HCS412 KEELOQ Code Hopping Encoder and Transponder FEATURES PACKAGE TYPES Security • • • • • • • Automotive remote entry systems Automotive alarm systems Automotive immobilizers Gate and garage openers Electronic door locks (Home/Office/Hotel) Burglar alarm systems Proximity access control 2002 Microchip Technology Inc. 2 S2/RFEN/LC1 3 LC0 4 VDD VDD 7 LED 6 DATA 5 GND Oscillator Power Control Configuration Register LC0 RFEN/S2/LC1 DATA Debounce Control and Queuer LED Control PPM Detector Address EEPROM Decoding Register Wake-up Logic Encryption/Increment Logic S0 S1 LED 2.0V to 6.3V operation Three switch inputs: S2, S1, S0 – seven functions Battery-less bi-directional transponder capability Selectable baud rate and code word blanking Automatic code word completion Battery low detector PWM or Manchester data encoding Combined transmitter, transponder operation Anticollision of multiple transponders Passive proximity activation Device protected against reverse battery Intelligent damping for high Q LC-circuits 100 mVPP sensitive LC input Typical Applications S1 8 BLOCK DIAGRAM Operating • • • • • • • • • • • • • 1 Control Logic and Counters • • • • • • S0 Transponder Circuitry • Programmable 64-bit encoder crypt key Two 64-bit IFF keys Keys are read protected 32-bit bi-directional challenge and response using one of two possible keys 69-bit transmission length • 32-bit hopping code, • 37-bit nonencrypted portion Programmable 28/32-bit serial number 60-bit, read protected seed for secure learning Two IFF encryption algorithms Delayed counter increment mechanism Asynchronous transponder communication Transmissions include button Queuing information HCS412 • • • • PDIP, SOIC DATA PPM Manch. Encoder DATA Driver Other • • • • • • • • • • Simple programming interface On-chip tunable RC oscillator, ± 10% On-chip EEPROM 64-bit user EEPROM in Transponder mode Battery-low LED indication Serialized Quick Turn Programming (SQTPSM ) 8-pin PDIP/SOIC RF Enable output ASK and FSK PLL interface option Built in LC input amplifier Preliminary DS41099C-page 1 HCS412 GENERAL DESCRIPTION The HCS412 combines patented KEELOQ code hopping technology with bi-directional transponder challenge-and-response security into a single chip solution for logical and physical access control. When used as a code hopping encoder, the HCS412 is ideally suited to keyless entry systems; vehicle and garage door access in particular. The same HCS412 can also be used as a secure bi-directional transponder for contactless token verification. These capabilities make the HCS412 ideal for combined secure access control and identification applications, dramatically reducing the cost of hybrid transmitter/transponder solutions. 1.0 SYSTEM OVERVIEW Key Terms The following is a list of key terms used throughout this data sheet. For additional information on terminology, please refer to the KEELOQ introductory Technical Brief (TB003). • RKE - Remote Keyless Entry. • PKE - Passive Keyless Entry. • Button Status - Indicates what transponder button input(s) activated the transmission. Encompasses the 4 button status bits LC0, S2, S1 and S0 (Figure 3-2). • Code Hopping - A method by which a code, viewed externally to the system, appears to change unpredictably each time it is transmitted (Section 1.1.3). • Code word - A block of data that is repeatedly transmitted upon button activation (Section 3.2). • Transmission - A data stream consisting of repeating code words. • Crypt key - A unique and secret 64-bit number used to encrypt and decrypt data. In a symmetrical block cipher such as the KEELOQ algorithm, the encryption and decryption keys are equal and will therefore be referred to generally as the crypt key. • Encoder - A device that generates and encodes data. • Encryption Algorithm - A recipe whereby data is scrambled using a crypt key. The data can only be interpreted by the respective decryption algorithm using the same crypt key. • Decoder - A device that decodes data received from an encoder. • Transponder Reader (Reader, for short) - A device that authenticates a token using bi-directional communication. • Decryption algorithm - A recipe whereby data scrambled by an encryption algorithm can be unscrambled using the same crypt key. DS41099C-page 2 • Learn – Learning involves the receiver calculating the transmitter’s appropriate crypt key, decrypting the received hopping code and storing the serial number, synchronization counter value and crypt key in EEPROM (Section 6.1). The KEELOQ product family facilitates several learning strategies to be implemented on the decoder. The following are examples of what can be done. - Simple Learning The receiver uses a fixed crypt key, common to all components of all systems by the same manufacturer, to decrypt the received code word’s encrypted portion. - Normal Learning The receiver uses information transmitted during normal operation to derive the crypt key and decrypt the received code word’s encrypted portion. - Secure Learn The transmitter is activated through a special button combination to transmit a stored 60-bit seed value used to generate the transmitter’s crypt key. The receiver uses this seed value to derive the same crypt key and decrypt the received code word’s encrypted portion. • Manufacturer’s code - A unique and secret 64bit number used to generate unique encoder crypt keys. Each encoder is programmed with a crypt key that is a function of the manufacturer’s code. Each decoder is programmed with the manufacturer code itself. • Anticollision - A scheme whereby transponders in the same field can be addressed individually preventing simultaneous response to a command (Section 4.3.1). • IFF - Identify Friend or Foe (Section 1.2). • Proximity Activation - A method whereby an encoder automatically initiates a transmission in response to detecting an inductive field (Section 4.4.1). • Transport code - An access code, ‘password’ known only by the manufacturer, allowing program access to certain secure device memory areas (Section 4.3.3). • AGC - Automatic Gain Control. Preliminary 2002 Microchip Technology Inc. HCS412 1.1 Encoder Overview The HCS412 code hopping transcoder is designed specifically for passive entry systems; primarily vehicle access. The transcoder portion of a passive entry system is integrated into a transmitter, carried by the user and operated to gain access to a vehicle or restricted area. The HCS412 is meant to be a cost-effective yet secure solution to such systems, requiring very few external components (Figure 2-6). ‘grabbing’ or code ‘scanning’. The high security level of the HCS412 is based on the patented KEELOQ technology. A block cipher based on a block length of 32 bits and a key length of 64 bits is used. The algorithm obscures the information in such a way that even if the transmission information (before coding) differs by only one bit from that of the previous transmission, statistically greater than 50 percent of the next transmission’s encrypted bits will change. 1.1.3 1.1.1 Most low-end keyless entry transmitters are given a fixed identification code that is transmitted every time a button is pushed. The number of unique identification codes in a low-end system is usually a relatively small number. These shortcomings provide an opportunity for a sophisticated thief to create a device that ‘grabs’ a transmission and retransmits it later, or a device that quickly ‘scans’ all possible identification codes until the correct one is found. 1.1.2 HCS412 HOPPING CODE LOW-END SYSTEM SECURITY RISKS HCS412 SECURITY The HCS412, on the other hand, employs the KEELOQ code hopping technology coupled with a transmission length of 69 bits to virtually eliminate the use of code FIGURE 1-1: The 16-bit synchronization counter is the basis behind the transmitted code word changing for each transmission; it increments each time a button is pressed. Once the device detects a button press, it reads the button inputs and updates the synchronization counter. The synchronization counter and crypt key are input to the encryption algorithm and the output is 32 bits of encrypted information. This encrypted data will change with every button press, its value appearing externally to ‘randomly hop around’, hence it is referred to as the hopping portion of the code word. The 32-bit hopping code is combined with the button information and serial number to form the code word transmitted to the receiver. The code word format is explained in greater detail in Section 3.2. BUILDING THE TRANSMITTED CODE WORD (ENCODER) Transmitted Information EEPROM Array KEELOQ Encryption Algorithm 32 Bits of Encrypted Data Serial Number Button Press Information Crypt Key Sync Counter Serial Number 1.2 Identify Friend or Foe (IFF) Overview Validation of a token first involves an authentication device sending a random challenge to the token. The token then replies with a calculated response that is a function of the received challenge and the stored crypt key. The authentication device, transponder reader, performs the same calculation and compares it to the token’s response. If they match, the token is identified as valid and the transponder reader can take appropriate action. The bi-directional communication path required for IFF is typically inductive for short range (<10cm) transponder applications and an inductive challenge, RF response for longer range (~1.5m) passive entry applications. The HCS412’s 32-bit IFF response is generated using one of two possible encryption algorithms and one of two possible crypt keys; four combinations total. The authenticating device precedes the challenge with a five bit command word dictating which algorithm and key to use in calculating the response. 2002 Microchip Technology Inc. Preliminary DS41099C-page 3 HCS412 2.0 DEVICE DESCRIPTION 2.1 Pinout Description The HCS412’s footprint is identical to other encoders in the KEELOQ family, except for the two pins reserved for low frequency communication. TABLE 2-1: PINOUT SUMMARY Pin Name Pin Number S0 1 Button input pin with Schmitt Trigger detector and internal 60 kΩ (nominal) pull-down resistor (Figure 2-1). S1 2 Button input pin with Schmitt Trigger detector and internal 60 kΩ (nominal) pull-down resistor (Figure 2-1). S2/RFEN/LC1 3 Multi-purpose input / output pin (Figure 2-2). • Button input pin with Schmitt Trigger detector and internal pull-down resistor. • RFEN output driver. • LC1 low frequency (LF) antenna output driver for inductive responses and LC bias. • Programming clock signal input. LC0 4 Low frequency (LF) antenna input with automatic gain control for inductive reception and low frequency output driver for inductive responses (Figure 2-3). GND 5 Ground reference. DATA 6 Transmission data output driver. Programming input / output data signal (Figure 2-4). Description LED 7 LED output driver (Figure 2-5). VDD 8 Positive supply voltage. FIGURE 2-1: S0/S1 PIN DIAGRAM FIGURE 2-3: RECTIFIER AND REGULATOR SWITCH IN S0 S1 LC0 PIN DIAGRAM > 60 kΩ S2LC OPTION LC0 100Ω FIGURE 2-2: VDD AMP AND DET S2/RFEN/LC1 PIN DIAGRAM S2LC OPTION 10V VDD VBIAS > LC INPUT <LC OUTPUT RFEN > OUT 100Ω SWITCH 2 INPUT > < LC OUTPUT 10V DS41099C-page 4 Preliminary 2002 Microchip Technology Inc. HCS412 FIGURE 2-4: DATA PIN DIAGRAM FIGURE 2-5: LED PIN DIAGRAM LED DATA < IN R LED_ON > OE > DATA OUT > DATA 120 kΩ FIGURE 2-6: TYPICAL APPLICATION CIRCUITS Battery-less Short Range Transponder 1 S1 2 LC1 3 LC0 4 HCS412 S0 8 VDD 7 LED 6 DATA 5 GND Long Range / Proximity Activated Transponder / Encoder 1 S1 2 LC1 3 LC0 4 HCS412 S0 8 VDD 7 LED 6 DATA 5 GND RF Short Range Transponder with RFEN Control / Long Range Encoder 1 S1 2 RFEN 3 LC0 4 HCS412 2002 Microchip Technology Inc. S0 8 VDD 7 LED 6 DATA 5 GND Preliminary RF DS41099C-page 5 HCS412 2.2 Architecture Overview 2.2.1 WAKE-UP LOGIC AND POWER DISTRIBUTION The HCS412 automatically goes into a low-power Standby mode once connected to the supply voltage. Power is supplied to the minimum circuitry required to detect a wake-up condition; button activation or LC signal detection. The HCS412 will wake from Low-power mode when a button input is pulled high or a signal is detected on the LC0 LF antenna input pin. Waking involves powering the main logic circuitry that controls device operation. The button and transponder inputs are then sampled to determine which input activated the device. A button input activation places the device into Encoder mode. A signal detected on the transponder input places the device into Transponder mode. Encoder mode has priority over Transponder mode so a signal on the transponder input would be ignored if it occurred simultaneously to a button activation; ignored until the button input is released. 