 6.35 9.14 9.46 3.18 3.30 0.20 0.29 1.14 1.46 0.36 0.46 7.87 9.40 5 10 5 10 MIN MAX 4.32 3.68 8.26 6.60 9.78 3.43 0.38 1.78 0.56 10.92 15 15 Notes: Dimensions D and E1 do not include mold flash or protrusions. Mold flash or protrusions shall not exceed .010” (0.254mm) per side. JEDEC Equivalent: MS-001 Drawing No. C04-018 2002 Microchip Technology Inc. Preliminary DS40189D-page 31 HCS362 8-Lead Plastic Small Outline (SN) – Narrow, 150 mil (SOIC) E E1 p D 2 B n 1 α h 45° c A2 A φ β L Units Dimension Limits n p Number of Pins Pitch Overall Height Molded Package Thickness Standoff § Overall Width Molded Package Width Overall Length Chamfer Distance Foot Length Foot Angle Lead Thickness Lead Width Mold Draft Angle Top Mold Draft Angle Bottom * Controlling Parameter § Significant Characteristic A A2 A1 E E1 D h L φ c B α β MIN .053 .052 .004 .228 .146 .189 .010 .019 0 .008 .013 0 0 A1 INCHES* NOM 8 .050 .061 .056 .007 .237 .154 .193 .015 .025 4 .009 .017 12 12 MAX .069 .061 .010 .244 .157 .197 .020 .030 8 .010 .020 15 15 MILLIMETERS NOM 8 1.27 1.35 1.55 1.32 1.42 0.10 0.18 5.79 6.02 3.71 3.91 4.80 4.90 0.25 0.38 0.48 0.62 0 4 0.20 0.23 0.33 0.42 0 12 0 12 MIN MAX 1.75 1.55 0.25 6.20 3.99 5.00 0.51 0.76 8 0.25 0.51 15 15 Notes: Dimensions D and E1 do not include mold flash or protrusions. Mold flash or protrusions shall not exceed .010” (0.254mm) per side. JEDEC Equivalent: MS-012 Drawing No. C04-057 DS40189D-page 32 Preliminary 2002 Microchip Technology Inc. HCS362 8-Lead Plastic Thin Shrink Small Outline (ST) – 4.4 mm (TSSOP) E E1 p 013001 D 2 1 n B α A c φ β A1 A2 L Units Dimension Limits n p Number of Pins Pitch Overall Height Molded Package Thickness Standoff § Overall Width Molded Package Width Molded Package Length Foot Length Foot Angle Lead Thickness Lead Width Mold Draft Angle Top Mold Draft Angle Bottom * Controlling Parameter § Significant Characteristic A A2 A1 E E1 D L φ c B α β MIN INCHES NOM MAX 8 .026 .033 .002 .246 .169 .114 .020 0 .004 .007 0 0 .035 .004 .251 .173 .118 .024 4 .006 .010 5 5 .043 .037 .006 .256 .177 .122 .028 8 .008 .012 10 10 MILLIMETERS* NOM MAX 8 0.65 1.10 0.85 0.90 0.95 0.05 0.10 0.15 6.25 6.38 6.50 4.30 4.40 4.50 2.90 3.00 3.10 0.50 0.60 0.70 0 4 8 0.09 0.15 0.20 0.19 0.25 0.30 0 5 10 0 5 10 MIN Notes: Dimensions D and E1 do not include mold flash or protrusions. Mold flash or protrusions shall not exceed .005” (0.127mm) per side. JEDEC Equivalent: MO-153 Drawing No. C04-086 2002 Microchip Technology Inc. Preliminary DS40189D-page 33 HCS362 ON-LINE SUPPORT Systems Information and Upgrade Hot Line Microchip provides on-line support on the Microchip World Wide Web (WWW) site. The web site is used by Microchip as a means to make files and information easily available to customers. To view the site, the user must have access to the Internet and a web browser, such as Netscape® or Microsoft® Explorer. Files are also available for FTP download from our FTP site. The Systems Information and Upgrade Line provides system users a listing of the latest versions of all of Microchip's development systems software products. Plus, this line provides information on how customers can receive any currently available upgrade kits. The Hot Line Numbers are: 1-800-755-2345 for U.S. and most of Canada, and 1-480-792-7302 for the rest of the world. Connecting to the Microchip Internet Web Site The Microchip web site is available by using your favorite Internet