MICROCHIP HCS360 Technical data

HCS360
KEELOQ® Code Hopping Encoder

FEATURES

Security
• Programmable 28/32-bit serial number
• Programmable 64-bit encryption key
• Each transmission is unique
• 67-bit transmission code length
• 35-bit fixed code (28/32-bit serial number, 4/0-bit function code, 1-bit status, 2-bit CRC)
• Encryption keys are read protected
Operating
• 2.0-6.6V operation
• Four but ton inputs
- 15 functions available
• Selectable baud rate
• Automatic code word co mpletion
• Battery low signal transmitted to receiver
• Nonvolatile synchronization data
• PWM and Manchester modulation
Other
• Easy-to-use programming interface
• On-chip EEPROM
• On-chip oscillator and timing components
• Button inputs have inte rnal pull-down resistors
• Current limiting on LED
• Minimum component count
Enhanced Features Over HCS300
• 48-bit seed vs. 32-bit seed
• 2-bit CRC for error detection
• 28/32-bit serial number select
• Two seed transmission methods
• PWM and Manchester modulation
• IR Modulation mode
output

DESCRIPTION

The HCS360 is a code hopping encoder designed for secure Remote Keyless Entry (RKE) systems. The HCS360 utilizes the KEELOQ c ode ho pping techno logy, which incorporates high security, a small package outline and low cost, to make this device a perfect solution for unidirectional remote keyless entry sys­tems and access control systems.

PACKAGE TYPES

PDIP, SOIC
8
V
S0
S1 S2
S3
1
HCS360
2 3 4
DD
LED
7 6
DATA
V
SS
5

BLOCK DIAGRAM

LED
DATA
RESET circuit
VSS
VDD
Oscillator
Controller
LED driver
EEPROM
32-bit shift register
Button input port
Encoder
Power latching and switching
Typical Applications
The HCS360 is ideal for Remote Keyless Entry (RKE) applications. These applications include:
• Automotive RKE systems
• Automotive alarm systems
The HCS360 combines a 32-bit hopping code generated by a nonlinear encryption algorithm, with a 28/32-bit serial number and 7/3 status bits to create a 67-bit transmission stream.
S
S
S1S
2
3
0
• Automotive immobilizers
• Gate and garage door openers
• Identity t okens
• Burglar alarm systems
2002 Microchip Technology Inc. DS40152E-page 1
HCS360
The crypt key, serial number and conf iguration d ata are stored in an EEPROM array which is n ot accessible via any external connection. The EEPROM data is pro­grammable but read-protected. The data can be veri­fied only after an automatic erase and programming operation. This protects against attempts to gain access to keys or manipulate synchronizat ion values. The HCS360 provides an easy-to-use serial interface for programming the necessary keys, system parame­ters and configuration data.