2.2.2 CONTROL LOGIC A dedicated state machine, timer and a 32-bit shift register perform the control, timing and data manipulation in the HCS412. This includes the data encryption, data output modulation and reading of and writing to the onboard EEPROM. 2.2.3 EEPROM The HCS412 contains nonvolatile EEPROM to store configuration options, user data and the synchronization counter. The configuration options are programmed during production and include the read protected security-related information such as crypt keys, serial number and discrimination value (Table 7-2). The 64 bits (4x16-bit words) of user EEPROM are read/ write accessible through the low frequency communication path as well as in-circuit, wire programmable during production. The initial synchronization counter value is programmed during production. The counter is implemented in Grey code and updated using bit writes to minimize EEPROM writing over the life of the product. The user need not worry about counter format conversion as the transmitted counter value is in binary format. Counter corruption is protected for by the use of a semaphore word as well as by the internal circuitry ensuring the EEPROM write voltage is at an acceptable level prior to each write. DS41099C-page 6 The EEPROM is programmed during production by clocking (S2 pin) the data into the DATA pin (Section 7.0). Certain EEPROM locations can also be remotely read/written through the LF communication path (Section 4.3). 2.2.4 CONFIGURATION REGISTER The first activation after connecting power to the HCS412, the device retrieves the configuration from EEPROM storage and buffers the information in a configuration register. The configuration register then dictates various device operation options including the RC oscillator tuning, the S2/RFEN/LC1 pin configuration, low voltage trip point, modulation format,... 2.2.5 ONBOARD RC OSCILLATOR AND OSCILLATOR TUNE VALUE (OSCT) The HCS412 has an onboard RC oscillator. As the RC oscillator is susceptible to variations in process parameters, temperature and operating voltage, oscillator tuning is provided for more accurate timing characteristics. The 4-bit Oscillator Tune Value (OSCT) (Table 2-2) allows tuning within ±4% of the optimal oscillator speed at the voltage and temperature used when tuning the device. A properly tuned oscillator is then accurate over temperature and voltage variations to within ±10% of the tuned value. Oscillator speed is significantly affected by changes in the device supply voltage. It is therefore best to tune the HCS412 such that the variance in oscillator speed be symmetrical about an operating mid-point (Figure 2-7). ie... • If the design is to run on a single lithium battery, tune the oscillator while supplying the HCS412 with ~2.5V (middle of the 3V to 2V usable battery life). • If the design is to run on two lithium batteries, tune the oscillator while supplying the HCS412 with ~4V (middle of 6V to 2V battery life). • If the design is to run on 5V, tune the oscillator while supplying the HCS412 with 5V. Say the HCS412’s oscillator is tuned to be optimal at a 6V supply voltage but the device will operate on a single lithium battery. The resulting oscillator variance over temperature and voltage will not be ±4% but will be more like -7% to -15%. Programming using a supply voltage other than 5V may not be practical. In these cases, adjust the oscillator tune value such that the device will run optimally at the target voltage. (i.e., If programming using 5V a device that will run at 3V, program the device to run slow at 5V such that it will run optimally at 3V). Preliminary 2002 Microchip Technology Inc. HCS412 TABLE 2-2: OSCILLATOR CALIBRATION VALUE (OSCT) OSCT3:0 Description Slowest Oscillator Setting (long TE) + : : Slower (longer TE) : 0000b Nominal Setting TYPICAL VOLTAGE TRIP POINTS Volts (V) 0111b 0011b 0010b 0001b FIGURE 2-8: VLOW 5.0 4.8 VLOW sel = 1 4.6 4.4 4.2 4.0 3.8 2.8 1111b 1110b 1101b : Faster (shorter TE) : - : 2.2 2.0 1000b Fastest Oscillator Setting (short TE) 1.8 VLOW sel = 0 2.6 2.4 1.6 FIGURE 2-7: -40 HCS412 NORMALIZED RFTE VERSUS TEMP 0 50 85 Temp (°C) Nominal VLOW trip point NORMALIZED RFTE 1.10 1.08 TABLE 2-3: RFTE VLOWSEL Nominal Trip Point Description 0 2.2V for 3V battery applications 1 4.4V for 6V battery applications 1.06 1.04 1.02 1.00 0.98 0.96 0.94 TABLE 2-4: 0.92 VLOW STATUS BIT RFTE 0.90 VLOW Description 0 VDD is above selected trip voltage 1 VDD is below selected trip voltage -50 -40 -30 -20 -10 0 10 20 30 40 50 60 70 80 90 VDD LEGEND = 2.0V = 3.0V = 6.0V Note: 2.2.6 VLOWSEL OPTIONS Temperature °C 2.2.7 Values are for calibrated oscillator. LOW VOLTAGE DETECTOR The HCS412’s battery voltage detector detects when the supply voltage drops below a predetermined value. The value is selected by the Low Voltage Trip Point Select (VLOWSEL) configuration option. THE S2/RFEN/LC1 PIN The S2/RFEN/LC1 pin may be used as a button input, RF enable output or as an interface to the LF antenna. Select between LC1 antenna interface and S2/RFEN functionality with the button/transponder select (S2LC) configuration option (Table 2-2). 2.2.7.1 S2 BUTTON INPUT CONSIDERATIONS The low voltage detector result is included in encoder transmissions (VLOW) allowing the receiver to indicate when the transmitter battery is low (Figure 3-2). The S2/RFEN/LC1 pin defaults to LF antenna output LC1 when the HCS412 is first connected to the supply voltage (i.e., battery replacement). The HCS412 indicates a low battery condition by changing the LED operation (Figure 3-9). The configuration register controlling the pin’s function is loaded on the first device activation after battery replacement. A desired S2 input state is therefore enabled only after the first activation of either S0, S1 or LC0. The transponder bias circuitry switches off and the internal pull-down resistor is enabled when the S2/ RFEN/LC1 pin reaches button input configuration. There will be an extra delay the first activation after connecting to the supply voltage while the HCS412 retrieves the configuration word and configures the pins accordingly. 2002 Microchip Technology Inc. Preliminary DS41099C-page 7 HCS412 2.2.7.2 TRANSPONDER INTERFACE Connecting an LC resonant circuit between the LC0 and the LC1 pins creates the bi-directional low frequency communication path with the HCS412. The internal circuitry on the HCS412 provides the following functions: • LF input amplifier and envelope detector to detect and shape the incoming low frequency excitation signal. • 10V zener input protection from excessive antenna voltage generated when proximate to very strong magnetic fields. • LF antenna clamping transistors for inductive responses back to the transponder reader. The antenna ends are shorted together, ‘clamped’, dissipating the oscillatory energy. The reader detects this as a momentary load on its excitation antenna. • Damping circuitry that improves communication when using high-Q LC antenna circuits. • Incoming LF energy rectification and regulation TABLE 2-2: During normal transponder operation, the LC1 pin functions to bias the LC0 AGC amplifier input. The amplifier gain control sets the optimum level of amplification in respect to the incoming signal strength. The signal then passes through an envelope detector before interpretation in the logic circuit. 2.2.7.3 RF ENABLE OUTPUT When the RF enable (RFEN) configuration option is enabled, the RFEN signal output is coordinated with the DATA output pin to provide typical ASK or FSK PLL activation. TABLE 2-1: RFEN OPTION RFEN Description 0 RF Enable output is disabled. 1 RF Enable output is enabled. S2/RFEN/LC1 CONFIGURATION OPTION S2LC 0 for the supply voltage in battery-less or low battery transponder instances. Resulting S2/RFEN/LC1 Configuration • LC1 low frequency antenna output driver for inductive responses and LC bias. Note: LC0 low frequency antenna input is also enabled. 1 • S2 button input pin with Schmitt Trigger detector and internal pull-down resistor. • RFEN output driver. Note: LC0 and LC1 low frequency antenna interfaces are disabled and the transponder circuitry is switched off to reduce standby current. 3.0 ENCODER OPERATION 3.1.2 3.1 Encoder Activation 3.1.1 BUTTON ACTIVATION The other way to enter Encoder mode is if the S2/LC option is configured for LC operation and the wake-up circuit detects a signal on the LC0 LF antenna input pin. This form of activation is called Proximity activation as a code hopping transmission would be initiated when the device was proximate to a LF field. The main way to enter Encoder mode is when the wake-up circuit detects a button input activation; button input transition from GND to VDD. The HCS412 control logic wakes and delays a switch debounce time prior to sampling the button inputs. The button input states, cumulatively called the button status, determine whether the HCS412 transmits a code hopping or seed transmission, Table 3-1. PROXIMITY ACTIVATION Refer to Section 4.4 for details on configuring the HCS412 for Proximity Activation. Additional button activations added during a transmission will immediately RESET the HCS412, perhaps leaving the current code word incomplete. The device will start a new transmission which includes the updated button code value. Buttons removed during a transmission will have no effect unless no buttons remain activated. If no button activations remain, the minimum number of compete code words will be completed (Section 3.4.1) and the device will return to Standby mode. DS41099C-page 8 Preliminary 2002 Microchip Technology Inc. HCS412 TABLE 3-1: ENCODER MODE ACTIVATION 4-Bit Button Status LC0 S2 (Note 1) S1 S0 SEED TMPSD Resulting Transmission X 0 0 1 X X Code hopping transmission X 0 1 0 X X Code hopping transmission X 0 1 1 0 0 Code hopping transmission 0 1 Code hopping code words until time = TDSD, then seed code words. SEED transmissions temporarily enabled until the 7lsb’s of the synchronization counter wrap 7Fh to 00h. Then only code hopping code words. 1 0 Code hopping code words until time = TDSD, then seed code words. 1 1 Code hopping transmission (2 key IFF enabled) X 1 0 1 X X Code hopping transmission X 1 0 0 X X Code hopping transmission X 1 1 0 X X Code hopping transmission X 1 1 1 0 0 Code hopping transmission 0 1 Limited SEED transmissions - temporarily enabled until the 7lsb’s of the synchronization counter wrap 7Fh to 00h. 1 0 SEED transmission 1 1 Code hopping transmission (2 key IFF enabled) X X Proximity activated code hopping transmission. 1 0 0 0 Note 1: The transmitted button status will reflect the state of the LC0 input when the button inputs are sampled. 