Microchip Technology Inc HCS512T-I-SN, HCS512T-I-P, HCS512-I-SN, HCS512-I-P Datasheet
1997 Microchip Technology Inc. DS40151C-page 1
M
HCS512
FEATURES
Security
• Secure storage of Manufacturer’s Code
• Secure storage of transmitter’s keys
• Up to four transmitters can be learned
•K
EE
L
OQ
code hopping technology
• Normal and secure learning mechanisms
Operating
• 3.0V – 6.0V operation
• 4 MHz RC oscillator
• Learning indication on LRNOUT
• Auto baud rate detection
• Power saving sleep mode
Other
• Stand alone decoder
• On-chip EEPROM for transmitter storage
• Four binary function outputs–15 functions
• 18-pin DIP/SOIC package
Typical Applications
• Automotive remote entry systems
• Automotive alarm systems
• Automotive immobilizers
• Gate and garage openers
• Electronic door locks
• Identity tokens
• Burglar alarm systems
Compatible Encoders
• HCS200, HCS300, HCS301, HCS360, HCS361
• NTQ106
DESCRIPTION
The Microchip Technology Inc. HCS512 is a code hopping decoder designed for secure Remote Keyless
Entry (RKE) systems. The HCS512 utilizes the patented K
EE
L
OQ
code hopping system and high security
learning mechanisms to make this a canned solution
when used with the HCS encoders to implement a unidirectional remote keyless entry system.
PACKA GE TYPE
BLOCK DIAGRAM
The Manufacturer’s Code, transmitter keys, and synchronization information are stored in protected on-chip
EEPROM. The HCS512 uses the D ATA and CLK inputs
to load the Manufacturer’s Code which cannot be read
out of the device.
The HCS512 operates over a wide voltage range of
3.0 volts to 6.0 volts. The decoder employs automatic
baud rate detection which allows it to compensate for
wide variations in transmitter data rate. The decoder
contains sophisticated error checking algorithms to
ensure only valid codes are accepted.
HCS512
PDIP, SOIC
1
2
3
4
5
6
7
8
9
LRNIN
LRNOUT
NC
MCLR
GND
S0
S1
S2
S3
18
17
16
15
14
13
12
11
10
RFIN
NC
OSCIN
OSCOUT
VDD
DATA
CLK
SLEEP
VLOW
S0 S1 S3S2VLOW
67-Bit Reception Register
EEPROM CONTROL
DECRYPTOR
OUTPUT
SEL
RFIN
OSCILLATOR
OSCIN
CONTROL
LRNOUT
DATA
CLK
LRNIN
MCLR
SLEEP
Code Hopping Decoder
HCS512
DS40151C-page 2
1997 Microchip Technology Inc.
1.0 K
EE
L
OQ
SYSTEM OVERVIEW
1.1 K
ey Terms
• Man
ufacturer’s Code – a 64-bit word, unique to
each manufacturer, used to produce a unique
encoder key in each transmitter (encoder).
• Encoder K
ey – a 64-bit key, unique for each transmitter. The encoder key controls the decryption
algorithm and is stored in EEPROM on the
decoder device.
• Lear
n – The receiver uses information that is
transmitted to derive the transmitter’s secret key,
decrypt the discrimination value and the synchronization counter in learning mode. The encoder
key is a function of the Manufacturer’s Code and
the device serial number and/or seed value.
The HCS encoders and decoders employ the K
EE
L
OQ
code hopping technology and an encryption algorithm
to achieve a high level of security. Code hopping is a
method by which the code transmitted from the transmitter to the receiver is different every time a button is
pushed. This method, coupled with a transmission
length of 66 bits, virtually eliminates the use of code
‘grabbing’ or code ‘scanning’.
1.2 HCS Encoder Over
view
The HCS encoders have a small EEPROM array which
must be loaded with several parameters before use.
The most important of these values are:
• A 28-bit serial number which is meant to be
unique for every encoder
• An encoder key that is generated at the time of
production
• A 16-bit synchronization value
The serial number for each encoder is programmed by
the manufacturer at the time of production. The
generation of the encoder key is done using a ke y generation algorithm (Figure 1-1). Typically, inputs to the
key generation algorithm are the serial number of the
encoder and a 64-bit manufacturer’s code. The manufacturer’s code is chosen by the system manufacturer
and must be carefully controlled. The manufacturer’s
code is a pivotal part of the overall system security.
FIGURE 1-1: CREATION AND STORAGE OF ENCODER KEY DURING PRODUCTION
Transmitter
Manufacturer’s
Serial Number or
Code
Encoder
Key
Key
Generation
Algorithm
Serial Number
Encoder Key
Sync Counter
.
.
.
