Leidos 418M1 RTR-4 Wireless Option User Manual Keeloq Code Hopping Encoder

Science Application International Corporation RTR-4 Wireless Option Keeloq Code Hopping Encoder

manual hcs300

 1999 Microchip Technology Inc. Preliminary DS21137E-page 1FEATURESSecurity• Programmable 28-bit serial number• Programmable 64-bit encryption key• Each transmission is unique• 66-bit transmission code length• 32-bit hopping code• 34-bit fixed code (28-bit serial number, 4-bit button code, 2-bit status)• Encryption keys are read protectedOperating• 2.0—6.3V operation• Four button inputs• No additional circuitry required• 15 functions available • Selectable baud rate• Automatic code word completion• Battery low signal transmitted to receiver• Non-volatile synchronization dataOther• Easy to use programming interface• On-chip EEPROM• On-chip oscillator and timing components• Button inputs have internal pulldown resistors• Current limiting on LED output• Minimum component count• Synchronous transmission modeTypical ApplicationsThe HCS300 is ideal for Remote Keyless Entry (RKE)applications. These applications include:• Automotive RKE systems• Automotive alarm systems• Automotive immobilizers• Gate and garage door openers • Identity tokens• Burglar alarm systemsDESCRIPTIONThe HCS300 from Microchip Technology Inc., is a codehopping encoder designed for secure Remote KeylessEntry (RKE) systems. The HCS300 utilizes the ® codehopping technology, which incorporates high security, asmall package outline and low cost to make this devicea perfect solution for unidirectional remote keylessentry systems and access control systems.PACKAGE TYPESHCS300 BLOCK DIAGRAM12348765S0S1S2S3VDDLEDPWMVSSPDIP, SOICHCS300VSSVDDOscillatorReset circuitLED driverControllerPowerlatchingandswitchingButton input port32-bit shift registerEncoderEEPROMPWM LED S3S2S1S0KEELOQ® Code Hopping EncoderHCS300KEELOQ is a registered trademark of Microchip Technology, Inc.Microchip’s Secure Data Products are covered by some or all of the following patents:Code hopping encoder patents issued in Europe, U.S.A., and R.S.A. — U.S.A.: 5,517,187; Europe: 0459781; R.S.A.: ZA93/472621137e.Book Page 1 Monday, October 4, 1999 8:04 AM
HCS300DS21137E-page 2 Preliminary  1999 Microchip Technology Inc.The HCS300 combines a 32-bit hopping codegenerated by a non-linear encryption algorithm, with a28-bit serial number and six status bits to create a 66-bit transmission stream. The length of the transmissioneliminates the threat of code scanning and the codehopping mechanism makes each transmission unique,thus rendering code capture and resend (code grab-bing) schemes useless.The encryption key, serial number, and configurationdata are stored in EEPROM, which is not accessible viaany external connection. This makes the HCS300 avery secure unit. The HCS300 provides an easy to useserial interface for programming the necessary securitykeys, system parameters, and configuration data.The encyrption keys and code combinations are pro-grammable but read-protected. The keys can only beverified after an automatic erase and programmingoperation. This protects against attempts to gainaccess to keys and manipulate synchronization values.The HCS300 operates over a wide voltage range of2.0V to 6.3V and has four button inputs in an 8-pinconfiguration. This allows the system designer thefreedom to utilize up to 15 functions. The onlycomponents required for device operation are the but-tons and RF circuitry, allowing for a very lowsystem cost.1.0 SYSTEM OVERVIEWKey Terms• Manufacturer’s code - a 64-bit word, unique to each manufacturer, used to produce a unique encryption key in each transmitter (encoder).• Encryption Key - a unique 64-bit key generated and programmed into the encoder during the manufacturing process. The encryption key controls the encryption algorithm and is stored in EEPROM on the encoder device.1.1 Learn The HCS product family facilitates several learn strate-gies to be implemented on the decoder. The followingare examples of what can be done. It must be pointedout that there exists some third-party patents on learn-ing strategies and implementation.1.1.1 NORMAL LEARNThe receiver uses the same information that is trans-mitted during normal operation to derive the transmit-ter’s secret key, decrypt the discrimination value andthe synchronization counter.1.1.2 SECURE LEARN*The transmitter is activated through a special buttoncombination to transmit a stored 48-bit value (randomseed) that can be used for key generation or be part ofthe key. Transmission of the random seed can be dis-abled after learning is completed.The HCS300 is a code hopping encoder device that isdesigned specifically for keyless entry systems,primarily for vehicles and home garage door openers.It is meant to be a cost-effective, yet secure solution tosuch systems. The encoder portion of a keyless entrysystem is meant to be held by the user and operated togain access to a vehicle or restricted area. TheHCS300 requires very few external components(Figure 2-1).Most keyless entry systems transmit the same codefrom a transmitter every time a button is pushed. Therelative number of code combinations for a low endsystem is also a relatively small number. Theseshortcomings provide the means for a sophisticatedthief to create a device that ‘grabs’ a transmission andre-transmits it later or a device that scans all possiblecombinations until the correct one is found.The HCS300 employs the code hopping technologyand an encryption algorithm to achieve a high level ofsecurity. Code hopping is a method by which the codetransmitted from the transmitter to the receiver isdifferent every time a button is pushed. This method,coupled with a transmission length of 66 bits, virtuallyeliminates the use of code ‘grabbing’ or code‘scanning’.As indicated in the block diagram on page one, theHCS300 has a small EEPROM array which must beloaded with several parameters before use. The mostimportant of these values are:• A 28-bit serial number which is meant to be unique for every encoder.• An encryption key that is generated at the time of production.• A 16-bit synchronization value.The serial number for each transmitter is programmedby the manufacturer at the time of production. Thegeneration of the encryption key is done using a keygeneration algorithm (Figure 1-1). Typically, inputs tothe key generation algorithm are the serial number ofthe transmitter and a 64-bit manufacturer’s code. Themanufacturer’s code is chosen by the systemmanufacturer and must be carefully controlled. Themanufacturer’s code is a pivotal part of the overallsystem security.21137e.Book Page 2 Monday, October 4, 1999 8:04 AM