3.2 Transmitted Code Word The HCS412 transmits a 69-bit code word in response to a button or proximity activation (Figure 3-1). Each code word contains a 50% duty cycle preamble, header, 32 bits of encrypted data and 37 bits of fixed code data followed by a guard period before another code word can begin. The 32 bits of Encrypted Data include 4 button bits, 2 counter overflow bits, 10 discrimination bits and the 16bit synchronization counter value (Figure 3-2). FIGURE 3-1: The content of the 37 bits of Fixed Code Data varies with the extended serial number (XSER) option (Figure 3-2). • If the extended serial number option is disabled (XSER = 0), the 37 bits include 5 status bits, 4 button status bits and the 28-bit serial number. • If the extended serial number option is enabled (XSER = 1), the 37 bits include 5 status bits and the 32-bit serial number. CODE WORD FORMAT 50% Duty Cycle Preamble TP 2002 Microchip Technology Inc. Header TH Encrypted Portion of Transmission THOP Preliminary Fixed Portion of Transmission TFIX Guard Time TG DS41099C-page 9 HCS412 FIGURE 3-2: CODE WORD ORGANIZATION 28-bit Serial Number (XSER = 0) Fixed Code Portion (37 Bits) QUE 2 Bits CRC 2 Bits VLOW 1-Bit BUT 4 Bits SER 1 12 MSb’s Hopping Code Portion Message (32 Bits) Q1 Q0 C1 C0 MSb S1 S0 LC0 S2 S1 S0 LC0 OVR1 69 Data bits Transmitted LSb first. Fixed Code Portion (37 Bits) VLOW 1-Bit SER 1 Most Sig 16 Bits Hopping Code Portion Message (32 Bits) 0 15 MSb S2 S1 S0 LC0 OVR1 LSb OVR0 69 Data bits Transmitted LSb first. Shaded data included in CRC calculation QUEUE COUNTER (QUE) The QUE counter can be used to request secondary decoder functions using only a single transmitter button. Typically a decoder must keep track of incoming transmissions to determine when a double button press occurs, perhaps an unlock all doors request. The QUE counter removes this burden from the decoder by counting multiple button presses. The 2-bit QUE counter is incremented each time an active button input is released for at least the Debounce Time (TDBR), then reactivated (button pressed again) within the Queue Time (TQUE). The FIGURE 3-3: Synchronization Counter 16 Bits Counter DISCRIM BUT Overflow 10 Bits 4 Bits 2 Bits SER 0 Least Sig 16 Bits Q1 Q0 C1 C0 3.2.1 LSb OVR0 32-bit Serial Number (XSER = 1) CRC 2 Bits 0 15 S2 QUE 2 Bits Synchronization Counter 16 Bits Counter BUT DISCRIM Overflow 4 Bits 10 Bits 2 Bits SER 0 Least Sig16 Bits counter increments up from 0 to a maximum of 3, returning to 0 only after a different button activation or after button activations spaced greater than the Queue Time (TQUE) apart. The current transmission aborts, after completing the minimum number of code words (Section 3.4.1), when the active button input is released. A button re-activation within Queue Time (TQUE) then initiates a new transmission (new synchronization counter, encrypted data) using the updated QUE value. Figure 3-3 shows the timing diagram to increment the queue counter value. QUE COUNTER TIMING DIAGRAM 1st Button Press All Buttons Released 2nd Button Press Input Sx QUE1:0 = 002 Synch CNT = X Code Words Transmitted t1 = 0 QUE1:0 = 012 Synch CNT = X+1 t1 > TDBP t2 = 0 DS41099C-page 10 Preliminary TDBR < t < TQUE 2002 Microchip Technology Inc. HCS412 3.2.2 CYCLE REDUNDANCY CHECK (CRC) 3.2.4 The CRC bits may be used to check the received data integrity, but it is not recommended when operating near the low voltage trip point, see Note below. The CRC is calculated on the 65 previously transmitted bits (Figure 3-2), detecting all single bit and 66% of all double bit errors. EQUATION 3-1: CRC CALCULATION CRC [ 1 ] n + 1 = CRC [ 0 ]n ⊕ Din and CRC [ 0 ] n + 1 = ( CRC [ 0 ] n ⊕ Din ) ⊕ CRC [ 1 ] n with Note: The CRC may be wrong when the operating voltage is near VLOW trip point. VLOW is sampled twice each transmission, once for the CRC calculation (DATA output is LOW) and once when the VLOW bit is transmitted (DATA output is HIGH). VDD varying slightly during a transmission could lead to a different VLOW status transmitted than that used in the CRC calculation. Work around: If the CRC is incorrect, recalculate for the opposite value of VLOW. LOW VOLTAGE DETECTOR STATUS (VLOW) The low voltage detector result is included in every transmitted code word. The HCS412 samples the voltage detector output at the onset of a transmission and just before the VLOW bit is transmitted in each code word. The first sample is used in the CRC calculation and the subsequent samples determine what VLOW value will be transmitted. The transmitted VLOW status will be a ‘0’ as long as VDD remains above the selected low voltage trip point. VLOW will change to a ‘1’ if VDD drops below the selected low voltage trip point. LOW VOLTAGE STATUS BIT VLOW Description 0 VDD is above trip voltage (VLOWSEL) 1 VDD is below trip voltage (VLOWSEL) TABLE 3-3: LOW VOLTAGE TRIP POINT SELECTION OPTIONS VLOWSEL Nominal Trip Point 0 2.2V for 3V battery applications 1 4.4V for 6V battery applications Description 2002 Microchip Technology Inc. The bits must be programmed during production as ‘1’s to be utilized. OVR0 is cleared the first time the synchronization counter wraps from FFFFh to 0000h. OVR1 is cleared the second time the synchronization counter wraps to zero. The two bits remain at ‘0’ after all subsequent counter wraps. EXTENDED SERIAL NUMBER (XSER) The Extended Serial Number option determines whether the serial number is 28 or 32 bits. CRC [ 1, 0 ] 0 = 0 TABLE 3-2: The Counter Overflow Bits may be utilized to increase the synchronization counter range from the nominal 65,535 to 131,070 or 196,605. 3.2.5 and Din the nth transmission bit 0 ≤ n ≤ 64 3.2.3 COUNTER OVERFLOW BITS (OVR1, OVR0) When configured for a 28-bit serial number, the most significant nibble of the 32 bits reserved for the serial number is replaced with a copy of the 4-bit button status, Figure 3-2. 3.2.6 DISCRIMINATION VALUE (DISC) The Discrimination Value is a 10-bit fixed value typically used by the decoder in a post-decryption check. It may be any value, but in a typical system it will be programmed as the 10 Least Significant bits of the serial number. The discrimination bits are part of the information that form the encrypted portion of the transmission (Figure 3-2). After the receiver has decrypted a transmission, the discrimination bits are checked against the receiver’s stored value to verify that the decryption process was valid. If the discrimination value was programmed equal to the 10 LSb’s of the serial number then it may merely be compared to the respective bits of the received serial number. 3.2.7 SEED CODE WORD DATA FORMAT The Seed Code Word transmission allows for what is known as a secure learning function, increasing a system’s security. The seed code word also consists of 69 bits, but the 32 bits of code hopping data and the 28 bits of fixed data are replaced by a 60-bit seed value that was stored during production (Figure 3-4). Instead of using the normal key generation inputs to create the crypt key, this seed value is used. Seed transmissions are either: • permanently enabled • permanently disabled • temporarily enabled (limited) until the 7 Least Significant bits of the synchronization counter wrap from 7Fh to 00h. The Seed Enable (SEED) and Temporary Seed Enable (TMPSD) configuration options control the function (Table 3-4). Preliminary DS41099C-page 11 HCS412 FIGURE 3-4: QUE 2 Bits CRC 2 Bits SEED CODE WORD DATA FORMAT VLOW 1-Bit BUT 4 Bits SDVAL3 12 Most Sig Bits SDVAL2 16 Bits SDVAL1 16 Bits SDVAL0 16 Least Sig Bits Q1 Q0 C1 C0 MSb LSb S2 S1 S0 LC0 69 Data bits Transmitted LSb first. Shaded data included in CRC calculation Note: SEED transmissions only allowed when appropriate configuration bits are set. TABLE 3-4: SEED TRANSMISSION OPTIONS SEED TMPSD Description 0 0 0 1 Limited SEED transmissions (Note 1) - temporarily enabled until the 7 LSb’s of the synchronization counter wrap from 7Fh to 00h 1 0 SEED transmissions permanently enabled (Note 1) 1 1 SEED transmissions permanently disabled (2 key IFF enabled) SEED transmissions permanently disabled Note 1: Refer to Table 3-1 for appropriate button activation of SEED transmissions. 3.3 Transmission Data Modulation The modulated data timing is typically referred to in multiples of a Basic Timing Element (RFTE). ‘RF’ TE because the DATA pin output is typically sent through a RF transmitter to the decoder or transponder reader. The data modulation format is selectable between Pulse Width Modulation (PWM) and Manchester using the Data Modulation (MOD) configuration option. RFTE may be selected using the Transmission Baud Rate (RFBSL) configuration option (Table 3-6). Regardless of the modulation format, each code word contains a leading 50% duty cycle preamble and a synchronization header to wake the receiver and provide synchronization events for the receive routine. Each code word also contains a trailing guard time, separating code words. Manchester encoding further includes a leading and closing ‘1’ around each 69-bit data block. TABLE 3-5: The same code word repeats as long as the same input pins remain active, until a time-out occurs or a delayed seed transmission is activated. TRANSMISSION MODULATION TIMING Period PWM Manchester Units Preamble 31* 31* RFTE Header 10 4 RFTE Data 207 142 RFTE Guard 46 31 RFTE * Enabling long preambles extends the first code word’s preamble to TLPRE milliseconds. TABLE 3-6: BAUD RATE SELECTION (RFBSL) RFBSL1:0 CWBE 00b 01b 10b 11b DS41099C-page 12 PWM RFTE Manchester RFTE Transmit... X 400 µs 800 µs All code words 0 200 µs 400 µs All code words 1 200 µs 400 µs Every other code word 0 100 µs 200 µs All code words 1 100 µs 200 µs Every other code word 0 100 µs 200 µs All code word 1 100 µs 200 µs Every fourth code word Preliminary 2002 Microchip Technology Inc. HCS412 FIGURE 3-5: PWM TRANSMISSION FORMAT—MOD = 0 1 CODE WORD TOTAL TRANSMISSION: Preamble Sync Encrypt Guard Fixed TE TE Preamble Sync Encrypt TE LOGIC "0" LOGIC "1" 31 RFTE Preamble, 50% Duty Cycle Long Preamble (LPRE) disabled Encrypted Portion 10TE Header Fixed Code Portion Guard Time CODE WORD FIGURE 3-6: MANCHESTER TRANSMISSION FORMAT—MOD = 1 1 CODE WORD TOTAL TRANSMISSION: Preamble Sync Encrypt Fixed Guard TE Preamble Sync Encrypt TE LOGIC "0" LOGIC "1" START bit bit 0 bit 1 bit 2 50% Duty Preamble Header Encrypted Portion STOP bit Fixed Code Portion Guard Time CODE WORD 3.4 Encoder Special Features 3.4.2 3.4.1 CODE WORD COMPLETION AND MINIMUM CODE WORDS The Auto-shutoff function prevents battery drain should a button get stuck for a long period of time. The time period (TTO) is approximately 20 seconds, after which the device will enter Time-out mode. The code word completion feature ensures that entire code words are transmitted, even if the active button is released before the code word transmission is complete. If the button is held down beyond the time for one code word, multiple complete code words will result. The device default is that a momentary button press will transmit at least one complete code word. Enable the Minimum Four Code Words (MTX4) configuration option to extend this feature such that a minimum of 4 code words are completed on a momentary button activation. 2002 Microchip Technology Inc. AUTO-SHUTOFF The device will stop transmitting in Time-out mode but there will be leakage across the stuck button input’s internal pull-down resistor. The current draw will therefore be higher than when in Standby mode. 3.4.3 CODE WORD BLANKING ENABLE Federal Communications Commission (FCC) part 15 rules specify the limits on worst case average fundamental power and harmonics that can be transmitted in a 100 ms window. For FCC approval purposes, it may therefore be advantageous to minimize the transmission duty cycle. This can be achieved by minimizing the on-time of the individual bits as well as by blanking out consecutive code words. Preliminary DS41099C-page 13 HCS412 The Code Word Blanking Enable (CWBE) option may be used to reduce the average power of a transmission by transmitting only every second or every fourth code word (Figure 3-7). This selectable feature is determined in conjunction with the baud rate selection bit RFBSL (Table 3-7). FIGURE 3-7: Enabling the CWBE option may similarly allow the user to transmit a higher amplitude transmission as the time averaged power is reduced. CWBE effectively halves the RF on-time for a given transmission so the RF output power could theoretically be doubled while maintaining the same time averaged output power. CODE WORD BLANKING RF Output Amplitude = A CWBE Disabled (All words transmitted) A CWBE Enabled (1 out of 2 transmitted) 2A Code Word CWBE Enabled (1 out of 4 transmitted) 4A Code Word TABLE 3-7: Code Word Code Word Code Word Code Word Code Word Code Word Code Word Code Word Code Word Code Word Code Word CODE WORD BLANKING ENABLE (CWBE) RFBSL1:0 CWBE PWM RFTE Manchester RFTE Transmit... 