MICROCHIP HCS301 Technical data
HCS301
KEELOQ® Code Hopping Encoder
FEATURES
Security
•Programmable 28-bit serial number
•Programmable 64-bit encryption key
•Each transmission is unique
•66-bit transmission code length
•32-bit hopping code
•34-bit fixed code (28-bit serial number,
4-bit button code, 2-bit status)
•Encryption keys are read protected
Operating
•3.5V - 13.0V operation
•Four button inputs
•No additional circuitry required
•15 functions available
•Selectable baud rate
•Automatic code word completion
•Battery low signal transmitted to receiver
•Battery low indication on LED
•Non-volatile synchronization data
Other
•Functionally identical to HCS300
•Easy-to-use programming interface
•On-chip EEPROM
•On-chip oscillator and timing components
•Button inputs have internal pull-down resistors
•Current limiting on LED
•Low external component cost
Typical Applications
output
DESCRIPTION
The HCS301 from Microchip Technology Inc. is a code
hopping encoder designed for secure Remote Keyless
Entry (RKE) systems. The HCS301 utilizes the KEELOQ
code hopping technology, which incorporates high
security, a small package outline and low cost, to make
this device a perfect solution for unidirectional remote
keyless entry systems and access control systems.
PACKAGE TYPES
PDIP, SOIC
8
S0
S1
S2
S3
1
2
3
4
HCS301
VDD
LED
7
6
PWM
V
SS
5
HCS301 BLOCK DIAGRAM
LED
PWM
Oscillator
RESET circuit
LED
VSS
VDD
Controller
driver
EEPROM
32-bit shift register
Button input port
Power
latching
and
switching
Encoder
The HCS301 is ideal for Remote Keyless Entry (RKE)
applications. These applications include:
•Automotive RKE systems
•Automotive alarm systems
•Automotive immobilizers
•Gate and garage door openers
•Identity tokens
•Burglar alarm systems
2001 Microchip Technology Inc. DS21143B-page 1
The HCS301 combines a 32-bit hopping code,
generated by a nonlinear encryption algorithm, with a
28-bit serial number and 6 information bits to create a
66-bit code word. The code word length eliminates the
threat of code scanning and the code hopping mechanism makes each transmission unique, thus rendering
code capture and resend schemesuseless.
S3
S2
S1 S0
HCS301
The crypt key, serial number and conf iguration dat a are
stored in an EEPROM array which is n ot accessible via
any external connection. The EEPROM data is programmable but read-protected. The data can be verified only after an automatic erase and programming
operation. This protects against attempts to gain
access to keys or manipulate synchronizat ion values.
The HCS301 provides an easy-to-use serial interface
for programming the necessary keys, system parameters and configuration data.
1.0 SYSTEM OVERVIEW
Key Terms
The following is a l ist of key te rms us ed thro ughout this
data sheet. For additional information on K
Code Hopping, refer to Technical Brief 3 (TB003).
• RKE - Remote Keyless Entry
• Button Status - Indicates what button input(s)
activated the transmission. Encompasses the 4
button status bits S3, S2, S1 and S0 (Figure 4-2).
• Code Hopping - A method by which a code,
viewed externally to the system, appears to
change unpredictably each time it is transmitted.
• Code word - A block of data that is repeatedly
transmitted upon button activation (Figure4-1).
• Transmission - A data stream consisting of
repeating code words (Figure 8-2).
• Crypt key - A unique and secret 64-bit number
used to encrypt and decrypt data. In a symmetrical block cipher such as the K
the encryption and de cry pti on k ey s a re equal and
will therefore be referred to gene rally as the crypt
key.
• Encoder - A device that generates and encodes
data.
• Encryption Algorithm - A recipe whereb y data i s
scrambled using a crypt k ey . The dat a can only be
interpreted by the respe ctive dec ryptio n algo rithm
using the same crypt key.
• Decoder - A device that decodes data received
from an encoder.
• Decryption algorithm - A recipe whereby data
scrambled by an encryption algorithm can be
unscrambled using the same crypt key.
EELOQ algorithm,
EELOQ and
• Learn – Learning inv olves the recei ver calcula ting
the transmitter’s appropriate crypt key, d ec ryp ting
the received hopping code and storing the serial
number, synchronization counter value and crypt
key in EEPROM. The K
itates several learning strategies to be implemented on the decoder. The following are
examples of what can be done.
- Simple Learning
The receiver uses a fixed crypt key, common
to all components of all system s by the same
manufacturer, to decrypt the received code
word’s encrypted portion.