1.0 SYSTEM OVERVIEW

Key Terms
The following is a l ist of key te rms us ed thro ughout this data sheet. For additional information on K Code Hopping, refer to Technical Brief 3 (TB003).
RKE - Remote Keyless Entry
Button Status - Indicates what button input(s) activated the transmission. Encompasses the 4 button status bits S3, S2, S1 and S0 (Figure 3-1).
Code Hopping - A method by which a code, viewed externally to the system, appears to change unpredictably each time it is transmitted.
Code word - A block of data that is repeatedly transmitted upon button activation (Figure3-1).
Transmission - A data stream consisting of repeating code words (Figure 8-1).
Crypt key - A unique and secret 64-bit number used to encrypt and decrypt data. In a symmetri­cal block cipher such as the K the encryption and de cry pti on k ey s a re equal and will therefore be referred to generally as the crypt key.
Encoder - A device that generates and encodes data.
Encryption Algorithm - A recipe wher eby data i s scrambled using a cryp t key . The dat a can only be interpreted by the respe ctive dec ryptio n algo rithm using the same crypt key.
Decoder - A device that decodes data received from an encoder.
Decryption algorithm - A recipe whereby data scrambled by an encryption algorithm can be unscrambled using the s ame crypt key.
EELOQ algorithm,
EELOQ and
LearnLearning involves the receive r calculatin g the transmitter’s appropriate crypt ke y, d ec rypting the received hopping code and storing the serial number, synchronization counter value and crypt key in EEPROM. The K
itates several learning strategies to be imple­mented on the decoder. The following are examples of what can be done.
- Simple Learning
The receiver uses a fixed crypt key, common to all compone nts of al l s y ste ms b y the same manufacturer, to decrypt the received code
word’s encrypted portion.
- Normal Learning
The receiver uses information transmitted during normal operation to derive the crypt key and decrypt the received code word’s encrypted portion.
- Secure Learn
The transmitter is activated through a special button combinat ion to t ransmit a stored 60-bit seed value used to generat e the trans mitter’s crypt key. The receiver uses this seed value to derive the same crypt key and decrypt the received code word’s encrypted portion.
Manufacturer’s code – A unique and secret 64- bit number used to generate un ique encoder crypt keys. Each encoder is programmed with a crypt key that is a function of the manufacturer’s code. Each decoder is programmed with the manufac­turer code itself.
The HCS360 code hopping encode r is designed sp ecif­ically for keyless entry systems; primarily vehicles and home garage door openers. The encoder portion of a keyless entry system is integrated into a transmitter, carried by the user and operated to gain access to a vehicle or restricted area. The HCS360 is meant to be a cost-effective yet secure solution to such systems, requiring very few external components (Figure 2-1).
Most low-end keyless entry transmitters are given a fixed identificati on code that is transmitted ever y time a button is pushed. The number of unique identification codes in a low-end system is usually a relatively small number. These shortcomings provide an opportunity
for a soph istic ated t hief to crea te a d evice that ‘grab s’ a transmission and retransmits it later, or a device that quickly ‘scans ’ all pos sible identi ficati on c odes un til the correct one is found.
The HCS360, on the other hand, employs the K code hopping technology coupled with a transmission length of 66 bits to virtually eliminate the use of code ‘grabbing’ or code ‘scann ing’. The hig h security le vel of the HCS360 is ba sed on the p ate nted K ogy. A block cipher based on a block length of 32 bits and a key length of 64 bits is used. The algorithm obscures the informati on i n such a way that even if th e transmission informati on (before c oding) dif fers b y only one bit from that of the previous transmission, the next
EELOQ product family facil-
EELOQ
EELOQ
technol-
DS40152E-page 2 2002 Microchip Technology Inc.
HCS360
coded transmission will be completely different. Statis­tically, if only one bit in the 32-bit string of information changes, greater than 50 percent of the coded trans­mission bits will change.
As indicated in the block diagram on page one, the HCS360 has a small EEPROM array which must be loaded with several p arameters before use; mos t ofte n programmed by the manufacturer at the time of produc­tion. The most important of these are:
• A 28-bit serial number, typically unique for every encoder
• A crypt key
• An initial 16-bit synchronization value
• A 16-bit configuration value
The crypt key generatio n typically input s the transmitter serial number and 64-bit manufact urer ’s code into t he key generation algorithm (Figure 1-1). The manufac­turer’s code is chosen by the system manufacturer and must be carefully controlled as it is a pivotal part of the overall system security.

FIGURE 1-1: CREATION AND STORAGE OF CRYPT KEY DURING PRODUCTION

Production Programmer
Manufacturer’s
Code
Transmitter
Serial Number
Key
Generation
Algorithm
Crypt
Key
HCS360
EEPROM Array
Serial Number
Crypt Key Sync Counter
.
.
.
The 16-bit synchronization counter is the basis behind the transmitted code word changing for each transmis­sion; it increments each time a button is pressed. Due to the code hoppin g algorith m’s complex ity, each i ncre­ment of the synchronization value results in greater than 50% of the bits changing in the transmitted code word.
Figure 1-2 shows how the key values in EEPROM are used in the encoder . O nce the encoder dete cts a button press, it reads the button inputs and updates the syn­chronization counter. The synchronization counter and crypt key are input to the encryption algorithm and the output is 32 bits of encrypted information. This data will change with every button press, its value appearing externally to ‘ran domly h op aroun d’, hence it is re ferred to as the hopping portion of the code word. The 32-bit hopping code is combined with the button information and serial numb er to fo rm the code word transm itted to the receiver. The code word format is explained in greater detail in Section 4.2.
A receiver may use any type of controller as a decoder, but it is typically a microcontroller with compatible firm­ware that allows the decoder to operate in conjunction with an HCS360 based transmitter. Section 7.0 provides detail on integrating the HCS360 into a sys­tem.
A transmitter must first be ‘learned’ by the receiver before its use is allowed in the system. Learning includes calculating the transmitter’s appropriate crypt key, decrypting the received hopping code and storing the serial number, synchronization counter value and crypt key in EEPROM.
In normal operation, each received message of valid format is evaluated. The serial number is used to deter­mine if it is from a learned transmitter. If from a learned transmitter, the message is decrypted and the synchro­nization counter is verified. Finally, the button status is checked to see what operation is requested. Figure 1-3 shows the relationship between some of the values stored by the receiver and the values received from the transmitter.
2002 Microchip Technology Inc. DS40152E-page 3
HCS360

