HCS512
KEELOQ® Code Hopping Decoder
FEATURES
Security
•
•
•
•
•
Secure storage of Manufacturer’s Code
Secure storage of transmitter’s keys
Up to four transmitters can be learned
KEELOQ code hopping technology
Normal and secure learning mechanisms
PACKAGE TYPE
PDIP, SOIC
1
18
RFIN
LRNOUT
2
17
NC
NC
3
16
OSCIN
MCLR
4
15
OSCOUT
GND
5
14
VDD
S0
6
13
DATA
S1
7
12
CLK
S2
8
11
SLEEP
S3
9
10
VLOW
Operating
•
•
•
•
•
3.0V – 6.0V operation
4 MHz RC oscillator
Learning indication on LRNOUT
Auto baud rate detection
Power saving sleep mode
Other
•
•
•
•
Stand alone decoder
On-chip EEPROM for transmitter storage
Four binary function outputs–15 functions
18-pin DIP/SOIC package
HCS512
LRNIN
BLOCK DIAGRAM
RFIN
67-Bit Reception Register
Typical Applications
•
•
•
•
•
•
•
Automotive remote entry systems
Automotive alarm systems
Automotive immobilizers
Gate and garage openers
Electronic door locks
Identity tokens
Burglar alarm systems
Compatible Encoders
• HCS200, HCS300, HCS301, HCS360, HCS361
• NTQ106
DESCRIPTION
The Microchip Technology Inc. HCS512 is a code hopping decoder designed for secure Remote Keyless
Entry (RKE) systems. The HCS512 utilizes the patented KEELOQ code hopping system and high security
learning mechanisms to make this a canned solution
when used with the HCS encoders to implement a unidirectional remote keyless entry system.
DECRYPTOR
EEPROM
DATA
CLK
LRNIN
SEL
MCLR
SLEEP
CONTROL
OSCIN OSCILLATOR
OUTPUT
S0
S1
S2
CONTROL
S3
VLOW
LRNOUT
The Manufacturer’s Code, transmitter keys, and synchronization information are stored in protected onchip EEPROM. The HCS512 uses the DATA and CLK
inputs to load the Manufacturer’s Code which cannot
be read out of the device.
The HCS512 operates over a wide voltage range of
3.0 volts to 6.0 volts. The decoder employs automatic
baud rate detection which allows it to compensate for
wide variations in transmitter data rate. The decoder
contains sophisticated error checking algorithms to
ensure only valid codes are accepted.
KEELOQ is a registered trademark of Microchip Technology, Inc.
Microchip’s Secure Data Products are covered by some or all of the following patents:
Code hopping encoder patents issued in Europe, U.S.A., and R.S.A. — U.S.A.: 5,517,187; Europe: 0459781; R.S.A.: ZA93/4726
Secure learning patents issued in the U.S.A. and R.S.A. — U.S.A.: 5,686,904; R.S.A.: 95/5429
2001 Microchip Technology Inc.
DS40151C-page 1
HCS512
1.0
KEELOQ SYSTEM OVERVIEW
1.2
1.1
Key Terms
The HCS encoders have a small EEPROM array which
must be loaded with several parameters before use.
The most important of these values are:
• Manufacturer’s Code – a 64-bit word, unique to
each manufacturer, used to produce a unique
encoder key in each transmitter (encoder).
• Encoder Key – a 64-bit key, unique for each transmitter. The encoder key controls the decryption
algorithm and is stored in EEPROM on the
decoder device.
• Learn – The receiver uses information that is
transmitted to derive the transmitter’s secret key,
decrypt the discrimination value and the synchronization counter in learning mode. The encoder
key is a function of the Manufacturer’s Code and
the device serial number and/or seed value.
The HCS encoders and decoders employ the KEELOQ
code hopping technology and an encryption algorithm
to achieve a high level of security. Code hopping is a
method by which the code transmitted from the transmitter to the receiver is different every time a button is
pushed. This method, coupled with a transmission
length of 66 bits, virtually eliminates the use of code
‘grabbing’ or code ‘scanning’.
FIGURE 1-1:
• A 28-bit serial number which is meant to be
unique for every encoder
• An encoder key that is generated at the time of
production
• A 16-bit synchronization value
The serial number for each encoder is programmed by
the manufacturer at the time of production. The
generation of the encoder key is done using a key generation algorithm (Figure 1-1). Typically, inputs to the
key generation algorithm are the serial number of the
encoder and a 64-bit manufacturer’s code. The manufacturer’s code is chosen by the system manufacturer
and must be carefully controlled. The manufacturer’s
code is a pivotal part of the overall system security.
CREATION AND STORAGE OF ENCODER KEY DURING PRODUCTION
HCSXXX EEPROM Array
Transmitter
Serial Number or
Seed
Manufacturer’s
Code
DS40151C-page 2
HCS Encoder Overview
Key
Generation
Algorithm
Serial Number
Encoder Key
Sync Counter
Encoder
Key
.
.
.
2001 Microchip Technology Inc.
HCS512
The 16-bit synchronization value is the basis for the
transmitted code changing for each transmission and is
updated each time a button is pressed. Because of the
complexity of the code hopping encryption algorithm, a
change in one bit of the synchronization value will
result in a large change in the actual transmitted code.
There is a relationship (Figure 1-3) between the key
values in EEPROM and how they are used in the
encoder. Once the encoder detects that a button has
been pressed, the encoder reads the button and
updates the synchronization counter. The synchronization value is then combined with the encoder key in the
encryption algorithm, and the output is 32 bits of
encrypted information. This data will change with every
button press, hence, it is referred to as the hopping
portion of the code word. The 32-bit hopping code is
combined with the button information and the serial
number to form the code word transmitted to the
receiver.
