MICROCHIP HCS512 Technical data

HCS512

KEELOQ® Code Hopping Decoder

FEATURES

Security

• Secure storage of Manufacturer’s Code

• Secure sto rage of transmitter’s keys

• Up to four transmitters can be learned

•K

• Normal and secure learning mechanisms

Operating

• 4.0V – 6.0V operation

• 4 MHz external RC oscillator

• Learning indication on LRNOUT

• Auto baud rate detection

• Power saving SLEEP mode

Other

• Stand-alone decoder

• On-chip EEPROM for transmitter storage

• Four binary function outputs–15 functions

• 18-pin DIP/SOIC package

Typical Applications

• Automotive remote entry systems

• Automotive alarm systems

• Automotive immobilizers

• Gate and garage openers

• Electronic door locks

• Identity t okens

• Burglar alarm systems

Compatible Encoders

All KEELOQ encoders and transponders configured for
the following setting:

• PWM modulation format (1/3-2/3)

•T

•10 x TE Header

• 28-bit Serial Number

• 16-bit Synchronization counter

• Discrimination bit s equal to Serial Num ber 8 LSbs

• 66- to 69-bit length code word.



EELOQ

E in the range from 100 µs to 400 µs

code hopping technology

DESCRIPTION

The Microchip Technology Inc. HC S51 2 is a c od e ho p­ping decoder designed for secure Remote Keyless
Entry (RKE) systems. The HCS512 utilizes the pat­ented K

EELOQ code hopping system and high security

learning mechanisms to make this a canned solution
when used with the HCS en co ders to i mp lem en t a un i­directional remote keyless entry system.

PACKAGE TYPE

PDIP, SOIC

NC

S0

S1

S2

S3

1
2
3
4
5
6
7
8
9

18

RFIN

NC

17

OSCIN

16

HCS512

15
14
13
12
11
10

OSC

VDD

DATA

CLK

SLEEP

V

LOW

OUT

LRNIN

LRNOUT

MCLR

GND

BLOCK DIAGRAM

RFIN

EEPROM CONTROL

OSCIN

OSCILLATOR

The Manufacturer’s Code, transmitter keys, and syn­chronization information are stored in protected on­chip EEPROM. The HCS512 uses the DATA and CLK
inputs to load the Manufacturer’s Code which cannot
be read out of the device.

Reception Register

DECRYPTOR

OUTPUT

S0 S1 S3S2VLOW

CONTROL

DATA
CLK

LRNIN
MCLR

SLEEP

LRNOUT

 2002 Microchip Technology Inc. DS40151D-page 1

HCS512

The HCS512 operates over a wide voltage range of

3.0 volts to 6.0 volts. The decoder employs automatic
baud rate detection which allows it to compensate for
wide variations in transmitter data rate. The decoder
contains sophisticated error checking algorithms to
ensure only valid codes are accepted.

1.0 SYSTEM OVERVIEW

Key Terms

The following is a l ist of key te rms us ed thro ughout this
data sheet. For additional information on K
Code Hopping, refer to Technical Brief 3 (TB003).

• RKE - Remote Keyless Entry

• Button Status - Indicates what button input(s)
activated the transmission. Encompasses the 4
button status bits S3, S2, S1 and S0 (Figure8-2).

• Code Hopping - A method by which a code,
viewed externally to the system, appears to
change unpredictably each time it is transmitted.

• Code word - A block of data that is repeatedly
transmitted upon button activation (Figure8-1).

• Transmission - A data stream consisting of
repeating code words (Figure 8-1).

• Crypt key - A unique and secret 64-bit number
used to encrypt and decrypt data. In a symmetri­cal block cipher such as the K
the encryption and de cry pti on k ey s a re equal and
will therefore be refer red to generally as the crypt
key.

• Encoder - A device that generates and encodes
data.

• Encryption Algorithm - A recipe whereb y data i s
scrambled using a crypt k ey . The dat a can only be
interpreted by the respe ctive dec ryptio n algo rithm
using the same crypt key.

• Decoder - A device that decodes data received
from an encoder.

• Decryption algorithm - A recipe whereby data
scrambled by an encryption algorithm can be
unscrambled using the same crypt key.

