View HCS500-ISM_208760.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

M
FEATURES
Security
* * * * * Encrypted storage of manufacturer's code Encrypted storage of encoder keys Up to seven transmitters can be learned KEELOQ code hopping technology Normal and secure learning mechanisms
HCS500
Code Hopping Decoder
PACKAGE TYPE
PDIP, SOIC VDD EE_CLK EE_DAT MCLR 1 HCS500 2 3 4 8 7 6 5 VSS RFIN S_CLK S_DAT
Operating
* 3.0V--5.5V operation * Internal oscillator * Auto bit rate detection
BLOCK DIAGRAM
RFIN 67-bit Reception Register DECRYPTOR EE_DAT External EEPROM CONTROL EE_CLK S_DAT S_CLK
Other
* * * * * Stand-alone decoder chipset External EEPROM for transmitter storage Synchronous serial interface 1 Kbit user EEPROM 8-pin DIP/SOIC package
Typical Applications
* * * * * * * Automotive remote entry systems Automotive alarm systems Automotive immobilizers Gate and garage openers Electronic door locks Identity tokens Burglar alarm systems
OSCILLATOR
MCLR
The manufacturer's code, encoder keys, and synchronization information are stored in encrypted form in external EEPROM. The HCS500 uses the S_DAT and S_CLK inputs to communicate with a host controller device. The HCS500 operates over a wide voltage range of 3.0 volts to 5.5 volts. The decoder employs automatic bit-rate detection, which allows it to compensate for wide variations in transmitter data rate. The decoder contains sophisticated error checking algorithms to ensure only valid codes are accepted.
Compatible Encoders
* HCS200, HCS300, HCS301, HCS360, HCS410 (PWM Mode)
DESCRIPTION
The Microchip Technology Inc. HCS500 is a code hopping decoder designed for secure Remote Keyless Entry (RKE) systems. The HCS500 utilizes the patented KEELOQ code hopping system and high security learning mechanisms to make this a canned solution when used with the HCS encoders to implement a unidirectional remote and access control systems. The HCS500 can be used as a stand-alone decoder or in conjunction with a microcontroller.
KEELOQ is a registered trademark of Microchip Technology Inc. *Code hopping patents issued in Europe, U.S.A; and R.S.--US:5,517,187; Europe: 0459781
(c) 1997 Microchip Technology Inc.
Preliminary
DS40153B-page 1
HCS500
1.0
1.1
KEELOQ SYSTEM OVERVIEW
Key Terms
1.2
HCS Encoder Overview
* Manufacturer's Code - A 64-bit word, unique to each manufacturer, used to produce a unique encoder key in each transmitter. * Encoder Key - A 64-bit key, unique for each transmitter. The encoder key controls the KeeLoq decryption algorithm and is stored in EEPROM on the decoder device. * Learn - The receiver uses information that is transmitted to derive the transmitter's encoder key, decrypt the discrimination value, and the synchronization counter in learning mode. The encoder key is a function of the manufacturer's code and the device serial number and/or seed value. The HCS encoders and decoders employ the KeeLoq code hopping technology and a KeeLoq encryption algorithm to achieve a high level of security. Code hopping is a method by which the code transmitted from the transmitter to the receiver is different every time a button is pushed. This method, coupled with a transmission length of 66 bits, virtually eliminates the use of code `grabbing' or code `scanning'.
The HCS encoders have a small EEPROM array which must be loaded with several parameters before use. The most important of these values are: * An encoder key that is generated at the time of production * A 16-bit synchronization counter value * A 28-bit serial number which is meant to be unique for every encoder The manufacturer programs the serial number for each encoder at the time of production, while the `Key Generation Algorithm' generates the encoder key (Figure 11). Inputs to the key generation algorithm typically consist of the encoder's serial number and a 64-bit manufacturer's code, which the manufacturer creates. Note: The manufacturer code is a pivotal part of the system's overall security. Consequently, all possible precautions must be taken and maintained for this code.
FIGURE 1-1:
CREATION AND STORAGE OF ENCRYPTION KEY DURING PRODUCTION
Transmitter Serial Number or Seed HCS500 EEPROM Array
Serial Number Encryption Key Sync Counter
Manufacturer's Code
Key Generation Algorithm
Encryption Key
. . .
DS40153B-page 2
Preliminary
(c) 1997 Microchip Technology Inc.
HCS500
The 16-bit synchronization counter is the basis for the transmitted code changing for each transmission and is updated each time a button is pressed. Because of the complexity of the KEELOQ encryption algorithm, a change in one bit of the synchronization counter value will result in a large change in the actual transmitted code. There is a relationship (Figure 1-2) between the encoder key values in EEPROM and how they are used in the encoder. Once the encoder detects that a button has been pressed, the encoder reads the button and updates the synchronization counter. The synchronization value is then combined with the encoder key in the KEELOQ encryption algorithm, and the output is 32 bits of encrypted information. This data will change with every button press, hence, it is referred to as the code hopping portion of the code word. The 32-bit code hopping portion is combined with the button information and the serial number to form the code word transmitted to the receiver.
1.3
HCS Decoder Overview
Before a transmitter and receiver can work together, the receiver must first `learn' and store certain information from the transmitter. This information includes a `check value' of the serial number, the encoder key, and current synchronization counter value. When a validly formatted message is detected, the receiver first compares the serial number. If the serial number check value is from a learned transmitter, the message is decrypted. Next, the receiver checks the decrypted synchronization counter value against what is stored in memory. If the synchronization counter value is verified, then a valid transmission message is sent. Figure 1-3 shows the relationship between some of the values stored by the receiver and the values received from the transmitter.
FIGURE 1-2:
BASIC OPERATION OF A CODE HOPPING TRANSMITTER (ENCODER)
Transmitted Information KEELOQ Encryption Algorithm 32 Bits of Encrypted Data Button Press Information
Serial Number
EEPROM Array Encoder Key Sync. Counter Value Serial Number
FIGURE 1-3:
BASIC OPERATION OF A CODE HOPPING RECEIVER (DECODER)
Check for Match EEPROM Array Encoder Key Sync. Counter Value Serial Number Manufacturer Code Check for Match KEELOQ Decryption Algorithm Decrypted Synchronization Counter
Button Press Information
Serial Number
32 Bits of Encrypted Data
Received Information
(c) 1997 Microchip Technology Inc.