 1999 Microchip Technology Inc. Preliminary DS21137E-page 3HCS300FIGURE 1-1: CREATION AND STORAGE OF ENCRYPTION KEY DURING PRODUCTIONThe 16-bit synchronization value is the basis for thetransmitted code changing for each transmission, andis updated each time a button is pressed. Because ofthe complexity of the code hopping encryption algo-rithm, a change in one bit of the synchronization valuewill result in a large change in the actual transmittedcode. There is a relationship (Figure 1-2) between thekey values in EEPROM and how they are used in theencoder. Once the encoder detects that a button hasbeen pressed, the encoder reads the button andupdates the synchronization counter. The synchroniza-tion value is then combined with the encryption key inthe encryption algorithm and the output is 32 bits ofencrypted information. This data will change with everybutton press, hence, it is referred to as the hoppingportion of the code word. The 32-bit hopping code iscombined with the button information and the serialnumber to form the code word transmitted to thereceiver. The code word format is explained in detailin Section 4.2. Any type of controller may be used as a receiver, but itis typically a microcontroller with compatible firmwarethat allows the receiver to operate in conjunction with atransmitter, based on the HCS300. Section 7.0provides more detail on integrating the HCS300 into atotal system.Before a transmitter can be used with a particularreceiver, the transmitter must be ‘learned’ by thereceiver. Upon learning a transmitter, information isstored by the receiver so that it may track thetransmitter, including the serial number of thetransmitter, the current synchronization value for thattransmitter and the same encryption key that is used onthe transmitter. If a receiver receives a message of validformat, the serial number is checked and, if it is from alearned transmitter, the message is decrypted and thedecrypted synchronization counter is checked againstwhat is stored. If the synchronization value is verified,then the button status is checked to see what operationis needed. Figure 1-3 shows the relationship betweensome of the values stored by the receiver and the val-ues received from the transmitter. Transmitter Manufacturer’s Serial Number orCodeEncryption KeyKeyGenerationAlgorithmSerial NumberEncryption KeySync Counter...HCS300 EEPROM ArraySeed21137e.Book Page 3 Monday, October 4, 1999 8:04 AM
HCS300DS21137E-page 4 Preliminary  1999 Microchip Technology Inc.FIGURE 1-2: BASIC OPERATION OF TRANSMITTER (ENCODER)FIGURE 1-3: BASIC OPERATION OF RECEIVER (DECODER) KEELOQAlgorithmButton PressInformationEncryptionEEPROM Array32 Bits of Encrypted Data Serial NumberTransmitted InformationEncryption KeySync CounterSerial NumberButton PressInformationEEPROM ArrayEncryption Key32 Bits of Encrypted DataSerial NumberReceived Information DecryptedSynchronization CounterCheck forMatchCheck forMatchKEELOQAlgorithmDecryptionSync CounterSerial NumberManufacturer Code21137e.Book Page 4 Monday, October 4, 1999 8:04 AM
 1999 Microchip Technology Inc. Preliminary DS21137E-page 5HCS3002.0 DEVICE OPERATIONAs shown in the typical application circuits (Figure 2-1),the HCS300 is a simple device to use. It requires onlythe addition of buttons and RF circuitry for use as thetransmitter in your security application. A description ofeach pin is described in Table 2-1.FIGURE 2-1: TYPICAL CIRCUITSTABLE 2-1: PIN DESCRIPTIONSThe high security level of the HCS300 is based on thepatented technology. A block cipher type of encryptionalgorithm based on a block length of 32 bits and a keylength of 64 bits is used. The algorithm obscures theinformation in such a way that even if the transmissioninformation (before coding) differs by only one bit fromthe information in the previous transmission, the nextcoded transmission will be totally different. Statistically,if only one bit in the 32-bit string of informationchanges, approximately 50 percent of the coded trans-mission will change. The HCS300 will wake up upondetecting a switch closure and then delay approxi-mately 10 ms for switch debounce (Figure 2-2). Thesynchronized information, fixed information, and switchinformation will be encrypted to form the hopping code.The encrypted or hopping code portion of the transmis-sion will change every time a button is pressed, even ifthe same button is pushed again. Keeping a buttonpressed for a long time will result in the same codeword being transmitted, until the button is released ortimeout occurs. A code that has been transmitted willnot occur again for more than 64K transmissions. Thiswill provide more than 18 years of typical use before acode is repeated, based on 10 operations per day.Overflow information programmed into the encoder canbe used by the decoder to extend the number of uniquetransmissions to more than 192K.If in the transmit process it is detected that a new but-ton(s) has been pressed, a reset will immediately beforced and the code word will not be completed. Pleasenote that buttons removed will not have any effect onthe code word unless no buttons remain pressed inwhich case the current code word will be completedand the power down will occur.VDDB0Tx outS0S1S2S3LEDVDDPWMVSS2 button remote controlB1VDDTx outS0S1S2S3LEDVDDPWMVSS5 button remote control (Note)B4 B3 B2 B1 B0Note: Up to 15 functions can be implemented by press-ing more than one button simultaneously or byusing a suitable diode array.Name PinNumber DescriptionS0 1 Switch input 0S1 2 Switch input 1S2 3 Switch input 2/Can also be clockpin when in programming modeS3 4 Switch input 3/Clock pin when inprogramming modeVSS 5Ground reference connection PWM 6 Pulse width modulation (PWM)output pin/Data pin forprogramming modeLED 7Cathode connection for directlydriving LED during transmissionVDD 8Positive supply voltageconnection21137e.Book Page 5 Monday, October 4, 1999 8:04 AM
