MICROCHIP HCS473 Technical data

查询HCS473供应商

HCS473

Data Sheet

Code Hopping Encoder and Transponder

 2002 Microchip Technology Inc. Preliminary DS40035C

Note the following details of the code protection feature on Microchip devices:

• Microchip products meet the specification contained in their particular Microchip Data Sheet.

• Microchip believes that its family of products is one of the most secure families of its kind on the market today, when used in the intended manner and under normal conditions.

• There are dishonest and possibly illegal methods used to breach the code protection feature. All of these methods, to our knowledge, require using the Microchip products in a manner outside the operating specifications contained in Microchip's Data Sheets. Most likely, the person doing so is engaged in theft of intellectual property.

• Microchip is willing to work with the customer who is concerned about the integrity of their code.

• Neither Microchip nor any other semiconductor manufacturer can guarantee the security of their code. Code protection does not mean that we are guaranteeing the product as “unbreakable.”

Code protection is constantly evolving. We at Microchip are committed to continuously improving the code protection features of our products.

Information contained in this publication regarding device applications and the like is intended through suggestion only and may be superseded by updates. It is your responsibility to ensure that your application meets with your specifications. No representation or warranty is given and no liability is assumed by Microchip Technology Incorporated with respect to the accuracy or use of such information, or infringement of patents or other intellectual property rights arising from such use or otherwise. Use of Microchip’s products as critical components in life support systems is not authorized except with express written approval by Microchip. No licenses are conveyed, implicitly or otherwise, under any intellectual property rights.

Trademarks

The Microchip name and logo, the Microchip logo, K

EELOQ,

MPLAB, PIC, PICmicro, PICSTART and PRO MATE are registered trademarks of Microchip Technology Incorporated in the U.S.A. and other countries.

FilterLab, microID, MXDEV, MXLAB, PICMASTER, SEEVAL and The Embedded Control Solutions Company are registered trademarks of Microchip Technology Incorporated in the U.S.A.

dsPIC, dsPICDEM.net, ECONOMONITOR, FanSense, FlexROM, fuzzyLAB, In-Circuit Serial Programming, ICSP, ICEPIC, microPort, Migratable Memory, MPASM, MPLIB, MPLINK, MPSIM, PICC, PICDEM, PICDEM.net, rfPIC, Select Mode and Total Endurance are trademarks of Microchip Technology Incorporated in the U.S.A. and other countries.

Serialized Quick Turn Programming (SQTP) is a service mark of Microchip Technology Incorporated in the U.S.A.

All other trademarks mentioned herein are property of their respective companies.

Printed on recycled paper.

Microchip received QS-9000 quality system certification for its worldwide headquarters, design and wafer fabrication facilities in Chandler and Tempe, Arizona in July 1999 and Mountain View, California in March 2002. The Company’s quality system processes and procedures are QS-9000 compliant for its PICmicro devices, Serial EEPROMs, microperipherals, non-volatile memory and analog products. In addition, Microchip’s quality system for the design and manufacture of development systems is ISO 9001 certified.

8-bit MCUs, KEELOQ

code hopping

DS40035C - page ii Preliminary  2002 Microchip Technology Inc.

HCS473

KEELOQ® 3-Axis Transcoder

FEATURES

Encoder Security

• Read protected 64-bit encoder key

• 69-bit transmission length

• 60-bit, read protected seed for secure learning

• Programmable 32-bit serial number

• Non-volatile 16/20-bit synchronization counter

Encoder Operation

• 2.05V to 5.5V operation

• Four switch inputs – up to 15 functions codes

• PWM or Manchester modulation

• Selectable Baud Rate (416 - 5,000 bps)

• Transmissions include button queuing information

• PLL interface

Transponder Security

• 2 read protected 64-bit Challenge/Response keys

• Two IFF encryption algorithms

• 16/32-bit Challenge/Response

• Separate Vehicle ID and Token ID

• 2 vehicles supported

• CRC on all communication

Transponder Operation

Package Types

PDIP, SOIC

S3/RFEN

VDDT

LCX

LCY

Block Diagram

Low

Voltage

Detector

Wake-up

Control

S3/

RFEN

Internal

Oscillator

Control

HCS473

Logic

EEPROM

LED

DATA

SST

LCCOM

LCZ

RESET and

Power

Control

LED

Driver

Data

Output

LED

DATA

• Three sensitive transponder inputs

• Bi-directional transponder communication

• Transponder in/RF out operation

LCX

LCY

LCZ

3 Input Transponder

Circuitry

DDT

LCCOM

SST

• Anticollision of multiple transponders

• Intelligent damping for high Q-factor LC-circuits

• Low battery operation

• Passive proximity activation

• 64-bit secure user EEPROM

• Fast reaction time

Typical Applications

• Passive entry systems

• Automotive remote entry systems

• Automotive alarm systems

• Automotive immobilizers

Peripherals

• Low Voltage Detector

• On-board RC oscillator with ±10% variation

• Gate and garage openers

• Electronic door locks (Home/Office/Hotel)

• Burglar alarm systems

• Proximity access control

• Passive proximity authentication

 2002 Microchip Technology Inc. Preliminary DS40035C-page 1

HCS473

Table of Contents

1.0 General Description ..................................................................................................................................................................... 3

2.0 Device Description ...................................................................................................................................................................... 5

3.0 Device Operation ....................................................................................................................................................................... 11

4.0 Programming Specification ....................................................................................................................................................... 37

5.0 Integrating the HCS473 Into A System ..................................................................................................................................... 39

6.0 Development Support................................................................................................................................................................. 43

7.0 Electrical Characteristics ........................................................................................................................................................... 49

8.0 Packaging Information................................................................................................................................................................ 57

INDEX .................................................................................................................................................................................................. 61

On-Line Support................................................................................................................................................................................... 62

Systems Information and Upgrade Hot Line ........................................................................................................................................ 62

Reader Response ................................................................................................................................................................................ 63

Product Identification System............................................................................................................................................................... 64

TO OUR VALUED CUSTOMERS

It is our intention to provide our valued customers with the best documentation possible to ensure successful use of your Microchip products. To this end, we will continue to improve our publications to better suit your needs. Our publications will be refined and enhanced as new volumes and updates are introduced.