00b X 400 µs 800 µs All code words 01b 10b 11b 3.4.4 Code Word 0 200 µs 400 µs All code words 1 200 µs 400 µs Every other code word 0 100 µs 200 µs All code words 1 100 µs 200 µs Every other code word 0 100 µs 200 µs All code word 1 100 µs 200 µs Every fourth code word DELAYED INCREMENT (DINC) The HCS412’s Delayed Increment feature advances the synchronization counter by 12 a period of TTO after the encoder activation occurs, for additional security. The next activation will show a synchronization counter increase of 13, not 1. The PLL Interface (AFSK) configuration option controls the output as shown in Figure 3-8. TABLE 3-8: PLL INTERFACE(AFSK) AFSK Description 0 ASK PLL Setup 1 FSK PLL Setup If the active button is released before the time-out TTO has elapsed, the device stops transmitting but remains powered for the duration of the time-out period. The device will then advance the stored synchronization counter by 12 before powering down. 3.4.6 If the active button is released before the time-out TTO has elapsed and another activation occurs while waiting out the time-out period, the time-out counter will RESET and the resulting transmission will contain synchronization counter value +1. If the supply voltage drops below the trip point specified by VLDWSEL, the LED pin will be driven low only once for a longer period of time. Note: If delayed increment is enabled, the QUE counter will not reset to 0 until timeout TTO has elapsed. 3.4.5 PLL INTERFACE If the RFEN/S2/LC1 pin is configured as an RF enable output, the pin’s behavior is coordinated with the DATA pin to enable a typical PLL’s ASK or FSK mode. DS41099C-page 14 LED OUTPUT During normal operation (good battery), while transmitting data the device’s LED pin will periodically be driven low as indicated in Figure 3-9. 3.4.7 LONG PREAMBLE (LPRE) Enabling the Long Preamble configuration option extends the first code word’s 50% duty cycle preamble to a ‘long’ preamble time TLPRE. The longer preamble will be a square wave at the selected RFTE (Figure 3-10). Preliminary 2002 Microchip Technology Inc. HCS412 FIGURE 3-8: RF ENABLE/ASK/FSK OPTIONS AFSK = 0, RFEN = 1 SWITCH S2/RFEN/LC1 DATA TTD Code Word Code Word Code Word Code Word Code Word Code Word TLEDON AFSK = 1, RFEN = 0 SWITCH S2/RFEN/LC1 DATA FIGURE 3-9: LED OPERATION NORMAL OPERATION SWITCH DATA Code Word Code Word Code Word LED TLEDON TLEDOFF LOW VOLTAGE OPERATION SWITCH Code Word Code Word Code Word DATA LED TLEDL FIGURE 3-10: LONG PREAMBLE ENABLED (LPRE) First Code Word Header TLPRE Consecutive Code Words First Code Word - Long Preamble 2002 Microchip Technology Inc. Second Code Word - Normal Preamble Preliminary Third Code Word - Normal Preamble DS41099C-page 15 HCS412 3.4.8 QLVS FEATURES Setting the HCS412’s special QLVS (‘Quick Secure Learning’) configuration option enables the following options: • Reduces the time (TDSD) before a delayed seed transmission begins. • Disables DATA modulation when the LED pin is driven low (Figure 3-11). - If the PLL Interface option is set to ASK, the DATA pin will go low while the LED pin is low. - If the PLL Interface option is set to FSK, the DATA pin will go high and the RFEN output will go low while the LED pin is low. If the battery is low, the HCS412 transmits only until the LED goes on. • If the Temporary Seed (TMPSD) option is enabled, seed transmission capability can be disabled by applying the button sequence shown in Figure 3-12 FIGURE 3-11: LED, DATA, RFEN INTERACTION WHEN QLVS IS SET QLVS = 1, RFEN = 1 SWITCH LED TTD TLEDON AFSK = 0 (ASK) S2/RFEN/LC1 DATA AFSK = 1 (FSK) S2/RFEN/LC1 DATA FIGURE 3-12: SEED DISABLE WAVEFORM 50 ms S0, S1 50 ms DS41099C-page 16 1200 ms Preliminary 2002 Microchip Technology Inc. HCS412 TABLE 3-9: ENCODER TIMING SPECIFICATIONS VDD = +2.0 to 6.6V Commercial (C):TAMB = 0°C to +70°C Industrial (I): TAMB = -40°C to +85°C Parameter Symbol Min. Typ. Max. Unit Remarks TBP 44 + Code Word Time 58 + Code Word Time 63 + Code Word Time ms Note 1 Transmit delay from button detect TTD 20 30 40 ms Note 2 Debounce delay on button press TDBP 14 20 26 ms Debounce delay on button release TDBR Auto-shutoff time-out period TTO Time to second button press Long preamble 20 18 20 ms 22 s Note 3 TLPRE 64 ms LED on time TLEDON 32 ms Note 4 LED off time TLEDOFF 480 ms Note 4 LED on time (VDD < VLOW Trip Point) TLEDL 200 ms Note 5 Time to delayed SEED transmission TDSD 3 s Queue Time TQUE 30 ms Note 1: TBP is the time in which a second button can be pressed without completion of the first code word where the intention was to press the combination of buttons. 2: Transmit delay maximum value, if the previous transmission was successfully transmitted. 3: The auto-shutoff time-out period is not tested. 4: The LED times specified for VDD > VTRIP specified by VLOW in the configuration word. 5: LED on time if VDD < VTRIP specified by VLOW in the configuration word. 2002 Microchip Technology Inc. Preliminary DS41099C-page 17 HCS412 4.0 TRANSPONDER OPERATION 4.1 IFF Mode The HCS412’s IFF Mode allows it to function as a bidirectional token or transponder. IFF mode capabilities include the following. • A bi-directional challenge and response sequence for IFF validation. HCS412 IFF responses may be directed to use one of two available encryption algorithms and one of two available crypt keys. • Read selected EEPROM areas. • Write selected EEPROM areas. • Request a code hopping transmission. • Proximity Activation of a code hopping transmission. 4.2 • RF responses on the DATA pin modulate according to standard encoder transmissions (Figure 3-5, Figure 3-6). Communication with the HCS412 over the low frequency path (LC pins) uses a basic Timing Element, LFTE. The Low Frequency Baud Rate Select option, LFBSL, sets LFTE to either 100 µs or 200 µs (Table 4-1). The response on the DATA pin uses the Encoder mode’s RF Timing Element (RFTE) and the modulation format set by the MOD configuration option (Table 3-6). The RF responses use the standard Encoder mode format with the 32-bit hopping portion replaced by the response data (Figure 4-19). If the response is only 16 bits, the 32 bits will contain 2 copies of the response (Figure 4-16). TABLE 4-1: IFF Communication The transponder reader initiates each communication by turning on the low frequency field, then waits for a HCS412 to Acknowledge the field. The HCS412 enters IFF mode upon detecting a signal on the LC0 LF antenna input pin. Once the incoming signal has remained high for at least the power-up time TPU, the device responds with a field Acknowledge sequence indicating that the it has detected the LF field, is in IFF Mode and is ready to receive commands (Figure 4-1). The HCS412 will repeat the field Acknowledge sequence every 255 LFTE‘s if the field remains but no command is received (Figure 4-1). The transponder reader follows the HCS412’s field Acknowledge by sending the desired 5-bit command and associated data. LF commands are always preceded by a 2 LFTE low START pulse and are Pulse Position Modulated (PPM) as shown in Figure 4-2. The last command or data bit should be followed by leaving the field on for a minimum of 6 LFTE. HCS412 PPM data responses are preceded by a 1 LFTE low pulse, followed by a 01b preamble before the data begins (Figure 4-4). The responses are sent either on the LC antenna output alone or on both the LC output and the DATA pin, depending on the device configuration (Section 4.4.2). This allows for short-range LF responses as well as long-range RF responses. Data to and from the HCS412 is always sent Least Significant bit first. The data length and modulation format vary according to the command and the transmission path. Data Length and Commands: • Read and Write transfers 16 bits of data. • Challenge and Response transfers 32 bits of data. LOW FREQUENCY BAUD RATE SELECT BITS LFBSL LFTE 0 200 µs 1 100 µs 4.2.1 CALCULATING COMMUNICATION TE The HCS412’s internal oscillator will vary ±10% over the device’s rated voltage and temperature range. When the oscillator varies, both its transmitted TE and expected TE when receiving will vary. Communication reliability with the token may be improved by calculating the HCS412’s TE from the field Acknowledge sequence and using this measured time element in communication to and in reception routines from the token. Always begin and end the time measurement on rising edges. Whether LF or RF, the falling edge decay rates may vary but the rising edge relationships should remain consistent. A common TE calculation method would be to time an 8 TE sequence, then divide the value down to determine the single TE value. An 8 TE measurement will give good resolution and may be easily right-shifted (divide by 2) three times for the math portion of the calculation (Figure 4-1). Accurately measuring TE is important for communicating to an HCS412 as well as for inductive programming a device. The configuration word sent during programming contains the 4-bit oscillator tuning value. Accurately determining TE allows the programmer to calculate the correct oscillator tuning bits to place in the configuration word, whether the device oscillator needs to be sped up or slowed down to meet its desired TE. Modulation Format and Transmission Path: • LF responses on the LC output are Pulse Position Modulated (PPM) according to Figure 4-2. DS41099C-page 18 Preliminary 2002 Microchip Technology Inc. HCS412 FIGURE 4-1: FIELD ACKNOWLEDGE SEQUENCE 3LFTE 3LFTE 3LFTE TPU 2LFTE TATO Command Inductive Comms (LC) 8LFTE RF Comms (DATA) 8LFTE Field Ack sequence repeats every 255 LFTE if no command is received. Inductive Comms (LC) 255LFTE 255LFTE RF Comms (DATA) Communication from reader to HCS412 Filed ACK Sequence from HCS412 to reader FIGURE 4-2: LC PIN PULSE POSITION MODULATION (PPM) Transponder reader communication to the HCS412 0 1 Start or previous bit 2 LFTE 2 LFTE TBITC Extending the high time is acceptable but the low time should minimally be 1 LFTE. The HCS412 determines bit values from rising edge to rising edge times. 4 LFTE 2 LFTE TBITC HCS412 response back to the reader 0 1 Start or previous bit LFTE LFTE 2 LFTE LFTE TBITR TBITR 2002 Microchip Technology Inc. Preliminary DS41099C-page 19 HCS412 4.3 IFF Commands TABLE 4-2: LIST OF AVAILABLE IFF COMMANDS Opcode Command Anticollision Command (Section 4.3.1) 00000 Select HCS412, used if Anticollision enabled Read Commands (Section 4.3.2) 00001 Read configuration word 00010 Read low serial number (least significant 16 bits) 00011 Read high serial number (most significant 16 bits) 00100 Read user EEPROM 0 00101 Read user EEPROM 1 00110 Read user EEPROM 2 00111 Read user EEPROM 3 Program Command (Section 4.3.5) 01000 Program HCS412 EEPROM Write Commands (Section 4.3.3) 01001 Write configuration word 01010 Write low serial number (least significant 16 bits) 01011 Write high serial number (most significant 16 bits) 01100 Write user EEPROM 0 01101 Write user EEPROM 1 01110 Write user EEPROM 2 01111 Write user EEPROM 3 Challenge and Response Commands (Section 4.3.6) 10000 Challenge and Response using key-1 and IFF algorithm 10001 Challenge and Response using key-1 and HOP algorithm 10100 Challenge and Response using key-2 and IFF algorithm 10101 Challenge and Response using key-2 and HOP algorithm Request Hopping Code Command (Section 4.3.7) 11000 Request Hopping Code transmission Default IFF Command (Section 4.3.8) 11100 DS41099C-page 20 Enable default IFF communication Preliminary 2002 Microchip Technology Inc. HCS412 ANTICOLLISION Clocking out ‘1’s then increments the 3 LSb’s, the first ‘1’ setting the bits to 000b. When the value matches the 3 LSb’s of a token, the token responds with an Encoder Select Acknowledge. The reader must halt clocking out further ‘1’s or risk selecting multiple tokens. Any remaining tokens in the field will be unselected, responding only if a new device selection sequence selects them. Removing the field will also RESET a selected/unselected state if removed long enough to result in a device RESET. Multiple tokens in the same inductive field will simultaneously respond to inductive commands. The responses will collide making token authentication impossible. Enabling anticollision allows addressing of an individual token, regardless how many tokens are in the field. The HCS412 method is that all tokens