Preliminary
DS40153B-page 3
HCS500
2.0
PIN 1 2 3 4 5 6 7 8
PIN ASSIGNMENT
Decoder Function VDD EE_CLK EE_DAT MCLR S_DAT S_CLK RFIN GND I/O(1) P O I/O I I/O I I P Buffer Type(1) -- TTL TTL ST TTL TTL TTL -- Power Connection Clock to I 2CTM EEPROM Data to I 2C EEPROM Master clear input Synchronous data from controller Synchronous clock from controller RF input from receiver Ground connection Description
Note: P = power, I = in, O = out, and ST = Schmitt Trigger input.
I2C is a trademark of Philips Corporation.
DS40153B-page 4
Preliminary
(c) 1997 Microchip Technology Inc.
HCS500
3.0
3.1
DECODER OPERATION
Learning a Transmitter to a Receiver (Normal or Secure Learn)
Before the transmitter and receiver can work together, the receiver must first `learn' and store the following information from the transmitter in EEPROM: * A check value of the serial number * The encoder key * The current synchronization counter value The decoder must also store the manufacturer's code (Section 1.2) in protected memory. This code will typically be the same for all of the decoders in a system. The HCS500 has seven memory slots, and, consequently, can store up to seven transmitters. During the learn procedure, the decoder searches for an empty memory slot for storing the transmitter's information. When all of the memory slots are full, the decoder will overwrite the last transmitter's information. To erase all of the memory slots at once, use the ERASE_ALL command (C3H). 3.1.1 LEARNING PROCEDURE
3: Learning a transmitter with an encoder key that is identical to a transmitter already in memory replaces the existing transmitter. In practice, this means that all transmitters should have unique encoder keys. Learning a previously learned transmitter does not use any additional memory slots. The following checks are performed by the decoder to determine if the transmission is valid during learn: * The first code word is checked for bit integrity. * The second code word is checked for bit integrity. * The encoder key is generated according to the selected algorithm. * The hopping code is decrypted. * The discrimination value is checked. * If all the checks pass, the key, serial number check value, and synchronization counter values are stored in EEPROM memory. Figure 3-1 shows a flow chart of the learn sequence.
FIGURE 3-1:
LEARN SEQUENCE
Learning is initiated by sending the ACTIVATE_LEARN (D2H) command to the decoder. The decoder acknowledges reception of the command by pulling the data line high. For the HCS500 decoder to learn a new transmitter, the following sequence is required: 1. 2. Activate the transmitter once. Activate the transmitter a second time. (In secure learning mode, the seed transmission must be transmitted during the second stage of learn by activating the appropriate buttons on the transmitter.) The HCS500 will transmit a learn-status string, indicating that the learn was successful. The decoder has now learned the transmitter. Repeat steps 1-3 to learn up to seven transmitters Note 1: Learning will be terminated if two nonsequential codes were received or if two acceptable codes were not decoded within 30 seconds. 2: If more than seven transmitters are learned, the new transmitter will replace the last transmitter learned. It is, therefore, not possible to erase lost transmitters by repeatedly learning new transmitters. To remove lost or stolen transmitters, ERASE_ALL transmitters and relearn all available transmitters.
Enter Learn Mode Wait for Reception of a Valid Code Wait for Reception of Second Non-Repeated Valid Code Generate Key from Serial Number/ Seed Value Use Generated Key to Decrypt Compare Discrimination Value with Serial Number
3. 4.
Equal?
No
Yes Learn successful. Store: Serial number check value Encoder key Sync. counter value Exit
Learn Unsuccessful
(c) 1997 Microchip Technology Inc.
Preliminary
DS40153B-page 5
HCS500
3.2 Validation of Codes 3.4 Synchronization with Decoder
The decoder waits for a transmission and checks the serial number to determine if it is a learned transmitter. If it is, it takes the code hopping portion of the transmission and decrypts it, using the encoder key. It uses the discrimination value to determine if the decryption was valid. If everything up to this point is valid, the synchronization counter value is evaluated. The KEELOQ technology features a sophisticated synchronization technique (Figure 3-3) which does not require the calculation and storage of future codes. If the stored synchronization counter value for that particular transmitter and the synchronization counter value that was just decrypted are within a formatted window of 16, the counter is stored, and the command is executed. If the synchronization counter value was not within the single operation window, but is within the double operation window of the 16K window, the transmitted synchronization counter value is stored in a temporary location, and the decoder goes back to waiting for another transmission. When the next valid transmission is received, it will check the new synchronization counter value with the one in temporary storage. If the two values are sequential, it is assumed that the counter had just gotten out of the single operation `window', but is now back in synchronization, so the new synchronization counter value is stored, and the command is executed. If a transmitter has somehow gotten out of the double operation window, the transmitter will not work and must be relearned. Since the entire window rotates after each valid transmission, codes that have been used become part of the `blocked' (48K) codes and are no longer valid. This eliminates the possibility of grabbing a previous code and retransmitting to gain entry.
3.3
Validation Steps
Validation consists of the following steps: 1. 2. 3. 4. 5. 6. Search EEPROM to find the Serial Number Check Value Match Decrypt the Hopping Code Compare the 10 bits of the discrimination value with the lower 10 bits of serial number Check if the synchronization counter value falls within the first synchronization window. Check if the synchronization counter value falls within the second synchronization window. If a valid transmission is found, update the synchronization counter, else use the next transmitter block, and repeat the tests.
FIGURE 3-2:
DECODER OPERATION
Start
FIGURE 3-3:
No Transmission Received? Yes No Does Ser # Check Val Match?
SYNCHRONIZATION WINDOW
Entire Window rotates to eliminate use of previously used codes Blocked (48K Codes)
Yes Decrypt Transmission Is decryption valid? Yes Is Yes counter within 16? No Is No counter within 16K? Yes Save Counter in Temp Location Execute Command and Update Counter Double Operation (16K Codes)
Current Position
No
Single Operation Window (16 Codes)
DS40153B-page 6
Preliminary
(c) 1997 Microchip Technology Inc.