HCS300DS21137E-page 6 Preliminary  1999 Microchip Technology Inc.FIGURE 2-2: ENCODER OPERATION 3.0 EEPROM MEMORY ORGANIZATIONThe HCS300 contains 192 bits (12 x 16-bit words) ofEEPROM memory (Table 3-1). This EEPROM array isused to store the encryption key information,synchronization value, etc. Further descriptions of thememory array is given in the following sections.TABLE 3-1: EEPROM MEMORY MAP 3.1 Key_0 - Key_3 (64-Bit Encryption Key)The 64-bit encryption key is used by the transmitter tocreate the encrypted message transmitted to thereceiver. This key is created and programmed at thetime of production using a key generation algorithm.Inputs to the key generation algorithm are the serialnumber for the particular transmitter being used and asecret manufacturer’s code. While the key generationalgorithm supplied is the typical method used, a usermay elect to create their own method of key generation.This may be done, providing that the decoder is pro-grammed with the same means of creating the key fordecryption purposes. If a seed is used, the seed willalso form part of the input to the key generation algo-rithm.Power UpReset and Debounce Delay (10 ms)Sample InputsUpdate Sync Info Encrypt WithLoad Transmit Register ButtonsAdded?AllButtonsReleased?(A button has been pressed) Transmit StopNoYesNoYesEncryption Key Complete Code Word Transmission WORD ADDRESS MNEMONIC DESCRIPTION0KEY_0 64-bit encryption key(word 0)1KEY_1 64-bit encryption key(word 1)2KEY_2 64-bit encryption key(word 2)3KEY_3 64-bit encryption key(word 3)4SYNC 16-bit synchronizationvalue 5RESERVED Set to 0000H6SER_0 Device Serial Number(word 0)7SER_1(Note) Device Serial Number(word 1)8SEED_0 Seed Value (word 0)9SEED_1 Seed Value (word 1)10 EN_KEY 16-bit Envelope Key11 CONFIG Config WordNote: The MSB of the serial number contains a bit used to select the auto shutoff timer.21137e.Book Page 6 Monday, October 4, 1999 8:04 AM
 1999 Microchip Technology Inc. Preliminary DS21137E-page 7HCS3003.2 SYNC (Synchronization Counter)This is the 16-bit synchronization value that is used tocreate the hopping code for transmission. This valuewill be changed after every transmission.3.3 SER_0, SER_1 (Encoder Serial Number) SER_0 and SER_1 are the lower and upper words ofthe device serial number, respectively. Although thereare 32 bits allocated for the serial number, only thelower order 28 bits are transmitted. The serial numberis meant to be unique for every transmitter. The mostsignificant bit of the serial number (Bit 31) is used toturn the auto shutoff timer on or off.3.3.1 AUTO SHUTOFF TIMER SELECTThe most significant bit of the serial number (Bit 31) isused to turn the Auto shutoff timer on or off. This timerprevents the transmitter from draining the batteryshould a button get stuck in the on position for a longperiod of time. The time period is approximately25 seconds, after which the device will go to the Time-out mode. When in the Time-out mode, the device willstop transmitting, although since some circuits withinthe device are still active, the current draw within theShutoff mode will be more than Standby mode. If themost significant bit in the serial number is a one, thenthe auto shutoff timer is enabled, and a zero in the mostsignificant bit will disable the timer. The length of thetimer is not selectable.3.4 SEED_0, SEED_1 (Seed Word)This is the two word (32 bits) seed code that will betransmitted when all four buttons are pressed at thesame time. This allows the system designer to imple-ment the secure learn feature or use this fixed codeword as part of a different key generation/tracking pro-cess or purely as a fixed code transmission.3.5 EN_Key (Envelope Encryption Key)Envelope encryption is a selectable option thatencrypts the portion of the transmission that containsthe transmitter serial number. Selecting this option isdone by setting the appropriate bit in the configurationword (Table 3-2). Normally, the serial number istransmitted in the clear (un-encrypted), but for anadded level of security, the system designer may electto implement this option. The envelope encryption keyis used to encrypt the serial number portion of thetransmission, if the envelope encryption option hasbeen selected. The envelope encryption algorithm is adifferent algorithm than the key generation or transmitencryption algorithm. The EN_key is typically a randomnumber and the same for all transmitters in a system.3.6 Configuration WordThe configuration word is a 16-bit word stored inEEPROM array that is used by the device to storeinformation used during the encryption process, as wellas the status of option configurations. Furtherexplanations of each of the bits are described in thefollowing sections.TABLE 3-2: CONFIGURATION WORD 3.6.1 DISCRIMINATION VALUE (DISC0 TO DISC9) The discrimination value can be programmed with anyvalue to serve as a post decryption check on thedecoder end. In a typical system, this will beprogrammed with the 10 least significant bits of theserial number, which will also be stored by the receiversystem after a transmitter has been learned. Thediscrimination bits are part of the information that is toform the encrypted portion of the transmission. Afterthe receiver has decrypted a transmission, thediscrimination bits can be checked against the storedvalue to verify that the decryption process was valid.3.6.2 OVERFLOW BITS (OVR0 AND OVR1) The overflow bits are used to extend the number of pos-sible synchronization values. The