FIGURE 1-2: BUILDING THE TRANSMITTED CODE WORD (ENCODER)

EEPROM Array
Crypt Key
Sync Counter
Serial Number
KEELOQ
Encryption
Algorithm
Button Press
Information
Serial Number
Transmitted Information

FIGURE 1-3: BASIC OPERATION OF RECEIVER (DECODER)

1
Received Information
Button Press Information
Serial Number
Check for
2
Match
32 Bits of
Encrypted Data
32 Bits
Encrypted Data
EEPROM Array
Manufacturer Code
Serial Number
Sync Counte r
KEELOQ Decryption Algorithm
Decrypted
Synchronization
Counter
Perform Function Indicated by
5
button press
NOTE: Circled numbers indicate the order of execution.
Crypt Key
3
Check for
4
Match
DS40152E-page 4 2002 Microchip Technology Inc.
HCS360

2.0 DEVICE OPERATION

As shown in the typical a pplication circ uits (Figu re 2-1), the HCS360 is a simple device to use. It requires only the addition of buttons and RF circuitry for use as the transmitter in your security applic ation. A descripti on of each pin is described in Table2-1.

FIGURE 2-1: TYPICAL CIRCUITS

VDD
B0
B1
S0 S1
S2 S3
Two button remote control
VDD LED
DATA
V
SS
Tx out
discrimination value and button information will be encrypted to form the hopping code. The hopping code portion will change every transmission, even if the same button is pushed again. A code word that has been transmitted will not repeat for more than 64K transmissions. Thi s provides mo re than 18 years of use before a code is repeated; based on 10 operations per day . Overflow inform ation sent from the enc oder can be used to extend the number of unique transmissions to more than 192K.
If in the tr an smit proc ess it i s de tec ted t hat a n ew b ut­ton(s) has been pressed, a RESET will immediately occur and the current cod e word will no t be compl eted. Please note that buttons removed will not have any effect on the code word unless no buttons remain pressed; in which c ase the code word will be compl eted and the power-down will occur.

FIGURE 2-2: ENCODER OPERATION

TABLE 2-1: PIN DESCRIPTIONS

Name
S0 1 Switch input 0 S1 2 Switch input 1 S2 3 Switc h input 2 / Clock pin when in
S3 4 Switch input 3
SS 5 Ground reference
V
DATA 6 Data output pin /Data I/O pin for
LED VDD 8 Positive supply voltage
The HCS360 will wake-up upon detecting a button press and delay approximately 10 ms for button debounce (Figure 2-2). The synchronization counter,
2002 Microchip Technology Inc. DS40152E-page 5
Pin
Number
Description
Programming mode
Programming mode
7 Cathode connection for LED
HCS360

3.0 EEPROM MEMORY ORGANIZATION

The HCS360 contains 192 bits (12 x 16-bit words) of EEPROM memory (Table 3-1). This EEPROM array is used to store the crypt key information, synchronization value, etc . Fu r t he r d es cr i pti o ns of t h e m e mory array is given in the following sections.