FIGURE 1-2:
1.3
HCS Decoder Overview
Before a transmitter can be used with a particular
receiver, the transmitter must be ‘learned’ by the
receiver. Upon learning a transmitter, information is
stored by the receiver so that it may track the
transmitter, including the serial number of the
transmitter, the current synchronization value for that
transmitter, and the same encoder key that is used on
the transmitter. If a receiver receives a message of
valid format, the serial number is checked and, if it is
from a learned transmitter, the message is decrypted
and the decrypted synchronization counter is checked
against what is stored. If the synchronization value is
verified, then the button status is checked to see what
operation is needed. Figure 1-3 shows the relationship
between some of the values stored by the receiver and
the values received from the transmitter.
BASIC OPERATION OF TRANSMITTER (ENCODER)
Transmitted Information
KEELOQ
Encryption
Algorithm
EEPROM Array
32 Bits of
Encrypted Data
Serial Number
Button Press
Information
Encoder Key
Sync Counter
Serial Number
FIGURE 1-3:
BASIC OPERATION OF RECEIVER (DECODER)
Check for
Match
EEPROM Array
KEELOQ
Decryption
Algorithm
Encoder Key
Decrypted
Synchronization
Counter
Sync Counter
Serial Number
Check for
Match
Manufacturer’s Code
Button Press
Information
Serial Number
32-Bits of
Encrypted Data
Received Information
2001 Microchip Technology Inc.
DS40151C-page 3
HCS512
2.0
PIN
PIN ASSIGNMENT
Decoder
Function
I/O (1)
Buffer
Type(1)
Description
1
LRNIN
I
TTL
Learn input - initiates learning, 10K pull-up required on input
2
LRNOUT
O
TTL
Learn output - indicates learning
3
NC
—
TTL
Do not connect
4
MCLR
I
ST
Master clear input
5
Ground
P
—
Ground connection
6
S0
O
TTL
Switch 0
7
S1
O
TTL
Switch 1
8
S2
O
TTL
Switch 2
9
S3
O
TTL
Switch 3
10
Vlow
O
TTL
Battery low indication output
TTL
11
SLEEP
I
12
CLK
I/O
TTL/ST
(2)
Clock in programming mode and synchronous mode
Connect to RFIN to allow wake-up from sleep
13
DATA
I/O
TTL/ST(2)
Data in programming mode and synchronous mode
14
VDD
P
—
Power connection
15
OSCOUT
—
—
Oscillator out – no connection
16
OSCIN (4 MHz)
I
ST
Oscillator in – recommended values 10 k¾ and 10pF
17
NC
—
—
18
RFIN
I
TTL
RF input from receiver
Note 1: P = power, I = in, O = out, and ST = Schmitt Trigger input.
2: Pin 12 and Pin 13 have a dual purpose. After reset, these pins are used to determine if programming mode
is selected in which case they are the clock and data lines. In normal operation, they are the clock and data
lines of the synchronous data output stream.
DS40151C-page 4
2001 Microchip Technology Inc.
HCS512
3.0
DESCRIPTION OF FUNCTIONS
3.2
3.1
Parallel Interface
The decoder has a PWM/Synchronous interface connection to microcontrollers with limited I/O. An output
data stream is generated when a valid transmission is
received. The data stream consists of one start bit, four
function bits, one bit for battery status, one bit to indicate a repeated transmission, two status bits, and one
stop bit. (Table 3-1). The DATA and CLK lines are used
to send a synchronous event message.
The HCS512 activates the S3, S2, S1 & S0 outputs
according to Table 3-1 when a new valid code is
received. The outputs will be activated for approximately 500 ms. If a repeated code is received during
this time, the output extends for approximately 500 ms.
TABLE 3-1:
FUNCTION OUTPUT TABLE
Function
Code
S3
S2
S1
S0
0001
0010
0011
0100
0101
0110
0111
1000
1001
1010
1011
1100
1101
1110
1111
0
0
0
0
0
0
0
1
1
1
1
1
1
1
1
0
0
0
1
1
1
1
0
0
0
0
1
1
1
1
0
1
1
0
0
1
1
0
0
1
1
0
0
1
1
1
0
1
0
1
0
1
0
1
0
1
0
1
0
1
FIGURE 3-1:
START
FIGURE 3-2:
START
Serial Interface
A special status message is transmitted on the second
pass of learn. This allows the controlling microcontroller to determine if the learn was successful (Result = 1)
and if a previous transmitter was overwritten (Overwrite
= 1). The status message is shown in Figure 3-2.
Table 3-2 show the values for TX1:0 and the number of
transmitters learned.
TABLE 3-2:
STATUS BITS
TX1
TX0
Number of Transmitters
0
0
One
0
1
Two
1
0
Three
1
1
Four
DATA OUTPUT FORMAT
S3
S2
S1
VLOW
REPEAT
TX1
TX0
STOP
RESULT
OVRWR
TX1
TX0
STOP
S0
STATUS MESSAGE FORMAT
0
0
0
0
A 1-wire PWM or 2-wire synchronous interface can be used.
In 1-wire mode, the data is transmitted as a PWM signal with a basic pulse width of 400 µs.
In 2-wire mode, synchronous mode PWM bits start on the rising edge of the clock, and the bits must be sampled on the
falling edge. The start and stop bits are ‘1’.