trained to a given vehicle will have the same 25 MSb’s of their serial number. The serial numbers of up to 8 tokens trained to access a given vehicle will differ only in the 3 LSb’s. Think of the 25 MSb’s of the HCS412's serial number as the vehicle ID and the 3 LSb’s as the token ID. The vehicle ID associates the token with a given vehicle and the token ID makes it a uniquely addressable (selectable) 1 of 8 possible tokens authorized to access the vehicle. The ability to isolate a single HCS412 for communication greatly depends on the number of Most Significant serial number bits included in the device selection sequence. The more serial number bits sent, the more narrow the device selection. All bits not transmitted are treated as wildcards. Sending only 1 bit, bit 3 as a ‘0’, will only narrow the number of tokens allowed to respond to all with bit 3 equal to ‘0’. When the transponder reader sends the full 25 MSb’s of the serial number, it narrows all possible tokens down to only those trained to the vehicle - only those tokens whose serial number’s 25 MSb’s match. The transponder reader addresses an individual token, HCS412, by sending a ‘SELECT ENCODER’ command. The command is followed by from 1 to 25 bits of the HCS412's serial number, starting with bit 3 (Least Significant bit first) (Figure 4-3). DEVICE SELECT COMMAND Command Description Expected data In 00000 Select HCS412, used if Anticollision enabled The desired HCS412’s serial number 0 Command MSb Delay to Serial Most Sig X Bits of Serial Number TOTD 1 to 25 bits of the Serial Number, starting with Bit 3. Delay Clock Serial 3 LSb’s RF Comms Communication from reader to HCS412 2ms 000b 001b 010b 011b : Bit X 2 LFTE Start 1 to 25 bits of the Serial Number, starting with Bit 3. TESA Encoder Select ACK Send ‘1’s to increment 3LSb’s Bit 27 Bit 26 Bit 25 Bit 24 Bit 23 Bit 22 Bit 21 Bit 20 Bit 19 Bit 18 Bit 17 Bit 16 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Communication from HCS412 to reader 28-bit Serial Number Bit 5 2 LFTE Start Bit 4 2 LFTE Start Bit 3 Inductive Comms ACK 4th ‘1’ interrupted by ACK, indicating selection @ LSb = 011b ‘1’ 0 0 Command ‘1’ Delay to Command 0 ACK 0 Activate Field Encoder select Acknowledge if serial number match ANTICOLLISION - DEVICE SELECTION LSb FIGURE 4-3: Response ‘1’ TABLE 4-3: ‘1’ 4.3.1 2002 Microchip Technology Inc. Preliminary DS41099C-page 21 HCS412 4.3.2 The following locations are available to read: READ • The 64-bit general purpose user EEPROM. (USER[3:0]). • The 32-bit serial number (SER[1:0]). The serial number is also transmitted in each code hopping transmission. • The16-bit Configuration word containing all nonsecurity related options. The transponder reader sends one of seven possible read commands indicating which 16-bit EEPROM word to retrieve (Table 4-4). The HCS412 retrieves the data and returns the 16-bit response. Each Read response is preceded by a 1LFTE low START pulse and ‘01b’ preamble (Figure 4-4). TABLE 4-4: LIST OF READ COMMANDS Command Description Expected data In 00001 Read Configuration word None 16-bit Configuration word 00010 Read low serial number None Lower 16 bits of serial number (SER0) 00011 Read high serial number None Higher 16 bits of serial number (SER1) 00100 Read user EEPROM 0 None 16 Bits of User EEPROM USR0 00101 Read user EEPROM 1 None 16 Bits of User EEPROM USR1 00110 Read user EEPROM 2 None 16 Bits of User EEPROM USR2 00111 Read user EEPROM 3 None 16 Bits of User EEPROM USR3 READ ACK Delay to Command Command Communication from reader to HCS412 TRT 01b Preamble 6 LFTE 0 0 Command 16-bit Response 0 1 MSb bit2 bit1 2 LFTE Start bit0 ACK LSb TATO TPU Delay until Response 1 LFTE Start 16-bit Response MSb Activate Field LSb FIGURE 4-4: Response Communication from HCS412 to reader 4.3.3 WRITE The transponder reader sends one of seven possible write commands (Table 4-5) indicating which 16-bit EEPROM word to write to. The 16-bit data to be written follows the command. The HCS412 will attempt to write the value into EEPROM and respond with an Acknowledge sequence if successful. The following locations are available to write: • The 64-bit general purpose user EEPROM. (USER[3:0]) (Figure 4-6). • The 32-bit serial number (SER[1:0]). The serial number is also transmitted in each code hopping transmission (Figure 4-5). • The16-bit Configuration word containing all nonsecurity related configuration options. If the configuration is written, the device must be RESET before the new settings take effect (Figure 4-5). DS41099C-page 22 A Transport Code, write access password, protects the serial number and configuration word from undesired modification. For these locations the reader must follow the WRITE command with the appropriate 28-bit transport code, then the 16 bits of data to write. Only a correct match with the transport code programmed during production will allow write access to the serial number and configuration word (Figure 4-5). The delay to a successful write Acknowledge will vary depending on the number of bits changed. Preliminary 2002 Microchip Technology Inc. HCS412 TABLE 4-5: LIST OF WRITE COMMANDS Command Description Expected data In Response if Write is Successful 01001 Write Configuration word 28-bit Transport code; 16-Bit configuration word Write Acknowledge pulse 01010 Write low serial number 28-bit Transport code; Least Significant 16 bits of the serial number (SER0) Write Acknowledge pulse 01011 Write high serial number 28-bit Transport code; Most Significant 16 bits of the serial number (SER1) Write Acknowledge pulse 01100 Write user EEPROM 0 16 Bit User EEPROM USR0 Write Acknowledge pulse 01101 Write user EEPROM 1 16 Bit User EEPROM USR1 Write Acknowledge pulse 01110 Write user EEPROM 2 16 Bit User EEPROM USR2 Write Acknowledge pulse 01111 Write user EEPROM 3 16 Bit User EEPROM USR3 Write Acknowledge pulse ACK Delay to Command Delay to TCODE Command 28-bit Transport Code Delay to Data TTTD 2 LFTE Start MSb MSb LSb 0 Command 0 1 2 LFTE Start bit1 ACK bit0 TPU LSb TOTD TATO 16 bits Data 28-bit Transport Code 2 LFTE Start Delay before Write Write ACK ACK TWR 16 Data Bits MSb Activate Field WRITE TO SERIAL NUMBER OR CONFIGURATION LSb FIGURE 4-5: Write Delay ACK Communication from reader to HCS412 Communication from HCS412 to reader Delay to Command Communication from reader to HCS412 0 16 Data Bits MSb Command Delay before Write Write ACK ACK TWR LSb 2 LFTE Start MSb LSb ACK 16 bits Data TOTD 1 TATO TPU Delay to Data Command 1 ACK bit1 Activate Field WRITE TO USER AREA bit0 FIGURE 4-6: Write Delay ACK 2 LFTE Start Communication from HCS412 to reader 2002 Microchip Technology Inc. Preliminary DS41099C-page 23 HCS412 4.3.4 BULK ERASE Resetting the device after the PROGRAM command results in a bulk erase, resetting the EEPROM memory map to all zeros. This is important to remember as the reader must now communicate to the device using the communication options resulting from a zero’d configuration word - baud rates, modulation format, etc. (Table 5-1). A Bulk Erase resets the HCS412’s memory map to all zeros. The transponder reader selects the appropriate device through anticollision, as need be, issues the PROGRAM command followed by the device’s 28-bit transport code, then resets the device by removing the field for 100 ms. FIGURE 4-7: BULK ERASE Activate Field ACK Delay to Command 28-bit Transport Code Delay to TCODE Command Delay 6ms MSb LSb 28-bit Transport Code 2 LFTE Start Communication from reader to HCS412 100ms 0 MSb 1 Program Command 2 LFTE Start 0 0 ACK 0 TPU LSb TOTD TATO Device Reset Communication from HCS412 to reader PROGRAM tion. Each word follows the standard HCS412 response format with a leading 1LFTE low START pulse and ‘01b’ preamble (Figure 4-10). Inductive programming a HCS412 begins with a bulk erase sequence (Section 4.3.4), followed by issuing the PROGRAM command and the desired EEPROM memory map’s 18x16-bit words (Section 5.0). The HCS412 will send a write Acknowledge after each word has been successfully written, indicating the device is ready to receive the next 16-bit word. Since the bulk erase resets the configuration options to all zeros, the oscillator tuning value will also be cleared. The correct tuning value is required when the programming sequence sends the new configuration word. The value may either be obtained by reading the configuration word prior to bulk erase to extract the value or by determining TE from the field Acknowledge sequence and calculating the tuning value appropriately (Section 4.2.1). After a complete 18 word memory map has been received and written, the HCS412 PPM modulates 18 bursts of 16-bit words on the LC pins for write verifica- TABLE 4-6: PROGRAM COMMANDS Command Program HCS412 EEPROM FIGURE 4-8: Expected data In Response Transport code (28 bits); Complete memory map: 18 x 16-bit words (288 bits) Write Acknowledge pulse after each 16-bit word, 288 bits transmitted in 18 bursts of 16-bit words PROGRAM SEQUENCE - FIRST WORD Activate Field ACK Delay to Command Delay to TCODE Command 28-bit Transport Code Delay to Data TTTD 2 LFTE Start MSb LSb 0 0 0 Program Command MSb 2 LFTE Start 1 ACK LSb TPU 0 TOTD TATO Delay before Write Write ACK ACK 16 bits Data 28-bit Transport Code TWR 16 Data Bits MSb 01000 Description LSb 4.3.5 Write Delay ACK 2 LFTE Start Communication from reader to HCS412 Repeat 18 times for programming Communication from HCS412 to reader DS41099C-page 24 Preliminary 2002 Microchip Technology Inc. HCS412 Successful Write Acknowledge 16-bit Word 18 Reserved (all 0’s) Successful Write Acknowledge 16-bit Word 17 CNT1, CNT0 Successful Write Acknowledge 16-bit Word 2 KEY1_3, KEY1_2 Successful Write Acknowledge Transport Code ACK 16-bit Word 1 KEY1_1, KEY1_0 PROGRAM SEQUENCE - CONSECUTIVE WORDS Program Command FIGURE 4-9: MSb Reserved LSb Reserved MSb CNT1 LSb CNT0 MSb KEY1_3 LSb KEY1_2 LSb KEY1_0 MSb KEY1_1 Start Verify Write 18x16-bit words total. Communication from reader to HCS412 Communication from HCS412 to reader FIGURE 4-10: PROGRAMMING - VERIFICATION 01b Preamble 1 Communication from HCS412 to reader 4.3.6 The transponder reader sends one of four possible IFF commands indicating which crypt key and which algorithm to use to encrypt the challenge (Table 4-7). The command is followed by the 32-bit challenge, typically a random number. The HCS412 encrypts the challenge using the designated crypt key and algorithm and responds with the 32-bit encrypted result. The reader authenticates the response by comparing it to the expected value. Command MSb Reserved 1LFTE Start + ‘01b’ + 16-bit Word 18 Reserved (all 0’s) LSb Reserved MSb CNT1 1LFTE Start + ‘01b’ + 16-bit Word 17 CNT1, CNT0 LSb CNT0 MSb KEY1_5 1LFTE Start + ‘01b’ + 16-bit Word 2 KEY1_5, KEY1_4 LSb KEY1_4 MSb KEY1_3 1LFTE Start + ‘01b’ + 16-bit Word 2 KEY1_3, KEY1_2 MSb KEY1_1 Approximately 1ms delay before verify begins. IFF CHALLENGE AND RESPONSE TABLE 4-7: LSb KEY1_2 1LFTE Start + ‘01b’ + 16-bit Word 1 KEY1_1, KEY1_0 LSb KEY1_0 Write 18x16-bit words total. Communication from reader to HCS412 3LFTE Delay between each 16-bit word MSb 16-bit Response 16-bit Word 18 All Zeros Successful Write Acknowledge 16-bit Word 1 KEY1_1, KEY1_0 Transport Code Program Command ACK 1 LFTE Start Successful Write Acknowledge LSb 0 Verify 18x16-bit words total. The second crypt key and the seed value occupy the same EEPROM storage area. To use the second crypt key for IFF, the Seed Enable (SEED) and the Temporary Seed Enable (TMPSD) configuration options must be disabled. Note: If seed transmissions are not appropriately disabled, the HCS412 will default to using KEY1 for IFF. CHALLENGE AND RESPONSE COMMANDS Description Expected data In Response 32-Bit Challenge 32-Bit Response 10000 IFF using key-1 and IFF algorithm 10001 IFF using key-1 and HOP algorithm 32-Bit Challenge 32-Bit Response 10100 IFF using key-2 and IFF algorithm 32-Bit Challenge 32-Bit Response 10101 IFF using key-2 and HOP algorithm 32-Bit Challenge 32-Bit Response 2002 Microchip Technology Inc. Preliminary DS41099C-page 25 HCS412 FIGURE 4-11: IFF CHALLENGE AND RESPONSE Activate Field Delay to Command ACK Delay to Data Command