synchronizationcounter is 16 bits in length, yielding 65,536 valuesbefore the cycle repeats. Under typical use of10 operations a day, this will provide nearly 18 years ofuse before a repeated value will be used. Should thesystem designer conclude that is not adequate, thenthe overflow bits can be utilized to extend the numberof unique values. This can be done by programmingOVR0 and OVR1 to 1s at the time of production. Theencoder will automatically clear OVR0 the first time thatthe synchronization value wraps from 0xFFFF toBit Number Bit Description0Discrimination Bit 01Discrimination Bit 12Discrimination Bit 23Discrimination Bit 34Discrimination Bit 45Discrimination Bit 56Discrimination Bit 67Discrimination Bit 78 Discrimination Bit 89Discrimination Bit 910 Overflow Bit 0 (OVR0)11 Overflow Bit 1 (OVR1)12 Low Voltage Trip Point Select13 Baudrate Select Bit 0 (BSL0)14 Baudrate Select Bit 1 (BSL1)15 Envelope Encryption Select (EENC)21137e.Book Page 7 Monday, October 4, 1999 8:04 AM
HCS300DS21137E-page 8 Preliminary  1999 Microchip Technology Inc.0x0000 and clear OVR1 the second time the counterwraps. Once cleared, OVR0 and OVR1 cannot be setagain, thereby creating a permanent record of thecounter overflow. This prevents fast cycling of 64Kcounter. If the decoder system is programmed to trackthe overflow bits, then the effective number of uniquesynchronization values can be extended to 196,608. Ifprogrammed to zero, the system will be compatible withthe NTQ104/5/6 devices (i.e., no overflow with discrim-ination bits set to zero).3.6.3 ENVELOPE ENCRYPTION (EENC)If the EENC bit is set to a 1, the 32-bit fixed code partof the transmission will also be encrypted so that it willappear to be random. The 16-bit envelope key andenvelope algorithm will be used for encryption.3.6.4 BAUDRATE SELECT BITS (BSL0, BSL1)BSL0 and BSL1 select the speed of transmission andthe code word blanking. Table 3-3 shows how the bitsare used to select the different baud rates andSection 5.2 provides detailed explanation in code wordblanking.TABLE 3-3: BAUDRATE SELECT3.6.5 LOW VOLTAGE TRIP POINT SELECTThe low voltage trip point select bit is used to tell theHCS300 what VDD level is being used. This informationwill be used by the device to determine when to sendthe voltage low signal to the receiver. When this bit isset to a one, the VDD level is assumed to be operatingfrom a 5 volt or 6 volt VDD level. If the bit is set low, thenthe VDD level is assumed to be 3.0 volts. Refer toFigure 3-1 for voltage trip point.VLOW is tested at 6.3Vat -25°C and +85°C and 2.0V at -25°C and +85°CFIGURE 3-1: TYPICAL VOLTAGE TRIP POINTS 4.0 TRANSMITTED WORD 4.1 Transmission Format (PWM)The HCS300 transmission is made up of several parts(Figure 4-1). Each transmission is begun with apreamble and a header, followed by the encrypted andthen the fixed data. The actual data is 66 bits whichconsists of 32 bits of encrypted data and 34 bits of fixeddata. Each transmission is followed by a guard periodbefore another transmission can begin. Refer toTable 8-4 for transmission timing requirements. Theencrypted portion provides up to four billion changingcode combinations and includes the button status bits(based on which buttons were activated) along with thesynchronization counter value and some discriminationbits. The fixed portion is comprised of the status bits,the function bits and the 28-bit serial number. The fixedand encrypted sections combined increase the numberof combinations to 7.38 x 1019.4.2 Synchronous Transmission ModeSynchronous transmission mode can be used to clockthe code word out using an external clock.To enter synchronous transmission mode, the pro-gramming mode start-up sequence must be executedas shown in Figure 4-3. If either S1 or S0 is set on thefalling edge of S2 (or S3), the device enters synchro-nous transmission mode. In this mode, it functions as anormal transmitter, with the exception that the timing ofthe PWM data string is controlled externally and 16extra bits are transmitted at the end with the code word.The button code will be the S0, S1 value at the fallingedge of S2 or S3. The timing of the PWM data string iscontrolled by supplying a clock on S2 or S3 and shouldnot exceed 20 kHz. The code word is the same as inPWM mode with 16 reserved bits at the end of theword. The reserved bits can be ignored. When in syn-BSL1 BSL0 Basic Pulse Element Code Words Transmitted0 0 400µs All0 1 200µs 1 out of 21 0 100µs 1 out of 21 1 100µs 1 out of 4-40 050852.01.61.81.42.22.42.63.63.84.04.2 VLOWTemp ( C )Volts (V)VLOW sel = 0VLOW sel = 121137e.Book Page 8 Monday, October 4, 1999 8:04 AM
 1999 Microchip Technology Inc. Preliminary DS21137E-page 9HCS300chronous transmission mode S2 or S3 should not betoggled until all internal processing has been com-pleted as shown in Figure 4-4.4.3 Code Word OrganizationThe HCS300 transmits a 66-bit code word when a but-ton is pressed. The 66-bit word is constructed from aFixed Code portion and an Encrypted Code portion(Figure 4-2).The Encrypted Data is generated from four button bits,two overflow counter bits, ten discrimination bits, andthe 16-bit synchronization value (Figure 8-4).The Fixed Code Data is made up from two status bits,four button bits, and the 28-bit serial number. The fourbutton bits and the 28-bit serial number may beencrypted with the Envelope Key, if the envelopeencryption is enabled by the user.FIGURE 4-1: CODE WORD TRANSMISSION FORMAT FIGURE 4-2: CODE WORD ORGANIZATIONLOGIC ‘0’LOGIC ‘1’BitPeriodPreamble Header Encrypted Portion of Transmission Fixed Portion ofTransmission Guard TimeTPTHTHOP TFIX TG16-bit Discriminationbits(10 bits)Overflowbits(2 bits)ButtonStatus(4 bits)Transmission Direction32 bits of Encrypted Data Encrypted using BLOCK CIPHER AlgorithmEncrypted Code DataSync Value28-bit Serial NumberButtonStatus(4 bits)++VLOW and Repeat Status(2 bits)Serial Number and Button 2 bits of StatusFixed Code DataStatus (32 bits)21137e.Book Page 9 Monday, October 4, 1999 8:04 AM