- Normal Learning
The receiver uses information transmitted
during normal operation to derive the crypt
key and decrypt the received code word’s
encrypted portion.
- Secure Learn
The transmitter is activated through a special
button combinat ion to t ransmit a stored 60-bit
seed value used to generat e the trans mitter’s
crypt key. The receiver uses this seed value
to derive the same crypt key and decrypt the
received code word’s encrypted portion.
• Manufacturer’s code – A unique and secret 64-
bit number used to generate un ique encoder crypt
keys. Each encoder is programmed with a crypt
key that is a function of the manufacturer’s code.
Each decoder is programmed with the manufacturer code itself.
The HCS301 code hopping encode r is designed sp ecifically for keyless entry systems; primarily vehicles and
home garage door openers. The encoder portion of a
keyless entry system is integrated into a transmitter,
carried by the user and operated to gain access to a
vehicle or restricted area. The HCS301 is meant to be
a cost-effective yet secure solution to such systems,
requiring very few external components (Figure 2-1).
Most low-end keyless entry transmitters are given a
fixed identificati on code that is transmitted ever y time a
button is pushed. The number of unique identification
codes in a low-end system is usually a relatively small
number. These shortcomings provide an opportunity
for a soph istic ated t hief to crea te a d evice that ‘grab s’
a transmission and retransmits it later, or a device that
quickly ‘scans ’ all pos sible identi ficati on c odes un til the
correct one is found.
The HCS301, on the other hand, employs the K
code hopping technology coupled with a transmission
length of 66 bits to virtually eliminate the use of code
‘grabbing’ or code ‘scann ing’. The hig h security le vel of
the HCS301 is base d on the p atented K
ogy. A block cipher based on a block length of 32 bits
and a key length of 64 bits is used. The algorithm
obscures the informati on i n such a way that even if the
transmission informati on (before c oding) dif fers b y only
one bit from that of the previous transmission, the next
EELOQ product family facil-
EELOQ
EELOQ
technol-
DS21143B-page 2 2001 Microchip Technology Inc.
HCS301
coded transmission will be completely different. Statistically, if only one bit in the 32-bit string of information
changes, greater than 50 percent of the coded transmission bits will change.
As indicated in the block diagram on page one, the
HCS301 has a small EEPROM array which must be
loaded with several p arameters before use; most often
programmed by the manufacturer at the time of production. The most important of these are:
• A 28-bit serial number, typically unique for every
encoder
• A crypt key
• An initial 16-bit synchronization value
• A 16-bit configuration value
The crypt key generatio n typically input s the transmitter
serial number and 64-bit manufact urer ’s code into t he
key generation algorithm (Figure 1-1). The manufacturer’s code is chosen by the system manufacturer and
must be carefully controlled as it is a pivotal part of the
overall system security.
FIGURE 1-1: CREATION AND STORAGE OF CRYPT KEY DURING PRODUCTION
Production
Programmer
Manufacturer’s
Code
Transmitter
Serial Number
Key
Generation
Algorithm
Crypt
Key
HCS301
EEPROM Array
Serial Number
Crypt Key
Sync Counter
.
.
.
The 16-bit synchronization counter is the basis behind
the transmitted code word changing for each transmission; it increments each time a button is pressed. Due
to the code hoppin g algorith m’s complex ity, each inc rement of the synchronization value results in greater
than 50% of the bits changing in the transmitted code
word.
Figure 1-2 shows how the key values in EEPROM are
used in the encoder . O nce the encoder dete cts a button
press, it reads the button inputs and updates the synchronization counter. The synchronization counter and
crypt key are input to the encryption algorithm and the
output is 32 bits of encrypted information. This data will
change with every button press, its value appearing
externally to ‘ran domly h op aroun d’, hence it is re ferred
to as the hopping portion of the code word. The 32-bit
hopping code is combined with the button information
and serial numb er to fo rm the code word transm itted to
the receiver. The code word format is explained in
greater detail in Section 4.0.
A receiver may use any type of controller as a decoder,
but it is typically a microcon troller with compatible firmware that allows the decoder to operate in conjunction
with an HCS301 based transmitter. Section 7.0
provides detail on integrating the HCS301 into a system.
A transmitter must first be ‘learned’ by the receiver
before its use is allowed in the system. Learning
includes calculating the transmitter’s appropriate crypt
key, decrypting the received hopping code and storing
the serial number, synchronization counter value and
crypt key in EEPROM.
