HCS512
K
EE
L
OQ®
Code Hopping Decoder
FEATURES
Security
•
•
•
•
•
Secure storage of Manufacturer’s Code
Secure storage of transmitter’s keys
Up to four transmitters can be learned
K
EE
L
OQ
®
code hopping technology
Normal and secure learning mechanisms
DESCRIPTION
The Microchip Technology Inc. HCS512 is a code hop-
ping decoder designed for secure Remote Keyless
Entry (RKE) systems. The HCS512 utilizes the pat-
ented K
EE
L
OQ
code hopping system and high security
learning mechanisms to make this a canned solution
when used with the HCS encoders to implement a uni-
directional remote keyless entry system.
Operating
•
•
•
•
•
4.0V – 6.0V operation
4 MHz external RC oscillator
Learning indication on LRNOUT
Auto baud rate detection
Power saving SLEEP mode
PACKAGE TYPE
PDIP, SOIC
LRNIN
LRNOUT
NC
MCLR
GND
S0
S1
S2
1
2
3
4
5
6
7
8
9
HCS512
18
17
16
15
14
13
12
11
10
RFIN
NC
OSCIN
OSC
OUT
V
DD
DATA
CLK
SLEEP
V
LOW
Other
•
•
•
•
Stand-alone decoder
On-chip EEPROM for transmitter storage
Four binary function outputs–15 functions
18-pin DIP/SOIC package
Typical Applications
•
•
•
•
•
•
•
Automotive remote entry systems
Automotive alarm systems
Automotive immobilizers
Gate and garage openers
Electronic door locks
Identity tokens
Burglar alarm systems
S3
BLOCK DIAGRAM
RFIN
Reception Register
DECRYPTOR
EEPROM
CONTROL
DATA
CLK
LRNIN
OSCIN OSCILLATOR
OUTPUT
S0
S1
S2
S3
MCLR
SLEEP
CONTROL
V
LOW
LRNOUT
Compatible Encoders
All K
EE
L
OQ
encoders and transponders configured for
the following setting:
•
•
•
•
•
•
•
PWM modulation format (1/3-2/3)
T
E
in the range from 100
μs
to 400
μs
10 x T
E
Header
28-bit Serial Number
16-bit Synchronization counter
Discrimination bits equal to Serial Number 8 LSbs
66- to 69-bit length code word.
The Manufacturer’s Code, transmitter keys, and syn-
chronization information are stored in protected on-
chip EEPROM. The HCS512 uses the DATA and CLK
inputs to load the Manufacturer’s Code which cannot
be read out of the device.
©
2011 Microchip Technology Inc.
DS40151E-page 1
HCS512
The HCS512 operates over a wide voltage range of
3.0 volts to 6.0 volts. The decoder employs automatic
baud rate detection which allows it to compensate for
wide variations in transmitter data rate. The decoder
contains sophisticated error checking algorithms to
ensure only valid codes are accepted.
during normal operation to derive the crypt
key and decrypt the received code word’s
encrypted portion.
-
Secure Learn
The transmitter is activated through a special
button combination to transmit a stored 60-bit
seed value used to generate the transmitter’s
crypt key. The receiver uses this seed value
to derive the same crypt key and decrypt the
received code word’s encrypted portion.
•
Manufacturer’s code
– A unique and secret 64-
bit number used to generate unique encoder crypt
keys. Each encoder is programmed with a crypt
key that is a function of the manufacturer’s code.
Each decoder is programmed with the manufac-
turer code itself.
1.0
SYSTEM OVERVIEW
Key Terms
The following is a list of key terms used throughout this
data sheet. For additional information on K
EE
L
OQ
and
Code Hopping, refer to Technical Brief 3 (TB003).
•
RKE
- Remote Keyless Entry
•
Button Status
- Indicates what button input(s)
activated the transmission. Encompasses the 4
button status bits S3, S2, S1 and S0 (Figure 8-2).
•
Code Hopping
- A method by which a code,
viewed externally to the system, appears to
change unpredictably each time it is transmitted.
•
Code word
- A block of data that is repeatedly
transmitted upon button activation (Figure 8-1).
•
Transmission
- A data stream consisting of
repeating code words (Figure 8-1).
•
Crypt key
- A unique and secret 64-bit number
used to encrypt and decrypt data. In a symmetri-
cal block cipher such as the K
EE
L
OQ
algorithm,
the encryption and decryption keys are equal and
will therefore be referred to generally as the crypt
key.