HCS500
4.0 INTERFACING TO A MICROCONTROLLER
4.1 Valid Transmission Message
The decoder informs the microcontroller of a valid transmission by taking the data line high for up to 500 ms. The controlling microcontroller must acknowledge by taking the clock line high. The decoder then takes the data line low. The microcontroller can then begin clocking a data stream out of the HCS500. The data stream consists of: * * * * * Start bit `0'. 2 status bits [REPEAT, VLOW]. 4-bit function code [S3 S2 S1 S0]. Stop bit `1'. 4 bits indicating which block was used [TX3...TX0]. * 4 bits indicating the number of transmitters learned into the decoder [CNT3...CNT0]. * 64 bits of the received transmission with the hopping code decrypted. Note: Data is always clocked in/out Least Significant Bit (LSB) first.
The HCS500 interfaces to a microcontroller via a synchronous serial interface. A clock and data line are used to communicate with the HCS500. The microcontroller controls the clock line. There are two groups of data transfer messages. The first is from the decoder whenever the decoder receives a valid transmission. The decoder signals reception of a valid code by taking the data line high (maximum of 500 ms) The microcontroller then services the request by clocking out a data string from the decoder. The data string contains the function code, the status bit, and block indicators. The second is from the controlling microcontroller to the decoder in the form of a defined command set. Figure 4-1 shows the HCS500 decoder and the I/O interface lines necessary to interface to a microcontroller.
The decoder will terminate the transmission of the data stream at any point where the clock is kept low for longer than 1 ms.Therefore, the microcontroller can only clock out the required bits. A maximum of 80 bits can be clocked out of the decoder.
FIGURE 4-1:
HCS500 DECODER AND I/O INTERFACE LINES
VDD RF RECEIVER 1K
1 2 3 4
A0 A1 A2 Vss 24LC02
Vcc WP SCL SD
8 7 6 5
1 2 3 4
VDD EE_CLK EE_DAT MCLR
Vss RFIN S_CLK S_DAT
8 7 6 5
SYNC CLOCK
SYNC DATA
HCS500
MICRO RESET
FIGURE 4-2:
DECODER VALID TRANSMISSION MESSAGE
TPP1 TPP3 TCLKL TCLKH TDS
S_CLK TCLKH
TCLA TDHI S_DAT
0
REPT VLOW S0
S1
S2
S3
1
CNT0
CNT3 TX0
TX3
RX0
RX1
RX62 RX63
Decoder Signal Valid Transmission A B
Information Ci
Received String Cii
(c) 1997 Microchip Technology Inc.
Preliminary
DS40153B-page 7
HCS500
4.2
4.2.1
Command Mode
MICROCONTROLLER COMMAND MODE ACTIVATION
4.2.2
COLLISION DETECTION
The microcontroller command consists of four parts. The first part activates the command mode, the second part is the actual command, the third is the address accessed, and the last part is the data. The microcontroller starts the command by taking the clock line high for up to 500 ms. The decoder acknowledges the startup sequence by taking the data line high. The microcontroller takes the clock line low, after which the decoder will take the data line low, tri-state the data line and wait for the command to be clock in. The data must be set up on the rising edge and will be sampled on the falling edge of the clock line.
The HCS500 uses collision detection to prevent clashes between the decoder and microcontroller. Whenever the decoder receives a valid transmission the following sequence is followed: * The decoder first checks to see if the clock line is high. If the clock line is high, the valid transmission notification is aborted, and the microcontroller command mode request is serviced. * The decoder takes the data line high and checks that the clock line doesn't go high within 50 s. If the clock line goes high, the valid transmission notification is aborted and the command mode request is serviced. * If the clock line goes high after 50 s but before 500 ms, the decoder will acknowledge by taking the data line low. * The microcontroller can then start to clock out the 80-bit data stream of the received transmission.
FIGURE 4-3:
MICROCONTROLLER COMMAND MODE ACTIVATION
TCLKL TREQ TSTART TCLKH TCMD TDS TADDR TDATA
CLK
C Data TACK TRESP
LSB
MSB
LSB
MSB
LSB
MSB
HCS500 Data
Start Command A B Command Byte C Address Byte D Data Byte E
DS40153B-page 8
Preliminary
(c) 1997 Microchip Technology Inc.
HCS500
4.2.3 COMMAND ACTIVATION TIMES 4.2.4 DECODER COMMANDS The command activation time (Table 4-1) is defined as the maximum time the microcontroller has to wait for a response from the decoder. The decoder will abort and service the command request. The response time depends on the state of the decoder when the command mode is requested. The command byte specifies the operation required by the controlling microcontroller. Table 4-2 lists the commands.
TABLE 4-1:
COMMAND ACTIVATION TIMES
Decoder State Min -- -- -- -- 3 ms 40 ms 170 ms Max 2 1/2 BPWMAX = 2.7 ms
While receiving transmissions During the validation of a received transmission During the update of the sync counters During learn
TABLE 4-2:
READ WRITE ACTIVATE_LRN ERASE_ALL PROGRAM
DECODER COMMANDS
Command Byte F016 E116 D216 C316 B416 Operation Read a byte from user EEPROM Write a byte to user EEPROM Activate a learn sequence on the decoder Activate an erase all function on the decoder Program manufacturer's code and configuration byte
Instruction
(c) 1997 Microchip Technology Inc.
Preliminary
DS40153B-page 9
HCS500
4.2.5 READ BYTE/S FROM USER EEPROM 4.2.6 WRITE BYTE/S TO USER EEPROM The read command (Figure 4-4) is used to read bytes from the user EEPROM. The offset in the user EEPROM is specified by the address byte which is truncated to seven bits (C to D). After the address, a dummy byte must be clocked in (D to E). The EEPROM data byte is clocked out on the next rising edge of the clock line with the least significant bit first (E to F). Sequential reads are possible by repeating sequence E to F within 1 ms after the falling edge of the previous byte's Most Significant Bit (MSB) bit. During the sequential read, the address value will wrap after 128 bytes. The decoder will terminate the read command if no clock pulses are received for a period longer than 1.2 ms. The write command (Figure 4-5) is used to write a location in the user EEPROM. The address byte is truncated to seven bits (C to D). The data is clocked in least significant bit first. The clock line must be asserted to initiate the write. Sequential writes of bytes are possible by clocking in the byte and then asserting the clock line (D - F). The decoder will terminate the write command if no clock pulses are received for a period longer than 1.2 ms After a successful write sequence the decoder will acknowledge by taking the data line high and keeping it high until the clock line goes low.