FIGURE 3-3:
PWM TRANSMISSION FORMAT
600µs
CLK
DATA
Start
1200µs
2001 Microchip Technology Inc.
S3
S2
“1”
S1
S0
VLOW
RPT Reserved Reserved Stop
“0”
DS40151C-page 5
HCS512
4.0
DECODER OPERATION
The following checks are performed on the decoder to
determine if the transmission is valid during learn:
4.1
Learning a Transmitter to a Receiver
•
•
•
•
Either the serial number-based learning method or the
seed-based learning method can be selected. The
learning method is selected in the configuration byte. In
order for a transmitter to be used with a decoder, the
transmitter must first be ‘learned’. When a transmitter is
learned to a decoder, the decoder stores the encoder
key, a check value of the serial number and current
synchronization value in EEPROM. The decoder must
keep track of these values for every transmitter that is
learned. The maximum number of transmitters that can
be learned is four. The decoder must also contain the
Manufacturer’s Code in order to learn a transmitter.
The Manufacturer’s Code will typically be the same for
all decoders in a system.
The first code word is checked for bit integrity.
The second code word is checked for bit integrity.
The hopping code is decrypted.
If all the checks pass, the serial number and synchronization counters are stored in EEPROM
memory.
Figure 4-1 shows a flow chart of the learn sequence.
FIGURE 4-1:
Enter Learn
Mode
Wait for Reception
of a Valid Code
Wait for Reception
of Second
Non-Repeated
Valid Code
The HCS512 has four memory slots. After an “erase
all” procedure, all the memory slots will be cleared.
Erase all is activated by taking LRNIN low for approximately 10 seconds. When a new transmitter is learned,
the decoder searches for an empty memory slot and
stores the transmitter’s information in that memory slot.
When all memory slots are full, the decoder randomly
overwrites existing transmitters.
4.1.1
Generate Key
from Serial Number
or Seed Value
Use Generated Key
to Decrypt
LEARNING PROCEDURE
Learning is activated by taking the LRNIN input low for
longer than 64 ms. This input requires an external pullup resistor.
Compare Discrimination
Value with Serial Number
To learn a new transmitter to the HCS512 decoder, the
following sequence is required:
1.
2.
3.
4.
5.
6.
Enter learning mode by pulling LRNIN low for
longer than 64 ms. The LRNOUT output will go
high.
Activate the transmitter until the LRNOUT output goes low indicating reception of a valid code
(hopping message).
Activate the transmitter a second time until the
LRNOUT toggles for 4 seconds (in secure learning mode, the seed transmission must be transmitted during the second stage of learn by
activating the appropriate buttons on the transmitter).
If LRNIN is taken low momentarily during the
learn status indication, the indication will be terminated. Once a successful learning sequence
is detected, the indication can be terminated
allowing quick learning in a manufacturing
setup.
The transmitter is now learned into the decoder.
Repeat steps 1-4 to learn up to four transmitters.
Learning will be terminated if two non-sequential
codes were received or if two acceptable codes
were not decoded within 30 seconds.
DS40151C-page 6
LEARN SEQUENCE
Equal
?
No
Yes
Learn successful. Store:
Serial number check value
Synchronization counter
Encoder Key
Learn
Unsuccessful
Exit
4.2
Validation of Codes
The decoder waits for a transmission and checks the
serial number to determine if the transmitter has been
learned. If learned, the decoder decrypts the encrypted
portion of the transmission using the encoder key. It
uses the discrimination bits to determine if the decryption was valid. If everything up to this point is valid, the
synchronization value is evaluated.
2001 Microchip Technology Inc.
HCS512
4.3
Validation Steps
Validation consists of the following steps:
• Search EEPROM to find the Serial Number Check
Value Match
• Decrypt the Hopping Code
• Compare the 10 bits of discrimination value with
the lower 10 bits of serial number
• Check if the synchronization counter falls within
the first synchronization window.
• Check if the synchronization counter falls within
the second synchronization window.
• If a valid transmission is found, update the synchronization counter, else use the next transmitter
block and repeat the tests.
FIGURE 4-2:
DECODER OPERATION
and the command is executed. If the counter value was
not within the single operation window, but is within the
double operation window of 16K, the transmitted synchronization value is stored in a temporary location,
and it goes back to waiting for another transmission.
When the next valid transmission is received, it will
check the new value with the one in temporary storage.
If the two values are sequential, it is assumed that the
counter was outside of the single operation ‘window’,
but is now back in sync, so the new synchronization
value is stored and the command executed. If a transmitter has somehow gotten out of the double operation
window, the transmitter will not work and must be
relearned. Since the entire window rotates after each
valid transmission, codes that have been used become
part of the ‘blocked’ (48K) codes and are no longer
valid. This eliminates the possibility of grabbing a previous code and retransmitting it to gain entry.
Start
FIGURE 4-3:
SYNCHRONIZATION WINDOW
Entire Window
rotates to eliminate
previously
used codes
Blocked
(48K Codes)
No Transmission
Received
?
Yes
Does
Ser # Check Val
Match
?
Yes
Decrypt Transmission
No
No
Double
Operation
(16K
Codes)
Single Operation
Window (16 Codes)
4.5
Is
Decryption
Valid
?
Yes
Is
Counter
Within 16
?
Yes
Execute
Command
and
Update
Counter
No
No
Is
Counter
Within 32K
?
Yes
Save Counter
in Temp Location
4.4
Synchronization with Decoder
The KEELOQ technology features a sophisticated
synchronization technique (Figure 4-3) which does not
require the calculation and storage of future codes. If
the stored counter value for that particular transmitter
and the counter value that was just decrypted are
within a formatted window of 16, the counter is stored
2001 Microchip Technology Inc.
Current
Position
Sleep Mode
The sleep mode of the HCS512 is used to reduce current consumption when no RF input signal is present.
Sleep mode will only be effective in systems where the
RF receiver is relatively quiet when no signal is present.
During sleep, the clock stops, thereby significantly
reducing the operating current. Sleep mode is enabled
by the SLEEP bit in the configuration byte.