Delay before Response 32-bit Challenge TIT 0 1 01b Preamble bit2 bit0 TPU bit1 TOTD TATO 32-bit Response MSb LSb 32-bit Challenge MSb Command LSb 2 LFTE Start MSb ACK LSb 0 1 2 LFTE Start 32-bit Response 1 LFTE Start Communication from reader to HCS412 Communication from HCS412 to reader 4.3.7 CODE HOPPING REQUEST The command tells the HCS412 to increment the synchronization counter and build the 32-bit code hopping portion of the code word. • If RF Echo is enabled, the data will be transmitted in a code word on the DATA line followed by the data transmitted on the LC lines. The DATA line is transmitted first for passive entry support (Figure 4-13). • If RF Echo is disabled, the data will be transmitted on the LC lines only (Figure 4-12). The data format will be the same as described in Section 3.2. TABLE 4-8: REQUEST HOPPING CODE COMMANDS Command 11000 Description Expected data In Request Hopping Code transmission Response None 32-Bit Hopping Code FIGURE 4-12: CODE HOPPING REQUEST (RF ECHO DISABLED) Activate Field Delay to Command ACK Delay before Response Command TATO 01b Preamble 1 1 0 0 TOTH 0 TPU 32-bit Response 1 LFTE Start MSb Command LSb 2 LFTE Start MSb ACK LSb 0 1 32-Bit PPM Response Communication from reader to HCS412 Communication from HCS412 to reader Opcode (Request Hop Code) FIGURE 4-13: CODE HOPPING REQUEST (RF ECHO ENABLED) Fixed Code (37 bits) Header Field ACK MSb LSb Preliminary Hop Code (32 bits) LF Communication from HCS412 to reader Preamble LF Communication from reader to HCS412 DS41099C-page 26 32-Bit PPM Response MSb DATA (RF) LSb Field ACK Inductive (LF) 2002 Microchip Technology Inc. HCS412 4.3.8 ENABLE DEFAULT IFF COMMUNICATION Default IFF communication settings: • Anticollision disabled • RF echo disabled • 200 µs LF baud rate. The ENABLE DEFAULT IFF COMMUNICATION command defaults certain HCS412 communication options such that the transponder reader may communicate to the device with a common (safe) protocol. The default setting remains for the duration of the communication, returning to normal only after a device RESET. TABLE 4-9: DEFAULT IFF COMMUNICATION COMMANDS Command 11100 Description Expected data In Response None None Enable default IFF communication FIGURE 4-14: ENABLE DEFAULT IFF COMMUNICATION Command Delay Next Command 1 1 TATO 1 ACK pulses Delay to Command 0 ACK 0 Activate Field 2 LFTE Start Command MSb LSb Inductive Comms RF Comms Communication from reader to HCS412 Communication from HCS412 to reader 4.4 IFF Communication Special Features TABLE 4-10: LF COMMUNICATION SPECIAL FEATURES (LFSP) LFSP1:0 Description 00 No special options enabled 01 Anticollision enabled (Section 4.3.1) 10 Proximity Activation enabled 11 Anticollision and RF Echo enabled 4.4.1 PASSIVE PROXIMITY ACTIVATION (LFSP = 10) Enabling the Proximity Activation configuration option allows the HCS412 to transmit a hopping code transmission in response to a signal present on the LC0 pin. The HCS412 sends out Field Acknowledge Sequence in response to detecting the LF field (Figure 4-1). If the HCS412 does not receive a command before the second field Acknowledge sequence [within 255 LFTE‘s], it will transmit a normal code hopping transmission for 2 seconds on the DATA pin. After 2 seconds the HCS412 reverts to normal transponder mode. The 2 second transmission does not repeat when the device is in the presence of a continuous LF field. The HCS412 must be RESET, remove and reapply the LF field, to activate another transmission. The button status used in the code hopping transmission indicates a proximity activation by clearing the S0, S1 and S2 button activation flags. FIGURE 4-15: PROXIMITY ACTIVATION No command received from reader for 255 LFTE. Inductive (LF) ACK DATA (RF) LF Communication from reader to HCS412 Transmit hopping code for 2 seconds LF Communication from HCS412 to reader 2002 Microchip Technology Inc. Preliminary DS41099C-page 27 HCS412 4.4.2 ANTICOLLISION AND RF ECHO (LFSP = 11) LF communication from the token to the transponder reader has much less range than LF communication from the reader to the token. Transmitting the information on the DATA line increases communication range by enabling longer range RF talk back. In addition to enabling anticollision, this mode adds that all HCS412 responses and Acknowledges are echoed on the DATA output line. Responses are first transmitted on the DATA line, followed by the equivalent data transmitted on the LF LC lines (Figure 4-16, Figure 4-17). The information is sent on the DATA line first to benefit longer range passive-entry authentication times. 32-Bit Response TOTH 16-Bit Response 16-Bit Response Next ACK TATO TPU Response (16 bits) Command (Read) FIGURE 4-16: RF ECHO OPTION AND READ COMMAND MSb LSb Fixed Code (37 bits) LF Communication from HCS412 to reader Response (32 bits) LF Communication from reader to HCS412 Header Preamble LSb ACK DATA (RF) MSb Inductive (LF) Next ACK MSb Fixed Code (37 bits) LF Communication from HCS412 to reader Response (32 bits) LF Communication from reader to HCS412 Header Preamble DATA (RF) MSb LSb Inductive (LF) LSb Opcode (IFF) Response (32 bits) FIGURE 4-17: RF ECHO OPTION AND IFF COMMAND FIGURE 4-18: RF ECHO OPTION AND REQUEST HOPPING CODE COMMAND DS41099C-page 28 Next Field Ack Fixed Code (37 bits) LSb Preliminary Hop Code (32 bits) LF Communication from HCS412 to reader Header LF Communication from reader to HCS412 Preamble DATA (RF) 32-Bit PPM Response MSb Inductive (LF) TOTH Request Hopping Code Opcode MSb TATO LSb Field ACK 2002 Microchip Technology Inc. HCS412 4.4.3 INTELLIGENT DAMPING (IDAMP) FIGURE 4-19: INTELLIGENT DAMPING A high Q-factor LC antenna circuit connected to the HCS412 will continue to resonate after a strong LF field is removed, slowly decaying. The slow decay makes fast communication near the reader difficult as data bit low times disappear. 5 µs If the Intelligent Damping option is enabled, the HCS412 will clamp the LC pins through a 2 kΩ resistor for 5 µs every 1/4 LFTE, whenever the HCS412 is expecting data from the transponder reader. The intelligent damping pulses start 12.5 LFTE after the Acknowledge sequence is complete and continue for 12.5 LFTE. If the HCS412 detects data from the reader while sending out damping pulses, it will continue to send the damping pulses. TABLE 4-11: Description 0 Intelligent damping enabled 1 Intelligent damping disabled 12.5 LFTE 5 µs 12.5 LFTE Bit From reader INTELLIGENT DAMPING (IDAMP) IDAMP TABLE 4-12: Field ACK 1/4 LFTE DAMP PULSES LF TIMING SPECIFICATIONS Parameter Symbol Min. Typ. Max. Units LFTE 180 90 200 100 220 110 µs Power-up Time TPU 4.2 6 7.8 Acknowledge to Opcode Time TATO 13 Time Element IFFB = 0 IFFB = 1 ms LFTE PPM Command Bit Time Data = 0 Data = 1 TBITC — — 4 6 — — LFTE PPM Response Bit Time Data = 0 Data = 1 TBITR — — 2 3 — — LFTE TRT — 13 — LFTE Read Response Time IFF Response Time TIT 3.87 4.3 4.73 ms Opcode to Data Input Time TOTD 2.6 — — ms Transport Code to Data Input Time TTTD 2.2 — — ms Encoder Select Acknowledge Time TESA — LFTE+100 — µs IFF EEPROM Write Time (16 bits) TWR — 30 — ms Op Code to Hop Code Response Time TOTH 10.26 11.4 12.54 ms 2002 Microchip Technology Inc. Preliminary DS41099C-page 29 HCS412 5.0 CONFIGURATION SUMMARY Table 5-1 summarizes the available HCS412 options. TABLE 5-1: Symbol HCS412 CONFIGURATION SUMMARY Reference Section KEY1 SDVAL Description 64-bit Encoder Key 1 Section 3.2.7 60-bit seed value transmitted in CH Mode if (SEED = 1 AND TMPSD = 0) or if (SEED = 0 AND TMPSD = 1). TCODE Section 4.3.3 28-bit Transport Code KEY2 LSB 60 bits of Encoder Key 2. 4 MSb’s set to XXXX. (Note 1) AFSK Section 3.4.5 PLL Interface Select. 0 = ASK 1 = FSK RFEN Section 2.2.7 RF Enable output active. 0 = Disable 1 = Enable LPRE Section 3.4.7 Long Preamble Enable. 0 = Disable 1 = Enable QLVS Section 3.4.8 Special Features Enable. 0 = Disable 1 = Enable OSCT Section 2.2.5 Oscillator Tune Value. 1000b Fastest 0000b Nominal 0111b Slowest VLOWSEL Section 2.2.6 Low Voltage Trip Point Select 0 = 2.2 Volt 1 = 4.4 Volt IDAMP Section 4.4.3 Intelligent Damping Enable 0 = Enable 1 = Disable LFSP Section 4.4 LFSP1:0 Active Feature LF Communication Special Features 00b None 01b Anticollision 10b Prox Activation 11b RF Echo LFBSL Section 4.2 IFF Baud Rate Select (LFTE) 0 = 200 us 1 = 100 us MOD Section 3.3 DATA pin modulation format 0 = PWM 1 = Manch CWBE Section 3.4.3 Code word Blanking Enable 0 = Disable 1 = Enable MTX4 Section 3.4.1 Minimum Four Code words 0 = Disable 1 = Enable RFBSL Section 3.3 S2LC Section 3.4.1 — Transmission Baud Rate (RFTE) S2/RFEN/LC1 Pin Configuration bit. Reserved, Set to 0 RFBSL1:0 PWM Manch 00b 400 us 800 us 01b 200 us 400 us 10b 100 us 200 us 11b 100 us 0 = LC 200 us 1 = S Input — — TMPSD Section 3.2.7 Temporary Seed Enable (Note 1) 0 = Disable 1 = Enable SEED Section 3.2.7 Seed Transmission Enable (Note 1) 0 = Disable 1 = Enable XSER Section 3.2.5 Extended Serial number 0 = Disable 1 = Enable DINC Section 3.4.4 Delayed Increment 0 = Disable 1 = Enable DISC Section 3.2.6 10-bit Discrimination value OVR Section 3.2.4 Counter Overflow Value SER 32-bit Serial Number USR 64-bit user EEPROM area CNT 16-bit Synchronization counter — Reserved set 0000h Note 1: If IFF with KEY2 is enabled only if TMPSD = 1 and SEED = 1. DS41099C-page 30 Preliminary 2002 Microchip Technology Inc. HCS412 6.0 INTEGRATING THE HCS412 INTO A SYSTEM FIGURE 6-1: Use of the HCS412 in a system requires a compatible decoder. This decoder is typically a microcontroller with compatible firmware. Microchip will provide (via a free license agreement) firmware routines that accept transmissions from the HCS412 and decrypt the hopping code portion of the data stream. These routines provide system designers the means to develop their own decoding system. 6.1 TYPICAL LEARN SEQUENCE Enter Learn Mode Wait for Reception of a Valid Code Generate Key from Serial Number Use Generated Key to Decrypt Learning a Transmitter to a Receiver A transmitter must first be ’learned’ by a decoder before its use is allowed in the system. Several learning strategies are possible, Figure 6-1 details a typical learn sequence. Core to each, the decoder must minimally store each learned transmitter’s serial number and current synchronization counter value in EEPROM. Additionally, the decoder typically stores each transmitter’s unique crypt key. The maximum number of learned transmitters will therefore be relative to the available EEPROM. A transmitter’s serial number is transmitted in the clear but the synchronization counter only exists in the code word’s encrypted portion. The decoder obtains the counter value by decrypting using the same key used to encrypt the information. The KEELOQ algorithm is a symmetrical block cipher so the encryption and decryption keys are identical and referred to generally as the crypt key. The encoder receives its crypt key during manufacturing. The decoder is programmed with the ability to generate a crypt key as well as all but one required input to the key generation routine; typically the transmitter’s serial number. Figure 6-1 summarizes a typical learn sequence. The decoder receives and authenticates a first transmission; first button press. Authentication involves generating the appropriate crypt key, decrypting, validating the correct key usage via the discrimination bits and buffering the counter value. A second transmission is received and authenticated. A final check verifies the counter values were sequential; consecutive button presses. If the learn sequence is successfully complete, the decoder stores the learned transmitter’s serial number, current synchronization counter value and appropriate crypt key. From now on the crypt key will be retrieved from EEPROM during normal operation instead of recalculating it for each transmission received. Compare Discrimination Value with Fixed Value Equal ? No Yes Wait for Reception of Second Valid Code Use Generated Key to Decrypt Compare Discrimination Value with Fixed Value Equal ? No Yes Counters Sequential ? Yes No Learn successful Store: Learn Unsuccessful Serial number Encryption key Synchronization counter Exit Certain learning strategies have been patented and care must be taken not to infringe. 