FIGURE 4-4:
READ BYTES FROM USER EEPROM
TRD TRD
CLK C DATA LSB MSB LSB MSB LSB MSB LSB Start Command A B Command Byte C Address Byte D Dummy Byte E MSB Data Byte F
Decoder DATA
FIGURE 4-5:
WRITE BYTES TO USER EEPROM
TWR TACK TRESP
CLK C DATA LSB MSB LSB MSB LSB MSB
TACK2
Decoder DATA Start Command A B Command Byte C Address Byte D Data Byte E Acknowledge F
DS40153B-page 10
Preliminary
(c) 1997 Microchip Technology Inc.
HCS500
4.2.7 ACTIVATE LEARN The activate learn command (Figure 4-6) is used to activate a transmitter learning sequence on the decoder. The command consists of a command mode activation sequence, a command byte, and two dummy bytes. The decoder will respond by taking the data line high to acknowledge that the command was valid and that learn is active. Upon reception of the first transmission, the decoder will respond with a learn status message (Figure 4-7). During learn, the decoder will acknowledge the reception of the first transmission by taking the data line high for 60 ms. The controlling microcontroller can clock out at most eight bits, which will all be zeros. All of the bits of the status byte are zero, and this is used to distinguish between a learn time-out status string and the first transmission received string. The controlling microcontroller must ensure that the clock line does not go high 60 ms after the falling edge of the data line, for this will terminate learn. Upon reception of the second transmission, the decoder will respond with a learn status message (Figure 4-8). The learn status message after the second transmission consists of the following: * 1 start bit. * The function code [S3:S0] of the message is zero, indicating that this is a status string. * The RESULT bit indicates the result of the learn sequence. The RESULT bit is set if successful and cleared otherwise. * The OVR bit will indicate whether an exiting transmitter is over written. The OVR bit will be set if an existing transmitter is learned over. * The [CNT3...CNT0] bits will indicate the number of transmitters learned on the decoder. * The [TX3...TX0] bits indicate the block number used during the learning of the transmitter.
FIGURE 4-6:
LEARN MODE ACTIVATION
TLRN TACK TRESP
CLK C DATA LSB MSB LSB MSB LSB MSB
TACK2
Decoder DATA Start Command A B Command Byte C Dummy Byte D Dummy Byte E Acknowledge F
FIGURE 4-7:
LEARN STATUS MESSAGE AFTER FIRST TRANSMISSION
TCA CLK TCLH TCLA TDHI Decoder Data
0 0 0 0 0 0 0 0
TCLL
TCLKL TCLKH TDS
Command Request A B
Status Byte C
FIGURE 4-8:
LEARN STATUS MESSAGE AFTER SECOND TRANSMISSION
TCA TCLL TCLKL TCLKH TDS
CLK TCLA TDHI Decoder Data Communications Request 0 OVR RSLT 0 0 0 0 1 CNT0 CNT3 TX0 TX3 RX0 RX1 RX62 RX63 TCLH
Learn Status Bits
Decoded Tx
A
B
Ci
Cii
(c) 1997 Microchip Technology Inc.
Preliminary
DS40153B-page 11
HCS500
4.2.8 ERASE ALL The erase all command (Figure 4-9) erases all the transmitters in the decoder. After the command and two dummy bytes are clocked in, the clock line must be asserted to activate the command. After a successful completion of an erase all command, the data line is asserted until the clock line goes low. Subcommand 01 can be used where a transmitter with permanent status is implemented in the microcontroller software. Use of subcommand 01 ensures that the permanent transmitter remains in memory even when all other transmitters are erased. The first transmitter learned after any of the following events is the first transmitter in memory and becomes the permanent transmitter: 1. 2. Programming of the manufacturer's code. Erasing of all transmitters (subcommand 00 only).
4.3
Stand-alone Mode
The HCS500 decoder can also be used in stand-alone applications. The HCS500 will activate the data line for up to 500 ms if a valid transmission was received, and this output can be used to drive a relay circuit. To activate learn or erase all commands, a button must be connected to the CLK input. User feedback is indicated on an LED connected to the DATA output line. If the CLK line is pulled high, using the learn button, the LED will switch on. After the CLK line is kept high for longer than 2 seconds, the decoder will switch the LED line off, indicating that learn will be entered if the button is released. If the CLK line is kept high for another 6 seconds, the decoder will activate an ERASE_ALL Command. Learn mode can be aborted by taking the clock line high until the data line goes high (LED switches on). During learn, the data line will give feedback to the user and, therefore, must not be connected to the relay drive circuitry. Note: The REPS bit must be cleared in the configuration byte in stand-alone mode.
4.5
Test mode
A special test mode is activated after: 1. 2. Programming of the manufacturer's code. Erasing of all transmitters.
Test mode can be used to test a decoder before any transmitters are learned on it. Test mode enables testing of decoders without spending the time to learn a transmitter. Test mode is terminated after the first successful learning of an ordinary transmitter. In test mode, the decoder responds to a test transmitter. The test transmitter has the following properties: 1. 2. 3. 4. Encoder key = manufacturer's code. Serial number = any value. Discrimination bits = lower 10 bits of the serial number. Synchronization counter value = any value (synchronization information is ignored).
After taking the clock low and before a transmitter is learn, any low-to-high change on the clock line may terminate learn. This has learn implications when a switch with contact bounce is used.
Because the synchronization counter value is ignored in test mode, any number of test transmitters can be used, even if their synchronization counter values are different.
4.4
Erase All Command and Erase Command
4.6
Power Supply Supervisor
The Table 4-3 describes two versions of the Erase All command.
TABLE 4-3:
Command Byte C316
ERASE ALL COMMAND
Subcommand Byte 0016 Description Erase all transmitters. Erase all transmitters except 1. The first transmitter in memory is not erased.
Reliable operation of the HCS500 requires that the contents of the EEPROM memory be protected against erroneous writes. To ensure that erroneous writes do not occur after supply voltage "brown-out" conditions, the use of a proper power supply supervisor device is imperative (Figure 4-10 and Figure 8-2).
C316
0116
DS40153B-page 12
Preliminary
(c) 1997 Microchip Technology Inc.