If you have any questions or comments regarding this publication, please contact the Marketing Communications Department via E-mail at docerrors@mail.microchip.com or fax the Reader Response Form in the back of this data sheet to (480) 792-4150. We welcome your feedback.

Most Current Data Sheet

To obtain the most up-to-date version of this data sheet, please register at our Worldwide Web site at:

http://www.microchip.com

You can determine the version of a data sheet by examining its literature number found on the bottom outside corner of any page. The last character of the literature number is the version number, (e.g., DS30000A is version A of document DS30000).

Errata

An errata sheet, describing minor operational differences from the data sheet and recommended workarounds, may exist for current devices. As device/documentation issues become known to us, we will publish an errata sheet. The errata will specify the revision of silicon and revision of document to which it applies.

To determine if an errata sheet exists for a particular device, please check with one of the following:

• Microchip’s Worldwide Web site; http://www.microchip.com

• Your local Microchip sales office (see last page)

• The Microchip Corporate Literature Center; U.S. FAX: (480) 792-7277 When contacting a sales office or the literature center, please specify which device, revision of silicon and data sheet (include liter-

ature number) you are using.

Customer Notification System

DS40035C-page 2 Preliminary  2002 Microchip Technology Inc.

HCS473

1.0 GENERAL DESCRIPTION

The HCS473 combines the patented KEELOQ code hopping technology and bi-directional transponder challenge-and-response security into a single chip solution for logical and physical access control.

The three-input transponder interface allows the combination of three orthogonal transponder antennas, eliminating the directionality associated with traditional single antenna transponder systems.

When used as a code hopping encoder, the HCS473 is well suited to keyless entry systems; vehicle and garage door access in particular. The same HCS473 can also be used as a secure bi-directional transponder for contactless authentication. These capabilities make the HCS473 ideal for combined secure access control and identification applications, dramatically reducing the cost of hybrid transmitter/transponder solutions.

1.1 System Overview

1.1.1 KEY TERMS

The following is a list of key terms used throughout this data sheet. For additional information on terminology, please refer to the K (TB003).

• AGC - Automatic Gain Control.

• Anticollision - A scheme whereby transponders

in the same field can be addressed individually, preventing simultaneous response to a command (Section 3.2.1.4).

• Button Status - Indicates what button input(s)

activated the transmission. Encompasses the 4 button status bits S3, S2, S1 and S0 (Figure 3-2).

• Code Hopping - A method by which a code,

viewed externally to the system, appears to change unpredictably each time it is transmitted (Section 1.2.3).

• Code word - A block of data that is repeatedly

transmitted upon button activation (Figure 3-2).

• Crypto key - A unique and secret 64-bit number

used to encrypt and decrypt data. In a symmetrical block cipher such as the K the encryption and decryption keys are equal and will therefore be referred to generally as the crypto key.

• Decoder - A device that decodes data received

from an encoder.

• Decryption algorithm - A recipe whereby data

scrambled by an encryption algorithm can be unscrambled using the same crypto key.

• Device Identifier - 16-bit value used to uniquely

select one of multiple transponders for communication.

• Encoder - A device that generates and encodes

data.

EELOQ introductory Technical Brief

EELOQ algorithm,

• Encryption Algorithm - A recipe whereby data is scrambled using a crypto key. The data can only be interpreted by the respective decryption algorithm using the same crypto key.

• IFF - Identify Friend or Foe, a classic authentication method (Section 3.2.3.3).

• Learn - Learning involves the receiver calculating the transmitter’s appropriate crypto key, decrypting the received hopping code and storing the serial number, synchronization counter value and crypto key in EEPROM (Section 5.1). The

EELOQ product family facilitates several learning

K strategies to be implemented on the decoder. The following are examples of what can be done.

• Simple Learning The receiver uses a fixed crypto key, common to all components of all systems by the same manufacturer, to decrypt the received code word’s encrypted portion.

• Normal Learning The receiver uses information transmitted during normal operation to derive the crypto key and decrypt the received code word’s encrypted portion.

• Secure Learn The transmitter is activated through a special button combination to transmit a stored 60-bit seed value used to derive the transmitter’s crypto key. The receiver uses this seed value to calculate the same crypto key and decrypt the received code word’s encrypted portion.

• LF - Low Frequency. For HCS473 purposes, LF refers to a typical 125 kHz frequency.

• Manufacturer’s code – A unique and secret 64bit number used to generate unique encoder crypto keys. Each encoder is programmed with a crypto key that is a function of the manufacturer’s code. Each decoder is programmed with the manufacturer code itself.

• Proximity Activation - A method whereby an encoder automatically initiates a transmission in response to detecting an inductive field (Section 3.1.1.2).

• PKE - Passive Keyless Entry.

• RKE - Remote Keyless Entry.

• Transmission - A data stream consisting of repeating code words.

• Transcoder - Device combining unidirectional transmitter capabilities with bi-directional authentication capabilities.

• Transponder - A transmitter-receiver activated for transmission by reception of a predetermined signal.

 2002 Microchip Technology Inc. Preliminary DS40035C-page 3

HCS473

• Transponder Reader (Reader, for short) - A device that authenticates a transponder using bidirectional communication.

• Transport code - An access code, ‘password’ known only by the manufacturer, allowing write access to certain secure device memory areas (Section 3.2.3.2).

1.2 Encoder Overview

The HCS473 code hopping transcoder is designed specifically for passive entry systems; particularly vehicle access. The transcoder portion of a passive entry system is integrated into a fob, carried by the user and operated to gain access to a vehicle or restricted area. The HCS473 is meant to be a cost-effective yet secure solution to such systems, requiring very few external components (Figure 2-1).

1.2.1 LOW-END SYSTEM SECURITY

RISKS

Most low-end keyless entry transmitters are given a fixed identification code that is transmitted every time a button is pushed. The number of unique identification codes in a low-end system is usually a relatively small number. These shortcomings provide an opportunity for a sophisticated thief to create a device that ‘grabs’ a transmission and retransmits it later, or a device that quickly ‘scans’ all possible identification codes until the correct one is found.