TABLE 3-1: EEPROM MEMORY MAP

WORD
ADDRESS
0 KEY_0 64-bit crypt key
1 KEY_1 64-bit crypt key
2 KEY_2 64-bit crypt key
3 KEY_3 64-bit crypt key
4 SYNC_A 16-bit synch counter 5 SYNC_B/
6 RESERVED Set to 0000H 7SEED_0Seed Value
8SEED_1Seed Value
9SER_0Device Serial Number
10 SER_1 Device Serial Number
11 CONFIG Configuration Word
MNEMONIC DESCRIPTION
(word 0) LSb’s
(word 1)
(word 2)
(word 3) MSb’s
16-bit synch counter B
SEED_2
or Seed value (word 2)
(word 0) LSb’s
(word 1) MSb’s
(word 0) LSb’s
(word 1) MSb’s
3.2 SYNC_A, SYNC_B (Synchronization Counter)
This is th e 16 -bit syn chr oni zatio n va lue th at is used to create the hopping code for trans missio n. This value is incremented after every transmission. Separate syn­chronization counters can be used to stay synchro­nized with different receivers.
3.3 SEED_0, SEED_1, and SEED_2 (Seed Word)
The three word (48 bits) seed code will be transmitted when seed transmission is selected. This allows the sys­tem designer to implement the Secure Learn feature or use this fixed code word as part of a different key genera­tion/tracking process or purely as a fixed code transmis­sion.
Note: Since SEED2 and SYNC_B share the
same memory location, Secure Learn and Independent mod e trans miss ion (inclu ding IR mode) are mutually exclusive.
3.4 SER_0, SER_1 (Encoder Serial Number)
SER_0 and SER_1 are the lower and upper words of the device serial number, respectively. There are 32 bits allocated for the Serial Number and a selectable configuration bit determines whether 32 or 28 bits will be transmitted. The serial number is meant to be unique for every transmitter.
3.1 KEY_0 - KEY_3 (64-Bit Crypt Key)
The 64-bit crypt key is used to create the encrypted message transmitted to the receiver. This key is calcu­lated and programmed during production using a key generation algorithm. The key generation algorithm may be different from the K the key generation algorithm are typically the transmit-
ter’s serial number and the 64 -bit manufa cturer’s cod e. While the key generation algorithm supplied from Microchip is the typical method used, a user may elec t to create their own m ethod of key gene ration. This ma y be done providing that the deco der is program med with the same means of creating the key for decryption purposes.
DS40152E-page 6 2002 Microchip Technology Inc.
EELOQ
algorithm. Inputs to
HCS360
3.5 CONFIG (Configuration Word)
The Configuration Word is a 16-bit word stored in EEPROM array that is used by the device to store information used during the enc ryption proce ss, as well as the status of option configurations. Further explanations of each of the bits are described in the following sections.

TABLE 3-2: CONFIGURATION WORD.

Bit Number Symbol Bit Description
0 LNGRD Long Guard Tim e 1 BSEL 0 Baud Rate Selection 2 BSEL 1 Baud Rate Selection 3 NU Not Used 4 SEED Seed Transmission enable 5 DELM Delay mode enable 6 TIMO Time-out enable 7 IND Independent mode enable 8 USRA0 User bit
9 USRA1 User bit 10 USRB0 User bit 11 USRB1 User bit 12 XSER Extended serial number
enable
13 TMPSD Temporary seed transmis-
sion enable
14 MOD Manchester/PWM modula-
tion selection
15 OVR Overflow bit
3.5.1 MOD: MODULATION FORMAT
MOD selects between Manchester code modulation and PWM modulation.
If MOD = 1, Manchester modulation is selected: If MOD = 0, PWM modulation is selected.
BSEL 1 and BSEL 0 determine the baud rate according to Table3-4 when Manchester modulation is selected.

TABLE 3-4: BAUD RATE SELECTION

MOD BSEL 1 BSEL 0 TE Unit
100800us 101400us 110400us 111200us
3.5.3 OVR: OVERFLOW
The overflow bit is u sed to exten d the nu mber o f poss i­ble synchronization values. The synchronization counter is 16 bits in length, yielding 65,536 values before the cycle repeats. Under typical use of 10 operations a day, this will provide n ea rly 18 years of use before a repeated value will be used. Should the system designer conclude that is not adequate, then the overflow bit can be utiliz ed to exte nd the numbe r of unique values. This can be do ne by pr ogramming O VR to 1 at the time of production. The encoder will auto­matically clear OVR the first time that the transmitted synchronization value wraps from 0xFFFF to 0x0000. Once cleared, OVR cannot be set again, thereby crea t­ing a permanent record of the counter overflow. This prevents fast cycling of 64K counter . If the dec oder sys­tem is programmed to track the overflow bits, then the effective number of unique synchronization values can be extended to 128K. If programmed to zero, the sys­tem will be compatible with old encoder devices.
3.5.4 LNGRD: LONG GUARD TIME
LNGRD = 1 selects the encoder to extend the guard time between code words adding 50 ms. This can be used to reduce the average power transmitted over a 100 ms window and thereby transmit a higher peak power.
3.5.2 BSEL 1, 0 BAUD RATE SELECTION
BSEL 1 and BSEL 0 determin e the baud rate according to Table 3-3 when PWM mo dulation is selected.

