All KEELOQ encoders and transponders configured for
the following setting:
• PWM modulation format (1/3-2/3)
•T
•10 x TE Header
• 28-bit Serial Number
• 16-bit Synchronization counter
• Discrimination bit s equal to Serial Num ber 8 LSbs
• 66- to 69-bit length code word.
EELOQ
E in the range from 100 µs to 400 µs
code hopping technology
DESCRIPTION
The Microchip Technology Inc. HC S51 2 is a c od e ho pping decoder designed for secure Remote Keyless
Entry (RKE) systems. The HCS512 utilizes the patented K
EELOQ code hopping system and high security
learning mechanisms to make this a canned solution
when used with the HCS en co ders to i mp lem en t a un idirectional remote keyless entry system.
PACKAGE TYPE
PDIP, SOIC
NC
S0
S1
S2
S3
1
2
3
4
5
6
7
8
9
18
RFIN
NC
17
OSCIN
16
HCS512
15
14
13
12
11
10
OSC
VDD
DATA
CLK
SLEEP
V
LOW
OUT
LRNIN
LRNOUT
MCLR
GND
BLOCK DIAGRAM
RFIN
EEPROMCONTROL
OSCIN
OSCILLATOR
The Manufacturer’s Code, transmitter keys, and synchronization information are stored in protected onchip EEPROM. The HCS512 uses the DATA and CLK
inputs to load the Manufacturer’s Code which cannot
be read out of the device.
Reception Register
DECRYPTOR
OUTPUT
S0 S1S3S2VLOW
CONTROL
DATA
CLK
LRNIN
MCLR
SLEEP
LRNOUT
2002 Microchip Technology Inc.DS40151D-page 1
HCS512
The HCS512 operates over a wide voltage range of
3.0 volts to 6.0 volts. The decoder employs automatic
baud rate detection which allows it to compensate for
wide variations in transmitter data rate. The decoder
contains sophisticated error checking algorithms to
ensure only valid codes are accepted.
1.0SYSTEM OVERVIEW
Key Terms
The following is a l ist of key te rms us ed thro ughout this
data sheet. For additional information on K
Code Hopping, refer to Technical Brief 3 (TB003).
• RKE - Remote Keyless Entry
• Button Status - Indicates what button input(s)
activated the transmission. Encompasses the 4
button status bits S3, S2, S1 and S0 (Figure8-2).
• Code Hopping - A method by which a code,
viewed externally to the system, appears to
change unpredictably each time it is transmitted.
• Code word - A block of data that is repeatedly
transmitted upon button activation (Figure8-1).
• Transmission - A data stream consisting of
repeating code words (Figure 8-1).
• Crypt key - A unique and secret 64-bit number
used to encrypt and decrypt data. In a symmetrical block cipher such as the K
the encryption and de cry pti on k ey s a re equal and
will therefore be refer red to generally as the crypt
key.
• Encoder - A device that generates and encodes
data.
• Encryption Algorithm - A recipe whereb y data i s
scrambled using a crypt k ey . The dat a can only be
interpreted by the respe ctive dec ryptio n algo rithm
using the same crypt key.
• Decoder - A device that decodes data received
from an encoder.
• Decryption algorithm - A recipe whereby data
scrambled by an encryption algorithm can be
unscrambled using the same crypt key.
• Learn – Learning invol ves the recei ver calcula ting
the transmitter’s app ropr i ate crypt key, decrypting
the received hopping code and storing the serial
number, synchronization counter value and crypt
key in EEPROM. The K
itates several learning strategies to be implemented on the decoder. The following are
examples of what can be done.
- Simple Learning
The receiver uses a fixed crypt key, common
to all components of all system s by the s am e
manufacturer, to decrypt the received code
word’s encrypted portion.
- Normal Learning
The receiver uses information transmitted
EELOQ algorithm,
EELOQ product family fa cil-
EELOQ and
during normal operation to derive the crypt
key and decrypt the received code word’s
encrypted portion.