• Learn – Learning invol ves the recei ver calcula ting
the transmitter’s app ropr i ate crypt key, decrypting
the received hopping code and storing the serial
number, synchronization counter value and crypt
key in EEPROM. The K
itates several learning strategies to be imple­mented on the decoder. The following are
examples of what can be done.

- Simple Learning

The receiver uses a fixed crypt key, common
to all components of all system s by the s am e
manufacturer, to decrypt the received code
word’s encrypted portion.

- Normal Learning

The receiver uses information transmitted

EELOQ algorithm,

EELOQ product family fa cil-

EELOQ and

during normal operation to derive the crypt
key and decrypt the received code word’s
encrypted portion.

- Secure Learn
The transmitter is activated through a special
button combinat ion to t ransmit a stored 60-bit
seed value used to generat e the trans mitter’s
crypt key. The receiver uses this seed value
to derive the same crypt key and decrypt the
received code word’s encrypted portion.

• Manufacturer’s code – A unique and secret 64-
bit number used to generate un ique encoder crypt
keys. Each encoder is programmed with a crypt
key that is a function of the manufacturer’s code.
Each decoder is programmed with the manufac­turer code itself.

1.1 HCS Encoder Overview

The HCS encoders have a small EEPROM array wh ich
must be loaded with several parameters before use.
The most important of these values are:

• A crypt key that is generated at the time of pro­duction

• A 16-bit sy nchronizati on counter value

• A 28-bit serial number w hich is meant to be
unique for every encoder

The manufacturer program s the serial nu mber for eac h
encoder at the time of production, while the ‘Key Gen­eration Algorithm’ generat es the crypt k ey (Figure 1-1).
Inputs to the key generation algorithm typically consist
of the encoder’s serial number and a 64-bit manufac­turer’s code, which the manufacturer creates.

Note: The manufact urer co de is a pivo tal part of

the system’s overall security. Conse­quently, all possible precautions must be
taken and maintained for this code.

DS40151D-page 2  2002 Microchip Technology Inc.

HCS512

FIGURE 1-1: CREATION AND STORAGE OF CRYPT KEY DURING PRODUCTION

Production
Programmer

Manufacturer’s

Code

The 16-bit synchronization counter is the basis behind
the transmitted code word changing for each transmis­sion; it increments each time a button is pressed. Due

to the code hoppin g algorith m’s complex ity, each incre­ment of the synchronization value results in greater
than 50% of the bits changing in the transmitted code
word.

Figure 1-2 shows how the key values in EEPROM are
used in the encoder . O nce the encoder dete cts a button
press, it reads the button inputs and updates the syn­chronization counter. The synchronization co unter and
crypt key are input to the encryption algorithm and the
output is 32 bits of encrypted information. This data will
change with every button press, its value appearing
externally to ‘ran domly h op aroun d’, hence it is re ferred
to as the hopping portion of the code word. The 32-bit
hopping code is combined with the button information
and serial numb er to fo rm the code word transm itted to
the receiver. The code word format is explained in
greater detail in Section 8.2.

Transmitter

Serial Number

Key

Generation

Algorithm

HCS512

EEPROM Array

Serial Number

Crypt Key
Sync Counter

Crypt

Key

A receiver may use any type of controller as a decoder,
but it is typically a microcontroller with compatible firm­ware that allows the decoder to operate in conjunction
with an HCS512 based transmitter. Section 5.0
provides detail on integrating the HCS512 into a sys­tem.

A transmitter must first be ‘learned’ by the receiver
before its use is allowed in the system. Learning
includes calculating the transmitter’s appropriate crypt
key, decrypting the received hopping code and storing
the serial number, synchronization counter value and
crypt key in EEPROM.

In normal operation, each received message of valid
format is evaluated. The serial number is used to deter­mine if it is from a learned transmitter. If from a learned
transmitter, the message is decrypted and the synchro­nization counter is verified. Finally, the button status is
checked to see what operation is requested. Figure 1-3
shows the relationship between some of the values
stored by the receiver and the values received from
the transmitter.

.

.

.