HCSXXX EEPROM Array
Seed
HCS512
1997 Microchip Technology Inc. DS40151C-page 3
The 16-bit synchronization value is the basis for the
transmitted code changing for each transmission and is
updated each time a button is pressed. Because of the
complexity of the code hopping encryption algorithm, a
change in one bit of the synchronization value will result
in a large change in the actual transmitted code. There
is a relationship (Figure 1-3) between the key values in
EEPROM and how they are used in the encoder . Once
the encoder detects that a button has been pressed,
the encoder reads the button and updates the synchronization counter. The synchronization value is then
combined with the encoder key in the encryption algorithm, and the output is 32 bits of encrypted information.
This data will change with every button press, hence , it
is referred to as the hopping portion of the code word.
The 32-bit hopping code is combined with the button
information and the serial number to form the code
word transmitted to the receiver.
1.3 HCS Decoder Over
view
Before a transmitter can be used with a particular
receiver, the transmitter must be ‘learned’ by the
receiver. Upon learning a transmitter, information is
stored by the receiver so that it may track the
transmitter, including the serial number of the
transmitter, the current synchronization value for that
transmitter, and the same encoder key that is used on
the transmitter. If a receiv er receives a message of v alid
format, the serial number is checked and, if it is from a
learned transmitter, the message is decrypted and the
decrypted synchronization counter is checked against
what is stored. If the synchronization value is verified,
then the button status is checked to see what operation
is needed. Figure 1-3 shows the relationship between
some of the values stored by the receiver and the values received from the transmitter.
FIGURE 1-2: BASIC OPERATION OF TRANSMITTER (ENCODER)
FIGURE 1-3: BASIC OPERATION OF RECEIVER (DECODER)
KEELOQ
Algorithm
Button Press
Information
Encryption
EEPROM Array
32 Bits of
Encrypted Data
Serial Number
Transmitted Information
Encoder Key
Sync Counter
Serial Number
Button Press
Information
EEPROM Array
Encoder Key
32-Bits of
Encrypted Data
Serial Number
Received Information
Decrypted
Synchronization
Counter
Check for
Match
Check for
Match
KEELOQ
Algorithm
Decryption
Sync Counter
Serial Number
Manufacturer’s Code
HCS512
DS40151C-page 4
1997 Microchip Technology Inc.
2.0 PIN ASSIGNMENT
PIN
Decoder
Function
I/O
(1)
Buffer
Type
(1)
Description
1 LRNIN
I TTL Learn input - initiates learning, 10K pull-up required on input
2 LRNOUT O TTL Learn output - indicates learning
3 NC — TTL Do not connect
4 MCLR
I ST Master clear input
5 Ground P — Ground connection
6 S0 O TTL Switch 0
7 S1 O TTL Switch 1
8 S2 O TTL Switch 2
9 S3 O TTL Switch 3
10 Vlow O TTL Battery low indication output
11 SLEEP I TTL Connect to RFIN to allow wake-up from sleep
12 CLK I/O
TTL/ST
(2)
Clock in programming mode and synchronous mode
13 DATA I/O
TTL/ST
(2)
Data in programming mode and synchronous mode
14 V
DD
P — Power connection
15 OSC
OUT
— — Oscillator out – no connection
16 OSC
IN
(4 MHz) I ST Oscillator in – recommended values 10 k Ω and 10pF
17 NC — —
18 RFIN I TTL RF input from receiver
Note 1: P = power, I = in, O = out, and ST = Schmitt Trigger input.
2:
Pin 12 and Pin 13 have a dual purpose. After reset, these pins are used to determine if programming mode
is selected in which case they are the clock and data lines. In normal operation, they are the clock and data
lines of the synchronous data output stream.
HCS512
1997 Microchip Technology Inc. DS40151C-page 5
3.0 DESCRIPTION OF FUNCTIONS
3.1 P
arallel Interface
The HCS512 activates the S3, S2, S1 & S0 outputs
according to Table 3-1 when a new valid code is
received. The outputs will be activated for approximately 500 ms. If a repeated code is received during
this time, the output extends f or approximately 500 ms.
TABLE 3-1: FUNCTION OUTPUT TABLE
3.2 Serial Interface
The decoder has a PWM/Synchronous interface connection to microcontrollers with limited I/O. An output
data stream is generated when a valid transmission is
received. The data stream consists of one start bit, four
function bits, one bit for battery status, one bit to indicate a repeated transmission, two status bits, and one
stop bit. (Table 3-1). The DATA and CLK lines are used
to send a synchronous event message.
A special status message is transmitted on the second
pass of learn. This allows the controlling microcontroller
to determine if the learn was successful (Result = 1)
and if a previous transmitter was ov erwritten (Overwrite
= 1). The status message is shown in Figure 3-2.
Table 3-2 show the values for TX1:0 and the n umber of
transmitters learned.