1.2.2 HCS473 SECURITY

The HCS473, on the other hand, employs the KEELOQ code hopping technology coupled with a transmission length of 69 bits to virtually eliminate the use of code ‘grabbing’ or code ‘scanning’. The high security level of the HCS473 is based on the patented K ogy. A block cipher based on a block length of 32 bits and a key length of 64 bits is used. The algorithm obscures the information in such a way that even if the transmission’s pre-encrypted information differs by only one bit from that of the previous transmission, statistically greater than 50 percent of the transmission’s encrypted result will change.

EELOQ

technol-

1.2.3 HCS473 HOPPING CODE

The 16-bit synchronization counter is the basis behind the transmitted code word changing for each transmission; it increments each time a button is pressed.

Once the device detects a button press, it reads the button inputs and updates the synchronization counter. The synchronization counter and crypto key are input to the encryption algorithm and the output is 32 bits of encrypted information. This encrypted data will change with every button press, its value appearing externally to ‘randomly hop around’, hence it is referred to as the hopping portion of the code word. The 32-bit hopping code is combined with the button information and serial number to form the code word transmitted to the receiver. The code word format is explained in greater detail in Section 3.1.2.

1.3 Identify Friend or Foe (IFF) Overview

Validation of a transponder first involves an authenticating device sending a random challenge to the device. The transponder then replies with a calculated response that is a function of the received challenge and its stored crypto key. The authenticating device, transponder reader, performs the same calculation and compares it to the transponder’s response. If they match, the transponder is identified as valid and the transponder reader can take appropriate action.

The HCS473’s IFF response is generated using one of two possible crypto keys. The authenticating device precedes the challenge with a three bit field dictating which key to use in calculating the response.

The bi-directional communication path required for IFF is typically inductive for short range (<10cm) transponder applications with an inductive challenge and inductive response. Longer range (~1.5m) passive entry applications still transmit using the LF inductive path but the response is transmitted RF.

DS40035C-page 4 Preliminary  2002 Microchip Technology Inc.

HCS473

2.0 DEVICE DESCRIPTION

The HCS473 is designed for small package outline, cost-sensitive applications by minimizing the number of external components required for RKE and PKE applications.

Figure 2-1 shows a typical 3-axis HCS473 RKE/PKE application.

• The switch inputs have internal pull-down resistors and integrated debouncing allowing a switch to be directly connected to the inputs.

The transponder circuitry requires only the addition of external LC-resonant circuits for inductive communication capability.

• The open-drain LED output allows an external resistor for customization of LED brightness - and current consumption.

• The DATA output can be directly connected to the RF circuit or connected in conjunction with S3/ RFEN to a PLL.

2.1 Pinout Overview

A description of pinouts for the HCS473 can be found in Table 2-1.

TABLE 2-1: PINOUT SUMMARY

Pin Name

S0 1 Button input pin with Schmitt Trigger detector and internal pull-down resistor (Figure 2-3). S1 2 Button input pin with Schmitt Trigger detector and internal pull-down resistor (Figure 2-3). S2 3 Button input pin with Schmitt Trigger detector and internal pull-down resistor (Figure 2-3). S3/RFEN 4 Multi-purpose input/output pin (Figure 2-4).

DDT 5 Transponder supply voltage. Regulated voltage output for strong inductive field.

V LCX 6 Sensitive transponder input X (Figure 2-7). A strong signal on this pin is internally regulated

LCY 7 Sensitive transponder input Y (Figure 2-7) LCZ 8 Sensitive transponder input Z (Figure 2-7) LCCOM 9 Transponder bias output (Figure 2-7)

SST 10 Transponder ground reference, must be connected to VSS.

SS 11 Ground reference

V DATA 12 Transmission data output (Figure 2-5) LED 13 Open drain LED output (Figure 2-6)

DD 14 Positive supply voltage

Number

Description

• Button input pin with Schmitt Trigger detector and internal pull-down resistor.

• RFEN output driver.

and supplied on V

DD for low-battery operation/recharging.

2.2 LF Antenna Considerations

A typical magnetic low frequency sensor (receiving antenna) consists of a parallel inductor-capacitor circuit that is sensitive to an externally applied magnetic signal. This LC circuit is tuned to resonate at the source signal's base frequency. The real-time voltage across the sensor represents the presence and strength of the surrounding magnetic field. By amplitude modulating the source's magnetic field, it is possible to transfer data over short distances. This communication approach is successfully used with distances up to 1.8 meters, depending on transmission strengths and sensor sensitivity. Two key factors that greatly affect communication range are:

1. Sensor tuning

2. A properly tuned sensor's relative sensitivity

 2002 Microchip Technology Inc. Preliminary DS40035C-page 5

An LC antenna’s component values may be initially calculated using the following equation. “Initially” because there are many factors affecting component selection.

2π F

It is not this data sheet’s purpose to present in-depth details regarding LC antenna and their tuning. Please refer to “Low Frequency Magnetic Transmitter Design Application Note”, AN232, for appropriate LF antenna design details.

Note: Microchip also has a confidential Applica-

tion Note on Magnetic Sensors (AN832C). Contact Microchip for a Non-Disclosure Agreement in order to obtain this application note.

-----------

HCS473

FIGURE 2-1: HCS473 3-AXIS

APPLICATION

1µF 100nF

HCS473

DDT

LCCOM

LED

DATA

VSST

LCZ

680pF

Circuit

S3/RFEN

LCX

LCY

Note: The 680pF capacitor prevents device instability - self

resonance.

FIGURE 2-3: S0/S1/S2 PIN DIAGRAM

S0, S1, S2 Inputs

RPD

FIGURE 2-4: S3/RFEN PIN DIAGRAM

VDD

RFEN

PFET

NFET

S3 Input/ RFEN Output

RPD

FIGURE 2-2: HCS473 1-AXIS

APPLICATION

1µF 100nF

HCS473

DDT

LCCOM

LED

DATA

VSST

LCZ

100Ω

S3/RFEN

LCX

LCY

100Ω

660 pF

Circuit

Note: RPD is disabled when driving RFEN.

FIGURE 2-5: DATA PIN DIAGRAM

VDD

PFET

NFET

DATA

RDATA

Note: RDATA is disabled when the DATA line is driven.