2002 Microchip Technology Inc. Preliminary DS41099C-page 31 HCS412 6.2 Decoder Operation 6.3 Figure 6-2 summarizes normal decoder operation. The decoder waits until a transmission is received. The received serial number is compared to the EEPROM table of learned transmitters to first determine if this transmitter’s use is allowed in the system. If from a learned transmitter, the transmission is decrypted using the stored crypt key and authenticated via the discrimination bits for appropriate crypt key usage. If the decryption was valid the synchronization value is evaluated. FIGURE 6-2: TYPICAL DECODER OPERATION Start No Transmission Received ? Yes No Is Decryption Valid ? Yes No Is Counter Within 16 ? No No Is Counter Within 32K ? Yes The KEELOQ technology patent scope includes a sophisticated synchronization technique that does not require the calculation and storage of future codes. The technique securely blocks invalid transmissions while providing transparent resynchronization to transmitters inadvertently activated away from the receiver. Figure 6-3 shows a 3-partition, rotating synchronization window. The size of each window is optional but the technique is fundamental. Each time a transmission is authenticated, the intended function is executed and the transmission’s synchronization counter value is stored in EEPROM. From the currently stored counter value there is an initial "Single Operation" forward window of 16 codes. If the difference between a received synchronization counter and the last stored counter is within 16, the intended function will be executed on the single button press and the new synchronization counter will be stored. Storing the new synchronization counter value effectively rotates the entire synchronization window. A "Double Operation" (resynchronization) window further exists from the Single Operation window up to 32K codes forward of the currently stored counter value. It is referred to as "Double Operation" because a transmission with synchronization counter value in this window will require an additional, sequential counter transmission prior to executing the intended function. Upon receiving the sequential transmission the decoder executes the intended function and stores the synchronization counter value. This resynchronization occurs transparently to the user as it is human nature to press the button a second time if the first was unsuccessful. Does Serial Number Match ? Yes Decrypt Transmission No Execute Command and Update Counter The third window is a "Blocked Window" ranging from the double operation window to the currently stored synchronization counter value. Any transmission with synchronization counter value within this window will be ignored. This window excludes previously used, perhaps code-grabbed transmissions from accessing the system. Note: Yes Save Counter in Temp Location DS41099C-page 32 Synchronization with Decoder (Evaluating the Counter) Preliminary The synchronization method described in this section is only a typical implementation and because it is usually implemented in firmware, it can be altered to fit the needs of a particular system. 2002 Microchip Technology Inc. HCS412 FIGURE 6-3: SYNCHRONIZATION WINDOW Entire Window rotates to eliminate use of previously used codes Blocked Window (32K Codes) Stored Synchronization Counter Value Double Operation (resynchronization) Window (32K Codes) FIGURE 6-4: Single Operation Window (16 Codes) BASIC OPERATION OF RECEIVER (DECODER) 1 Received Information EEPROM Array Manufacturer Code Button Press Information Serial Number 2 32 Bits of Encrypted Data Check for Match Serial Number Sync Counter 3 KEELOQ Decryption Algorithm Decrypted Synchronization Counter Crypt Key 4 Check for Match Perform Function 5 Indicated by button press Note: Circled numbers indicate sequence of events. 2002 Microchip Technology Inc. Preliminary DS41099C-page 33 HCS412 7.0 PROGRAMMING THE HCS412 The HCS412 will signal a ‘write complete’ after writing each 16-bit word by sending out a series of ACK pulses TACKH high, TACKL low on DATA. The ACK pulses continue until S2 is dropped. The HCS412 requires some parameters programmed into the device before it can be used. The programming cycle allows the user to input all 288 bits in a serial data stream, which are then stored internally in EEPROM. Programming verification is allowed only once, after the programming cycle (Figure 7-3), by reading back the EEPROM memory map. Reading is done by clocking the S2 line and reading the data bits on DATA, again Least Significant bit first. For security reasons, it is not possible to execute a Verify function without first programming the EEPROM. Programming is initiated by forcing the DATA line high, after the S2 line has been held high for the appropriate length of time line (Table 7-1 and Figure 7-2). A delay is required after entering Program mode while the automatic bulk erase cycle completes. The bulk erase writes all EEPROM locations to zeros. Note: To ensure that the device does not accidentally enter Programming mode, DATA should never be pulled high by the circuit connected to it. Special care should be taken when driving PNP RF transistors. The device is then programmed by clocking in the EEPROM memory map (Least Significant bit first) 16 bits at a time, using S2 as the clock line and DATA as the data-in line. After each 16-bit word is loaded, a programming delay is required for the internal program cycle to complete. This delay can take up to Twc. FIGURE 7-1: CREATION AND STORAGE OF CRYPT KEY DURING PRODUCTION Production Programmer HCS412 Transmitter Serial Number EEPROM Array Serial Number Crypt Key Sync Counter Key Generation Algorithm Manufacturer’s Code PROGRAMMING WAVEFORMS H O LD Initiate Data Polling Here TCLKH TCLKL TDS TP TPBW DATA (Data) Bit 0 Bit 1 TWC TDH TCLKL Bit 2 Bit 3 Bit 14 Ack Ack Bit 15 Data for Word 0 (KEY1_0) TPH2 TA TPS TPH1 C KL S2 (Clock) Write Cycle Complete Here C KH Enter Program Mode TA FIGURE 7-2: . . . Crypt Key Ack Calibration Pulses Bit 16 Bit 17 Data for Word 1 (KEY1_1) Repeat for each word (18 times total) Note 1: S0 and S1 button inputs to be held to ground during the entire programming sequence. FIGURE 7-3: VERIFY WAVEFORMS End of Programming Cycle Beginning of Verify Cycle Data from Word 0 DATA (Data) Bit190 Bit191 Ack TWC Bit 0 Bit 1 Bit 2 Bit 3 Bit 14 Bit 15 Bit 16 Bit 17 Bit190 Bit191 TDV S2 (Clock) Note: If a Verify operation is to be done, then it must immediately follow the Program cycle. DS41099C-page 34 Preliminary 2002 Microchip Technology Inc. HCS412 7.1 EEPROM Organization TABLE 7-1: 16Bit Word HCS412 EEPROM ORGANIZATION BITS 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 KEY1_4 KEY1_7 (KEY1 MSB) KEY1_6 5 SEED_1 / KEY2_1 SEED_0 / KEY2_0 (SEED AND KEY2 LSB) 6 SEED_3 / KEY2_3 SEED_2 / KEY2_2 7 SEED_5 / KEY2_5 / TCODE_1 SEED_4 / KEY2_4 / TCODE_0 (TCODE LSB) 9 8 7 6 5 4 3 0 SER1 0 SER0 12 SER3 SER2 13 USR0 MSB USR0 LSB 14 USR1 MSB USR1 LSB 15 USR2 MSB USR2 LSB 16 USR3 MSB USR3 LSB 17 CNT1 (Counter MSB) CNT0 (Counter LSB) 18 Reserved, set to 0 Reserved, set to 0 TABLE 7-2: 1 TMPSD 0 11 2 SEED 1 10bit Discrimination Value OSCT 3 XSER 2 LFSP 1 DINC 1 0 VLOWSEL OVR LFBSL 0 SEED_6 / KEY2_6 / TCODE_2 IDAMP 10 RFBSL MOD 1 CWBE 9 SEED_7 / KEY2_7 / TCODE_3 (MSB for all 3) MTX4 8 AFSK KEY1_5 4 RFEN 3 LPRE KEY1_2 S2LC KEY1_0 (KEY1 LSB) KEY1_3 QLVS KEY1_1 2 Set to 0 1 0 PROGRAMMING/VERIFY TIMING REQUIREMENTS VDD = 5.0V ± 10%, 25° C ± 5 °C Parameter Program mode setup time Hold time 1 Hold time 2 Bulk Write time Program delay time Program cycle time Clock low time Clock high time Data setup time Data hold time Data out valid time Hold time Acknowledge low time Acknowledge high time 2002 Microchip Technology Inc. Symbol Min. Max. Units TPS TPH1 TPH2 TPBW TPROG TWC TCLKL TCLKH TDS TDH TDV TPHOLD TACKL TACKH 2 4.0 50 4.0 4.0 50 50 50 0 18 5.0 — — — — — — — — — 30 — — — ms ms µs ms ms ms µs µs µs µs µs µs µs µs 100 800 800 Preliminary DS41099C-page 35 HCS412 8.0 ELECTRICAL CHARACTERISTICS TABLE 8-1: ABSOLUTE MAXIMUM RATING Symbol Note: Item Rating Units VDD Supply voltage -0.3 to 6.6 V VIN* Input voltage -0.3 to VDD + 0.3 V VOUT Output voltage -0.3 to VDD + 0.3 V IOUT Max output current 50 mA TSTG Storage temperature -55 to +125 C (Note) TLSOL Lead soldering temp 300 C (Note) VESD ESD rating (Human Body Model) 4000 V Stresses above those listed under “ABSOLUTE MAXIMUM RATINGS” may cause permanent damage to the device. * If a battery is inserted in reverse, the protection circuitry switches on, protecting the device and draining the battery. TABLE 8-2: DC AND TRANSPONDER CHARACTERISTICS Commercial (C): Industrial (I): TAMB = 0°C to 70°C TAMB = -40°C to 85°C 2.0V < VDD < 6.3V Parameter Average operating current Note 2 Symbol Min Typ1 Max Unit IDD (avg) — 200 500 µA VDD = 6.3V 2.3 4.0 mA VDD = 6.3V LC = off else < 5 µA Programming current IDDP Standby current IDDS — 0.1 500 nA High level input voltage VIH 0.55 VDD — VDD + 0.3 V Low level input voltage VIL -0.3 — 0.15 VDD V High level output voltage VOH 0.8 VDD 0.8 VDD — — Low level output voltage VOL — — — — Conditions V VDD = 2V, IOH =- .45 mA VDD = 6.3V, IOH,= -2 mA 0.08 VDD 0.08 VDD V VDD = 2V, IOH = 0.5 mA VDD = 6.3V, IOH = 5 mA LED output current ILED 3.0 4.0 7.0 mA VDD = 3.0V, VLED = 1.5V Switch input resistor RS 40 60 80 kΩ S0/S1 not S2 DATA input resistor RDATA 80 120 160 kΩ ILC — — 10.0 mA LC input clamp voltage VLCC — 10 LC induced output current VDDI — VDDV — — 4.5 4.0 Carrier frequency fc — 125 LC input sensitivity VLCS — 100 LC input current LC induced output voltage VLCC=10 VP-P — V ILC <10 mA 2.0 mA VLCC > 10V — — V 10 V < VLCC, IDD = 0 mA 10 V < VLCC, IDD = -1 mA kHz — mVPP Note 3 Note 1: Typical values at 25°C. 2: No load connected. 3: Not tested. DS41099C-page 36 Preliminary 2002 Microchip Technology Inc. HCS412 9.0 PACKAGING INFORMATION Package Type: 8-Lead Plastic Dual In-line (P) – 300 mil (PDIP) E1 D 2 n 1 α E A2 A L c A1 β B1 p eB B Units Dimension Limits n p Number of Pins Pitch Top to Seating Plane Molded Package Thickness Base to Seating Plane Shoulder to Shoulder Width Molded Package Width Overall Length Tip to Seating Plane Lead Thickness Upper Lead Width Lower Lead Width Overall Row Spacing Mold Draft Angle Top Mold Draft Angle Bottom * Controlling Parameter § Significant Characteristic § A A2 A1 E E1 D L c B1 B eB α β MIN .140 .115 .015 .300 .240 .360 .125 .008 .045 .014 .310 5 5 INCHES* NOM MAX 8 .100 .155 .130 .170 .145 .313 .250 .373 .130 .012 .058 .018 .370 10 10 .325 .260 .385 .135 .015 .070 .022 .430 15 15 MILLIMETERS NOM 8 2.54 3.56 3.94 2.92 3.30 0.38 7.62 7.94 6.10 6.35 9.14 9.46 3.18 3.30 0.20 0.29 1.14 1.46 0.36 0.46 7.87 9.40 5 10 5 10 MIN MAX 4.32 3.68 8.26 6.60 9.78 3.43 0.38 1.78 0.56 10.92 15 15 Notes: Dimensions D and E1 do not include mold flash or protrusions. Mold flash or protrusions shall not exceed .010” (0.254mm) per side. JEDEC Equivalent: MS-001 Drawing No. C04-018 2002 Microchip Technology Inc. Preliminary DS41099C-page 37 HCS412 Package Type: 8-Lead Plastic Small Outline (SN) – Narrow, 150 mil (SOIC) E E1 p D 2 B n 1 α h 45° c A2 A φ β L Units Dimension Limits n p Number of Pins Pitch Overall Height Molded Package Thickness Standoff § Overall Width Molded Package Width Overall Length Chamfer Distance Foot Length Foot Angle Lead Thickness Lead Width Mold Draft Angle Top Mold Draft Angle Bottom * Controlling Parameter § Significant Characteristic A A2 A1 E E1 D h L φ c B α β MIN .053 .052 .004 .228 .146 .189 .010 .019 0 .008 .013 0 0 A1 INCHES* NOM 8 .050 .061 .056 .007 .237 .154 .193 .015 .025 4 .009 .017 12 12 MAX .069 .061 .010 .244 .157 .197 .020 .030 8 .010 .020 15 15 MILLIMETERS NOM 8 1.27 1.35 1.55 1.32 1.42 0.10 0.18 5.79 6.02 3.71 3.91 4.80 4.90 0.25 0.38 0.48 0.62 0 4 0.20 0.23 0.33 0.42 0 12 0 12 MIN MAX 1.75 1.55 0.25 6.20 3.99 5.00 0.51 0.76 8 0.25 0.51 15 15 Notes: Dimensions D and E1 do not include mold flash or protrusions. Mold flash or protrusions shall not exceed .010” (0.254mm) per side. JEDEC Equivalent: MS-012 Drawing No. C04-057 DS41099C-page 38 Preliminary 2002 Microchip Technology Inc. HCS412 9.1 Package Marking Information 8-Lead PDIP (300 mil) Example XXXXXXXX XXXXXNNN YYWW HCS412 XXXXX862 9925 Example 8-Lead SOIC (150 mil) XXXXXXXX XXXXYYWW XXXXXXXX XXXX9925 862 NNN Legend: MM...M XX...X YY WW NNN Note: * Microchip part number information Customer specific information* Year code (last 2 digits of calendar year) Week code (week of January 1 is week ‘01’) Alphanumeric traceability code In the event the full Microchip part number cannot be marked on one line, it will be carried over to the next line thus limiting the number of available characters for customer specific information. Standard marking consists of Microchip part number, year code, week code and traceability code. For marking beyond this, certain price adders apply. Please check with your Microchip Sales Office. For SQTP devices, any special marking adders are included in SQTP price. 