HCS300DS21137E-page 10 Preliminary  1999 Microchip Technology Inc.FIGURE 4-3: SYNCHRONOUS TRANSMISSION MODEFIGURE 4-4: TRANSMISSION WORD FORMAT DURING SYNCHRONOUS TRANSMISSION MODE5.0 SPECIAL FEATURES5.1 Code Word Completion Code word completion is an automatic feature thatmakes sure that the entire code word is transmitted,even if the button is released before the transmission iscomplete. The HCS300 encoder powers itself up whena button is pushed and powers itself down after thecommand is finished, if the user has already releasedthe button. If the button is held down beyond the timefor one transmission, then multiple transmissions willresult. If another button is activated during atransmission, the active transmission will be abortedand the new code will be generated using the newbutton information. 5.2 Blank Alternate Code Word Federal Communications Commission (FCC) Part 15rules specify the limits on fundamental power andharmonics that can be transmitted. Power is calculatedon the worst case average power transmitted in a100ms window. It is therefore advantageous tominimize the duty cycle of the transmitted word. Thiscan be achieved by minimizing the duty cycle of theindividual bits and by blanking out consecutive words.Blank Alternate Code Word (BACW) is used forreducing the average power of a transmission(Figure 5-1). This is a selectable feature that isdetermined in conjunction with the baudrate selectionbits BSL0 and BSL1. Using the BACW allows the userto transmit a higher amplitude transmission if thetransmission length is shorter. The FCC putsconstraints on the average power that can betransmitted by a device, and BACW effectively preventscontinuous transmission by only allowing the transmis-sion of every second or every fourth code word. Thisreduces the average power transmitted and hence,assists in FCC approval of a transmitter device.5.3 Envelope Encryption OptionEnvelope Encryption is a user selectable option whichis meant to offer a higher level of security for a codehopping system. During a normal transmission with theenvelope encryption turned off, the 28-bit serialnumber is transmitted in the clear (unencrypted). Ifenvelope encryption is selected, then the serial numberis also encrypted before transmission. The encryptionfor the serial number is done using a different algorithmthan the transmission algorithm. The envelopeencryption scheme is not nearly as complex as thealgorithm and, hence, not as secure. When the enve-lope encryption is used, the serial number must bedecrypted using the envelope key and envelopedecryption. After the serial number is obtained, the nor-mal decryption method can be used to decrypt the hop-ping code. All transmitters in a system must use thesame envelope key.5.4 Secure LearnIn order to increase the level of security in a system, itis possible for the receiver to implement what is knownas a secure learn function. This can be done by utilizingthe seed value on the HCS300 which is stored inEEPROM and can only be transmitted when all fourt = 50 ms“01,10,11”PWMS2(S3)S[1:0]16 2 4 28 16 16Transmission DirectionReserved Padding ButtonCode Serial Number Data Word Sync Counter21137e.Book Page 10 Monday, October 4, 1999 8:04 AM
 1999 Microchip Technology Inc. Preliminary DS21137E-page 11HCS300button inputs are pressed at the same time (Table 5-1).Instead of the normal key generation method beingused to create the encryption key, this seed value isused and there need not be any mathematical relation-ship between serial numbers and seeds. TABLE 5-1: PIN ACTIVATION TABLE5.5 Auto-shutoffThe Auto-shutoff function automatically stops thedevice from transmitting if a button inadvertently getspressed for a long period of time. This will prevent thedevice from draining the battery if a button gets pressedwhile the transmitter is in a pocket or purse. This func-tion can be enabled or disabled and is selected by set-ting or clearing the Auto-shutoff bit (see Section 3.3.1).Setting this bit high will enable the function (turn Auto-shutoff function on) and setting the bit low will disablethe function. Time-out period is approximately 25 sec-onds.FIGURE 5-1: BLANK ALTERNATE CODE WORD (BACW)S3 S2 S1 S0 Notes1000 1 12001 0 13001 1 14010 0 15010 1 16011 0 17011 1 18100 0 19100 1 110 101 0 111 101 1 112 11 0 0 113 110 1 114 111 0 115 111 1 2Note 1: Transmit generated 32-bit codehopping word.2: Transmit 32-bit seed value.One Code WordBACW Disabled(All words transmitted)BACW Enabled(1 out of 2 transmitted)BACW Enabled(1 out of 4 transmitted)A2A4A100ms 100ms 100ms 100msAmplitudeTime21137e.Book Page 11 Monday, October 4, 1999 8:04 AM
HCS300DS21137E-page 12 Preliminary  1999 Microchip Technology Inc.5.6 VLOW: Voltage LOW Indicator The VLOW bit is transmitted with every transmission(Figure 8-4) and will be transmitted as a one if theoperating voltage has dropped below the low voltagetrip point. The trip point is selectable between twovalues, based on the battery voltage being used. SeeSection 3.6.5 for a description of how the low voltageselect option is set. This VLOW signal is transmitted sothe receiver can give an audible signal to the user thatthe transmitter battery is low (Section 5.8).5.7 RPT: Repeat Indicator This bit will be low for the first transmitted word. If abutton is held down for more than one transmitted codeword, this bit will be set to indicate a repeated codeword and remain set until the button is released(Figure 8-4).5.8 LED Output OperationDuring normal transmission the LED output is LOW. Ifthe supply voltage drops below the low voltage trippoint, the LED output will be toggled at approximately5Hz during the transmission (Section 3.6.5).21137e.Book Page 12 Monday, October 4, 1999 8:04 AM