- Secure Learn
The transmitter is activated through a special
button combinat ion to t ransmit a stored 60-bit
seed value used to generat e the trans mitter’s
crypt key. The receiver uses this seed value
to derive the same crypt key and decrypt the
received code word’s encrypted portion.
• Manufacturer’s code – A unique and secret 64-
bit number used to generate un ique encoder crypt
keys. Each encoder is programmed with a crypt
key that is a function of the manufacturer’s code.
Each decoder is programmed with the manufacturer code itself.
1.1HCS Encoder Overview
The HCS encoders have a small EEPROM array wh ich
must be loaded with several parameters before use.
The most important of these values are:
• A crypt key that is generated at the time of production
• A 16-bit sy nchronizati on counter value
• A 28-bit serial number w hich is meant to be
unique for every encoder
The manufacturer program s the serial nu mber for eac h
encoder at the time of production, while the ‘Key Generation Algorithm’ generat es the crypt k ey (Figure 1-1).
Inputs to the key generation algorithm typically consist
of the encoder’s serial number and a 64-bit manufacturer’s code, which the manufacturer creates.
Note:The manufact urer co de is a pivo tal part of
the system’s overall security. Consequently, all possible precautions must be
taken and maintained for this code.
DS40151D-page 2 2002 Microchip Technology Inc.
HCS512
FIGURE 1-1:CREATION AND STORAGE OF CRYPT KEY DURING PRODUCTION
Production
Programmer
Manufacturer’s
Code
The 16-bit synchronization counter is the basis behind
the transmitted code word changing for each transmission; it increments each time a button is pressed. Due
to the code hoppin g algorith m’s complex ity, each increment of the synchronization value results in greater
than 50% of the bits changing in the transmitted code
word.
Figure 1-2 shows how the key values in EEPROM are
used in the encoder . O nce the encoder dete cts a button
press, it reads the button inputs and updates the synchronization counter. The synchronization co unter and
crypt key are input to the encryption algorithm and the
output is 32 bits of encrypted information. This data will
change with every button press, its value appearing
externally to ‘ran domly h op aroun d’, hence it is re ferred
to as the hopping portion of the code word. The 32-bit
hopping code is combined with the button information
and serial numb er to fo rm the code word transm itted to
the receiver. The code word format is explained in
greater detail in Section 8.2.
Transmitter
Serial Number
Key
Generation
Algorithm
HCS512
EEPROM Array
Serial Number
Crypt Key
Sync Counter
Crypt
Key
A receiver may use any type of controller as a decoder,
but it is typically a microcontroller with compatible firmware that allows the decoder to operate in conjunction
with an HCS512 based transmitter. Section 5.0
provides detail on integrating the HCS512 into a system.
A transmitter must first be ‘learned’ by the receiver
before its use is allowed in the system. Learning
includes calculating the transmitter’s appropriate crypt
key, decrypting the received hopping code and storing
the serial number, synchronization counter value and
crypt key in EEPROM.
In normal operation, each received message of valid
format is evaluated. The serial number is used to determine if it is from a learned transmitter. If from a learned
transmitter, the message is decrypted and the synchronization counter is verified. Finally, the button status is
checked to see what operation is requested. Figure 1-3
shows the relationship between some of the values
stored by the receiver and the values received from
the transmitter.
.
.
.
FIGURE 1-2:BUILDING THE TRANSMITTED CODE WORD (ENCODER)
EEPROM Array
Crypt Key
Sync Counter
Serial Number
2002 Microchip Technology Inc.DS40151D-page 3
KEELOQ
Encryption
Algorithm
Button Press
Information
Serial Number
Transmitted Information
Encrypted Data
32 Bits
HCS512
FIGURE 1-3:BASIC OPERATION OF RECEIVER (DECODER)
1
Received Information
Button Press
Information
Serial Number
32 Bits of
Encrypted Data
EEPROM Array
Manufacturer Code
Check for
2
Match
KEELOQ
Decryption
Algorithm
Perform Function
Indicated by
5
button press
NOTE: Circled numbers indicate the order of execution.