DATA OUT

Note: Connect unused LC antenna inputs to LCCOM

through a 100Ω resistor for proper bias conditions.

DS40035C-page 6 Preliminary  2002 Microchip Technology Inc.

HCS473

FIGURE 2-6: LED PIN DIAGRAM

VDD

Weak

LED

Program

Mode

Detect

FIGURE 2-7: LCCOM/LCX/LCY/LCZ/

VSST PIN DIAGRAM

LCX

only

LCX/LCY/ LCZ Inputs

100Ω

RECTIFIER and

REGULATOR

AMP and DET

VSST

LC Input

2.3 Architectural Overview

2.3.1 WAKE-UP LOGIC

The HCS473 automatically goes into a low-power Standby mode once connected to a supply voltage. Power is supplied to the minimum circuitry required to detect a wake-up condition; button activation or LC signal detection.

The HCS473 will wake from Low-power mode when a button input is pulled high or a signal is detected on a LC low frequency antenna input pin. Waking involves powering the main logic circuitry that controls device operation. The button and transponder inputs are then sampled to determine which input activated the device.

A button input activation places the device into Encoder mode. A signal detected on the transponder input places the device into Transponder mode. Encoder mode has priority over Transponder mode such that communication on the transponder input would be ignored or perhaps interrupted if it occurred simultaneously to a button activation; ignored until the button input is released.

2.3.2 ENCODER INTERFACE

Using the four button inputs, up to 15 unique control codes may be transmitted.

Note: S3 may not be used as a button input if the

RFEN option is enabled.

LCCOM

100Ω

10V

DAMP

CURRENT

DAMP

CLAMP

BIAS

 2002 Microchip Technology Inc. Preliminary DS40035C-page 7

HCS473

2.3.3 TRANSPONDER INTERFACE

The transponder interface on the HCS473 consists of the following:

• The internal transponder circuitry has separate power supply (V tions.

- The V

DDT pin supplies power to the transpon-

der circuitry and also outputs a regulated voltage if the LCX antenna input is receiving a strong signal; transponder is placed in a strong LF field.

- The V

SST pin supplies the ground reference

to the transponder circuitry and must be connected to the V

• LF input amplifier and envelope detector to detect and shape the incoming low frequency excitation signal.

• Three sensitive transponder inputs with over-voltage protection (LCX, LCY, LCZ).

• Incoming LF energy rectification and regulation on the LCX input to supplement the supply voltage in low-battery transponder instances.

• 10V zener input protection from excessive antenna voltage resulting when proximate to very strong magnetic fields.

• LCCOM pin used to bias the transponder resonant circuits for best sensitivity.

• LF antenna clamping transistors for inductive responses back to the transponder reader. The antenna ends are shorted together, ‘clamped’, dissipating the oscillatory energy. The reader detects this as a momentary load on its excitation antenna.

• Damping transistors to increase LF communication reliability when using high Q-factor LC antennae.

The LCCOM pin functions to bias the LCX, LCY, and LCZ AGC amplifier inputs. The amplifier gain control sets the optimum level of amplification in respect to the incoming signal strength. The signal then passes through an envelope detector before interpretation in the logic circuit.

A block diagram of the transponder circuit is shown in Figure 2-8.

DDT) and ground (VSST) connec-

SS pin.

FIGURE 2-8: HCS473 TRANSPONDER

CIRCUIT

LCX

LCY

LCZ

LCCOM

Rectifier/ Regulator

Noise

Filter

CCT

Signal In

Damp/Clamp

Control

2.3.4 INTERNAL EEPROM

The HCS473 has an on-board non-volatile EEPROM which is used to store:

• configuration options

- encryption keys

- serial number

- vehicle ID’s

- baud rates

- ... see Section 3.1.4 and Section 3.2.1

• 64 bits of user memory

• synchronization counter. All options are programmable during production, but

many of the security related options are programmable only during production and are further read protected.

The user area allows storage of general purpose information and is accessible only through the transponder communication path.

During every EEPROM write, the device ensures that the internal programming voltage is at an acceptable level prior to performing the EEPROM write.

DS40035C-page 8 Preliminary  2002 Microchip Technology Inc.

2.3.5 INTERNAL RC OSCILLATOR

The HCS473 runs on an internal RC oscillator. The internal oscillator may vary ±10% over the device’s rated voltage and temperature range for commercial temperature devices. A certain percentage of industrial temperature devices vary further on the slow side,

-20%, when used at higher voltages (V cold temperature. The LF and RF communication timing values are subject to these variations.

DD > 3.5V) and

2.3.6 LOW VOLTAGE DETECTOR

The HCS473’s battery voltage detector detects when the supply voltage drops below a predetermined value. The value is selected by the Low Voltage Trip Point Select (VLOWSEL) configuration option (Section 3.3).

The low voltage detector result is included in encoder transmissions (VLOW) allowing the receiver to indicate when the transmitter battery is low (Section 3.1.4.6).

The HCS473 also indicates a low battery condition by changing the LED operation (Section 3.1.5).

2.3.7 THE S3/RFEN PIN

HCS473

The S3/RFEN pin may be used as a button input or RF enable output to a compatible PLL. Select between S3 button input and RFEN functionality with the RFEN configuration option (Table 2-2).

TABLE 2-2: RFEN OPTION

RFEN Resulting S3/RFEN Configuration

0 S3 button input pin with Schmitt Trigger

detector and internal pull-down resistor.

1 RFEN output driver.

S3 may not be used as a button input if the RFEN option is enabled

 2002 Microchip Technology Inc. Preliminary DS40035C-page 9

HCS473

NOTES:

DS40035C-page 10 Preliminary  2002 Microchip Technology Inc.

HCS473

3.0 DEVICE OPERATION

HCS473 operation depends on how the device is activated. The device exits Low-power mode either when a switch input is pulled high or when a signal is detected on an LC antenna input pin. Once activated, the device determines the source of the activation and enters Encoder mode or Transponder mode.