TABLE 3-3: BAUD RATE SELECTION

MOD BSEL 1 BSEL 0 T
000400us 001200us 010200us 011100us
2002 Microchip Technology Inc. DS40152E-page 7
E Unit
HCS360
3.5.5 XSER: EXTENDED SERIAL NUMBER
If XSER = 0, the four Most Significant bits of the Serial Number are substituted by S[3:0] and the code word format is co mpatible with the HCS200/300/301.
If XSER = 1, the full 32-bit Serial Number [SER_1, SER_0] is transmitted.
Note: Since the button status S[3:0] is used to
detect a Seed transmission, Extended Serial Number and Secure Learn are mutually exclusive.

FIGURE 3-1: CODE WORD ORGANIZATION

XSER=0
Fixed Code Portion of Transmission Encrypted Portion of Transmission
Button Status (4 bits)
28-bit
Serial Number
MSB
CRC
(2-bit)
VLOW (1-bit)
3.5.6 DISCRIMINATION VALUE
While in other KEELOQ encoders its value is user selectable, the HCS360 uses directly the 8 Least Sig­nificant bits of the Se rial N umber a s part of t he info r­mation that form the encrypted portion of the transmission (Figure 3-1).
The discrimination value aids the post-decryption check on the decoder end. After the receiver has decrypted a transmiss ion, the discrimination b its are checked against the e ncoder Serial Number to verif y that the decryp tion process was valid.
3.5.7 USRA,B: USER BITS
User bits form part of the discrimi nation valu e. The user bits together with the IND bit can be used to identify the counter that is used in Independent mode.
Button Status
(4 bits)
Discrimination
bits
(12 bits)
16-bit
Sync Value
LSB
XSER=1
MSB
Fixed Code Portion of Transmission Encrypted Portion of Transmission
CRC
(2-bit)
VLOW (1-bit)
Button Status
(4 bits) SSSS 2103
Extended Serial Number
32-bit
Button Status
(4 bits)
I O U U S S ... S
N V S S E E ... E
Discrimination
bits
(12 bits)
Discrimination Bits
(12 bits)
D R R R R R ... R
1 0 7 6 ... 0
67 bits of Data Transmitted
16-bit
Sync Value
LSB
DS40152E-page 8 2002 Microchip Technology Inc.
HCS360
3.5.8 SEED: ENABLE SEED TRANSMISSION
If SEED = 0, seed transmission is disabled. The Inde­pendent Counter mode can only be used with seed transmission disable d since SEED_2 i s shared with th e second synchronization counter.
With SEED = 1, seed transmission is enabled. The appropriate button code(s) must be activated to trans­mit the seed information. In this mode, the seed infor-