The HCS512 will enter sleep mode when:
• The RF line is low
• After a function output is switched off
• Learn mode is terminated (time-out reached)
The device will not enter sleep mode when:
• A function output is active
• Learn sequence active
• Device is in programming mode
The device will wake up from sleep when:
• The SLEEP input pin changes state
• The CLOCK line changes state
Note:
During sleep mode the CLK line will
change from an output line to an input line
that can be used to wake up the device.
Connect CLK to LRNIN via a 100K resistor
to reliably enter the learn mode whenever
sleep mode is active.
DS40151C-page 7
HCS512
5.0
INTEGRATING THE HCS512
INTO A SYSTEM
The HCS512 can act as a stand alone decoder or be
interfaced to a microcontroller. Typical stand alone
applications include garage door openers and electronic door locks. In stand alone applications, the
HCS512 will handle learning, reception, decryption,
and validation of the received code; and generate the
appropriate output. For a garage door opener, the
HCS512 input will be connected to an RF receiver, and
the output, to a relay driver to connect a motor controller.
Typical systems where the HCS512 will be connected
to a microcontroller include vehicle and home security
systems. The HCS512 input will be connected to an RF
receiver and the function outputs to the microcontroller.
The HCS512 will handle all the decoding functions and
the microcontroller, all the system functions. The serial
output mode with a 1- or 2-wire interface can be used if
the microcontroller is I/O limited.
6.0
DECODER PROGRAMMING
The PG306001 production programmer will allow easy
setup and programming of the configuration byte and
the manufacturer’s code.
6.1
Configuration Byte
The configuration byte is used to set system configuration for the decoder. The LRN bits determine which
algorithm (Decrypt or XOR) is used for the key generation. SC_LRN determines whether normal learn (key
derived from serial number) or secure learn (key
derived from seed value) is used.
TABLE 6-1:
Bit
Name
Description
0
LRN0
Learn algorithm select
1
LRN1
Not used
2
SC_LRN
Secure Learn enable (1 = enabled)
3
SLEEP
Sleep enable (1 = enabled)
4
RES1
Not used
5
RES2
Not used
6
RES3
Not used
7
RES4
Not used
TABLE 6-2:
DS40151C-page 8
CONFIGURATION BYTE
LEARN METHOD LRN0, LRN1
DEFINITIONS
LRN0
Description
0
Decrypt algorithm
1
XOR algorithm
2001 Microchip Technology Inc.
HCS512
6.2
Programming the Manufacturer’s
Code
6.4
The checksum is used by the HCS512 to check that the
data downloaded was correctly received before programming the data. The checksum is calculated so that
the 10 bytes added together (discarding the overflow
bits) is zero. The checksum can be calculated by adding the first 9 bytes of data together and subtracting the
result from zero. Throughout the calculation the overflow is discarded.
The manufacturer’s code must be programmed into
EEPROM memory through the synchronous programming interface using the DATA and CLK lines. Provision
must be made for connections to these pins if the
decoder is going to be programmed in circuit.
Programming mode is activated if the CLK is low for at
least 1ms and then goes high within 64 ms after powerup, stays high for longer than 8ms but not longer than
128 ms. After entering programming mode the 64-bit
manufacturer’s code, 8-bit configuration byte, and 8-bit
checksum is sent to the device using the synchronous
interface. After receiving the 80-bit message the checksum is verified and the information is written to
EEPROM. If the programming operation was successful, the HCS512 will respond with an acknowledge
pulse.
Given a manufacturer’s code of 0123456789ABCDEF16 and a configuration word of 116, the
checksum is calculated as shown in Figure 6-1. The
checksum is 3F16.
6.5
Test Transmitter
The HCS512 decoder will automatically add a test
transmitter each time an Erase All Function is done. A
test transmitter is defined as a transmitter with a serial
number of zero. After an Erase All, the test transmitter
will always work without learning and will not check the
synchronization counter of the transmitter. Learning of
any new transmitters will erase the test transmitter.
After programming the manufacturer’s code, the
HCS512 decoder will automatically activate an
Erase All function, removing all transmitters from the
system.
6.3
Checksum
Download Format
Note 1: A transmitter with a serial number of zero
cannot be learned. Learn will fail after the
first transmission.
The manufacturer’s code and configuration byte must
be downloaded least significant byte, least significant
bit first as shown in Table 6-3.
2: Always learn at least one transmitter after
an Erase All sequence. This ensures that
the test transmitter is erased.
TABLE 6-3:
DOWNLOAD DATA
Byte 9
Byte 8
Byte 7
Byte 6
Byte 5
Byte 4
Byte 3
Byte 2
Byte 1
Byte 0
Checksum
Config
Man
Key_7
Man
Key_6
Man
Key_5
Man
Key_4
Man
Key_3
Man
Key_2
Man
Key_1
Man
Key_0
Byte 0, right-most bit downloaded first.
FIGURE 6-1:
CHECKSUM CALCULATION
0116 + 2316 = 246
2416 + 4516 = 6916
6916 + 6716 = D016
D016 + 8916 = 15916
5916 + AB16 = 10416 (Carry is discarded)
0416 + CD16 = D116 (Carry is discarded)
D116 + EF16 = 1C016
C016 + 116 = C116 (Carry is discarded)
(FF16 - C116) + 116 = 3F16
2001 Microchip Technology Inc.
DS40151C-page 9
HCS512
FIGURE 6-2:
MCLR
PROGRAMMING WAVEFORMS
TPS
TPH1
TCKL
TPH2
TCKH
TACK
CLK
(Clock)
DAT
Bit0
(Data)
Bit78
Bit79
Ack
Acknowledge
pulse
80-bit Data Package
Enter Program Mode
TABLE 6-4:
Bit1
PROGRAMMING TIMING
REQUIREMENTS
Parameter
Symbol
Min.