•
Encoder
- A device that generates and encodes
data.
•
Encryption Algorithm
- A recipe whereby data is
scrambled using a crypt key. The data can only be
interpreted by the respective decryption algorithm
using the same crypt key.
•
Decoder
- A device that decodes data received
from an encoder.
•
Decryption algorithm
- A recipe whereby data
scrambled by an encryption algorithm can be
unscrambled using the same crypt key.
•
Learn
– Learning involves the receiver calculating
the transmitter’s appropriate crypt key, decrypting
the received hopping code and storing the serial
number, synchronization counter value and crypt
key in EEPROM. The K
EE
L
OQ
product family facil-
itates several learning strategies to be imple-
mented on the decoder. The following are
examples of what can be done.
-
Simple Learning
The receiver uses a fixed crypt key, common
to all components of all systems by the same
manufacturer, to decrypt the received code
word’s encrypted portion.
-
Normal Learning
The receiver uses information transmitted
1.1
HCS Encoder Overview
The HCS encoders have a small EEPROM array which
must be loaded with several parameters before use.
The most important of these values are:
• A crypt key that is generated at the time of pro-
duction
• A 16-bit synchronization counter value
• A 28-bit serial number which is meant to be
unique for every encoder
The manufacturer programs the serial number for each
encoder at the time of production, while the ‘Key Gen-
eration Algorithm’ generates the crypt key (Figure 1-1).
Inputs to the key generation algorithm typically consist
of the encoder’s serial number and a 64-bit manufac-
turer’s code, which the manufacturer creates.
Note:
The manufacturer code is a pivotal part of
the system’s overall security. Conse-
quently, all possible precautions must be
taken and maintained for this code.
DS40151E-page 2
©
2011 Microchip Technology Inc.
HCS512
FIGURE 1-1:
Production
Programmer
CREATION AND STORAGE OF CRYPT KEY DURING PRODUCTION
HCS512
EEPROM Array
Serial Number
Crypt Key
Sync Counter
Transmitter
Serial Number
Manufacturer’s
Code
Key
Generation
Algorithm
Crypt
Key
.
.
.
The 16-bit synchronization counter is the basis behind
the transmitted code word changing for each transmis-
sion; it increments each time a button is pressed. Due
to the code hopping algorithm’s complexity, each incre-
ment of the synchronization value results in greater
than 50% of the bits changing in the transmitted code
word.
Figure 1-2 shows how the key values in EEPROM are
used in the encoder. Once the encoder detects a button
press, it reads the button inputs and updates the syn-
chronization counter. The synchronization counter and
crypt key are input to the encryption algorithm and the
output is 32 bits of encrypted information. This data will
change with every button press, its value appearing
externally to ‘randomly hop around’, hence it is referred
to as the hopping portion of the code word. The 32-bit
hopping code is combined with the button information
and serial number to form the code word transmitted to
the receiver. The code word format is explained in
greater detail in Section 8.2.
A receiver may use any type of controller as a decoder,
but it is typically a microcontroller with compatible firm-
ware that allows the decoder to operate in conjunction
with an HCS512 based transmitter. Section 5.0
provides detail on integrating the HCS512 into a sys-
tem.
A transmitter must first be ‘learned’ by the receiver
before its use is allowed in the system. Learning
includes calculating the transmitter’s appropriate crypt
key, decrypting the received hopping code and storing
the serial number, synchronization counter value and
crypt key in EEPROM.
In normal operation, each received message of valid
format is evaluated. The serial number is used to deter-
mine if it is from a learned transmitter. If from a learned
transmitter, the message is decrypted and the synchro-
nization counter is verified. Finally, the button status is
checked to see what operation is requested. Figure 1-3
shows the relationship between some of the values
stored by the receiver and the values received from
the transmitter.
FIGURE 1-2:
EEPROM Array
Crypt Key
Sync Counter
Serial Number
BUILDING THE TRANSMITTED CODE WORD (ENCODER)
K
EE
L
OQ
®
Encryption
Algorithm
Button Press
Information
Serial Number
32 Bits
Encrypted Data
Transmitted Information
©
2011 Microchip Technology Inc.
DS40151E-page 3
HCS512
FIGURE 1-3:
BASIC OPERATION OF RECEIVER (DECODER)
1 Received Information
EEPROM Array
Button Press
Information
Serial Number
32 Bits of
Encrypted Data
Manufacturer Code
2
Check for
Match
Serial Number
Sync Counter
Crypt Key
3
K
EE
L
OQ®
Decryption
Algorithm
Perform Function
5 Indicated by
button press
Decrypted
Synchronization
Counter
4
Check for
Match
NOTE:
Circled numbers indicate the order of execution.