HCS500
FIGURE 4-9: ERASE ALL
TERA TACK TRESP CLK C DATA LSB MSB LSB MSB LSB MSB TACK2 Decoder DATA Start Command A B Command Byte C Subcommand Byte D Dummy Byte E Acknowledge F
FIGURE 4-10: STAND-ALONE MODE LEARN/ERASE-ALL TIMING
TPP1 TPP2 TPP3 TPP4
CLK
DATA Learn Activation A B C Erase-All Activation D Successful E
FIGURE 4-11: TYPICAL STAND-ALONE APPLICATION CIRCUIT
OUTPUT VCC Vcc RF Receiver S1 LEARN 1K 1 X2 X3 X4 U2 VCC A0 WP A1 SCL A2 SDA VSS 24LC02B 8 7 6 5 1 2 3 4 U1 VSS VDD EECLK RFIN EEDAT SCLK MCLR SDAT HCS500 8 7 6 5 R3 10K RELAY SPST Vcc K1
R1 10K R2 10K
Q1 NPN
22 F
VCC
U3 POWER SUPPLY SUPERVISOR 4.5V VI G VO N D
D1 LED
In-circuit Programming Probe Pads
Note:
Because each HCS500 is individually matched to its EEPROM, in-circuit programming is strongly recommended.
(c) 1997 Microchip Technology Inc.
Preliminary
DS40153B-page 13
HCS500
5.0 DECODER PROGRAMMING
The decoder uses a 2K, 24LC02B serial EEPROM. The memory is divided between system memory that stores the transmitter information (read protected) and user memory (read/write). Commands to access the user memory are described in Sections 4.2.5 and 4.2.6. The following information stored in system memory needs to be programmed before the decoder can be used: * 64-bit manufacturer's code * Decoder configuration byte Note 1: These memory locations are read protected and can only be written to using the program command with the device powered up. 2: The contents of the system memory is encrypted by a unique 64-bit key that is stored in the HCS500. To initialize the system memory, the HCS500's program command must be used. The EEPROM and HCS500 are matched, and the devices must be kept together. In-circuit programming is therefore recommended.
5.1
Configuration Byte
The decoder is configured during initialization by setting the appropriate bits in the configuration byte. The following table list the options: Bit 0 Mnemonic LRN_MODE Description Learning mode selection LRN_MODE = 0--Normal Learn LRN_MODE = 1--Secure Learn Algorithm selection LRN_ALG = 0--KEELOQ Decryption Algorithm LRN_ALG = 1--XOR Algorithm Repeat Transmission enable 0 = Disable 1 = Enabled Reserved Reserved Reserved Reserved Reserved
1
LRN_ALG
2
REPEAT
3 4 5 6 7 5.1.1 LRN_MODE
Not Used Not Used Not Used Not Used Not Used
LRN_MODE selects between two learning modes. With LRN_MODE = 0, the normal (serial number derived) mode is selected; with LRN_MODE=1, the secure (seed derived) mode is selected. See Section 6.0 for more detail on learning modes. 5.1.2 LRN_ALG
LRN_ALG selects between the two available algorithms. With LRN_ALG = 0, is selected the KEELOQ decryption algorithm is selected; with LRN_ALG = 1, the XOR algorithm is selected. See Section 6.0 for more detail on learning algorithms. 5.1.3 REPEAT
The HCS500 can be configured to indicate repeated transmissions. In a stand-alone configuration, repeated transmissions must be disabled.
DS40153B-page 14
Preliminary
(c) 1997 Microchip Technology Inc.
HCS500
5.2 Programming Waveform 5.3 Programming Data String
The programming command consists of the following: * * * * * Command Request Sequence (A to B) Command Byte (B to C) Configuration Byte (C to D) Manufacturer's Code Eight Data Bytes (D to G) Activation and Acknowledge Sequence (G to H) A total of 80 bits are clocked into the decoder. The 8-bit command byte is clocked in first, followed by the 8-bit configuration byte and the 64-bit manufacturer's code. The data must be clocked in Least Significant Bit (LSB) first. The decoder will then encrypt the manufacturer's code using the decoder's unique 64-bit EEPROM encoder key. After completion of the programming EEPROM, the decoder will acknowledge by taking the data line high (G to H). If the data line goes high within 30 ms after the clock goes high, programming also fails.
FIGURE 5-1:
PROGRAMMING WAVEFORM
TCLKL TPP1 TPP3 TCLKH TCMD TDS TADDR TDATA TDATA TACK TWT2
CLK C DATA TPP2TPP4
LSB
MSB
LSB
MSB
MSB
LSB
MSB TAW
DECODER DATA Start Command A B Command Byte C Configuration Byte D Least Significant Byte E F Most Significant Byte G Acknowledge H
(c) 1997 Microchip Technology Inc.
Preliminary
DS40153B-page 15
HCS500
6.0 KEY GENERATION
The HCS500 supports three learning schemes which are selected during the initialization of the system EEPROM. The learning schemes are: * Normal learn using the KEELOQ decryption algorithm * Secure learn using the KEELOQ decryption algorithm * Secure learn using the XOR algorithm
6.1
Normal (Serial Number derived) Learn using the KEELOQ Decryption Algorithm
This learning scheme uses the KEELOQ decryption algorithm and the 28-bit serial number of the transmitter to derive the encoder key. The 28-bit serial number is patched with predefined values as indicated below to form two 32-bit seeds. SourceH = 60000000 00000000H + Serial Number | 28 Bits SourceL = 20000000 00000000H + Serial Number | 28 Bits Then, using the KEELOQ decryption algorithm and the manufacturer's code the encoder key is derived as follows: KeyH Upper 32 bits = F KEELOQ Decryption (SourceH) | 64-Bit Manufacturer's Code KeyL Lower 32 bits = F KEELOQ Decryption (SourceL) | 64-Bit Manufacturer's Code
6.2
Secure (Seed Derived) Learn using the KEELOQ Decryption Algorithm
This scheme uses the secure seed transmitted by the encoder to derive the two input seeds. The decoder always uses the lower 64 bits of the transmission to form a 60-bit seed. The upper 4 bits are always forced to zero. For 32-bit seed encoders (HCS200/HCS300/HCS301): SourceH = Serial Number Lower 28 bits SourceL = Seed 32 bits For 48-bit seed encoders (HCS360/HCS361): SourceH = Seed Upper 16 bits + Serial Number Upper 16 bits with upper 4 bits set to zero SourceL = Seed Lower 32 bits For 60-bit seed encoders (HCS410): SourceH = Seed Upper 32 bits with upper 4 bits set to zero SourceL = Seed Lower 32 bits The KEELOQ decryption algorithm and the manufacturer's code is used to derive the encoder key as follows: KeyH Upper 32 bits = F KEELOQ Decrypt (SourceH) | 64 Bit Manufacturer's Code KeyL Lower 32 bits = F KEELOQ Decrypt (SourceL) | 64 Bit Manufacturer's Code
6.3
Secure (Seed Derived) Learn using the XOR Algorithm
This scheme uses the seed transmitted by the encoder to derive the two input seeds. The decoder always use the lower 64 bits of the transmission to form a 60-bit seed. The upper 4 bits are always forced to zero. For 32-bit seed encoders (HCS200/HCS300/HCS301): SourceH = Serial Number Lower 28 bits SourceL = Seed 32 bits For 48-bit seed encoders (HCS360/HCS361): SourceH = Seed Upper 16 bits + Serial Number Upper 16 bits with upper 4 bits set to zero SourceL = Seed Lower 32 bits For 60-bit seed encoders (HCS410): SourceH = Seed Upper 32 bits with upper 4 bits set to zero SourceL = Seed Lower 32 bits Then, using the KEELOQ decryption algorithm and the manufacturer's code the encoder key is derived as follows: KeyH Upper 32 bits = SourceH XOR 64-Bit Manufacturer's Code | Upper 32 bits KeyL Lower 32 bits = SourceL XOR 64-Bit Manufacturer's Code | Lower 32 bits
DS40153B-page 16
Preliminary
(c) 1997 Microchip Technology Inc.