Max.
Units
Program mode setup time
TPS
1
64
ms
Hold time 1
TPH1
8
128
ms
Hold time 2
TPH2
0.05
320
ms
Clock High Time
TCKH
0.05
320
ms
Clock Low Time
TCKL
0.050
320
ms
Acknowledge Time
TACK
—
80
ms
Note:
FOSC equals 4 MHz.
DS40151C-page 10
2001 Microchip Technology Inc.
HCS512
7.0
KEY GENERATION SCHEMES
The HCS512 decoder has two key generation schemes. Normal learning uses the transmitter’s serial number to derive
two input seeds which aµre used as inputs to the key generation algorithm. Secure learning uses the seed transmission
to derive the two input seeds. Two key generation algorithms are available to convert the inputs seeds to secret keys.
The appropriate scheme is selected in the configuration word.
FIGURE 7-1:
Serial
Number
Patched
Manufacturer’s
Key
Key Generation
Algorithms
------------------Decrypt
XOR
Encoder
Key
Seed
7.1
Normal Learning (Serial Number Derived)
The two input seeds are composed from the serial number in two ways, depending on the encoder type. The encoder
type is determined from the number of bits in the incoming transmission. SourceH is used to calculate the upper 32 bits
of the encoder key, and SourceL, for the lower 32 bits.
For 24-bit serial number encoders (56-bit transmissions):
SourceH = 65H + 24 bit Serial Number
SourceL = 2BH + 24 bit Serial Number
For 28-bit serial number encoders (66 / 67-bit transmissions):
SourceH = 6H + 28 bit Serial Number
SourceL = 2H + 28 bit Serial Number
7.2
Secure Learning (Seed Derived)
The two input seeds are composed from the seed value that is transmitted during secure learning. The lower 32 bits of
the seed transmission is used to compose the lower seed, and the upper 32 bits, for the upper seed. The upper 4 bits
(function code) are set to zero.
For 32-bit seed encoders:
SourceH = Serial Number Lower 28 bits with upper 4 bits always zero
SourceL = Seed 32 bits
For 48-bit seed encoders:
SourceH = Seed Upper 16 bits + Serial Number Upper 16 bits with upper 4 bits always zero
SourceL = Seed Lower 32 bits
For 64-bit seed encoders:
Note:
64-bit seeds are handled as 48-bit seeds
SourceH = Seed Upper 16 bits + Serial Number Upper
SourceL = Seed Lower 32 bits
2001 Microchip Technology Inc.
16 bits
with upper 4 bits always zero
DS40151C-page 11
HCS512
7.3
Key Generation Algorithms
There are two key generation algorithms implemented in the HCS512 decoder. The KEELOQ decryption algorithm provides a higher level of security than the XOR algorithm. Section 6.1 describes the selection of the algorithms in the configuration byte.
7.3.1
KEELOQ DECRYPT ALGORITHM
This algorithm uses the KEELOQ decryption algorithm and the manufacturer’s code to derive the encoder key as follows:
Key Upper 32 bits = F KEELOQ Decrypt (SourceH) | 64 Bit Manufacturers Code
Key Lower 32 bits = F KEELOQ Decrypt (SourceL) | 64 Bit Manufacturers Code
7.3.2
XOR WITH THE MANUFACTURER’S CODE
The two 32-bits seeds are XOR with the manufacturer’s code to form the 64 bit encoder key.
Key Upper 32 bits = SourceH ⊗ Manufacturers Code | Upper 32 bits
Key Lower 32 bits = SourceL ⊗ Manufacturers Code | Lower 32 bits
After programming the manufacturer’s code, the HCS512 decoder will automatically activate an Erase All function,
removing all transmitters from the system.
If LRNIN is taken low momentarily during the learn status indication, the indication will be terminated. Once a successful
learning sequence is detected, the indication can be terminated, allowing quick learning in a manufacturing set up.
FIGURE 7-2:
HCS512 KEY GENERATION
SC_LRN = 0
Padding
2/2B
28/24-bit Serial Number
Padding
6/65
28/24-bit Serial Number
LRN0 = 0
KEELOQ
Decryption
Algorithm
LS 32 bits of Encoder Key
MS 32 bits of Encoder Key
SC_LRN = 1
LS 32 bits of Seed Transmission
Padding
0000b
KEELOQ
Decryption
Algorithm
MS 28 bits of Seed Transmission
LS 32 bits of Encoder Key
MS 32 bits of Encoder Key
LRN0 = 1
LS 32 bits of Seed Transmission
LS 32 bits of Encoder Key
XOR
Padding
0000b
MS 28 bits of Seed Transmission
DS40151C-page 12
MS 32 bits of Encoder Key
2001 Microchip Technology Inc.
HCS512
8.0
KEELOQ ENCODERS
8.2
8.1
Transmission Format (PWM)
The HCSXXX encoder transmits a 66/67-bit code word
when a button is pressed. The 66/67-bit word is constructed from an encryption portion and a nonencrypted code portion (Figure 8-2).
The KEELOQ encoder transmission is made up of several parts (Figure 8-1). Each transmission begins with
a preamble and a header, followed by the encrypted
and then the fixed data. The actual data is 56/66/67 bits
which consists of 32 bits of encrypted data and 24/34/
35 bits of non-encrypted data. Each transmission is
followed by a guard period before another transmission
can begin. The encrypted portion provides up to four
billion changing code combinations and includes the
button status bits (based on which buttons were activated) along with the synchronization counter value
and some discrimination bits. The non-encrypted portion is comprised of the status bits, the function bits,
and the 24/28-bit serial number. The encrypted and
non-encrypted combined sections increase the number
of combinations to 7.38 x 1019.