FIGURE 1-2: BUILDING THE TRANSMITTED CODE WORD (ENCODER)

EEPROM Array

Crypt Key

Sync Counter

Serial Number

 2002 Microchip Technology Inc. DS40151D-page 3

KEELOQ

Encryption

Algorithm

Button Press

Information

Serial Number

Transmitted Information

Encrypted Data

32 Bits

HCS512

FIGURE 1-3: BASIC OPERATION OF RECEIVER (DECODER)

1

Received Information

Button Press
Information

Serial Number

32 Bits of

Encrypted Data

EEPROM Array

Manufacturer Code

Check for

2

Match

KEELOQ
Decryption
Algorithm

Perform Function
Indicated by

5

button press

NOTE: Circled numbers indicate the order of execution.

Decrypted

Synchronization

Counter

3

Serial Number

Sync Counte r

Crypt Key

Check for

4

Match

2.0 PIN ASSIGNMENT

PIN

1 LRNIN
2 LRNOUT O TTL Learn output - indicates learning
3NC — TTL Do not connect

4MCLR
5 Ground P — Ground connection
6S0 OTTL Switch 0
7S1 OTTL Switch 1
8S2 OTTL Switch 2

9S3 OTTL Switch 3
10 V
11 SLEEP I TTL Connect to RFIN to allow wake-up from SLEEP
12 CLK I/O

13 DATA I/O
14 V

15 OSCOUT (1MHZ) O TTL Oscillator out (test point)
16 OSC
17 NC — —
18 RFIN I TTL RF input from receiver

Note 1: P = power, I = in, O = out, and ST = Schmitt Trigger input.

Decoder

Function

LOW O TTL Battery low indication output

DD P — Power connection

IN (4MHz) I ST Oscillator in – recommended values 4.7 kΩ and 22 pF

2: Pin 12 and Pin 13 have a dual purpose. After RESET, these pins are used to determine if Programming

mode is selected in which case they are the clock and data lines. In normal operation, they are the clock
and data lines of the synchronous data output stream.

(1)

I/O

I TTL Learn input - initiates learning, 10K pull-up required on input

I ST Master clear input

Buffer

Type

TTL/ST
TTL/ST

(1)

(2)
(2)

Description

Clock in Programming mode and Synchronous mode

Data in Programming mode and Synchronous mode

DS40151D-page 4  2002 Microchip Technology Inc.

HCS512

3.0 DESCRIPTION OF FUNCTIONS

3.1 Parallel Interface

The HCS512 activates the S3, S2, S1 & S0 outputs
when a new valid code is received. The outputs will be
activated for approxi mat ely 50 0 ms. I f a repeated code
is received during this time, the output extends for
approximately 500 ms.

3.2 Serial Interface

The decoder has a PWM/Synchronous interface con­nection to microcontrol lers with l imited I/O. An output
data stream is generated when a valid transmission is
received. The data stream consists of one START bit,
four function bits, one bit for battery status, one bit to
indicate a repeated transmission, two status bits, and
one STOP bit. (Table 3-1). The DA T A and CLK line s are
used to send a synchronous event message.

FIGURE 3-1: DATA OUTPUT FORMAT

STARTS3S2S1S0

FIGURE 3-2: STATUS MESSAGE FORMAT

A special statu s mess age is transmitted on the sec on d
pass of learn. Th is al lows th e cont rollin g mic rocont rol­ler to determine if the learn w as successful (R esult = 1)
and if a previous transmitte r was overwritten (Overwri te
= 1). The status message is shown in Figure 3-2.

Table 3-1 show the values for TX1:0 and th e number of
transmitters learned.

TABLE 3-1: STATUS BITS

TX1 TX0 Number of Transmitters

00 One
01 Two
10 Three
11 Four

VLOW

TX1 TX0 STOPREPEAT

START0000

A 1-wire PWM or 2-wire synchronous interface can be used.
In 1-wire mode, the data is transmitted as a PWM signal with a basic pulse width of 400 µs.
In 2-wire mode, Synchronou s mode PWM bit s sta rt on the rising edg e of the clock, an d the bits must be sampl ed on the

falling edge. The START bit is a ‘1’ and the STOP bit is ‘0’.