In normal operation, each received message of valid
format is evaluated. The serial number is used to determine if it is from a learned transmitter. If from a learned
transmitter, the message is decrypted and the synchronization counter is verified. Finally, the button status is
checked to see what operation is requested. Figure 1-3
shows the relationship between some of the values
stored by the receiver and the values received from
the transmitter.
2001 Microchip Technology Inc. DS21143B-page 3
HCS301
FIGURE 1-2: BUILDING THE TRANSMITTED CODE WORD (ENCODER)
EEPROM Array
Crypt Key
Sync Counter
Serial Number
KEELOQ
Encryption
Algorithm
Button Press
Information
Serial Number
Transmitted Information
FIGURE 1-3: BASIC OPERATION OF RECEIVER (DECODER)
1
Received Information
Button Press
Information
Serial Number
Check for
2
Match
32 Bits of
Encrypted Data
32 Bits
Encrypted Data
EEPROM Array
Manufacturer Code
Serial Number
Sync Counte r
KEELOQ
Decryption
Algorithm
Decrypted
Synchronization
Counter
Perform Function
Indicated by
5
button press
NOTE: Circled numbers indicate the order of execution.
Crypt Key
3
Check for
4
Match
DS21143B-page 4 2001 Microchip Technology Inc.
HCS301
2.0 DEVICE OPERATION
As shown in the typical a pplication circ uits (Figu re 2-1),
the HCS301 is a simple device to use. It requires only
the addition of buttons and RF circuitry for use as the
transmitter in your security applic ation. A descripti on of
each pin is given in Table 2-1.
Note: When VDD > 9.0V and driving low capaci-
tive loads, a res ist or wi th a minimum value
of 50Ω should be used in line with V
This prevents clamping of PWM at 9.0V in
the event of P WM overshoot .
FIGURE 2-1: TYPICAL CIRCUITS
+12V
R
B0
B1
2 button remote control
B4 B3 B2 B1 B0
5 button remote control
Note 1: Up to 15 functions can be implemented by pressing
more than one button si multaneously or by usi ng a
suitable diode array.
2: Resistor R is recommended for current limiting.
S0
S1
S2
S3
S0
S1
S2
S3
(1)
V
DD
LED
PWM
SS
V
DD
V
LED
PWM
V
SS
Tx out
Tx out
DD.
TABLE 2-1: PIN DESCRIPTIONS
The HCS301 will wake-up upon detecting a button
press and delay approximately 10 ms for button
debounce (Figure 2-2). The synchronization counter,
discrimination value and button information will be
encrypted to form the hopping code. The hopping code
portion will change every transmission, even if the
same button is pushed again. A code word that has
been transmitted will not repeat for more than 64K
transmissions. Thi s provides mo re than 18 years of use
before a code is repeated; based on 10 operations per
day . Overflow inform ation sent from the enc oder can be
used to extend the number of unique transmissions to
more than 192K.
If in the tr an smit proc ess it i s de tec ted t hat a n ew b utton(s) has been pressed, a RESET will immediately
occur and the current cod e word will no t be compl eted.
Please note that buttons removed will not have any
effect on the code word unless no buttons remain
pressed; in which c ase the code word will be compl eted
and the power-down will occur.
2001 Microchip Technology Inc. DS21143B-page 5
HCS301
FIGURE 2-2: ENCODER OPERATION
Power-Up
(A button has been pressed)
RESET and Debounce Delay
(10 ms)
Sample Inputs
Update Sync Info
Encrypt With
Crypt Key
Load Transmit Register
Transmit
Yes
Buttons
Added
?
No
All
Buttons
Released
?
Yes
Complete Code
Word Transmission
Stop
No
3.0 EEPROM MEMORY ORGANIZATION
The HCS301 contains 192 bits (12 x 16-bit words) of
EEPROM memory (Table 3-1). This EEPROM array is
used to store the encryption key information,
synchroniz ation v alue, etc. Fur ther de scripti ons of the
memory array is given in the following sections.
T ABLE 3-1: EEPROM MEMORY MAP
WORD
ADDRESS
0 KEY_0 64-bit encryption key
1 KEY_1 64-bit encryption key
2 KEY_2 64-bit encryption key
3 KEY_3 64-bit encryption key
4 SYNC 16-bit synchronization
5 RESERVED Set to 0000H
6 SER_0 Device Serial Number
7 SER_1(Note) Device Serial Number
8 SEED_0 Seed V al ue (word 0)
9 SEED_1 Seed V al ue (word 1)
10 RESERVED Set to 0000H
11 CONFIG Config Word
Note: The MSB of the serial nu mber con tains a bit
MNEMONIC DESCRIPTION
(word 0) LSb’s
(word 1)
(word 2)
(word 3) MSb’s
value
(word 0) LSb’s
(word 1) MSb’s
used to select the Auto-shutoff timer.