FIGURE 8-1:
Code Word Organization
The Encrypted Data is generated from four button bits,
two overflow counter bits, ten discrimination bits, and
the 16-bit synchronization value.
The Non-encrypted Data is made up from 2 status
bits, 4 function bits, and the 28/32-bit serial number.
CODE WORD TRANSMISSION FORMAT
LOGIC ‘0’
LOGIC ‘1’
Bit
Period
Header
TH
Preamble
TP
FIGURE 8-2:
Encrypted Portion
of Transmission
THOP
Fixed Portion of
Transmission
TFIX
CODE WORD ORGANIZATION
Non-encrypted Data
Repeat
CRC1*
Guard
Time
TG
CRC0*
3/2 bits
Vlow
(1 bit)
+
Encrypted Data
Button Status (4 bits)
Button
Status
(4 bits)
28-bit
Serial Number
Serial Number and Button Status (32 bits)
+
Discrimination bits (12
bits)
16-bit
Sync Value
32 bits of Encrypted Data
66/67 bits
of Data
Transmitted
*HCS360/361
2001 Microchip Technology Inc.
DS40151C-page 13
HCS512
9.0
ELECTRICAL CHARACTERISTICS FOR HCS512
Absolute Maximum Ratings †
Ambient temperature under bias ............................................................................................................ -55°C to +125°C
Storage temperature .............................................................................................................................. -65°C to +150°C
Voltage on any pin with respect to VSS (except VDD)........................................................................ -0.6V to VDD +0.6V
Voltage on VDD with respect to Vss...................................................................................................................0 to +7.5V
Total power dissipation (Note 1) ...........................................................................................................................800 mW
Maximum current out of VSS pin ...........................................................................................................................150 mA
Maximum current into VDD pin ..............................................................................................................................100 mA
Input clamp current, Iik (VI < 0 or VI > VDD) .........................................................................................................± 20 mA
Output clamp current, IOK (VO < 0 or VO >VDD) ..................................................................................................± 20 mA
Maximum output current sunk by any I/O pin..........................................................................................................25 mA
Maximum output current sourced by any I/O pin.....................................................................................................20 mA
Note:
Power dissipation is calculated as follows: Pdis = VDD x {IDD - ∑ IOH} + ∑ {(VDD–VOH) x IOH} + ∑(VOl x IOL)
† NOTICE: Stresses above those listed under “Absolute Maximum Ratings” may cause permanent damage to the
device. This is a stress rating only and functional operation of the device at those or any other conditions above those
indicated in the operation listings of this specification is not implied. Exposure to maximum rating conditions for
extended periods may affect device reliability.
DS40151C-page 14
2001 Microchip Technology Inc.
HCS512
TABLE 9-1:
DC CHARACTERISTICS
Standard Operating Conditions (unless otherwise stated)
Operating temperature
Commercial (C):
0°C ≤ TA ≤ +70°C for commercial
Industrial (I):
-40°C ≤ TA ≤ +85°C for industrial
Symbol
Characteristic
Min
Typ(†)
Max
Units
VDD
Supply Voltage
3.0
—
6.0
V
VPOR
VDD start voltage to
ensure Reset
—
VSS
—
V
SVDD
VDD rise rate to
ensure Reset
0.05*
—
—
V/ms
IDD
Supply Current
—
—
1.8
7.3
15
4.5
10
32
mA
mA
µA
Conditions
FOSC = 4 MHz, VDD = 5.5V
(During EEPROM programming)
In SLEEP mode
VIL
Input Low Voltage
VSS
—
0.16 VDD
V
except MCLR = 0.2 VDD
VIH
Input High Voltage
0.48 VDD
—
VDD
V
except MCLR = 0.85 VDD
VOL
Output Low Voltage
—
—
0.6
V
IOL = 8.5 mA, VDD = 4.5V
VOH
Output High Voltage
VDD-0.7
—
—
V
IOH = -3.0 mA, VDD = 4.5V
†Data in “Typ” column is at 5.0V, 25°C unless otherwise stated. These parameters are for design guidance
only and are not tested.
*These parameters are characterized but not tested.
Note:
Negative current is defined as coming out of the pin.
TABLE 9-2:
AC CHARACTERISTICS
Symbol
Characteristic
Min
Typ
Max
Units
Conditions
FOSC
Oscillator frequency
2.7
4
6.21
MHz
Rext = 10K, Cext = 10pF
65
—
1080
µs
TE
PWM elemental
pulse width
4.5V < VDD < 5.5V
Oscillator components tolerance < 6%.
130
—
1080
µs
3V < Vdd < 6V
Oscillator components tolerance <10%
TOD
Output delay
70
90
115
ms
TA
Output activation time
322
500
740
ms
TRPT
REPEAT activation time
32
50
74
ms
TLRN
LRNIN activation time
21
32
—
ms
TMCLR
MCLR low time
150
—
—
ns
TOV
Time output valid
—
150
222
ms
FIGURE 9-1:
RESET WATCHDOG TIMER, OSCILLATOR START-UP TIMER AND POWER-UP
TIMER TIMING
VDD
MCLR
TMCLR
TOV
I/O Pins
2001 Microchip Technology Inc.
DS40151C-page 15
DS40151C-page 16
0s
TA
TA
Note 2
1s
2: Output is activated if battery low (VLOW) is detected.
Note 1: Output is activated as long as code is received.