2.0
PIN
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
PIN ASSIGNMENT
Decoder
Function
LRNIN
LRNOUT
NC
MCLR
Ground
S0
S1
S2
S3
V
LOW
SLEEP
CLK
DATA
V
DD
OSC
OUT
(1MH
Z
)
OSC
IN
(4MHz)
NC
RFIN
I/O
(1)
I
O
—
I
P
O
O
O
O
O
I
I/O
I/O
P
O
I
—
I
Buffer
Type
(1)
TTL
TTL
TTL
ST
—
TTL
TTL
TTL
TTL
TTL
TTL
TTL/ST
(2)
TTL/ST
(2)
—
TTL
ST
—
TTL
RF input from receiver
Description
Learn input - initiates learning, 10K pull-up required on input
Learn output - indicates learning
Do not connect
Master clear input
Ground connection
Switch 0
Switch 1
Switch 2
Switch 3
Battery low indication output
Connect to RFIN to allow wake-up from SLEEP
Clock in Programming mode and Synchronous mode
Data in Programming mode and Synchronous mode
Power connection
Oscillator out (test point)
Oscillator in – recommended values 4.7 kΩ and 22 pF
Note 1:
P = power, I = in, O = out, and ST = Schmitt Trigger input.
2:
Pin 12 and Pin 13 have a dual purpose. After RESET, these pins are used to determine if Programming
mode is selected in which case they are the clock and data lines. In normal operation, they are the clock
and data lines of the synchronous data output stream.
DS40151E-page 4
©
2011 Microchip Technology Inc.
HCS512
3.0
3.1
DESCRIPTION OF FUNCTIONS
Parallel Interface
The HCS512 activates the S3, S2, S1 & S0 outputs
when a new valid code is received. The outputs will be
activated for approximately 500 ms. If a repeated code
is received during this time, the output extends for
approximately 500 ms.
A special status message is transmitted on the second
pass of learn. This allows the controlling microcon-
troller to determine if the learn was successful (Result
= 1) and if a previous transmitter was overwritten
(Overwrite = 1). The status message is shown in
Figure 3-2.
Table 3-1 show the values for TX1:0 and the number of
transmitters learned.
3.2
Serial Interface
TABLE 3-1:
TX1
0
0
1
1
STATUS BITS
TX0
0
1
0
1
Number of Transmitters
One
Two
Three
Four
The decoder has a PWM/Synchronous interface con-
nection to microcontrollers with limited I/O. An output
data stream is generated when a valid transmission is
received. The data stream consists of one START bit,
four function bits, one bit for battery status, one bit to
indicate a repeated transmission, two status bits, and
one STOP bit. (Table 3-1). The DATA and CLK lines are
used to send a synchronous event message.
FIGURE 3-1:
START
DATA OUTPUT FORMAT
S3
S2
S1
S0
V
LOW
REPEAT
TX1
TX0
STOP
FIGURE 3-2:
START
STATUS MESSAGE FORMAT
0
0
0
0
RESULT
OVRWR
TX1
TX0
STOP
A 1-wire PWM or 2-wire synchronous interface can be used.
In 1-wire mode, the data is transmitted as a PWM signal with a basic pulse width of 400
μs.
In 2-wire mode, Synchronous mode PWM bits start on the rising edge of the clock, and the bits must be sampled on the
falling edge. The START bit is a ‘1’ and the STOP bit is ‘0’.
FIGURE 3-2:
PWM OUTPUT FORMAT
(1)
1/31/3 1/3
LOGIC “1”
LOGIC “0”
600
μs
1200
μs
CLK
DATA
START
1200
μs
S3
S2
S1
S0
V
LOW
RPT
Reserved Reserved
STOP
Note:
The Decoder output PWM format logic (“1” / “0”) is reversed with respect of the Encoder modulation format.
©
2011 Microchip Technology Inc.
DS40151E-page 5
京公网安备 11010802033920号
EEWORLD