3.1 KEY_0 - KEY_3 (64-Bit Crypt Key)
The 64-bit crypt key is used to create the encrypted
message tra nsmitted to the receiver. This ke y is calculated and programmed during production using a key
generation algorithm. The key generation algorithm
may be different from the K
the key generation algorithm are typically the transmit-
ter’s serial numbe r and the 64-bit man ufactu rer’s cod e.
While the key generation algorithm supplied from
Microchip is the typical method used, a user may elect
to create their ow n method of key g eneration. This ma y
be done providing that the deco der is program med with
the same means of creating the key for
decryption purposes.
DS21143B-page 6 2001 Microchip Technology Inc.
EELOQ
algorithm. Inputs to
HCS301
3.2 SYNC (Synchronization Counter)
This is the 16-bit synchronization value that is used to
create the hopping code for transmission. This value
will increment after every transmission.
3.3 Reserved
Must be initialized to 0000H.
3.4 SER_0, SER_1
(Encoder Serial Number)
SER_0 and SER_1 are the lower and upper words of
the device serial number, respectively. Although there
are 32 bits allocated for the serial number, only the
lower order 28 bits are transmitted. The serial number
is meant to be unique for every transmitter.
3.4.1 AUTO-SHUTOFF TIMER ENABLE
The Most Sign ificant bit of the serial number (Bit 31) is
used to turn the Auto-shutoff timer on or off. This timer
prevents the transmitter from draining the battery
should a bu tton get stuck in the on positi on for a l ong
period of time. The time period is approximately
25 seconds, after which the device will go to the Timeout mode. When in the Time-out mo de, t he devi ce w ill
stop transmitting, although since some circuits within
the device a re still acti ve, the curre nt draw within the
Shutoff mode will be higher than Standby mode. If the
Most Signifi can t bi t i n the s eri al n umb er i s a o ne, t hen
the Auto-shutoff timer is enabled, and a zero in the
Most Significant bit will disable the timer. The length of
the timer is not selectable.
3.5 SEED_0, SEED_1 (Seed Word)
The 2-word (32-bit) seed c ode will be tr ansmitte d when
all three buttons are pressed at the same time (see
Figure 4-2). This allows the system designer to implement the secu re learn feature or u se this fixed code
word as part of a different key generation/tracking process.
3.6 CONFIG (Configuration Word)
The Configuration Word is a 16-bit word stored in
EEPROM array that is used by the device to store
information used duri ng the encryp tion process, as w ell
as the status of option configurations. The following
sections further explain these bits.
TABLE 3-2: CONFIGURATION WORD
Bit Number Bit Description
0 Discrimination Bit 0
1 Discrimination Bit 1
2 Discrimination Bit 2
3 Discrimination Bit 3
4 Discrimination Bit 4
5 Discrimination Bit 5
6 Discrimination Bit 6
7 Discrimination Bit 7
8 Discrimination Bit 8
9 Discrimination Bit 9
10 Overflow Bit 0 (OVR0)
11 Overflow Bit 1 (OVR1)
12 Low Voltage Trip Poi nt Select
(V
LOW SEL)
13 Baud rate Select Bit 0 (BSL0)
14 Baud rate Select Bit 1 (BSL1)
15 Reserved, set to 0
3.6.1 DISCRIMINATION VALUE
(DISC0 TO DISC9)
The discrimination value aids the post-decryption
check on the decoder end. It may be any value, but in
a typical system it will be programmed as the 10 Least
Significant bits of the serial number. Values other than
this must be separately stored by the receiver when a
transmitter is learned. The discrimination bits are part
of the information tha t form the encrypte d portion o f the
transmission (Figure 4-2). After the receiver has
decrypted a transmission, the discrimination bits are
checked against the receiver’s stored value to verify
that the decryption proc ess was v alid. If the discrim ination value was programmed as the 10 LSb’s of the
serial number then it may merely be compared to the
respectiv e bits of the received se rial number; saving
EEPROM space.