Decrypted
Synchronization
Counter
3
Serial Number
Sync Counte r
Crypt Key
Check for
4
Match
2.0PIN ASSIGNMENT
PIN
1LRNIN
2LRNOUTOTTLLearn output - indicates learning
3NC —TTLDo not connect
9S3OTTLSwitch 3
10V
11SLEEPITTLConnect to RFIN to allow wake-up from SLEEP
12CLKI/O
13DATAI/O
14V
15OSCOUT (1MHZ)OTTLOscillator out (test point)
16OSC
17NC——
18RFINITTLRF input from receiver
Note 1: P = power, I = in, O = out, and ST = Schmitt Trigger input.
Decoder
Function
LOWOTTLBattery low indication output
DDP—Power connection
IN (4MHz)ISTOscillator in – recommended values 4.7 kΩ and 22 pF
2: Pin 12 and Pin 13 have a dual purpose. After RESET, these pins are used to determine if Programming
mode is selected in which case they are the clock and data lines. In normal operation, they are the clock
and data lines of the synchronous data output stream.
(1)
I/O
ITTLLearn input - initiates learning, 10K pull-up required on input
ISTMaster clear input
Buffer
Type
TTL/ST
TTL/ST
(1)
(2)
(2)
Description
Clock in Programming mode and Synchronous mode
Data in Programming mode and Synchronous mode
DS40151D-page 4 2002 Microchip Technology Inc.
HCS512
3.0DESCRIPTION OF FUNCTIONS
3.1Parallel Interface
The HCS512 activates the S3, S2, S1 & S0 outputs
when a new valid code is received. The outputs will be
activated for approxi mat ely 50 0 ms. I f a repeated code
is received during this time, the output extends for
approximately 500 ms.
3.2Serial Interface
The decoder has a PWM/Synchronous interface connection to microcontrol lers with l imited I/O. An output
data stream is generated when a valid transmission is
received. The data stream consists of one START bit,
four function bits, one bit for battery status, one bit to
indicate a repeated transmission, two status bits, and
one STOP bit. (Table 3-1). The DA T A and CLK line s are
used to send a synchronous event message.
FIGURE 3-1:DATA OUTPUT FORMAT
STARTS3S2S1S0
FIGURE 3-2:STATUS MESSAGE FORMAT
A special statu s mess age is transmitted on the sec on d
pass of learn. Th is al lows th e cont rollin g mic rocont roller to determine if the learn w as successful (R esult = 1)
and if a previous transmitte r was overwritten (Overwri te
= 1). The status message is shown in Figure 3-2.
Table 3-1 show the values for TX1:0 and th e number of
transmitters learned.
TABLE 3-1:STATUS BITS
TX1TX0Number of Transmitters
00One
01Two
10Three
11Four
VLOW
TX1TX0STOPREPEAT
START0000
A 1-wire PWM or 2-wire synchronous interface can be used.
In 1-wire mode, the data is transmitted as a PWM signal with a basic pulse width of 400 µs.
In 2-wire mode, Synchronou s mode PWM bit s sta rt on the rising edg e of the clock, an d the bits must be sampl ed on the
falling edge. The START bit is a ‘1’ and the STOP bit is ‘0’.
FIGURE 3-2:PWM OUTPUT FORMAT
600 µs
CLK
DATA
S3STARTS2S1S0VLOWRPT Reserved Reserved STOP
1200 µs
(1)
RESUL T
TX1TX0STOPOVRWR
1/31/31/3
LOGIC “1”
LOGIC “0”
1200 µs
Note: The Decoder output PWM format logic (“1” / “0”) is reversed with respe ct of the Encoder modulat ion format.