2002 Microchip Technology Inc. Preliminary DS41099C-page 39 HCS412 ON-LINE SUPPORT Systems Information and Upgrade Hot Line Microchip provides on-line support on the Microchip World Wide Web (WWW) site. The web site is used by Microchip as a means to make files and information easily available to customers. To view the site, the user must have access to the Internet and a web browser, such as Netscape or Microsoft Explorer. Files are also available for FTP download from our FTP site. The Systems Information and Upgrade Line provides system users a listing of the latest versions of all of Microchip's development systems software products. Plus, this line provides information on how customers can receive any currently available upgrade kits. The Hot Line Numbers are: 1-800-755-2345 for U.S. and most of Canada, and 1-480-792-7302 for the rest of the world. Connecting to the Microchip Internet Web Site The Microchip web site is available by using your favorite Internet browser to attach to: www.microchip.com The file transfer site is available by using an FTP service to connect to: ftp://ftp.microchip.com The web site and file transfer site provide a variety of services. Users may download files for the latest Development Tools, Data Sheets, Application Notes, User’s Guides, Articles and Sample Programs. A variety of Microchip specific business information is also available, including listings of Microchip sales offices, distributors and factory representatives. Other data available for consideration is: • Latest Microchip Press Releases • Technical Support Section with Frequently Asked Questions • Design Tips • Device Errata • Job Postings • Microchip Consultant Program Member Listing • Links to other useful web sites related to Microchip Products • Conferences for products, Development Systems, technical information and more • Listing of seminars and events DS41099C-page 40 Preliminary 2002 Microchip Technology Inc. HCS412 READER RESPONSE It is our intention to provide you with the best documentation possible to ensure successful use of your Microchip product. If you wish to provide your comments on organization, clarity, subject matter, and ways in which our documentation can better serve you, please FAX your comments to the Technical Publications Manager at (480) 792-7578. Please list the following information, and use this outline to provide us with your comments about this Data Sheet. To: Technical Publications Manager RE: Reader Response Total Pages Sent From: Name Company Address City / State / ZIP / Country Telephone: (_______) _________ - _________ FAX: (______) _________ - _________ Application (optional): Would you like a reply? Y N Literature Number: DS41099C Device: HCS412 Questions: 1. What are the best features of this document? 2. How does this document meet your hardware and software development needs? 3. Do you find the organization of this data sheet easy to follow? If not, why? 4. What additions to the data sheet do you think would enhance the structure and subject? 5. What deletions from the data sheet could be made without affecting the overall usefulness? 6. Is there any incorrect or misleading information (what and where)? 7. How would you improve this document? 8. How would you improve our software, systems, and silicon products? 2002 Microchip Technology Inc. Preliminary DS41099C-page 41 HCS412 10.0 HCS412 PRODUCT IDENTIFICATION SYSTEM To order or obtain information, e.g., on pricing or delivery, refer to the factory or the listed sales office. HCS412 — /X Package: P = Plastic DIP (300 mil body), 8-lead SN = Plastic SOIC (150 mil body), 8-lead Temperature Range: Device: - = 0°C to +70°C I = –40°C to +85°C HCS412 = Code Hopping Encoder HCS412T = Code Hopping Encoder (Tape and Reel) (SN only) Sales and Support Data Sheets Products supported by a preliminary Data Sheet may have an errata sheet describing minor operational differences and recommended workarounds. To determine if an errata sheet exists for a particular device, please contact one of the following: 1. 2. Your local Microchip sales office The Microchip Corporate Literature Center U.S. FAX: (480) 792-7277. 3. The Microchip Worldwide Site (www.microchip.com) Please specify which device, revision of silicon and Data Sheet (include Literature #) you are using. New Customer Notification System Register on our web site (www.microchip.com/cn) to receive the most current information on our products. DS41099C-page 42 Preliminary 2002 Microchip Technology Inc. Microchip’s Secure Data Products are covered by some or all of the following patents: Code hopping encoder patents issued in Europe, U.S.A., and R.S.A. — U.S.A.: 5,517,187; Europe: 0459781; R.S.A.: ZA93/4726 Secure learning patents issued in the U.S.A. and R.S.A. — U.S.A.: 5,686,904; R.S.A.: 95/5429 Information contained in this publication regarding device applications and the like is intended through suggestion only and may be superseded by updates. It is your responsibility to ensure that your application meets with your specifications. No representation or warranty is given and no liability is assumed by Microchip Technology Incorporated with respect to the accuracy or use of such information, or infringement of patents or other intellectual property rights arising from such use or otherwise. Use of Microchip’s products as critical components in life support systems is not authorized except with express written approval by Microchip. No licenses are conveyed, implicitly or otherwise, under any intellectual property rights. Trademarks The Microchip name and logo, the Microchip logo, FilterLab, KEELOQ, microID, MPLAB, PIC, PICmicro, PICMASTER, PICSTART, PRO MATE, SEEVAL and The Embedded Control Solutions Company are registered trademarks of Microchip Technology Incorporated in the U.S.A. and other countries. dsPIC, ECONOMONITOR, FanSense, FlexROM, fuzzyLAB, In-Circuit Serial Programming, ICSP, ICEPID, microPort, Migratable Memory, MPASM, MPLIB, MPLINK, MPSIM, MXDEV, PICC, PICDEM, PICDEM.net, rfPIC, Select Mode and Total Endurance are trademarks of Microchip Technology Incorporated in the U.S.A. Serialized Quick Turn Programming (SQTP) is a service mark of Microchip Technology Incorporated in the U.S.A. All other trademarks mentioned herein are property of their respective companies. © 2002, Microchip Technology Incorporated, Printed in the U.S.A., All Rights Reserved. Printed on recycled paper. Microchip received QS-9000 quality system certification for its worldwide headquarters, design and wafer fabrication facilities in Chandler and Tempe, Arizona in July 1999. The Company’s quality system processes and procedures are QS-9000 compliant for its PICmicro® 8-bit MCUs, KEELOQ® code hopping devices, Serial EEPROMs and microperipheral products. In addition, Microchip’s quality system for the design and manufacture of development systems is ISO 9001 certified. 2002 Microchip Technology Inc. Preliminary DS41099C - page 43 WORLDWIDE SALES AND SERVICE AMERICAS ASIA/PACIFIC Japan Corporate Office Australia 2355 West Chandler Blvd. Chandler, AZ 85224-6199 Tel: 480-792-7200 Fax: 480-792-7277 Technical Support: 480-792-7627 Web Address: http://www.microchip.com Microchip Technology Australia Pty Ltd Suite 22, 41 Rawson Street Epping 2121, NSW Australia Tel: 61-2-9868-6733 Fax: 61-2-9868-6755 Microchip Technology Japan K.K. Benex S-1 6F 3-18-20, Shinyokohama Kohoku-Ku, Yokohama-shi Kanagawa, 222-0033, Japan Tel: 81-45-471- 6166 Fax: 81-45-471-6122 Rocky Mountain China - Beijing 2355 West Chandler Blvd. Chandler, AZ 85224-6199 Tel: 480-792-7966 Fax: 480-792-7456 Microchip Technology Consulting (Shanghai) Co., Ltd., Beijing Liaison Office Unit 915 Bei Hai Wan Tai Bldg. No. 6 Chaoyangmen Beidajie Beijing, 100027, No. China Tel: 86-10-85282100 Fax: 86-10-85282104 Atlanta 500 Sugar Mill Road, Suite 200B Atlanta, GA 30350 Tel: 770-640-0034 Fax: 770-640-0307 Boston 2 Lan Drive, Suite 120 Westford, MA 01886 Tel: 978-692-3848 Fax: 978-692-3821 Chicago 333 Pierce Road, Suite 180 Itasca, IL 60143 Tel: 630-285-0071 Fax: 630-285-0075 Dallas 4570 Westgrove Drive, Suite 160 Addison, TX 75001 Tel: 972-818-7423 Fax: 972-818-2924 Detroit Tri-Atria Office Building 32255 Northwestern Highway, Suite 190 Farmington Hills, MI 48334 Tel: 248-538-2250 Fax: 248-538-2260 Kokomo 2767 S. Albright Road Kokomo, Indiana 46902 Tel: 765-864-8360 Fax: 765-864-8387 Los Angeles 18201 Von Karman, Suite 1090 Irvine, CA 92612 Tel: 949-263-1888 Fax: 949-263-1338 China - Chengdu Microchip Technology Consulting (Shanghai) Co., Ltd., Chengdu Liaison Office Rm. 2401, 24th Floor, Ming Xing Financial Tower No. 88 TIDU Street Chengdu 610016, China Tel: 86-28-6766200 Fax: 86-28-6766599 China - Fuzhou Microchip Technology Consulting (Shanghai) Co., Ltd., Fuzhou Liaison Office Unit 28F, World Trade Plaza No. 71 Wusi Road Fuzhou 350001, China Tel: 86-591-7503506 Fax: 86-591-7503521 China - Shanghai Microchip Technology Consulting (Shanghai) Co., Ltd. Room 701, Bldg. B Far East International Plaza No. 317 Xian Xia Road Shanghai, 200051 Tel: 86-21-6275-5700 Fax: 86-21-6275-5060 China - Shenzhen 150 Motor Parkway, Suite 202 Hauppauge, NY 11788 Tel: 631-273-5305 Fax: 631-273-5335 Microchip Technology Consulting (Shanghai) Co., Ltd., Shenzhen Liaison Office Rm. 1315, 13/F, Shenzhen Kerry Centre, Renminnan Lu Shenzhen 518001, China Tel: 86-755-2350361 Fax: 86-755-2366086 San Jose Hong Kong Microchip Technology Inc. 2107 North First Street, Suite 590 San Jose, CA 95131 Tel: 408-436-7950 Fax: 408-436-7955 Microchip Technology Hongkong Ltd. Unit 901-6, Tower 2, Metroplaza 223 Hing Fong Road Kwai Fong, N.T., Hong Kong Tel: 852-2401-1200 Fax: 852-2401-3431 New York Toronto 6285 Northam Drive, Suite 108 Mississauga, Ontario L4V 1X5, Canada Tel: 905-673-0699 Fax: 905-673-6509 India Microchip Technology Inc. India Liaison Office Divyasree Chambers 1 Floor, Wing A (A3/A4) No. 11, O’Shaugnessey Road Bangalore, 560 025, India Tel: 91-80-2290061 Fax: 91-80-2290062 Korea Microchip Technology Korea 168-1, Youngbo Bldg. 3 Floor Samsung-Dong, Kangnam-Ku Seoul, Korea 135-882 Tel: 82-2-554-7200 Fax: 82-2-558-5934 Singapore Microchip Technology Singapore Pte Ltd. 200 Middle Road #07-02 Prime Centre Singapore, 188980 Tel: 65-6334-8870 Fax: 65-6334-8850 Taiwan Microchip Technology Taiwan 11F-3, No. 207 Tung Hua North Road Taipei, 105, Taiwan Tel: 886-2-2717-7175 Fax: 886-2-2545-0139 EUROPE Denmark Microchip Technology Nordic ApS Regus Business Centre Lautrup hoj 1-3 Ballerup DK-2750 Denmark Tel: 45 4420 9895 Fax: 45 4420 9910 France Microchip Technology SARL Parc d’Activite du Moulin de Massy 43 Rue du Saule Trapu Batiment A - ler Etage 91300 Massy, France Tel: 33-1-69-53-63-20 Fax: 33-1-69-30-90-79 Germany Microchip Technology GmbH Gustav-Heinemann Ring 125 D-81739 Munich, Germany Tel: 49-89-627-144 0 Fax: 49-89-627-144-44 Italy Microchip Technology SRL Centro Direzionale Colleoni Palazzo Taurus 1 V. Le Colleoni 1 20041 Agrate Brianza Milan, Italy Tel: 39-039-65791-1 Fax: 39-039-6899883 United Kingdom Arizona Microchip Technology Ltd. 505 Eskdale Road Winnersh Triangle Wokingham Berkshire, England RG41 5TU Tel: 44 118 921 5869 Fax: 44-118 921-5820 03/01/02 DS41099C-page 44 Preliminary 2002 Microchip Technology Inc.