 1999 Microchip Technology Inc. Preliminary DS21137E-page 13HCS3006.0 PROGRAMMING THE HCS300 When using the HCS300 in a system, the user will haveto program some parameters into the device includingthe serial number and the secret key before it can beused. The programming cycle allows the user to inputall 192 bits in a serial data stream, which are thenstored internally in EEPROM. Programming will beinitiated by forcing the PWM line high, after the S3 linehas been held high for the appropriate length of timeline (Table 6-1 and Figure 6-1). After the program modeis entered, a delay must be provided to the device forthe automatic bulk write cycle to complete. This willwrite all locations in the EEPROM to an all zeros pat-tern. The device can then be programmed by clockingin 16 bits at a time, using S3 as the clock line and PWMas the data in line. After each 16-bit word is loaded, aprogramming delay is required for the internal programcycle to complete. This delay can take up to TWC. At theend of the programming cycle, the device can be veri-fied (Figure 6-2) by reading back the EEPROM. Read-ing is done by clocking the S3 line and reading the databits on PWM. For security reasons, it is not possible toexecute a verify function without first programming theEEPROM. A verify operation can only be doneonce, immediately following the program cycle. FIGURE 6-1: PROGRAMMING WAVEFORMSFIGURE 6-2: VERIFY WAVEFORMSNote: To ensure that the device does not acci-dentally enter programming mode, PWMshould never be pulled high by the circuitconnected to it. Special care should betaken when driving PNP RF transistors.PWMEnter Program Mode(Data)(Clock)Note 1: Unused button inputs to be held to ground during the entire programming sequence.Bit 0 Bit 1 Bit 2 Bit 3 Bit 14 Bit 15 Bit 16 Bit 17TPH1TPBWTPSRepeat 12 times for each wordTPH2TCLKHTCLKLTWCTDSS3 Data for Word 0 (KEY_0) Data for Word 1TDHNote 2: The VDD pin must be taken to ground after a program/verify cycle.PWM(Clock)(Data)Note: If a Verify operation is to be done, then it must immediately follow the Program cycle.End of Programming Cycle Begin Verify Cycle HereBit 1 Bit 2 Bit 3 Bit 15Bit 14 Bit 16 Bit 17 Bit190 Bit191TWCData in Word 0TDVS3Bit 0Bit191Bit19021137e.Book Page 13 Monday, October 4, 1999 8:04 AM
HCS300DS21137E-page 14 Preliminary  1999 Microchip Technology Inc.TABLE 6-1: PROGRAMMING/VERIFY TIMING REQUIREMENTSVDD = 5.0V ± 10%25° C ± 5 °CParameter Symbol Min. Max. UnitsProgram mode setup time TPS 3.5 4.5 msHold time 1 TPH13.5 — msHold time 2 TPH250 — µsBulk Write time TPBW — 2.2 msProgram delay time TPROG — 2.2 msProgram cycle time TWC —36msClock low time TCLKL 25 — µsClock high time TCLKH 25 — µsData setup time TDS 0—µsData hold time TDH 18 — µsData out valid time TDV 10 24 µs21137e.Book Page 14 Monday, October 4, 1999 8:04 AM
 1999 Microchip Technology Inc. Preliminary DS21137E-page 15HCS3007.0 INTEGRATING THE HCS300 INTO A SYSTEMUse of the HCS300 in a system requires a compatibledecoder. This decoder is typically a microcontroller withcompatible firmware. Microchip will provide (via alicense agreement) firmware routines that accepttransmissions from the HCS300 and decrypt thehopping code portion of the data stream. Theseroutines provide system designers the means todevelop their own decoding system.7.1 Learning a Transmitter to a ReceiverIn order for a transmitter to be used with a decoder, thetransmitter must first be ‘learned’. Several learningstrategies can be followed in the decoder implementa-tion. When a transmitter is learned to a decoder, it issuggested that the decoder stores the serial numberand current synchronization value in EEPROM. Thedecoder must keep track of these values for everytransmitter that is learned (Figure 7-1). The maximumnumber of transmitters that can be learned is only afunction of how much EEPROM memory storage isavailable. The decoder must also store the manufac-turer’s code in order to learn a transmission transmitter,although this value will not change in a typical systemso it is usually stored as part of the microcontrollerROM code. Storing the manufacturer’s code as part ofthe ROM code is also better for security reasons. It must be stated that some learning strategies havebeen patented and care must be taken not to infringe.FIGURE 7-1: TYPICAL LEARN SEQUENCEEnter LearnModeWait for Receptionof a Valid CodeGenerate Keyfrom Serial NumberUse Generated Keyto DecryptCompare DiscriminationValue with Fixed ValueEqualWait for Receptionof Second Valid CodeCompare DiscriminationValue with Fixed ValueUse Generated Key to DecryptEqualCountersEncryption keySerial numberSynchronization counterSequential???ExitLearn successful Store: LearnUnsuccessfulNoNoNoYesYesYes21137e.Book Page 15 Monday, October 4, 1999 8:04 AM
HCS300DS21137E-page 16 Preliminary  1999 Microchip Technology Inc.7.2 Decoder OperationIn a typical decoder operation (Figure 7-2), the keygeneration on the decoder side is done by taking theserial number from a transmission and combining thatwith the manufacturer’s code to create the same secretkey that was used by the transmitter. Once the secretkey is obtained, the rest of the transmission can bedecrypted. The decoder waits for a transmission andimmediately can check the serial number to determineif it is a learned transmitter. If it is, it takes the encryptedportion of the transmission and decrypts it using thestored key. It uses the discrimination bits to determineif the decryption was valid. If everything up to this pointis valid, the synchronization value is evaluated. FIGURE 7-2: TYPICAL DECODER OPERATION7.3 Synchronization with DecoderThe technology features a sophisticatedsynchronization technique (Figure 7-3) which does notrequire the calculation and storage of future codes. Ifthe stored counter value for that particular transmitterand the counter value that was just decrypted arewithin a formatted window of say 16, the counter isstored and the command is executed. If the countervalue was not within the single operation window, but iswithin the double operation window of say 32K window,the transmitted synchronization value is stored in tem-porary location and it goes back to waiting for anothertransmission. When the next valid transmission isreceived, it will check the new value with the one in tem-porary storage. If the two values are