3.1 Encoder mode

3.1.1 ENCODER ACTIVATION

3.1.1.1 Button Activation

The main way to enter Encoder mode is when the wake-up circuit detects a button input activation; button input transition from GND to V logic wakes and delays a nominal switch debounce time (T

DB) prior to sampling the button inputs. The but-

ton input states, cumulatively called the button status, determine whether the HCS473 transmits a code hopping or seed transmission.

The transmission begins a time T consists of a stream of code words transmitted as long as the switch input is held high or until a selectable TSEL timeout occurs (see Section 3.1.4.16 for TSEL options). A timeout returns the device to Low-power mode, protecting the battery in case a button is stuck.

Additional button activations during a transmission will immediately reset the HCS473, perhaps leaving the current code word incomplete. The device will start a new transmission which includes the updated button status value.

Buttons removed during a transmission will have no effect unless no buttons remain activated. If no button activations remain, the minimum number of complete code words will be completed (see Section 3.1.4.15 for MTX options) and the device will return to Low Power mode.

DD. The HCS473 control

PU after activation. It

3.1.2 TRANSMITTED CODE WORD

The HCS473 transmits a 69-bit code word in response to a button activation or proximity activation, Figure 3-

1. The code word content varies with the two unique transmission types; Hopping or Seed.

3.1.2.1 Hopping Code Word

Hopping code words are those transmitted during normal operation. Each Hopping code word contains a preamble, header, 32 bits of encrypted data and up to 37 bits of fixed value data followed by a guard period before another code word begins.

• The 32 bits of Encrypted Data include button status bits, discrimination bits and the synchronization counter value. The inclusion/omission of overflow bits and size of both synchronization counter and discrimination bit fields vary with the CNTSEL option, Figure 3-2 and Section 3.1.4.5.

• The 37 bits of Fixed Code Data include queue bits (if enabled), CRC bits, low voltage status and serial number. The inclusion/omission of button status and size of the serial number field vary with the XSER option, Figure 3-2 and Section 3.1.4.3.

3.1.2.2 Seed Code Word

Seed code words are required when the system implements secure key generation. Seed transmissions are activated when the button inputs match the value specified by the seed button code configuration option (SDBT), Section 3.1.4.9.

Each Seed code word contains a preamble, header and up to 69 bits of fixed data followed by a guard period before another code word begins.

• The 69 bits of Fixed Code Data include queue bits (if enabled), CRC bits, low voltage status, button status and the 60-bit seed value, Figure 3-2.

Note: For additional information on KEELOQ the-

ory and implementation, please refer to the KEELOQ introductory Technical Brief (TB003).

3.1.1.2 Proximity Activation

A second way to enter Encoder mode is if the proximity activation option (PXMA) is enabled and the wake-up circuit detects a wake-up sequence on an LC antenna input pin. This form of activation is called Proximity Activation as a code hopping transmission would be initiated when the device was proximate to a LF field.

 2002 Microchip Technology Inc. Preliminary DS40035C-page 11

HCS473

FIGURE 3-1: GENERAL CODE WORD FORMAT

Preamble

Header

FIGURE 3-2: CODE WORD ORGANIZATION

Hopping Code:

CRC

QUE

2 Bits

Q1 Q0 C1 C0

MSb

Hopping Code:

28-bit Serial Number (XSER = 0) 16-bit Synchronization Counter (CNTSEL=0) Button Queuing enabled (QUEN=1)

Fixed Code Portion (37 Bits)

VLOW

BUT

4 Bits

1-Bit

S2 S1 S0 S3

SER 1

12 MSb’s

SER 0

Least Sig16 Bits

32-bit Serial Number (XSER = 1) 20-bit Synchronization Counter (CNTSEL=1) Button Queuing disabled (QUEN=0)

Data Bits

Hopping Code Portion Message (32 Bits)

Counter

BUT

Overflow

4 Bits

S2 S1 S0 S3 OVR1 OVR0

2 Bits

DISCRIM

10 Bits

Guard

Time

Synchronization

Counter

16 Bits

LSb

69 Data bits

Transmitted LSb first.

Fixed Code Portion (35 Bits)

CRC

2 Bits

C1 C0

LOW

1-Bit

SER 1

Most Sig 16 Bits

MSb

Seed Code:

Fixed Code Portion (9 Bits) Seed Value (60 Bits)

QUE

CRC

2 Bits

Q1 Q0

C1 C0

Shaded 65 bits included in CRC calculation

Queuing enabled (QUE = 1)

LOW

BUT

1-Bit

4 Bits

111 1

SDVAL3

12 Most Sig Bits

SER 0

Least Sig 16 Bits

SDVAL2

16 Bits

BUT

4 Bits

S2 S1 S0 S3

Hopping Code Portion Message (32 Bits)

Synchronization

Counter

DISCRIM

8 Bits

Counter

20 Bits

67 Data bits

Transmitted LSb first.

SDVAL1

16 Bits

SDVAL0

16 Least Sig Bits

69 Data bits

Transmitted LSb first.

LSb

LSbMSb

DS40035C-page 12 Preliminary  2002 Microchip Technology Inc.

HCS473

3.1.3 CODE HOPPING MODULATION FORMAT

The data modulation format is selectable between Pulse Width Modulation (PWM) and Manchester using the modulation select (MSEL) configuration option.

Regardless of the modulation format, each code word contains a leading preamble and a synchronization header to wake the receiver and provide synchronization events for the receive routine. Each code word also contains a trailing guard time to separate code words.

The same code word repeats as long as the same input pins remain active, until a timeout occurs or a delayed seed transmission is activated.

The modulated data timing is typically referred to in multiples of a basic Timing Element (RFT because the DATA pin output is typically sent through a RF transmitter to the decoder or transponder reader.

E may be selected using the RF Transmission

RFT Baud Rate (RFBSL) configuration option (Section 3.1.4.13).

Manchester encoding further includes a leading data ‘1’ START pulse and closing 1 RFT

E STOP pulse around

each data block.

FIGURE 3-3: PWM TRANSMISSION FORMAT (MSEL = 0)

TOTAL TRANSMISSION:

Preamble Sync Encrypt Fixed Guard

1 CODE WORD

TETET

LOGIC "0"

LOGIC "1"

E). ‘RF’ TE

Preamble Sync Encrypt

Preamble

Header

Encrypted

Portion

CODE WORD

FIGURE 3-4: MANCHESTER TRANSMISSION FORMAT (MSEL = 1)

1 CODE WORD

TOTAL TRANSMISSION:

START bit

Preamble

Preamble Sync Encrypt Fixed Guard

LOGIC “0”

bit 0

bit 1

bit 2

LOGIC “1”

CODE WORD

Preamble Sync Encrypt

Fixed Code

Portion

STOP bit

GuardHeader Encrypted Fixed Code

TimePortion Portion

Guard

Time

 2002 Microchip Technology Inc. Preliminary DS40035C-page 13

HCS473

3.1.4 ENCODER MODE OPTIONS

The following HCS473 configuration options configure transmission characteristics of the information exiting the DATA pin:

• Modulation select (MSEL)

• Header select (HSEL)

• Extended serial number (XSER)

• Queue counter enable (QUEN)

• Counter select (CNTSEL)

• Low voltage trip point (VLOWSEL)

• PLL interface select (AFSK)

• RF enable output (RFEN)

• Seed button code (SDBT)

• Time before Seed (SDTM)

• Limited Seed (SDLM)

• Seed mode (SDMD)

• RF baud rate select (RFBSL)

• Guard time select (GSEL)

• Minimum code words (MTX)

• Timeout select (TSEL)

• Long preamble enable (LPRE)

• Long preamble length (LPRL)

• Preamble duty cycle (PRD) The following sections detail each configuration’s avail-

able options. All timing values specified are subject to the specified oscillator variation.

3.1.4.1 Modulation Format (MSEL)

The Modulation format option selects the modulation format for data output from the DATA pin; most often transmitted via RF.

MSEL options:

• Pulse Width Modulation (PWM), Figure 3-3

• Manchester Modulation, Figure 3-4

3.1.4.2 Header Select (HSEL)

The synchronization header is typically used by the receiver to adjust bit sampling appropriate to the transmitter’s current speed; as the transmitter’s RC oscillator varies with temperature and voltage, so will the transmission’s timing.

HSEL options:

•4 RF

• 10 RFTE

3.1.4.3 Extended Serial Number (XSER)

The Extended Serial Number option determines whether the HCS473 transmits a 28 or 32-bit serial number.

When configured for a 28-bit serial number, the Most Significant nibble of the 32 bits reserved for the serial number is replaced with a copy of the 4-bit button status, Figure 3-2.

XSER options:

• 28-bit serial number

• 32-bit serial number

3.1.4.4 Queue Counter (QUEN)

The QUE counter can be used to request secondary decoder functions using only a single transmitter button. Typically a decoder must keep track of incoming transmissions to determine when a double button press occurs, perhaps an unlock all doors request. The QUE counter removes this burden from the decoder by counting multiple button presses and including the QUE counter value in the last two bits of the 69-bit code word, (Figure 3-2). If QUEN is disabled, the transmission will consist only of 67 bits as the QUE bits field is not transmitted.

Que counter functionality is enabled with the QUEN configuration option. The 2-bit QUE counter is incremented each time an active button input is released for at least the Debounce Time (T (button pressed again) within the Queue Time (T Figure 3-5. The counter increments up from 0 to a maximum of 3, returning to 0 only after a different button activation or after button activations spaced greater than the Queue Time (T

The current transmission aborts, after completing the minimum number of code words (Section 3.1.4.15), when the active button inputs are released. A button reactivation within the queue time (T new transmission (new synchronization counter, encrypted data) using the updated QUE value. Button combinations are queued the same as individual buttons.

QUE) apart.

DB), then re-activated

QUE),

QUE) then initiates a

DS40035C-page 14 Preliminary  2002 Microchip Technology Inc.

FIGURE 3-5: QUE COUNTER TIMING DIAGRAM

HCS473

Button Input Sx

Code Words Transmitted

1st Button Press All Buttons Released 2nd Button Press

Transmission: QUE1:0 = 01

t ≥ TDB

QUE1:0 = 00 Synch CNT = X

TDB

3.1.4.5 Counter Select (CNTSEL)

The counter select option selects between a 16-bit or 20-bit counter. This option changes the way the 32-bit hopping portion is constructed, as indicated in Figure 3-2. The 16-bit counter format additionally includes two overflow bits for increasing the synchronization counter range, see Section 3.1.7.

CNTSEL options:

• 16-bit synchronization counter

• 20-bit synchronization counter

3.1.4.6 Low Voltage Trip Point Select

(VLOWSEL)

VLOWSEL options:

• 2.2V trip point

• 3.3V trip point

The low voltage detector result (VLOW) is included in Hopping code transmissions allowing the receiver to indicate when the transmitter battery is low (Figure 3-

2). The HCS473 also indicates a low battery condition

by changing the LED operation (Section 3.1.5). The HCS473 samples the internal low voltage detector

at the end of each code word’s first preamble bit. The transmitted VLOW status will be a ‘0’ as long as the low voltage detector indicates V low voltage trip point. VLOW will change to a ‘1’ if V drops below the selected low voltage trip point.

DD is above the selected

Transmission:

Synch CNT = X+1

TDB ≤ t ≤ TQUE

3.1.4.7 PLL Interface Select (PLLSEL)

The S3/RFEN pin may be configured as an RF enable output to an RF PLL. The pin’s behavior is coordinated with the DATA pin to activate a typical PLL in either ASK or FSK mode.

The PLL Interface (PLLSEL) configuration option controls the output as shown for Encoder operation in Figure 3-6. Please refer to Section 3.2.8 for RFEN behavior during LF communication.

PLLSEL options:

• ASK PLL Setup

• FSK PLL Setup

3.1.4.8 RF Enable Output (RFEN)

The S3/RFEN pin of the HCS473 can be configured to function as an RF enable output signal. When enabled, the pin is driven high whenever data is transmitted through the DATA pin; the S3/RFEN pin can therefore not be used as an input in this configuration. The RF enable option bit functions in conjunction with the PLL interface select option, PLLSEL.