browser to attach to: www.microchip.com The file transfer site is available by using an FTP service to connect to: ftp://ftp.microchip.com The web site and file transfer site provide a variety of services. Users may download files for the latest Development Tools, Data Sheets, Application Notes, User’s Guides, Articles and Sample Programs. A variety of Microchip specific business information is also available, including listings of Microchip sales offices, distributors and factory representatives. Other data available for consideration is: • Latest Microchip Press Releases • Technical Support Section with Frequently Asked Questions • Design Tips • Device Errata • Job Postings • Microchip Consultant Program Member Listing • Links to other useful web sites related to Microchip Products • Conferences for products, Development Systems, technical information and more • Listing of seminars and events DS40189D-page 34 Preliminary 2002 Microchip Technology Inc. HCS362 READER RESPONSE It is our intention to provide you with the best documentation possible to ensure successful use of your Microchip product. If you wish to provide your comments on organization, clarity, subject matter, and ways in which our documentation can better serve you, please FAX your comments to the Technical Publications Manager at (480) 792-7578. Please list the following information, and use this outline to provide us with your comments about this Data Sheet. To: Technical Publications Manager RE: Reader Response Total Pages Sent From: Name Company Address City / State / ZIP / Country Telephone: (_______) _________ - _________ FAX: (______) _________ - _________ Application (optional): Would you like a reply? Y N Literature Number: DS40189D Device: HCS362 Questions: 1. What are the best features of this document? 2. How does this document meet your hardware and software development needs? 3. Do you find the organization of this data sheet easy to follow? If not, why? 4. What additions to the data sheet do you think would enhance the structure and subject? 5. What deletions from the data sheet could be made without affecting the overall usefulness? 6. Is there any incorrect or misleading information (what and where)? 7. How would you improve this document? 8. How would you improve our software, systems, and silicon products? 2002 Microchip Technology Inc. Preliminary DS40189D-page 35 HCS362 HCS362 PRODUCT IDENTIFICATION SYSTEM To order or obtain information, e.g., on pricing or delivery, refer to the factory or the listed sales office. HCS362 — X /X Package: Temperature Range: Device: P = Plastic DIP (300 mil body), 8-lead SN = Plastic SOIC (150 mil body), 8-lead ST = Plastic TSSOP (4.4mm body), 8-lead I = –40 °C to +85 °C HCS362 HCS362T Code Hopping Encoder Code Hopping Encoder (Tape and Reel) Sales and Support Data Sheets Products supported by a preliminary Data Sheet may have an errata sheet describing minor operational differences and recommended workarounds. To determine if an errata sheet exists for a particular device, please contact one of the following: 1. Your local Microchip sales office 2. The Microchip Corporate Literature Center U.S. FAX: (480) 792-7277 3. The Microchip Worldwide Site (www.microchip.com) Please specify which device, revision of silicon and Data Sheet (include Literature #) you are using. New Customer Notification System Register on our web site (www.microchip.com/cn) to