sequential, it isassumed that the counter had just gotten out of the sin-gle operation ‘window’, but is now back in sync, so thenew synchronization value is stored and the commandexecuted. If a transmitter has somehow gotten out ofthe double operation window, the transmitter will notwork and must be re-learned. Since the entire windowrotates after each valid transmission, codes that havebeen used are part of the ‘blocked’ (32K) codes and areno longer valid. This eliminates the possibility of grab-bing a previous code and re-transmitting to gain entry.FIGURE 7-3: SYNCHRONIZATION WINDOW?TransmissionReceivedDoesSerial NumberMatch?Decrypt TransmissionIsDecryptionValid?IsCounterWithin 16?IsCounterWithin 32K?UpdateCounterExecuteCommandSave Counterin Temp LocationStartNoNoNoNoYesYesYesYesYesNoandNoNote: The synchronization method described inthis section is only a typicalimplementation and because it is usuallyimplemented in firmware, it can be alteredto fit the needs of a particular systemBlockedEntire Window rotates to eliminateuse of previouslyused codes CurrentPosition(32K Codes)DoubleOperation(32K Codes) Single OperationWindow (16 Codes)21137e.Book Page 16 Monday, October 4, 1999 8:04 AM
 1999 Microchip Technology Inc. Preliminary DS21137E-page 17HCS3008.0 ELECTRICAL CHARACTERISTICS TABLE 8-1: ABSOLUTE MAXIMUM RATINGSTABLE 8-2: DC CHARACTERISTICS Symbol Item Rating UnitsVDD Supply voltage -0.3 to 6.6 VVIN Input voltage -0.3 to VDD + 0.3 VVOUT Output voltage -0.3 to VDD + 0.3 VIOUT Max output current 50 mATSTG Storage temperature -55 to +125 C (Note)TLSOL Lead soldering temp 300 C (Note)VESD ESD rating 4000 VNote: Stresses above those listed under “ABSOLUTE MAXIMUM RATINGS” may cause permanent damage tothe device. Commercial (C): Tamb = 0°C to +70°CIndustrial (I): Tamb = -40°C to +85°C 2.0V < VDD < 3.0 3.0 < VDD < 6.3Parameter Sym. Min. Typ.1Max. Min. Typ.1Max. Unit ConditionsOperating cur-rent (avg)2ICC 0.2 1 1.0 2.5 mAmAVDD = 3.0VVDD = 6.3VStandby current ICCS 0.1 1.0 0.1 1.0 µAAuto-shutoffcurrent3,4 ICCS 40 75 160 650 µAHigh level Input voltage VIH 0.55VDD VDD+0.3 0.55VDD VDD+0.3 VLow level input voltage VIL -0.3 0.15VDD -0.3 0.15VDD VHigh level output voltage VOH 0.7Vdd 0.7Vdd VVIOH = -1.0 mA VDD = 2.0VIOH = -2.0 mA VDD = 6.3VLow level output voltage VOL 0.08VDD 0.08VDDVVIOL = 1.0 mA VDD = 2.0VIOL = 2.0 mA VDD = 6.3VLED sink current5ILED 1.0 1.8 2.5 2.0 2.7 3.7 mAmAVLED6 = 1.5V VDD = 3.0VVLED6 = 1.5V VDD = 6.3VResistance; S0-S3 RSO-3 40 60 80 40 60 80 kΩVDD = 4.0VResistance; PWM RPWM 80 120 160 80 120 160 kΩVDD = 4.0VNote 1: Typical values are at 25°C.2: No load.3: Auto-shutoff current specification does not include the current through the input pulldown resistors.4: Auto-shutoff current is periodically sampled and not 100% tested.5: With VLOW Sel = 0 for operation from 2.0V to 3.0V and VLOW Sel = 1 for operation from 3.0V to 6.3V.6: VLED is the voltage drop across the terminals of the LED.21137e.Book Page 17 Monday, October 4, 1999 8:04 AM
HCS300DS21137E-page 18 Preliminary  1999 Microchip Technology Inc.FIGURE 8-1: POWER UP AND TRANSMIT TIMINGTABLE 8-3: POWER UP AND TRANSMIT TIMING REQUIREMENTSFIGURE 8-2: PWM FORMATFIGURE 8-3: PREAMBLE/HEADER FORMATVDD = +2.0 to 6.3VCommercial (C): Tamb = 0°C to +70°CIndustrial (I): Tamb = -40°C to +85°CParameter Symbol Min. Max. Unit RemarksTime to second button press TBP 10 + Code Word Time 26 + Code Word Time ms (Note 1)Transmit delay from button detect TTD 10 26 msDebounce delay TDB 613msAuto-shutoff time-out period TTO 20 35 s (Note 2)Note 1: TBP is the time in which a second button can be pressed without completion of the first code word and the intention was to press the combination of buttons.2: The auto shutoff timeout period is not tested.Button Press SnDetectTDBPWMTTD Code Word TransmissionTTOCodeWord 1CodeWord 2CodeWord 3CodeWord nTBPLOGIC ‘0’LOGIC ‘1’Preamble Header Encrypted Portion of Transmission Fixed portion ofTransmission GuardTimeTPTHTHOP TFIX TGTBPTETETEPreamble HeaderP1 P1223 TE10 TE Data Word TransmissionBit 0 Bit 121137e.Book Page 18 Monday, October 4, 1999 8:04 AM
 1999 Microchip Technology Inc. Preliminary DS21137E-page 19HCS300FIGURE 8-4: DATA WORD FORMATTABLE 8-4: CODE WORD TRANSMISSION TIMING REQUIREMENTSFIGURE 8-5: HCS300 TE VS. TEMPVDD = +2.0 to 6.0VCommercial(C):Tamb = 0°C to +70°CIndustrial(I):Tamb = -40°C to +85°C Code Words TransmittedAll 1 out of 2 1 out of 4Symbol Characteristic Numberof TEMin. Typ. Max. Min. Typ. Max. Min. Typ. Max. UnitsTEBasic pulse element 1 260 400 660 130 200 330 65 100 165 µsTBP PWM bit pulse width 3 780 1200 1980 390 600 990 195 300 495 µsTPPreamble duration 23 6.0 9.2 15.2 3.0 4.6 7.6 1.5 2.3 3.8 msTHHeader duration 10 2.6 4.0 6.6 1.3 2.0 3.3 0.7 1.0 1.7 msTHOP Hopping code duration 96 25.0 38.4 63.4 12.5 19.2 31.7 6.2 9.6 15.8 msTFIX Fixed code duration 102 26.5 40.8 67.3 13.3 20.4 33.7 6.6 10.2 16.8 msTGGuard Time 39 10.1 15.6 25.7 5.1 7.8 12.9 2.5 3.9 6.4 msTotal Transmit Time 270 70.2 108.0 178.2 35.1 54.0 89.1 17.6 27.0 44.6 msPWM data rate 1282 833 505 2564 1667 1010 5128 3333 2020 bpsNote: The timing parameters are not tested but derived from the oscillator clock.Bit 0 Bit 1HeaderBit 30 Bit 31 Bit 32 Bit 33 Bit 58 Bit 59Fixed Code WordHopping Code Word Guard LSBLSB MSB MSB S3 S0 S1 S2 VLOW RPT TimeSerial Number Button Code StatusBit 60 Bit 61 Bit 62 Bit 63 Bit 64 Bit 650.81.71.61.51.41.31.21.11.00.90.7-50 -40 -30 -20 -10 0 10 20 30 40 50 60 70 80 900.6TE Min.TE Max.TypicalLEGEND= 2.0= 3.0= 6.021137e.Book Page 19 Monday, October 4, 1999 8:04 AM