FIGURE 3-2: PWM OUTPUT FORMAT

600 µs

CLK

DATA

S3START S2 S1 S0 VLOW RPT Reserved Reserved STOP

1200 µs

(1)

RESUL T

TX1 TX0 STOPOVRWR

1/31/31/3

LOGIC “1”

LOGIC “0”

1200 µs

Note: The Decoder output PWM format logic (“1” / “0”) is reversed with respe ct of the Encoder modulat ion format.

 2002 Microchip Technology Inc. DS40151D-page 5

HCS512

4.0 DECODER OPERATION

4.1 Learning a Transmitter to a
Receiver

Either the serial number-based learning method or the
seed-based learning method can be selected. The
learning method is s elected in t he config uration byte. In
order for a transmitter to be used with a decoder, the

transmitter must f irst be ‘learn ed’. When a transmitte r is
learned to a decoder, the decoder stores the crypt key,
a check value of the serial number and current syn­chronization value in EEPROM. The decoder must
keep track of these values for every transmitter that is
learned. The maxim um numbe r of trans mitters that can
be learned is four. The decoder must also contain the
Manufacturer’s Code in order to learn a transmitter.
The Manufacturer’s Code will typically be the same for
all decoders in a system.

The HCS512 has four memory slots. After an “erase
all” procedure, all the memory slots will be cleared.
Erase all is activated by taking LRNIN
mately 10 seconds . When a new transm itter is lea rned,
the decoder searches for an empty memory slot and
stores the transmitter’s informati on in that memory slo t.
When all memory slots are full, the decoder randomly
overwrites existing transmitters.

4.1.1 LEARNING PROCEDURE

Learning is activated by taking the LRNIN input low for
longer than 64 ms. Thi s inp ut req uire s an external pull­up resistor.

To learn a new transmitter to the HCS512 decoder, the
following sequence is required:

1. Enter Learning mode by pulling LRNIN

longer than 64 ms. The LRNOUT output will go
high.

2. Activate the transmitter until the LRNOUT out-

put goes low indic ating re cepti on of a v alid code
(hopping message).

3. Activate the transmitter a second time until the

LRNOUT toggles for 4 seconds (in Secure
Learning mode, the seed transmission must be
transmitte d dur in g the s eco nd sta ge o f le arn by
activatin g the ap propria te butt ons on t he trans ­mitter).

If LRNIN
learn status indication, the indication will be ter­minated. Onc e a succe ssful l earning sequen ce
is detected, the indication can be terminated
allowing quick learning in a manufacturing
setup.

4. The transmitter is no w lea r ned in to t he d ec oder.

5. Repeat steps 1-4 to learn up to four tran smitters.

6. Learning will be terminated if two non-sequential

codes were received or if two acceptable codes
were not decoded within 30 seconds.

is taken low momentarily during the

low for approxi-

low for

The following checks are performed on the decoder to
determine if the transmission is valid during learn:

• The first code word is checked for bit integrit y.

• The second code word is c hec ke d f or b it i nte grit y.

• The hopping code is decrypted.

• If all the checks pass, the serial number and syn­chronization counters are stored in EEPROM
memory.

Figure 4-1 shows a flow chart of the learn sequence.

FIGURE 4-1: LEARN SEQUENCE

Enter Learn

Mode

Wait for Reception

of a Valid Code

Wait for Reception

of Second

Non-Repeated

V alid Code

Generate Key

from Serial Number

or Seed Value

Use Generated Key

to Decrypt

Compare Discrimination

Value with Serial Number

Equal

?

Yes

Learn successful. Store:

Serial number check value

Synchronization counter

crypt key

Exit

No

Learn

Unsuccessful

DS40151D-page 6  2002 Microchip Technology Inc.

HCS512

4.2 Validation of Codes

The decoder waits for a transmission and checks the
serial number to determine if the transmitter has been
learned. If learned, the decoder decryp ts the en crypted
portion of t he t rans mis sio n us ing t he cr ypt k ey. It uses
the discrimination bits to determine if the decryption
was valid. If everything up to this point is valid, the
synchronization value is evaluated.