RFEN options:

• S3/RFEN pin functions as S3 switch input only

• S3/RFEN pin functions as RFEN output only

TABLE 3-1: VLOW STATUS BIT

VLOW Description

0 V 1 V

 2002 Microchip Technology Inc. Preliminary DS40035C-page 15

DD is above selected trip voltage DD is below selected trip voltage

HCS473

FIGURE 3-6: ENCODER OPERATION: RF ENABLE/ASK/FSK OPTIONS

SWITCH

ASK:

FSK:

S3/RFEN

DATA

S3/RFEN

DATA

TPU

Code Word Code Word Code Word

PLL

Code Word Code Word Code Word

3.1.4.9 SEED Button Code (SDBT)

SDBT selects which switch input(s) activate a seed transmission. Seed transmissions are disabled by clearing all 4 bits. If a button combination is pressed that matches the 4-bit SDBT value, a seed code word is transmitted as configured by the SDTM, SDLM and SDMD options (see following sections).

The binary bit order is S3-S2-S1-S0. For example, if you want the combination of S2 and S0 to activate a seed transmission, use SDBT=0101

SDBT options:

• Seed is transmitted when SDBT flags match the button input flags

• SDBT = 0000

disables seed capability.

Note: Configuring S3/RFEN as RFEN (see

Section 3.1.4.8) prevents the use of S3 to trigger a seed transmission.

3.1.4.10 Time Before Seed (SDTM)

The time before seed option selects the delay from device activation until the seed code words are transmitted. If the delay is not zero, the HCS473 transmits hopping code words until the selected time, then transmits seed code words.

As code words are always completed, the seed code word begins the first code word after the specified time.

SDTM options:

• 0s - seed code words begin immediately

•0.8s

•1.6s

•3.2s

Code Word

3.1.4.11 Limited Seed (SDLM)

The limited seed option may be used to disable seed transmission capability after a configurable number of transmitter activations; limiting a transmitter’s ability to be learned into a receiver. Specifically, seed transmissions are disabled when the synchronization counter’s LSB increments from 7Fh to 80h.

SDLM options:

• unlimited seed capability

• limited seed capability - counter value dependent

3.1.4.12 SEED Mode (SDMD)

The Seed mode option selects between User and Production seed modes. Production mode functions as a special time before seed case (SDTM).

With Production mode enabled, a seed button code activation triggers MTX hopping code words followed by MTX seed code words. Production mode functionality is disabled when the synchronization counter’s LSB increments from 7Fh to 80h.

SDMD options:

•User

• Production

3.1.4.13 RF Baud Rate Select (RFBSL)

The timing of code word data modulated on the DATA pin is referred to in multiples of a basic Timing Element RFT

E. ‘RF’ TE

sent through a RF transmitter to the decoder or transponder reader.

E may be selected using the RF Baud Rate Select

RFT (RFBSL) configuration option. RF ject to the oscillator variation over temperature and voltage.

RFBSL options:

•100 µs RFT

•200 µs RFTE

•400 µs RFTE

•800 µs RFTE

because the DATA pin output is typically

TE accuracy is sub-

DS40035C-page 16 Preliminary  2002 Microchip Technology Inc.

HCS473

3.1.4.14 Guard Time Select (GSEL)

The guard time (TG) select option determines the time between consecutive code words when no data is transmitted. The guard time may be selected in conjuction with the RF baud rate and preamble duty cycle to control time-averaged power output for transmitter certification.

GSEL options:

•3 RF

• 6.4 ms

•51.2 ms

• 102.4 ms

3.1.4.15 Minimum Code Words (MTX)

The Minimum Code Words (MTX) configuration option determines the minimum number of code words transmitted when a momentary switch input is taken high for more than T

MTX options:

•1 code word

•2 code words

•4 code words

•8 code words

PU, or when a proximity activation occurs.

3.1.4.18 Long Preamble Length (LPRL)

The long preamble length option selects the first code word’s preamble length when the long preamble option (LPRE) is enabled. Only the first code word begins with the long preamble, subsequent code words begin with the standard 16 high pulses preamble.

LPRL options:

•75 ms

• 100 ms

3.1.4.19 Preamble Duty Cycle (PRD)

The preamble duty cycle can be set to either 33% or 50% to limit the average power transmitted, Figure 3-7.

PRD options:

• 50% Duty Cycle

• 33% Duty Cycle

FIGURE 3-7: PREAMBLE FORMATS

50% Duty Cycle

33% Duty Cycle

TE TE

TE 2TE

3.1.4.16 Timeout Select (TSEL)

The HCS473’s Timeout function prevents battery drain should a switch input remain high (stuck button) longer than the selectable TSEL time. After the TSEL time, the device will return to Low-power mode.

The device will stop transmitting in Low-power mode but there will be leakage across the stuck button input’s internal pull-down resistor. The current draw will therefore be higher than if no button were stuck.

TSEL options:

•4s

•8s

•16s

•32s

3.1.4.17 Long Preamble Enable (LPRE)

Enabling the Long Preamble configuration option extends the first code word’s preamble to a ‘long’ preamble time LPRL wake and bias before the data bits arrive. The longer preamble will be a square wave at the selected RFT Subsequent code words begin with the standard preamble length.

LPRE options:

• Standard 16 high pulse preamble

• Long preamble, duration defined by LPRL

; allowing the receiver more time to

3.1.5 LED OPERATION

The LED pin output varies depending on whether the device V below V

The LED pin will periodically be driven low as long as the device is transmitting and the battery is good. If the supply voltage drops below the specified V point, the LED pin will be driven low only once for any given device activation so long as the low battery condition remains (Figure 3-8). If the battery voltage recovers during the transmission, the LED will begin blinking again.

DD is greater than VLOWSEL (a good battery) or

LOWSEL (a flat battery).

LOWSEL trip

 2002 Microchip Technology Inc. Preliminary DS40035C-page 17

HCS473

FIGURE 3-8: LED OPERATION

SWITCH Sx

Code Word Code Word Code Word

TLEDON

LED

DATA

VDD>VLOWSEL (good battery)

DD≤VLOWSEL

(flat battery)

3.1.6 CYCLE REDUNDANCY CHECK

(CRC)

The decoder can use the CRC bits to check the data integrity before processing begins. The CRC is calculated on the previously transmitted bits (Figure 3-2), detecting all single bit and 66% of all double bit errors.

EQUATION 3-1: CRC CALCULATION

CRC 1[]

and

CRC 0[]

with

and Di

the nth transmission bit 0 ≤ n ≤ 64

n1+

CRC 1 0,[]00=

CRC 0[]nDin⊕=

CRC 0[]nDin⊕()CRC 1[]

⊕=

3.1.7 COUNTER OVERFLOW BITS

(OVR1, OVR0)

The Counter Overflow Bits may be utilized to increase the 16-bit synchronization counter range from the nominal 65,535 to 131,070 or 196,605. The bits do not exist when the device is configured for 20-bit counter operation.

The bits must be programmed during production as ‘1’s to be utilized. OVR0 is cleared the first time the synchronization counter wraps from FFFFh to 0000h. OVR1 is cleared the second time the synchronization counter wraps to zero. The two bits remain at ‘0’ after all subsequent counter wraps.

Note: See Section 4.0, Programming Specs, for

information on programming OVR bits.

TLEDOFF

3.1.8 DISCRIMINATION VALUE (DISC)

The Discrimination Value is typically used by the decoder in a post-decryption check. It may be any value, but in a typical system it will be programmed equal to the Least Significant bits of the serial number.

The discrimination bits are part of the information that form the encrypted portion of the transmission (Figure 3-2). After the receiver has decrypted a transmission, the discrimination bits are checked against the receiver’s stored value to verify that the decryption process was valid; appropriate decryption key was used. If the discrimination value was programmed as the LSb’s of the serial number then it may merely be compared to the respective bits of the received serial number.

The discrimination bit field size varies with the counter select (CNTSEL) option (Figure 3-2).

3.2 Transponder Mode

The HCS473’s Transponder mode allows it to function as a bi-directional communication transponder. Commands are received on the LC pins, responses may be returned on either the LC pins or DATA pin for short range LF or long range RF responses, respectively.

Transponder mode capabilities include:

• A bi-directional challenge and response sequence for IFF validation.

• Read selected EEPROM areas.

• Write selected EEPROM areas.

• Request a code hopping transmission.

• Proximity Activation of a code hopping transmission.

• Address an individual transponder when multiple units are within the LF field; device selection for anticollision communication purposes.

DS40035C-page 18 Preliminary  2002 Microchip Technology Inc.

HCS473

3.2.1 TRANSPONDER OPTIONS

The following HCS473 configuration options influence the device behavior when in Transponder mode:

• Preamble length select (TPRLS)

• LF Demodulator (LFDEMOD)

• LF Baud rate select (LFBSL)

• Anticollision (ACOL)

• Proximity Activation (PXMA)

• Intelligent Damping (DAMP)

• LC response Enable (LCRSP)

• RF response Enable (RFRSP)

• Skip Field Acknowledge (SKIPACK) The following sections describe these options in detail.

3.2.1.1 Transponder Preamble Length Select (TPRLS)

Data responses through the DATA pin use the format determined by the Encoder mode options, with one exception/option to shorten the response time. The response’s preamble can be reduced to 4 high pulses by setting the transponder preamble length select option. This only affects the responses as a result of transponder communication (proximity activation transmissions included), not responses resulting from button input activations. The 4 high pulse short preamble will be at the same duty cycle defined by the preamble duty cycle Encoder mode option (PRD).

Note: The long preamble enable Encoder mode

option (LPRE) holds priority over the transponder preamble length option.

The demodulated signal on the LED pin is accurate to within +/-10µs of the signal on the LC pins. The injected signal will have baud rate limitations based on the HCS473’s internal filter charge and discharge times, Section 3.2.6.

The filter times discussed in Section 3.2.6 will be easily seen in Demodulator mode. The internal filter delay may be isolated by communicating to the HCS473 inputting the digital signal into LCX and observing the signal plus internal filter delays on the LED pin.

LFDEMOD options:

• Disabled - device functions normally

• Enabled - device demodulates signal on LC pins, outputting digital result on the LED pin.

Note: Damping is disabled when in Demodulator

mode.

3.2.1.3 LF Baud Rate Select (LFBSL)

The LF Baud rate select option allows the user to adjust the basic pulse width element (LF sponder communication.

TE) used for tran-

LFBSL options:

• 100 µs LFTE

• 200 µs LFTE

• 400 µs LFTE

• 800 µs LFTE

All communication to and from the HCS473 through the LC transponder pins will use the selected LF acknowledges to LF communication, through the DATA pin, will also use the selected LF

TE.

TE. RF

TABLE 3-2: TRANSPONDER PREAMBLE

LENGTH SELECT (TPRLS)

TPLS LPRE Description

00Normal - 16 high pulses X1Long - LPRL determines length 10Short - 4 high pulses

3.2.1.2 LF Demodulator (LFDEMOD)

The HCS473 has a LF Demodulator mode useful for debugging antenna hardware.

Enabling LFDEMOD limits the device to demodulator only mode. After receiving an appropriate wake-up sequence, the device enters a loop demodulating the signal on the LC pins and outputting the resulting digital representation on the LED pin. The HCS473 remains in this mode until no edges are detected on the LC pins

DEMOD, upon which it will return to Low-power

for T mode; requiring another wake-up sequence to further demodulate data.

3.2.1.4 Anticollision (ACOL)

Multiple transponders in the same inductive field will simultaneously respond to inductive commands. Enabling anticollision prevents multiple HCS473 responses from 'colliding'. Hence the term ‘anticollision.’

When anticollision (ACOL) is enabled, the first command received after the device wakes must be either the SELECT TRANSPONDER or ANTICOLLISION OFFcommand before the HCS473 will respond to any other command.

The ANTICOLLISION OFF command may be used to temporarily bypass anticollision requirements for a single communication sequence. It allows communication with an anticollision enabled HCS473 if the VID and TID are not known (perhaps during a learning sequence). See Section 3.2.3.7 for further anticollision off details.

The SELECT TRANSPONDER command allows the addressing of and communication to an individual HCS473, regardless if multiple devices are in the field (Section 3.2.3.1).

 2002 Microchip Technology Inc. Preliminary DS40035C-page 19

+ 47 hidden pages