HCS300DS21137E-page 20 Preliminary  1999 Microchip Technology Inc.HCS300 PRODUCT IDENTIFICATION SYSTEMTo order or obtain information, e.g., on pricing or delivery, refer to the factory or the listed sales office.Sales and SupportPackage: P = Plastic DIP (300 mil Body), 8-leadSN = Plastic SOIC (150 mil Body), 8-leadTemperature Blank = 0°C to +70°CRange: I = –40°C to +85°CDevice: HCS300 =Code Hopping EncoderHCS300T =Code Hopping Encoder (Tape and Reel)HCS300 - /PData SheetsProducts supported by a preliminary Data Sheet may have an errata sheet describing minor operational differencesand recommended workarounds. To determine if an errata sheet exists for a particular device, please contact one ofthe following:1. Your local Microchip sales office2. The Microchip Corporate Literature Center U.S. FAX: (480) 786-7277.3. The Microchip Worldwide Site (www.microchip.com)Please specify which device, revision of silicon and Data Sheet (include Literature #) you are using.New Customer Notification SystemRegister on our web site (www.microchip.com/cn) to receive the most current information on our products.21137e.Book Page 20 Monday, October 4, 1999 8:04 AM
 1999 Microchip Technology Inc. Preliminary DS21137E-page 21HCS300NOTES:21137e.Book Page 21 Monday, October 4, 1999 8:04 AM
HCS300DS21137E-page 22 Preliminary  1999 Microchip Technology Inc.NOTES:21137e.Book Page 22 Monday, October 4, 1999 8:04 AM
 1999 Microchip Technology Inc. Preliminary DS21137E-page 23HCS300NOTES:21137e.Book Page 23 Monday, October 4, 1999 8:04 AM
Information contained in this publication regarding device applications and the like is intended for suggestion only and may be superseded by updates. No representation or warranty is given and no liability is assumedby Microchip Technology Incorporated with respect to the accuracy or use of such information, or infringement of patents or other intellectual property rights arising from such use or otherwise. Use of Microchip’s productsas critical components in life support systems is not authorized except with express written approval by Microchip. No licenses are conveyed, implicitly or otherwise, under any intellectual property rights. The Microchiplogo and name are registered trademarks of Microchip Technology Inc. in the U.S.A. and other countries. All rights reserved. All other trademarks mentioned herein are the property of their respective companies. 1999 Microchip Technology Inc.All rights reserved. © 1999 Microchip Technology Incorporated. Printed in the USA. 11/99 Printed on recycled paper.AMERICASCorporate OfficeMicrochip Technology Inc.2355 West Chandler Blvd.Chandler, AZ 85224-6199Tel: 480-786-7200 Fax: 480-786-7277Technical Support: 480-786-7627Web Address: http://www.microchip.comAtlantaMicrochip Technology Inc.500 Sugar Mill Road, Suite 200BAtlanta, GA 30350Tel: 770-640-0034 Fax: 770-640-0307BostonMicrochip Technology Inc.5 Mount Royal AvenueMarlborough, MA 01752Tel: 508-480-9990 Fax: 508-480-8575ChicagoMicrochip Technology Inc.333 Pierce Road, Suite 180Itasca, IL 60143Tel: 630-285-0071 Fax: 630-285-0075DallasMicrochip Technology Inc.4570 Westgrove Drive, Suite 160Addison, TX 75248Tel: 972-818-7423 Fax: 972-818-2924DaytonMicrochip Technology Inc.Two Prestige Place, Suite 150Miamisburg, OH 45342Tel: 937-291-1654 Fax: 937-291-9175DetroitMicrochip Technology Inc.Tri-Atria Office Building 32255 Northwestern Highway, Suite 190Farmington Hills, MI 48334Tel: 248-538-2250 Fax: 248-538-2260Los AngelesMicrochip Technology Inc.18201 Von Karman, Suite 1090Irvine, CA 92612Tel: 949-263-1888 Fax: 949-263-1338New YorkMicrochip Technology Inc.150 Motor Parkway, Suite 202Hauppauge, NY 11788Tel: 631-273-5305 Fax: 631-273-5335San JoseMicrochip Technology Inc.2107 North First Street, Suite 590San Jose, CA 95131Tel: 408-436-7950 Fax: 408-436-7955AMERICAS (continued)TorontoMicrochip Technology Inc.5925 Airport Road, Suite 200Mississauga, Ontario L4V 1W1, Canada Tel: 905-405-6279 Fax: 905-405-6253ASIA/PACIFICHong KongMicrochip Asia PacificUnit 2101, Tower 2Metroplaza223 Hing Fong RoadKwai Fong, N.T., Hong KongTel: 852-2-401-1200 Fax: 852-2-401-3431BeijingMicrochip Technology, Beijing Unit 915, 6 Chaoyangmen Bei Dajie Dong Erhuan Road, Dongcheng District New China Hong Kong Manhattan BuildingBeijing 100027 PRC Tel: 86-10-85282100 Fax: 86-10-85282104IndiaMicrochip Technology Inc.India Liaison OfficeNo. 6, Legacy, Convent RoadBangalore 560 025, IndiaTel: 91-80-229-0061 Fax: 91-80-229-0062JapanMicrochip Technology Intl. Inc.Benex S-1 6F3-18-20, ShinyokohamaKohoku-Ku, Yokohama-shiKanagawa 222-0033 JapanTel: 81-45-471- 6166 Fax: 81-45-471-6122KoreaMicrochip Technology Korea168-1, Youngbo Bldg. 3 FloorSamsung-Dong, Kangnam-KuSeoul, KoreaTel: 82-2-554-7200 Fax: 82-2-558-5934ShanghaiMicrochip Technology RM 406 Shanghai Golden Bridge Bldg.2077 Yan’an Road West, Hong Qiao DistrictShanghai, PRC 200335Tel: 86-21-6275-5700 Fax: 86 21-6275-5060 ASIA/PACIFIC (continued)SingaporeMicrochip Technology Singapore Pte Ltd.200 Middle Road#07-02 Prime CentreSingapore 188980Tel: 65-334-8870 Fax: 65-334-8850Taiwan, R.O.CMicrochip Technology Taiwan10F-1C 207Tung Hua North RoadTai p ei, Ta iwa n , RO CTel: 886-2-2717-7175 Fax: 886-2-2545-0139EUROPEUnited KingdomArizona Microchip Technology Ltd.505 Eskdale RoadWinnersh TriangleWokingham Berkshire, England RG41 5TUTel: 44 118 921 5858 Fax: 44-118 921-5835DenmarkMicrochip Technology Denmark ApSRegus Business CentreLautrup hoj 1-3Ballerup DK-2750 DenmarkTel: 45 4420 9895 Fax: 45 4420 9910FranceArizona Microchip Technology SARLParc d’Activite du Moulin de Massy43 Rue du Saule TrapuBatiment A - ler Etage91300 Massy, FranceTel: 33-1-69-53-63-20 Fax: 33-1-69-30-90-79GermanyArizona Microchip Technology GmbHGustav-Heinemann-Ring 125D-81739 München, GermanyTel: 49-89-627-144 0 Fax: 49-89-627-144-44ItalyArizona Microchip Technology SRLCentro Direzionale Colleoni Palazzo Taurus 1 V. Le Colleoni 120041 Agrate BrianzaMilan, Italy Tel: 39-039-65791-1 Fax: 39-039-689988311/15/99WORLDWIDE SALES AND SERVICEMicrochip received QS-9000 quality system certification for its worldwide headquarters, design and wafer fabrication facilities in Chandler and Tempe, Arizona in July 1999. The Company’s quality system processes and procedures are QS-9000 compliant for its PICmicro® 8-bit MCUs, KEELOQ® code hopping devices, Serial EEPROMs and microperipheral products. In addition, Microchip’s quality system for the design and manufacture of development systems is ISO 9001 certified.

Navigation menu