TABLE 3-2: STATUS BITS
FIGURE 3-1: DATA OUTPUT FORMAT
FIGURE 3-2: STATUS MESSAGE FORMAT
A 1-wire PWM or 2-wire synchronous interface can be used.
In 1-wire mode, the data is transmitted as a PWM signal with a basic pulse width of 400 µ s.
In 2-wire mode, synchronous mode PWM bits start on the rising edge of the clock, and the bits must be sampled on the
falling edge. The start and stop bits are ‘1’.
FIGURE 3-3: PWM TRANSMISSION FORMAT
Function
Code
S3 S2 S1 S0
0001 0 0 0 1
0010 0 0 1 0
0011 0 0 1 1
0100 0 1 0 0
0101 0 1 0 1
0110 0 1 1 0
0111 0 1 1 1
1000 1 0 0 0
1001 1 0 0 1
1010 1 0 1 0
1011 1 0 1 1
1100 1 1 0 0
1101 1 1 0 1
1110 1 1 1 0
1111 1 1 1 1
TX1 TX0 Number of Transmitters
0 0 One
0 1 Two
1 0 Three
1 1 Four
START S3 S2 S1 S0
V
LOW
TX1 TX0 STOPREPEAT
START 0 0 0 0
RESULT
TX1 TX0 STOPOVRWR
S3Start S2 S1 S0 VLOW RPT ReservedReserved Stop
1200µs
CLK
DATA
“1” “0”
600µs
HCS512
DS40151C-page 6
1997 Microchip Technology Inc.
4.0 DECODER OPERATION
4.1 Learning a
Transmitter to a Receiver
Either the serial number-based learning method or the
seed-based learning method can be selected. The
learning method is selected in the configuration byte. In
order for a transmitter to be used with a decoder, the
transmitter must first be ‘learned’. When a transmitter is
learned to a decoder, the decoder stores the encoder
key, a check value of the serial number and current synchronization value in EEPROM. The decoder must
keep track of these values for every transmitter that is
learned. The maximum number of transmitters that can
be learned is four. The decoder must also contain the
Manufacturer’s Code in order to learn a transmitter. The
Manufacturer’ s Code will typically be the same for all
decoders in a system.
The HCS512 has f our memory slots. After an “erase all”
procedure, all the memory slots will be cleared. Erase
all is activated by taking LRNIN
low for approximately
10 seconds. When a new transmitter is learned, the
decoder searches for an empty memory slot and stores
the transmitter’s information in that memory slot. When
all memory slots are full, the decoder randomly overwrites existing transmitters.
4.1.1 LEARNING PROCEDURE
Learning is activated by taking the LRNIN
input low for
longer than 64 ms. This input requires an external pullup resistor.
To learn a new transmitter to the HCS512 decoder, the
following sequence is required:
1. Enter learning mode by pulling LRNIN low for
longer than 64 ms. The LRNOUT output will go
high.
2. Activate the transmitter until the LRNOUT output
goes low indicating reception of a valid code
(hopping message).
3. Activate the transmitter a second time until the
LRNOUT toggles for 4 seconds (in secure learning mode, the seed transmission must be transmitted during the second stage of learn by
activating the appropriate buttons on the transmitter).
If LRNIN
is taken low momentarily during the
learn status indication, the indication will be terminated. Once a successful learning sequence
is detected, the indication can be terminated
allowing quick learning in a manufacturing setup.
4. The transmitter is now learned into the decoder.
5. Repeat steps 1-4 to learn up to four transmitters.
6. Learning will be terminated if two non-sequential
codes were received or if two acceptable codes
were not decoded within 30 seconds.
The following checks are performed on the decoder to
determine if the transmission is valid during learn:
• The first code word is checked for bit integrity.
• The second code word is checked for bit integrity.
• The hopping code is decrypted.
• If all the checks pass, the serial number and synchronization counters are stored in EEPROM
memory.
Figure 4-1 shows a flow chart of the learn sequence.
FIGURE 4-1: LEARN SEQUENCE
4.2 V
alidation of Codes
The decoder waits for a transmission and checks the
serial number to determine if the transmitter has been
learned. If learned, the decoder decrypts the encrypted
portion of the transmission using the encoder key. It
uses the discrimination bits to determine if the decryption was valid. If everything up to this point is valid, the
synchronization value is evaluated.
Enter Learn
Mode
Wait for Reception
of Second
Compare Discrimination
Value with Serial Number
Use Generated Key
to Decrypt
Equal
Serial number check value
Synchronization counter
?
Exit
Learn successful. Store:
Learn
Unsuccessful
No
Yes
Wait for Reception
of a Valid Code
Non-Repeated
Valid Code
Generate Key
from Serial Number
or Seed Value
Encoder Key
Loading...