2002 Microchip Technology Inc.DS40151D-page 5
HCS512
4.0DECODER OPERATION
4.1Learning a Transmitter to a
Receiver
Either the serial number-based learning method or the
seed-based learning method can be selected. The
learning method is s elected in t he config uration byte. In
order for a transmitter to be used with a decoder, the
transmitter must f irst be ‘learn ed’. When a transmitte r is
learned to a decoder, the decoder stores the crypt key,
a check value of the serial number and current synchronization value in EEPROM. The decoder must
keep track of these values for every transmitter that is
learned. The maxim um numbe r of trans mitters that can
be learned is four. The decoder must also contain the
Manufacturer’s Code in order to learn a transmitter.
The Manufacturer’s Code will typically be the same for
all decoders in a system.
The HCS512 has four memory slots. After an “erase
all” procedure, all the memory slots will be cleared.
Erase all is activated by taking LRNIN
mately 10 seconds . When a new transm itter is lea rned,
the decoder searches for an empty memory slot and
stores the transmitter’s informati on in that memory slo t.
When all memory slots are full, the decoder randomly
overwrites existing transmitters.
4.1.1LEARNING PROCEDURE
Learning is activated by taking the LRNIN input low for
longer than 64 ms. Thi s inp ut req uire s an external pullup resistor.
To learn a new transmitter to the HCS512 decoder, the
following sequence is required:
1.Enter Learning mode by pulling LRNIN
longer than 64 ms. The LRNOUT output will go
high.
2.Activate the transmitter until the LRNOUT out-
put goes low indic ating re cepti on of a v alid code
(hopping message).
3.Activate the transmitter a second time until the
LRNOUT toggles for 4 seconds (in Secure
Learning mode, the seed transmission must be
transmitte d dur in g the s eco nd sta ge o f le arn by
activatin g the ap propria te butt ons on t he trans mitter).
If LRNIN
learn status indication, the indication will be terminated. Onc e a succe ssful l earning sequen ce
is detected, the indication can be terminated
allowing quick learning in a manufacturing
setup.
4.The transmitter is no w lea r ned in to t he d ec oder.
5.Repeat steps 1-4 to learn up to four tran smitters.
6.Learning will be terminated if two non-sequential
codes were received or if two acceptable codes
were not decoded within 30 seconds.
is taken low momentarily during the
low for approxi-
low for
The following checks are performed on the decoder to
determine if the transmission is valid during learn:
• The first code word is checked for bit integrit y.
• The second code word is c hec ke d f or b it i nte grit y.
• The hopping code is decrypted.
• If all the checks pass, the serial number and synchronization counters are stored in EEPROM
memory.
Figure 4-1 shows a flow chart of the learn sequence.
FIGURE 4-1:LEARN SEQUENCE
Enter Learn
Mode
Wait for Reception
of a Valid Code
Wait for Reception
of Second
Non-Repeated
V alid Code
Generate Key
from Serial Number
or Seed Value
Use Generated Key
to Decrypt
Compare Discrimination
Value with Serial Number
Equal
?
Yes
Learn successful. Store:
Serial number check value
Synchronization counter
crypt key
Exit
No
Learn
Unsuccessful
DS40151D-page 6 2002 Microchip Technology Inc.
HCS512
4.2Validation of Codes
The decoder waits for a transmission and checks the
serial number to determine if the transmitter has been
learned. If learned, the decoder decryp ts the en crypted
portion of t he t rans mis sio n us ing t he cr ypt k ey. It uses
the discrimination bits to determine if the decryption
was valid. If everything up to this point is valid, the
synchronization value is evaluated.
4.3Validation Steps
Validation consists of the following steps:
• Search EEPROM to find the Serial Number
Check Value Match
• Decrypt the Hopping Code
• Compare the 10 bits of discrimination value with
the lower 10 bits of serial number
• Check if the synchronization counter falls within
the first synchronization window.
• Check if the synchronization counter falls within
the second synchronization window.