receive the most current information on our products. DS40189D-page 36 Preliminary 2002 Microchip Technology Inc. Microchip’s Secure Data Products are covered by some or all of the following patents: Code hopping encoder patents issued in Europe, U.S.A., and R.S.A. — U.S.A.: 5,517,187; Europe: 0459781; R.S.A.: ZA93/4726 Secure learning patents issued in the U.S.A. and R.S.A. — U.S.A.: 5,686,904; R.S.A.: 95/5429 Information contained in this publication regarding device applications and the like is intended through suggestion only and may be superseded by updates. It is your responsibility to ensure that your application meets with your specifications. No representation or warranty is given and no liability is assumed by Microchip Technology Incorporated with respect to the accuracy or use of such information, or infringement of patents or other intellectual property rights arising from such use or otherwise. Use of Microchip’s products as critical components in life support systems is not authorized except with express written approval by Microchip. No licenses are conveyed, implicitly or otherwise, under any intellectual property rights. Trademarks The Microchip name and logo, the Microchip logo, FilterLab, KEELOQ, MPLAB, PIC, PICmicro, PICMASTER, PICSTART, PRO MATE, SEEVAL and The Embedded Control Solutions Company are registered trademarks of Microchip Technology Incorporated in the U.S.A. and other countries. dsPIC, ECONOMONITOR, FanSense, FlexROM, fuzzyLAB, In-Circuit Serial Programming, ICSP, ICEPIC, microID, microPort, Migratable Memory, MPASM, MPLIB, MPLINK, MPSIM, MXDEV, PICC, PICDEM, PICDEM.net, rfPIC, Select Mode and Total Endurance are trademarks of Microchip Technology Incorporated in the U.S.A. Serialized Quick Turn Programming (SQTP) is a service mark of Microchip Technology Incorporated in the U.S.A. All other trademarks mentioned herein are property of their respective companies. © 2002, Microchip Technology Incorporated, Printed in the U.S.A., All Rights Reserved. Printed on recycled paper. Microchip received QS-9000 quality system certification for its worldwide headquarters, design and wafer fabrication facilities in Chandler and Tempe, Arizona in July 1999. The Company’s quality system processes and procedures are QS-9000 compliant for its PICmicro® 8-bit MCUs, KEELOQ® code hopping devices, Serial EEPROMs and microperipheral products. In addition, Microchip’s quality system for the design and manufacture of development systems is ISO 9001 certified. 2002 Microchip Technology Inc. Preliminary DS40189D - page 37 WORLDWIDE SALES AND SERVICE AMERICAS ASIA/PACIFIC Japan Corporate Office Australia 2355 West Chandler Blvd. Chandler, AZ 85224-6199 Tel: 480-792-7200 Fax: 480-792-7277 Technical Support: 480-792-7627 Web Address: http://www.microchip.com Microchip Technology Australia Pty Ltd Suite 22, 41 Rawson Street Epping 2121, NSW Australia Tel: 61-2-9868-6733 Fax: 61-2-9868-6755 Microchip Technology Japan K.K. Benex S-1 6F 3-18-20, Shinyokohama Kohoku-Ku, Yokohama-shi Kanagawa, 222-0033, Japan Tel: 81-45-471- 6166 Fax: 81-45-471-6122 Rocky Mountain China - Beijing 2355 West Chandler Blvd. Chandler, AZ 85224-6199 Tel: 480-792-7966 Fax: 480-792-7456 Microchip Technology Consulting (Shanghai) Co., Ltd., Beijing Liaison Office Unit 915 Bei Hai Wan Tai Bldg. No. 6 Chaoyangmen Beidajie Beijing, 100027, No. China Tel: 86-10-85282100 Fax: 86-10-85282104 Atlanta 500 