HCS500
7.0
7.1
KEELOQ ENCODERS
Transmission Format (PWM)
7.2
Code Word Organization
The KEELOQ encoder transmission is made up of several parts (Figure 7-1). Each transmission begins with a preamble and a header, followed by the encrypted and then the fixed data. The actual data is 66/67 bits which consists of 32 bits of encrypted data and 34/35 bits of non-encrypted data. Each transmission is followed by a guard period before another transmission can begin. The code hopping portion provides up to four billion changing code combinations and includes the button status bits (based on which buttons were activated), along with the synchronization counter value and some discrimination bits. The non-code hopping portion is comprised of the status bits, the function bits, and the 28-bit serial number. The encrypted and nonencrypted combined sections increase the number of combinations to 7.38 x 1019.
The HCS encoder transmits a 66/67-bit code word when a button is pressed. The 66/67-bit word is constructed from a code hopping portion and a non-code hopping portion (Figure 7-2). The Encrypted Data is generated from four button bits, two overflow counter bits, ten discrimination bits, and the 16-bit synchronization counter value. The Non-encrypted Data is made up from 2 status bits, 4 function bits, and the 28/32-bit serial number.
FIGURE 7-1:
CODE WORD TRANSMISSION FORMAT
LOGIC `0' LOGIC `1' Bit Period Preamble TP Header TH Code Hopping Portion of Transmission THOP Fixed Portion of Transmission TFIX Guard Time TG
FIGURE 7-2:
CODE WORD ORGANIZATION
Non-encrypted Data Repeat Button Status S2S1S0S3 (4 bits) 28-bit Serial Number Encrypted Data Button Status S2S1S0S3 (4 bits) 16-bit Sync. Counter Value
CRC1*
CRC0*
VLOW (1 bit)
Discrimination bits (12 bits)
3/2 bits
*HCS360/361
+
Serial Number and Button Status (32 bits)
+
32 bits of Encrypted Data
66/67 bits of Data Transmitted
(c) 1997 Microchip Technology Inc.
Preliminary
DS40153B-page 17
HCS500
8.0 ELECTRICAL CHARACTERISTICS FOR HCS500
Absolute Maximum Ratings Ambient temperature under bias...............................................................................................................-40C to +85C Storage temperature .............................................................................................................................. -65C to +150C Voltage on any pin with respect to VSS (except VDD)......................................................................... -0.6V to VDD +0.6V Voltage on VDD with respect to Vss................................................................................................................... 0 to +7.0V Total power dissipation (Note) .............................................................................................................................. 700 mW Maximum current out of VSS pin ........................................................................................................................... 200 mA Maximum current into VDD pin .............................................................................................................................. 150 mA Input clamp current, IIK (VI < 0 or VI > VDD) ......................................................................................................... 20 mA Output clamp current, IOK (VO < 0 or VO >VDD) .................................................................................................. 20 mA Maximum output current sunk by any I/O pin.......................................................................................................... 25 mA Maximum output current sourced by any I/O pin..................................................................................................... 25 mA Note:
Power dissipation is calculated as follows: PDIS = VDD x {IDD - IOH} + {(VDD-VOH) x IOH} + (VOl x IOL)
NOTICE: Stresses above those listed under "Absolute Maximum Ratings" may cause permanent damage to the device. This is a stress rating only and functional operation of the device at those or any other conditions above those indicated in the operation listings of this specification is not implied. Exposure to maximum rating conditions for extended periods may affect device reliability.
DS40153B-page 18
Preliminary
(c) 1997 Microchip Technology Inc.
HCS500
TABLE 8-1: DC CHARACTERISTICS
Standard Operating Conditions (unless otherwise stated) Operating temperature Commercial (C): 0C TA +70C Industrial (I): -40C TA +85C Symbol VDD VPOR SVDD IDD IPD VIL VIH VOL VOH Parameters Supply voltage VDD start voltage to ensure Reset VDD rise rate to ensure reset Supply current Power Down Current Input low voltage Input high voltage Output low voltage Output high voltage Min 3.0 -- 0.05* -- -- -- -- VSS VSS 0.25 VDD 2.0 -- VDD - 0.7 Typ() -- Vss -- 1.8 0.3 0.25 0.3 -- -- -- -- -- -- Max 5.5 -- -- 2.4 5 4 5 0.15 VDD 0.8 VDD VDD 0.6 -- Units V V V/ms mA A A A V V V V V V FOSC = 4 MHz, VDD = 5.5V Sleep mode (no RF input) VDD = 3.0V, Commercial VDD = 3.0V, Industrial Except MCLR = 0.15 VDD VDD between 4.5V and 5.5V Except MCLR = 0.85 VDD VDD between 4.5V and 5.5V IOL = 8.7 mA, VDD = 4.5V IOH = -5.4 mA, VDD = 4.5V Conditions
Data in "Typ" column is at 5.0V, 25C unless otherwise stated. These parameters are for design guidance only and are not tested. * These parameters are characterized but not tested. Note: Negative current is defined as coming out of the pin.