LRNOUT
VLOW
TOD
2s
Note 1
3s
4s
5s
FIGURE 9-2:
S[3,2,1,0]
RFIN
1 Code Word 50ms
HCS512
OUTPUT ACTIVATION
2001 Microchip Technology Inc.
VDD
G
N
D
2001 Microchip Technology Inc.
10 pF
10K
VO
P2
HCS512
15 OSCOUT
16 OSCIN
3 NC
4 MCLR
10K
14
5
G
N
D
17
18
1
2
S0
S1
S2
S3
6
7
8
9
VLOW 10
SLEEP 11
CLK 12
DAT 13
NC
V
RFIN
D
LRNIN
D
LRNOUT
VDD
P4
100K
P3
100 µF
POWER SUPPLY
1N4004/7
1 RECEIVE DATA INPUT
LEARN
BUTTON
10K
VDD
GND
1
2
3
1K
100µF
P1
GND
In Circuit
Programming Pads
P2
P4
Vlow
S3
S2
S1
S0
LRNOUT
RESET
VO
P3
DATA
G
N
D
CLOCK
1K
1K
1K
1K
1K
VI
VDD
FIGURE 9-3:
VI
LOW VOLTAGE DETECTOR—DO NOT OMIT
12V
LM7805
HCS512
TYPICAL DECODER APPLICATION CIRCUIT
DS40151C-page 17
HCS512
HCS512 PRODUCT IDENTIFICATION SYSTEM
To order or obtain information, e.g., on pricing or delivery, refer to the factory or the listed sales office.
HCS512
—
/P
Package:
Temperature
Range:
Device:
P = Plastic DIP (300 mil Body), 8-lead
SN = Plastic SOIC (300 mil Body), 18-lead
Blank = 0°C to +70°C
I = -40°C to +85°C
HCS512
HCS512T
Code Hopping Decoder
Code Hopping Decoder (Tape and Reel)
Sales and Support
Data Sheets
Products supported by a preliminary Data Sheet may have an errata sheet describing minor operational differences and recommended workarounds. To determine if an errata sheet exists for a particular device, please contact one of the following:
1. Your local Microchip sales office
2. The Microchip Corporate Literature Center U.S. FAX: (480) 792-7277
3. The Microchip Worldwide Web Site (www.microchip.com)
DS40151C-page 18
2001 Microchip Technology Inc.
HCS512
“All rights reserved. Copyright © 2001, Microchip
Technology Incorporated, USA. Information contained
in this publication regarding device applications and the
like is intended through suggestion only and may be
superseded by updates. No representation or warranty
is given and no liability is assumed by Microchip
Technology Incorporated with respect to the accuracy
or use of such information, or infringement of patents or
other intellectual property rights arising from such use
or otherwise. Use of Microchip’s products as critical
components in life support systems is not authorized
except with express written approval by Microchip. No
licenses are conveyed, implicitly or otherwise, under
any intellectual property rights. The Microchip logo and
name are registered trademarks of Microchip
Technology Inc. in the U.S.A. and other countries. All
rights reserved. All other trademarks mentioned herein
are the property of their respective companies. No
licenses are conveyed, implicitly or otherwise, under
any intellectual property rights.”
Trademarks
The Microchip name, logo, PIC, PICmicro,
PICMASTER, PICSTART, PRO MATE, KEELOQ,
SEEVAL, MPLAB and The Embedded Control
Solutions Company are registered trademarks of
Microchip Technology Incorporated in the U.S.A. and
other countries.
Total Endurance, ICSP, In-Circuit Serial Programming,
FilterLab, MXDEV, microID, FlexROM, fuzzyLAB,
MPASM, MPLINK, MPLIB, PICDEM, ICEPIC,
Migratable Memory, FanSense, ECONOMONITOR,
SelectMode and microPort are trademarks of
Microchip Technology Incorporated in the U.S.A.
Serialized Quick Term Programming (SQTP) is a
service mark of Microchip Technology Incorporated in
the U.S.A.
All other trademarks mentioned herein are property of
their respective companies.
© 2001, Microchip Technology Incorporated, Printed in
the U.S.A., All Rights Reserved.
Microchip received QS-9000 quality system
certification for its worldwide headquarters,
design and wafer fabrication facilities in
Chandler and Tempe, Arizona in July 1999. The
Company’s quality system processes and
procedures are QS-9000 compliant for its
PICmicro® 8-bit MCUs, KEELOQ® code hopping
devices, Serial EEPROMs and microperipheral
products. In addition, Microchip’s quality
system for the design and manufacture of
development systems is ISO 9001 certified.
2001 Microchip Technology Inc.
DS40151C-page 19
WORLDWIDE SALES AND SERVICE
AMERICAS
New York
Corporate Office
150 Motor Parkway, Suite 202
Hauppauge, NY 11788
Tel: 631-273-5305 Fax: 631-273-5335
2355 West Chandler Blvd.
Chandler, AZ 85224-6199
Tel: 480-792-7200 Fax: 480-792-7277
Technical Support: 480-792-7627
Web Address: http://www.microchip.com
Rocky Mountain
2355 West Chandler Blvd.
Chandler, AZ 85224-6199
Tel: 480-792-7966 Fax: 480-792-7456
Atlanta
500 Sugar Mill Road, Suite 200B
Atlanta, GA 30350
Tel: 770-640-0034 Fax: 770-640-0307
Austin
Analog Product Sales
8303 MoPac Expressway North
Suite A-201
Austin, TX 78759
Tel: 512-345-2030 Fax: 512-345-6085
Boston
2 Lan Drive, Suite 120
Westford, MA 01886
Tel: 978-692-3848 Fax: 978-692-3821
Boston
Analog Product Sales
Unit A-8-1 Millbrook Tarry Condominium
97 Lowell Road
Concord, MA 01742
Tel: 978-371-6400 Fax: 978-371-0050
Chicago
333 Pierce Road, Suite 180
Itasca, IL 60143
Tel: 630-285-0071 Fax: 630-285-0075
Dallas
4570 Westgrove Drive, Suite 160
Addison, TX 75001
Tel: 972-818-7423 Fax: 972-818-2924
Dayton
Two Prestige Place, Suite 130
Miamisburg, OH 45342
Tel: 937-291-1654 Fax: 937-291-9175
Detroit
Tri-Atria Office Building
32255 Northwestern Highway, Suite 190
Farmington Hills, MI 48334
Tel: 248-538-2250 Fax: 248-538-2260
Los Angeles
18201 Von Karman, Suite 1090
Irvine, CA 92612
Tel: 949-263-1888 Fax: 949-263-1338
Mountain View
Analog Product Sales
1300 Terra Bella Avenue
Mountain View, CA 94043-1836
Tel: 650-968-9241 Fax: 650-967-1590
ASIA/PACIFIC (continued)
Korea
Microchip Technology Korea
168-1, Youngbo Bldg. 3 Floor
Samsung-Dong, Kangnam-Ku
Seoul, Korea
Tel: 82-2-554-7200 Fax: 82-2-558-5934
San Jose
Microchip Technology Inc.
2107 North First Street, Suite 590
San Jose, CA 95131
Tel: 408-436-7950 Fax: 408-436-7955
Singapore
Microchip Technology Singapore Pte Ltd.
200 Middle Road
#07-02 Prime Centre
Singapore, 188980
Tel: 65-334-8870 Fax: 65-334-8850
Toronto
6285 Northam Drive, Suite 108
Mississauga, Ontario L4V 1X5, Canada
Tel: 905-673-0699 Fax: 905-673-6509
Taiwan
Microchip Technology Taiwan
11F-3, No. 207
Tung Hua North Road
Taipei, 105, Taiwan
Tel: 886-2-2717-7175 Fax: 886-2-2545-0139
ASIA/PACIFIC
Australia
Microchip Technology Australia Pty Ltd
Suite 22, 41 Rawson Street
Epping 2121, NSW
Australia
Tel: 61-2-9868-6733 Fax: 61-2-9868-6755
EUROPE
China - Beijing
Denmark
Microchip Technology Beijing Office
Unit 915
New China Hong Kong Manhattan Bldg.
No. 6 Chaoyangmen Beidajie
Beijing, 100027, No. China
Tel: 86-10-85282100 Fax: 86-10-85282104
Microchip Technology Denmark ApS
Regus Business Centre
Lautrup hoj 1-3
Ballerup DK-2750 Denmark
Tel: 45 4420 9895 Fax: 45 4420 9910
France
China - Shanghai
Microchip Technology Shanghai Office
Room 701, Bldg. B
Far East International Plaza
No. 317 Xian Xia Road
Shanghai, 200051
Tel: 86-21-6275-5700 Fax: 86-21-6275-5060
Hong Kong
Microchip Asia Pacific
RM 2101, Tower 2, Metroplaza
223 Hing Fong Road
Kwai Fong, N.T., Hong Kong
Tel: 852-2401-1200 Fax: 852-2401-3431
India
Microchip Technology Inc.
India Liaison Office
Divyasree Chambers
1 Floor, Wing A (A3/A4)
No. 11, O’Shaugnessey Road
Bangalore, 560 025, India
Tel: 91-80-2290061 Fax: 91-80-2290062
Japan
Microchip Technology Intl. Inc.
Benex S-1 6F
3-18-20, Shinyokohama
Kohoku-Ku, Yokohama-shi
Kanagawa, 222-0033, Japan
Tel: 81-45-471- 6166 Fax: 81-45-471-6122
Arizona Microchip Technology SARL
Parc d’Activite du Moulin de Massy
43 Rue du Saule Trapu
Batiment A - ler Etage
91300 Massy, France
Tel: 33-1-69-53-63-20 Fax: 33-1-69-30-90-79
Germany
Arizona Microchip Technology GmbH
Gustav-Heinemann Ring 125
D-81739 Munich, Germany
Tel: 49-89-627-144 0 Fax: 49-89-627-144-44
Germany
Analog Product Sales
Lochhamer Strasse 13
D-82152 Martinsried, Germany
Tel: 49-89-895650-0 Fax: 49-89-895650-22
Italy
Arizona Microchip Technology SRL
Centro Direzionale Colleoni
Palazzo Taurus 1 V. Le Colleoni 1
20041 Agrate Brianza
Milan, Italy
Tel: 39-039-65791-1 Fax: 39-039-6899883
United Kingdom
Arizona Microchip Technology Ltd.
505 Eskdale Road
Winnersh Triangle
Wokingham
Berkshire, England RG41 5TU
Tel: 44 118 921 5869 Fax: 44-118 921-5820
01/30/01
All rights reserved. © 2001 Microchip Technology Incorporated. Printed in the USA. 2/01
Printed on recycled paper.
Information contained in this publication regarding device applications and the like is intended through suggestion only and may be superseded by
updates. It is your responsibility to ensure that your application meets with your specifications. No representation or warranty is given and no liability is
assumed by Microchip Technology Incorporated with respect to the accuracy or use of such information, or infringement of patents or other intellectual
property rights arising from such use or otherwise. Use of Microchip’s products as critical components in life support systems is not authorized except with
express written approval by Microchip. No licenses are conveyed, implicitly or otherwise, except as maybe explicitly expressed herein, under any intellectual property rights. The Microchip logo and name are registered trademarks of Microchip Technology Inc. in the U.S.A. and other countries. All rights
reserved. All other trademarks mentioned herein are the property of their respective companies.
DS40151C-page 20
2001 Microchip Technology Inc.