Sugar Mill Road, Suite 200B Atlanta, GA 30350 Tel: 770-640-0034 Fax: 770-640-0307 Boston 2 Lan Drive, Suite 120 Westford, MA 01886 Tel: 978-692-3848 Fax: 978-692-3821 Chicago 333 Pierce Road, Suite 180 Itasca, IL 60143 Tel: 630-285-0071 Fax: 630-285-0075 Dallas 4570 Westgrove Drive, Suite 160 Addison, TX 75001 Tel: 972-818-7423 Fax: 972-818-2924 Detroit Tri-Atria Office Building 32255 Northwestern Highway, Suite 190 Farmington Hills, MI 48334 Tel: 248-538-2250 Fax: 248-538-2260 Kokomo 2767 S. Albright Road Kokomo, Indiana 46902 Tel: 765-864-8360 Fax: 765-864-8387 Los Angeles 18201 Von Karman, Suite 1090 Irvine, CA 92612 Tel: 949-263-1888 Fax: 949-263-1338 China - Chengdu Microchip Technology Consulting (Shanghai) Co., Ltd., Chengdu Liaison Office Rm. 2401, 24th Floor, Ming Xing Financial Tower No. 88 TIDU Street Chengdu 610016, China Tel: 86-28-6766200 Fax: 86-28-6766599 China - Fuzhou Microchip Technology Consulting (Shanghai) Co., Ltd., Fuzhou Liaison Office Unit 28F, World Trade Plaza No. 71 Wusi Road Fuzhou 350001, China Tel: 86-591-7503506 Fax: 86-591-7503521 China - Shanghai Microchip Technology Consulting (Shanghai) Co., Ltd. Room 701, Bldg. B Far East International Plaza No. 317 Xian Xia Road Shanghai, 200051 Tel: 86-21-6275-5700 Fax: 86-21-6275-5060 China - Shenzhen 150 Motor Parkway, Suite 202 Hauppauge, NY 11788 Tel: 631-273-5305 Fax: 631-273-5335 Microchip Technology Consulting (Shanghai) Co., Ltd., Shenzhen Liaison Office Rm. 1315, 13/F, Shenzhen Kerry Centre, Renminnan Lu Shenzhen 518001, China Tel: 86-755-2350361 Fax: 86-755-2366086 San Jose Hong Kong Microchip Technology Inc. 2107 North First Street, Suite 590 San Jose, CA 95131 Tel: 408-436-7950 Fax: 408-436-7955 Microchip Technology Hongkong Ltd. Unit 901-6, Tower 2, Metroplaza 223 Hing Fong Road Kwai Fong, N.T., Hong Kong Tel: 852-2401-1200 Fax: 852-2401-3431 New York Toronto 6285 Northam Drive, Suite 108 Mississauga, Ontario L4V 1X5, Canada Tel: 905-673-0699 Fax: 905-673-6509 India Microchip Technology Inc. India Liaison Office Divyasree Chambers 1 Floor, Wing A (A3/A4) No. 11, O’Shaugnessey Road Bangalore, 560 025, India Tel: 91-80-2290061 Fax: 91-80-2290062 Korea Microchip Technology Korea 168-1, Youngbo Bldg. 3 Floor Samsung-Dong, Kangnam-Ku Seoul, Korea 135-882 Tel: 82-2-554-7200 Fax: 82-2-558-5934 Singapore Microchip Technology Singapore Pte Ltd. 200 Middle Road #07-02 Prime Centre Singapore, 188980 Tel: 65-334-8870 Fax: 65-334-8850 Taiwan Microchip Technology Taiwan 11F-3, No. 207 Tung Hua North Road Taipei, 105, Taiwan Tel: 886-2-2717-7175 Fax: 886-2-2545-0139 EUROPE Denmark Microchip Technology Nordic ApS Regus Business Centre Lautrup hoj 1-3 Ballerup DK-2750 Denmark Tel: 45 4420 9895 Fax: 45 4420 9910 France Microchip Technology SARL Parc d’Activite du Moulin de Massy 43 Rue du Saule Trapu Batiment A - ler Etage 91300 Massy, France Tel: 33-1-69-53-63-20 Fax: 33-1-69-30-90-79 Germany Microchip Technology GmbH Gustav-Heinemann Ring 125 D-81739 Munich, Germany Tel: 49-89-627-144 0 Fax: 49-89-627-144-44 Italy Microchip Technology SRL Centro Direzionale Colleoni Palazzo Taurus 1 V. Le Colleoni 1 20041 Agrate Brianza Milan, Italy Tel: 39-039-65791-1 Fax: 39-039-6899883 United Kingdom Arizona Microchip Technology Ltd. 505 Eskdale Road Winnersh Triangle Wokingham Berkshire, England RG41 5TU Tel: 44 118 921 5869 Fax: 44-118 921-5820 01/18/02 DS40189D-page 38 Preliminary 2002 Microchip Technology Inc.