• If a valid transmission is found, update the synchronization coun ter , el se use the next t ransmi tter
block and repeat the tests.
FIGURE 4-2:DECODER OPERATION
Start
No
Transmission
Received
?
Yes
No
Decrypt Transmission
No
No
Does
Ser # Check Val
Match
?
Yes
Is
Decryption
Valid
?
Yes
Is
Counter
Within 16
?
No
Is
Counter
Within 32K
?
Yes
Execute
Command
and
Update
Counter
Yes
Save Counter
in Temp Location
2002 Microchip Technology Inc.DS40151D-page 7
HCS512
4.4Synchronization with Decoder
(Evaluating the Counter)
The KEELOQ technology patent scope includes a
sophisticated synchronization technique that does not
require the calculation and s torage of future codes. The
technique sec urely blocks inva lid transmission s while
providing transparent resynchronizat ion to t r ans mi tte rs
inadvertently activated away from the receiver.
Figure 4-3 shows a 3-partition, rotating synchronization
window. The size of each window is optional but the
technique is fundamental. Each time a transmission is
authenticated, the intended function is executed and
the transmission’s synchronization counter value is
stored in EEPROM. From the currently stored counter
value there is an initial "Single Operation" forward window of 16 codes. If the difference between a received
synchronization counter and the last stored counter is
within 16, the intended fun ction wi ll be ex ecuted on the
single button press and the new synchronization
counter will be st ored. Stori ng the new s y nch ron iz atio n
counter value ef fectively rot ates the entire synchronization window.
A "Double Operation" (resynchronization) window further exists from the Si ngle Ope ration wind ow up to 3 2K
codes forward of the currently stored counter value. It
is referred to as "Double Operation" because a transmission with synchronization counter value in this window will require an additional, sequential counter
transmissi on prior to execut ing the intended function.
Upon receiving the sequential transmission the
decoder executes the intended function and stores the
synchroniz ation co unter va lue. Th is resy nchroniz ation
occurs transparently to the user as it is human nature
to press the button a second t ime if the first was un successful.
The third window is a "Blocked Window" ranging from
the double operation window to the currently stored
synchroniz ation counter value. An y transmission with
synchronization counter value within this window will
be ignored. This window excludes previously used,
perhaps code-grabbed transmissions from accessing
the system.
Note:The synchronization method described in
this section is only a typic al implement ation
and because it is usually implemented in
firmware, it can be altered to fit the needs
of a particular system.
FIGURE 4-3:SYNCHRONIZATION WINDOW
Entire Window
rotates to eliminate
use of previously
used codes
Blocked
Window
(32K Codes)
Double Operation
(resynchronization)
Window
(32K Codes)
4.5SLEEP Mode
The SLEEP mode of the HCS512 is used to reduce
current consumption when no RF input signal is
present. SLEEP mode will only be effective in systems
where the RF re ceiver is relat ively q uiet when no si gnal
is present. During SLEEP, the clock stops, thereby significantly reducing the operating current. SLEEP mode
is enabled by the SLEEP bit in the configuration byte.
The HCS512 will enter SLEEP mode when:
• The RF line is low
• After a function output is switched off
• Learn mode is terminated (time-out reached)
Stored
Synchronization
Counter Value
Single Operation
Window
(16 Codes)
The device will not enter SLEEP mode when:
• A function output is active
• Learn sequence active
• Device is in Programming mode
The device will wake-up from SLEEP when:
• The SLEEP input pin changes state
• The CLOCK line changes state
Note:During SLEEP mode the CLK line will
change from an output line to an input line
that can be used to wake-up the device.
Connect CLK to
to reliably enter the Learn mode whenever
SLEEP mode is active.
LRNIN via a 100K resistor
DS40151D-page 8 2002 Microchip Technology Inc.
Loading...
+ 18 hidden pages
You need points to download manuals.
1 point = 1 manual.
You can buy points or you can get point for every manual you upload.