FIGURE 3-2: Seed Transmission

All examples shown with XSER = 1, SEED = 1
When S[3:0] = 1001, delay is not acceptable.
CRC+VLOW SER_1 SEED_2 SEED_1 SEED_0
For S[3:0] = 0x3 before delay:
CRC+VLOW SER_1 SER_0 Encrypted Data
mation (SEED_0, SEED_1, and SEED_2) and the upper 12 or 16 bits of the serial number (SER_1) are transmitted instead of the hop code.
Seed transmission is available for function codes (Table 3-9) S[3:0] = 1001 and S[3:0] = 0011(delayed). This takes place regardless of the setting of the IND bit. The two seed transmissions are shown in Figure 3-2.
Data transmission direction
16-bit Data Word 16-bit Counter
Encrypt
Data transmission direction
For S[3:0] = 0011 after delay (Note 1, Note 2):
CRC+VLOW SER_1 SEED_2 SEED_1 SEED_0
Note 1 : For Seed Transmission, SEED_2 is transmitted instead of SER_0.
2: For Seed Transmission, the setting of DELM has no effect.
3.5.9 TMPSD: TEMPORARY SEED TRANSMISSION
The temporary seed transmission can be used to dis­able learning after the transmitter has been used for a programmable number of operations. This feature can be used to implemen t very secu re systems. After learn­ing is disabled, the seed information cannot be accessed even if physical access to the transmitter is possible. If TMPSD = 1 the seed transmission will be disabled after a number of code hopping transmis­sions. The number of tra nsmiss ions be fore see d trans­mission is disabl ed, can be programmed by setting th e synchronization counter (SYNC_A, SYNC_B) to a value as shown in Table 3-5.
Data transmission direction
TABLE 3-5: SYNCHRONOUS COUNTER
INITIALIZATION VALUES
Synchronous Counter
Value s
0000H 128 0060H 64 0050H 32 0048H 16
Number of
Transmissions
2002 Microchip Technology Inc. DS40152E-page 9
HCS360
3.5.10 DELM: DELAY MODE
If DELM = 1, delay transmission is enabled. A delayed transmissi on is indic ated by in verting th e lower nib ble of the discrimination value. The Delay mode is primarily for compatibil ity with pre vious K not recommended for new designs.
EELOQ devices and is

TABLE 3-6: TYPICAL DELAY TIMES

Number of Code
BSEL 1 BSEL 0
00 28 2.9s 5.1s 01 56 3.1s 6.4s 10 28 1.5s 3.2s 11 56 1.7s 4.5s
Words before Delay
Mode
3.5.11 TIMO: TIME-OUT OR AUTO-SHUTOFF
If TIMO = 1, the time-out is enabled. Time-out can be used to terminate accid ental c ontinuous tran smissions. When time-out occurs, the PWM output is set low and

TABLE 3-7: TYPICAL TIME-OUT TIMES

If DELM = 0, delay transmission is disabled (Table 3-
6).
Time Before Delay Mode
(MOD = 0)
the LED is turned off. Current consumption will be higher than in Standby mode since current will flow through the activated input resistors. This state can be exited only after al l in put s are taken low. TIMO = 0, will enable continuous transmission (Table 3-7).
Time Before Delay Mode
(MOD = 1)
Maximum Number of
BSEL 1 BSEL 0
00 256 ≈ 26.5s 46.9 01 512 ≈ 28.2s 58.4 10 256 ≈ 14.1s 29.2 11 512 ≈ 15.7s 40.7
Code Words Transmitted
Time Before Time-out
(MOD = 0)
Time Before Time-out
(MOD = 1)
DS40152E-page 10 2002 Microchip Technology Inc.
HCS360
3.5.12 IND: INDEPENDENT MODE
The Independent mode can be used where one

TABLE 3-8: IR MODULATION

T
E Basic Pulse
encoder is used to co ntro l tw o re ce iv ers . Two counters (SYNC_A and SYNC_B) are used in Independent mode. As indicated in Table 3-9, function codes 1 to 7 use SYNC_A and 8 to 15 SYNC_B.
800us
(800µs)
(32x)
3.5.13 INFRARED MODE
The Independent mode also selects IR mode. In IR
400us
mode functi on codes 12 to 15 will use SYNC_B. T he PWM output signal is modulated with a 40 kHz carrier (see Table 3-8). It must be pointed out that the 40 kHz is derived from the inte rnal cloc k and wil l therefore vary
200us
(200µs)
with the same percentage as the baud rate. If IND = 0, SYNC_A is used for all fun ction code s. If IND = 1, Inde­pendent mode is enabled and counters for functions are used according to Table 3-9.
TABLE 3-9:
FUNCTION CODES
100us
(100µs)
(4x)
S3 S2 S1 S0 IND = 0 IND = 1 Comments
Counter
10001 A A 20010 A A 3 0 0 1 1 A A If SEED = 1, transmit seed after delay. 40100 A A 50101 A A 60110 A A 70111 A A 81000 A B
9 1 0 0 1 A B If SEED = 1, transmit seed immediately. 101010 A B 111011 A B 121100 A
131101 A 141110 A 151111 A
(1)
B
(1)
B
(1)
B
(1)
B
Note 1: IR mode
(400µs)
(16x)
Period = 25µs
(8x)
2002 Microchip Technology Inc. DS40152E-page 11
Loading...
+ 23 hidden pages