4.3 Validation Steps

Validation consists of the following steps:

• Search EEPROM to find the Serial Number
Check Value Match

• Decrypt the Hopping Code

• Compare the 10 bits of discrimination value with
the lower 10 bits of serial number

• Check if the synchronization counter falls within
the first synchronization window.

• Check if the synchronization counter falls within
the second synchronization window.

• If a valid transmission is found, update the syn­chronization coun ter , el se use the next t ransmi tter
block and repeat the tests.

FIGURE 4-2: DECODER OPERATION

Start

No

Transmission

Received

?

Yes

No

Decrypt Transmission

No

No

Does

Ser # Check Val

Match

?

Yes

Is

Decryption

Valid

?

Yes

Is

Counter

Within 16

?

No

Is

Counter

Within 32K

?

Yes

Execute

Command

and

Update

Counter

Yes

Save Counter

in Temp Location

 2002 Microchip Technology Inc. DS40151D-page 7

HCS512

4.4 Synchronization with Decoder
(Evaluating the Counter)

The KEELOQ technology patent scope includes a
sophisticated synchronization technique that does not
require the calculation and s torage of future codes. The
technique sec urely blocks inva lid transmission s while
providing transparent resynchronizat ion to t r ans mi tte rs
inadvertently activated away from the receiver.

Figure 4-3 shows a 3-partition, rotating synchronization
window. The size of each window is optional but the
technique is fundamental. Each time a transmission is
authenticated, the intended function is executed and
the transmission’s synchronization counter value is
stored in EEPROM. From the currently stored counter
value there is an initial "Single Operation" forward win­dow of 16 codes. If the difference between a received
synchronization counter and the last stored counter is
within 16, the intended fun ction wi ll be ex ecuted on the
single button press and the new synchronization
counter will be st ored. Stori ng the new s y nch ron iz atio n
counter value ef fectively rot ates the entire synchroniza­tion window.

A "Double Operation" (resynchronization) window fur­ther exists from the Si ngle Ope ration wind ow up to 3 2K
codes forward of the currently stored counter value. It

is referred to as "Double Operation" because a trans­mission with synchronization counter value in this win­dow will require an additional, sequential counter
transmissi on prior to execut ing the intended function.
Upon receiving the sequential transmission the
decoder executes the intended function and stores the
synchroniz ation co unter va lue. Th is resy nchroniz ation
occurs transparently to the user as it is human nature
to press the button a second t ime if the first was un suc­cessful.

The third window is a "Blocked Window" ranging from
the double operation window to the currently stored
synchroniz ation counter value. An y transmission with
synchronization counter value within this window will
be ignored. This window excludes previously used,
perhaps code-grabbed transmissions from accessing
the system.

Note: The synchronization method described in

this section is only a typic al implement ation
and because it is usually implemented in
firmware, it can be altered to fit the needs
of a particular system.

FIGURE 4-3: SYNCHRONIZATION WINDOW

Entire Window
rotates to eliminate
use of previously
used codes

Blocked
Window

(32K Codes)

Double Operation

(resynchronization)

Window

(32K Codes)

4.5 SLEEP Mode

The SLEEP mode of the HCS512 is used to reduce
current consumption when no RF input signal is
present. SLEEP mode will only be effective in systems
where the RF re ceiver is relat ively q uiet when no si gnal
is present. During SLEEP, the clock stops, thereby sig­nificantly reducing the operating current. SLEEP mode
is enabled by the SLEEP bit in the configuration byte.

The HCS512 will enter SLEEP mode when:

• The RF line is low

• After a function output is switched off

• Learn mode is terminated (time-out reached)

Stored
Synchronization
Counter Value

Single Operation

Window

(16 Codes)

The device will not enter SLEEP mode when:

• A function output is active

• Learn sequence active

• Device is in Programming mode
The device will wake-up from SLEEP when:

• The SLEEP input pin changes state

• The CLOCK line changes state
Note: During SLEEP mode the CLK line will

change from an output line to an input line
that can be used to wake-up the device.
Connect CLK to
to reliably enter the Learn mode whenever
SLEEP mode is active.

LRNIN via a 100K resistor

DS40151D-page 8  2002 Microchip Technology Inc.