TABLE 8-2:
AC CHARACTERISTICS
Standard Operating Conditions (unless otherwise specified): Commercial (C): 0C TA +70C Industrial (I): -40C TA +85C
Symbol TE TOD TMCLR TOV
Parameters Transmit elemental period Output delay MCLR low time Time output valid
Min 65 48 150 --
Typ -- 75 -- 150
Max 660 237 -- 222
Units s ms ns ms
Conditions
FIGURE 8-1:
RESET WATCHDOG TIMER, OSCILLATOR START-UP TIMER AND POWER-UP TIMER TIMING
VDD MCLR TMCLR Tov I/O Pins
(c) 1997 Microchip Technology Inc.
Preliminary
DS40153B-page 19
HCS500
8.1
8.1.1
AC Electrical Characteristics
COMMAND MODE ACTIVATION Standard Operating Conditions (unless otherwise specified): Commercial (C): 0C TA +70C Industrial (I): -40C TA +85C
Symbol TREQ TRESP TACK TSTART TCLKH TCLKL FCLK TDS TCMD TADDR TDATA 8.1.2
Parameters Command request time Microcontroller request acknowledge time Decoder acknowledge time Start command mode to first command bit Clock high time Clock low time Clock frequency Data hold time Command validate time Address validate time Data validate time
Min 0.0050 -- -- 20 20 20 500 14 -- -- --
Typ -- -- -- -- -- -- -- -- -- -- --
Max 500 1 4 1000 1000 1000 25000 -- 10 10 10
Units ms ms s s s s Hz s s s s
READ FROM USER EEPROM COMMAND Standard Operating Conditions (unless otherwise specified): Commercial (C): 0C TA +70C Industrial (I): -40C TA +85C
Symbol TRD 8.1.3
Parameters Decoder EEPROM read time
Min 400
Typ --
Max 1500
Units s
WRITE TO USER EEPROM COMMAND Standard Operating Conditions (unless otherwise specified): Commercial (C): 0C TA +70C Industrial (I): -40C TA +85C
Symbol TWR TACK TRESP TACK2
Parameters Write command activation time EEPROM write acknowledge time Microcontroller acknowledge response time Decoder response acknowledge time
Min 20 -- 20 --
Typ -- -- -- --
Max 1000 10 1000 10
Units s ms s s
DS40153B-page 20
Preliminary
(c) 1997 Microchip Technology Inc.
HCS500
8.1.4 ACTIVATE LEARN COMMAND IN MICRO MODE Standard Operating Conditions (unless otherwise specified): Commercial (C): 0C TA +70 C Industrial (I): -40C TA +85C Symbol TLRN TACK TRESP TACK2 8.1.5 Parameters Learn command activation time Decoder acknowledge time Microcontroller acknowledge response time Decoder data line low Min 20 -- 20 -- Typ -- -- -- -- Max 1000 20 1000 10 Units s s s s
ACTIVATE LEARN COMMAND IN STAND-ALONE MODE Standard Operating Conditions (unless otherwise specified): Commercial (C): 0C TA +70C Industrial (I): -40C TA +85C
Symbol TPP1 TPP2 TPP3 8.1.6
Parameters Command request time Learn command activation time Erase-all command activation time
Min -- -- --
Typ -- -- --
Max 100 2 6
Units ms s s
LEARN STATUS STRING Standard Operating Conditions (unless otherwise specified): Commercial (C): 0C TA +70C Industrial (I): -40C TA +85C
Symbol TDHI TCLA TCA TCLH TCLL TCLKH TCLKL FCLK TDS
Parameters Command request time Microcontroller command request time Decoder request acknowledge time Clock high hold time Clock low hold time Clock high time Clock low time Clock frequency Data hold time
Min -- 0.005 --
Typ -- -- --
Max 500 500 10 1.2
Units ms ms s ms ms s s Hz s
0.020 20 20 500 --
-- -- -- -- --
1.2 1000 1000 25000 5
(c) 1997 Microchip Technology Inc.
Preliminary
DS40153B-page 21
HCS500
8.1.7 ERASE ALL COMMAND Standard Operating Conditions (unless otherwise specified): Commercial (C): 0C TA +70C Industrial (I): -40C TA +85C Symbol TERA TACK TRESP TACK2 8.1.8 Parameters Learn command activation time Decoder acknowledge time Microcontroller acknowledge response time Decoder data line low Min 20 20 20 -- Typ -- -- -- -- Max 1000 210 1000 10 Units s ms s s
PROGRAMMING COMMAND Standard Operating Conditions (unless otherwise specified): Commercial (C): 0C TA +70C Industrial (I): -40C TA +85C
Symbol TPP1 TPP2 TPP3 TPP4 TCLKH TCLKL FCLK TDS TCMD TACK TWT2 TALW
Parameters Command request time Decoder acknowledge time Start command mode to first command bit Data line low before tri-stated Clock high time Clock low time Clock frequency Data hold time Command validate time Command acknowledge time Acknowledge respond time Data low after clock low
Min -- -- 20 -- 20 20 500 -- -- 30 20 --
Typ -- -- -- -- -- -- -- -- -- -- -- --
Max 500 1 1000 5 1000 1000 25000 5 10 240 1000 10
Units ms ms s s s s Hz s s ms s s
FIGURE 8-2:
TYPICAL MICROCONTROLLER INTERFACE CIRCUIT
VCC RF Receiver 1K 1 X2 X3 X4 U2 VCC A0 WP A1 SCL A2 SDA VSS 24LC02B 8 7 6 5 1 2 3 4 U1 VDD VSS EECLK RFIN EEDAT SCLK MCLR SDAT HCS500 8 7 6 5 RST
Microcontroller R3 10K
VCC
U3 POWER SUPPLY SUPERVISOR 4.5V G VO VI N D
In-circuit Programming Probe Pads
Note:
Because each HCS500 is individually matched to its EEPROM, in-circuit programming is strongly recommended.
DS40153B-page 22
Preliminary
(c) 1997 Microchip Technology Inc.