3.6.2 OVERFLOW BITS
(OVR0, OVR1)
The overflow bits are used to extend the number of
possible synchronization values. The synchronization
counter is 16 bits in length, yielding 65,536 values
before the cycle repeats. Under typical use of
10 operations a day , th is will provi de nea rly 18 year s of
use before a repeated value will be used. Should the
system designer conclude that is not adequate, then
the overflow bits can be utilized to extend the number
2001 Microchip Technology Inc. DS21143B-page 7
HCS301
of unique values. This can be done by programming
OVR0 and OVR1 to 1s at the time of production. The
encoder will automatica lly clear OVR0 the first time that
the synchronization value wraps from 0xFFFF to
0x0000 and clear OVR1 the second time the counter
wraps. Once cleared, OVR0 and OVR1 cannot be set
again, thereby creating a permanent record of the
counter overflow. This prevents fast cycling of 64K
counter. If the decoder system is programmed to track
the overflow bits, then the effective number of unique
synchronization values can be extended to 196,608.
3.6.3 BAUD RATE SELECT BITS
(BSL0, BSL1)
BSL0 and BSL1 select the speed of transmission and
the code word blanking. Table 3-3 shows how the bits
are used to select the different baud rates and
Section 5.7 provides detailed explanation in code word
blanking.
TABLE 3-3: BAUD RATE SELECT
BSL1 BSL0
Basic Pulse
Element
0 0 400 µsAll
0 1 200 µs 1 out of 2
1 0 100 µs 1 out of 2
1 1 100 µs 1 out of 4
Code Words
Transmitted
3.6.4 LOW VOLTAGE TRIP POINT
SELECT
The low voltage trip point select bit is used to tell the
HCS301 what
VDD level is being used. This information
will be used by the device to determine when to send the
voltage low signal to the receiver. When this bit is set to
a one, the
9V or 12V
VDD level is assumed to be operating from a
VDD level. If the bit is set low, then the VDD le vel
is assumed to be 6.0 volts. Refer to Figure 3-1 for voltage trip point.
FIGURE 3-1: VOLTAGE TRIP POINTS
BY CHARACTERIZATION
Volts (V)
5.5
5.0
4.5
4.0
3.5
3.0
2.5
9.0
8.5
8.0
7.5
7.0
VLOW sel = 0
VLOW sel = 1
V
LOW
Max
Min
Max
Min
-40 20 40 100
-20 0 60 80
Temp (C)
DS21143B-page 8 2001 Microchip Technology Inc.
HCS301
4.0 TRANSMITTED WORD
4.1 Code Word Format
The HCS301 code word is made up of several parts
(Figure 4-1). Each code word contains a 50% duty
cycle preamble, a hea der , 32 bits of en crypted data an d
34 bits of fixed data followed by a guard period before
another code word can begin. Refer to Table 8-4 for
code word timing.
FIGURE 4-1: CODE WORD FORMAT
TE
TE
TE
LOGIC ‘0’
LOGIC ‘1’
Bit
Period
50% Duty Cycle
Preamble
TP
Header
TH
Encrypted Portion
of Transmission
4.2 Code Word Organization
The HCS301 transmits a 66-bit code word when a
button is pressed. The 66-bit word is constructed from
a Fixed Code portion and an Encrypted Code portion
(Figure 4-2).
The 32 bits of Encrypted Data are generated from 4
button bits, 12 discrimination bits and the 16-bit sync
value. The encrypted portion alone provides up to four
billion changing code combinations.
The 34 bits of Fixed Code Data are made up of 2 status bits, 4 button bits and the 28-bit serial number. The
fixed and encrypted sections combined increase the
number of code combinations to 7.38x 10
THOP
Fixed Portion of
Transmission
TFIX
Guard
Time
TG
19
.
FIGURE 4-2: CODE WORD ORGANIZATION
34 bits of Fixe d Portion 32 bits of Encrypted Por tion
Button
Status
S2 S1 S0 S3
Button
Status
1 1 1 1
Serial Number
(28 bits)
Serial Number
(28 bits)
MSb
MSb
Repeat
(1 bit)
Repeat
(1 bit)
VLOW
(1 bit)
LOW
V
(1 bit)
Note: SEED replaces Encrypted Portion when all button inputs are activated at the same time.
Button
Status
S2 S1 S0 S3
OVR
(2 bits)
DISC
(10 bits)
SEED
(32 bits)
Sync Counter
(16 bits)
66 Data bits
Transmitted
LSb first.
LSb
LSb
2001 Microchip Technology Inc. DS21143B-page 9
Loading...