HCS500
PRODUCT IDENTIFICATION SYSTEM
To order or obtain information, e.g., on pricing or delivery, refer to the factory or the listed sales office. HCS500 -- /P Package: P = Plastic DIP (300 mil Body), 8-lead SM = Plastic SOIC (150 mil Body), 8-lead Temperature Range: Device: Blank = 0C to +70C I = -40C to +85C HCS500 HCS500T Code Hopping Decoder Code Hopping Decoder (Tape and Reel)
Sales and Support
Data Sheets Products supported by a preliminary Data Sheet may have an errata sheet describing minor operational differences and recommended workarounds. To determine if an errata sheet exists for a particular device, please contact one of the following:
1. 2. 3.
Your local Microchip sales office. The Microchip Corporate Literature Center U.S. FAX: (602) 786-7277. The Microchip's Bulletin Board, via your local CompuServe number (CompuServe membership NOT required).
(c) 1997 Microchip Technology Inc.
Preliminary
DS40153B-page 23
WORLDWIDE SALES & SERVICE
AMERICAS
Corporate Office
Microchip Technology Inc. 2355 West Chandler Blvd. Chandler, AZ 85224-6199 Tel: 602-786-7200 Fax: 602-786-7277 Technical Support: 602 786-7627 Web: http://www.microchip.com
ASIA/PACIFIC
Hong Kong
Microchip Asia Pacific RM 3801B, Tower Two Metroplaza 223 Hing Fong Road Kwai Fong, N.T., Hong Kong Tel: 852-2-401-1200 Fax: 852-2-401-3431
EUROPE
United Kingdom
Arizona Microchip Technology Ltd. Unit 6, The Courtyard Meadow Bank, Furlong Road Bourne End, Buckinghamshire SL8 5AJ Tel: 44-1628-851077 Fax: 44-1628-850259
France
Arizona Microchip Technology SARL Zone Industrielle de la Bonde 2 Rue du Buisson aux Fraises 91300 Massy, France Tel: 33-1-69-53-63-20 Fax: 33-1-69-30-90-79
Atlanta
Microchip Technology Inc. 500 Sugar Mill Road, Suite 200B Atlanta, GA 30350 Tel: 770-640-0034 Fax: 770-640-0307
India
Microchip Technology India No. 6, Legacy, Convent Road Bangalore 560 025, India Tel: 91-80-229-0061 Fax: 91-80-229-0062
Boston
Microchip Technology Inc. 5 Mount Royal Avenue Marlborough, MA 01752 Tel: 508-480-9990 Fax: 508-480-8575
Korea
Microchip Technology Korea 168-1, Youngbo Bldg. 3 Floor Samsung-Dong, Kangnam-Ku Seoul, Korea Tel: 82-2-554-7200 Fax: 82-2-558-5934
Germany
Arizona Microchip Technology GmbH Gustav-Heinemann-Ring 125 D-81739 Muchen, Germany Tel: 49-89-627-144 0 Fax: 49-89-627-144-44
Chicago
Microchip Technology Inc. 333 Pierce Road, Suite 180 Itasca, IL 60143 Tel: 630-285-0071 Fax: 630-285-0075
Italy
Arizona Microchip Technology SRL Centro Direzionale Colleone Palazzo Taurus 1 V. Le Colleoni 1 20041 Agrate Brianza Milan, Italy Tel: 39-39-6899939 Fax: 39-39-6899883
Shanghai
Microchip Technology RM 406 Shanghai Golden Bridge Bldg. 2077 Yan'an Road West, Hongiao District Shanghai, PRC 200335 Tel: 86-21-6275-5700 Fax: 86 21-6275-5060
Dallas
Microchip Technology Inc. 14651 Dallas Parkway, Suite 816 Dallas, TX 75240-8809 Tel: 972-991-7177 Fax: 972-991-8588
Singapore
Microchip Technology Taiwan Singapore Branch 200 Middle Road #10-03 Prime Centre Singapore 188980 Tel: 65-334-8870 Fax: 65-334-8850
JAPAN
Microchip Technology Intl. Inc. Benex S-1 6F 3-18-20, Shin Yokohama Kohoku-Ku, Yokohama Kanagawa 222 Japan Tel: 81-4-5471- 6166 Fax: 81-4-5471-6122 5/8/97
Dayton
Microchip Technology Inc. Two Prestige Place, Suite 150 Miamisburg, OH 45342 Tel: 937-291-1654 Fax: 937-291-9175
Los Angeles
Microchip Technology Inc. 18201 Von Karman, Suite 1090 Irvine, CA 92612 Tel: 714-263-1888 Fax: 714-263-1338
Taiwan, R.O.C
Microchip Technology Taiwan 10F-1C 207 Tung Hua North Road Taipei, Taiwan, ROC Tel: 886 2-717-7175 Fax: 886-2-545-0139
New York
Microchip Technology Inc. 150 Motor Parkway, Suite 416 Hauppauge, NY 11788 Tel: 516-273-5305 Fax: 516-273-5335
San Jose
Microchip Technology Inc. 2107 North First Street, Suite 590 San Jose, CA 95131 Tel: 408-436-7950 Fax: 408-436-7955
Toronto
Microchip Technology Inc. 5925 Airport Road, Suite 200 Mississauga, Ontario L4V 1W1, Canada Tel: 905-405-6279 Fax: 905-405-6253
All rights reserved. (c) 1997, Microchip Technology Incorporated, USA. 6/97 Printed on recycled paper.
M
Preliminary
Information contained in this publication regarding device applications and the like is intended for suggestion only and may be superseded by updates. No representation or warranty is given and no liability is assumed by Microchip Technology Incorporated with respect to the accuracy or use of such information, or infringement of patents or other intellectual property rights arising from such use or otherwise. Use of Microchip's products as critical components in life support systems is not authorized except with express written approval by Microchip. No licenses are conveyed, implicitly or otherwise, under any intellectual property rights. The Microchip logo and name are registered trademarks of Microchip Technology Inc. in the U.S.A. and other countries. All rights reserved. All other trademarks mentioned herein are the property of their respective companies.
DS40153B-page 24
(c) 1997 Microchip Technology Inc.

▲Up To Search▲

Price & Availability of HCS500-ISM

	To Download HCS500-ISM Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .