M
FEATURES
Security
•
•
•
•
•
Encrypted storage of manufacturer’s code
Encrypted storage of encoder decryption keys
Up to seven transmitters can be learned
K
EE
L
OQ
code hopping technology
Normal and secure learning mechanisms
HCS515
Code Hopping Decoder
PACKAGE TYPE
PDIP, SOIC
NC
NC
Vdd
S0
S1
MCLR
NC
1
2
3
4
5
6
7
14
13
12
11
10
9
8
NC
NC
Vss
RF_IN
S_CLK
S_DAT
NC
HCS515
Operating
• 3.0V—5.5V operation
• Internal oscillator
• Auto bit rate detection
Other
•
•
•
•
•
Stand-alone decoder
Internal EEPROM for transmitter storage
Synchronous serial interface
1 Kbit user EEPROM
14-pin DIP/SOIC package
BLOCK DIAGRAM
RFIN
67-bit Reception Register
DECRYPTOR
EE_DAT
Internal
EEPROM
CONTROL
EE_CLK
S_DAT
S_CLK
S0
S1
MCLR
Typical Applications
•
•
•
•
•
•
•
Automotive remote entry systems
Automotive alarm systems
Automotive immobilizers
Gate and garage openers
Electronic door locks
Identity tokens
Burglar alarm systems
OSCILLATOR
Compatible Encoders
• HCS200, HCS300, HCS301, HCS360, HCS361,
HCS410 (PWM Mode)
DESCRIPTION
The Microchip Technology Inc. HCS515 is a code hop-
ping decoder designed for secure Remote Keyless
Entry (RKE) systems. The HCS515 utilizes the pat-
ented K
EE
L
OQ
code hopping system and high security
learning mechanisms to make this a canned solution
when used with the HCS encoders to implement a uni-
directional remote and access control systems. The
HCS515 can be used as a stand-alone decoder or in
conjunction with a microcontroller.
The manufacturer’s code, encoder decryption keys,
and synchronization information are stored in
encrypted form in internal EEPROM. The HCS515
uses the S_DAT and S_CLK inputs to communicate
with a host controller device.
The HCS515 operates over a wide voltage range of
3.0 volts to 5.5 volts. The decoder employs automatic
bit-rate detection, which allows it to compensate for
wide variations in transmitter data rate. The decoder
contains sophisticated error checking algorithms to
ensure only valid codes are accepted.
The K
EE
L
OQ
name, K
EE
L
OQ
logo, and logotype are registered trademarks of Microchip Technology Inc. in the U.S.A. and other countries.
*Code hopping patents issued in Europe, U. S. A. and R. S.—US:5,517,187; Europe: 0459781
©
1998 Microchip Technology Inc.
Preliminary
DS40183A-page 1
HCS515
1.0
1.1
K
EE
L
OQ
SYSTEM OVERVIEW
Key Terms
1.2
HCS Encoder Overview
• Manufacturer’s Code – A 64-bit word, unique to
each manufacturer, used to produce a unique
encoder decryption key in each transmitter.
• Encoder Decryption Key – A 64-bit key, unique for
each transmitter. The encoder decryption key
controls the K
EE
L
OQ
decryption algorithm and is
stored in EEPROM on the decoder device.
• Learn – The receiver uses information that is
transmitted to derive the transmitter’s encoder
decryption key, decrypt the discrimination value,
and the synchronization counter in learning mode.
The encoder decryption key is a function of the
manufacturer’s code and the device serial number
and/or seed value.
The HCS encoders and decoders employ the K
EE
L
OQ
code hopping technology and a K
EE
L
OQ
encryption
algorithm to achieve a high level of security. Code
hopping is a method by which the code transmitted
from the transmitter to the receiver is different every
time a button is pushed. This method, coupled with a
transmission length of 66 bits, virtually eliminates the
use of code ‘grabbing’ or code ‘scanning’.
The HCS encoders have a small EEPROM array which
must be loaded with several parameters before use.
The most important of these values are:
• An encoder decryption key that is generated at
the time of production
• A 16-bit synchronization counter value
• A 28-bit serial number which is meant to be
unique for every encoder
The manufacturer programs the serial number for each
encoder at the time of production, while the ‘Key Gen-
eration Algorithm’ generates the encoder decryption
key (Figure 1-1). Inputs to the key generation algorithm
typically consist of the encoder’s serial number and a
64-bit manufacturer’s code, which the manufacturer
creates.
Note:
The manufacturer code is a pivotal part of
the system’s overall security. Conse-
quently, all possible precautions must be
taken and maintained for this code.
The 16-bit synchronization counter is the basis for the
transmitted code changing for each transmission and is
updated each time a button is pressed. Because of the
complexity of the K
EE
L
OQ
encryption algorithm, a
change in one bit of the synchronization counter value
will result in a large change in the actual transmitted
code. There is a relationship (Figure 1-2) between the
encoder decryption key values in EEPROM and how
they are used in the encoder. Once the encoder
detects that a button has been pressed, the encoder
reads the button and updates the synchronization
counter. The synchronization value is then combined
with the encoder decryption key in the K
EE
L
OQ
encryption algorithm, and the output is 32 bits of
encrypted information. This data will change with every
button press, hence, it is referred to as the code hop-
ping portion of the code word. The 32-bit code hopping
portion is combined with the button information and the
serial number to form the code word transmitted to the
receiver.
FIGURE 1-1:
CREATION AND STORAGE OF ENCRYPTION KEY DURING PRODUCTION
Transmitter
Serial Number or
Seed
HCS515 EEPROM Array
Serial Number
Encryption Key
Sync Counter
Manufacturer’s
Code
Key
Generation
Algorithm
Encryption
Key
.
.
.
DS40183A-page 2
Preliminary
©
1998 Microchip Technology Inc.
HCS515
1.3
HCS Decoder Overview
Before a transmitter and receiver can work together,
the receiver must first ‘learn’ and store certain informa-
tion from the transmitter. This information includes a
‘check value’ of the serial number, the encoder decryp-
tion key, and current synchronization counter value.
When a valid formatted message is detected, the
receiver first compares the serial number. If the serial
number check value is from a learned transmitter, the
message is decrypted. Next, the receiver checks the
decrypted synchronization counter value against what
is stored in memory. If the synchronization counter
value is verified, then a valid transmission message is
sent. Figure 1-3 shows the relationship between some
of the values stored by the receiver and the values
received from the transmitter.
FIGURE 1-2:
BASIC OPERATION OF A CODE HOPPING TRANSMITTER (ENCODER)
Transmitted Information
K
EE
L
OQ
Encryption
Algorithm
32 Bits of
Encrypted Data
Serial Number
Button Press
Information
EEPROM Array
Encoder Decryption Key
Sync. Counter Value
Serial Number
FIGURE 1-3:
BASIC OPERATION OF A CODE HOPPING RECEIVER (DECODER)
Check for
Match
EEPROM Array
Encoder Decryption Key
Sync. Counter Value
Serial Number
Manufacturer Code
Check for
Match
K
EE
L
OQ
Decryption
Algorithm
Decrypted
Synchronization
Counter
Button Press
Information
Serial Number
32 Bits of
Encrypted Data
Received Information
©
1998 Microchip Technology Inc.
Preliminary
DS40183A-page 3
HCS515
2.0
PIN
1
2
3
4
5
6
7
8
9
10
11
12
13
14
PIN ASSIGNMENT
Decoder
Function
NC
NC
V
DD
S0
S1
MCLR
NC
NC
S_DAT
S_CLK
RF_IN
GND
NC
NC
I/O
(1)
—
—
—
O
O
I
—
—
I/O
I
I
—
—
—
Buffer
Type
(1)
—
—
—
TTL
TTL
ST
—
—
TTL
TTL
TTL
—
—
—
No connection
No connection
Power connection
S0 function output
S1 function output
Master clear input
No connection
No connection
Synchronous data from controller
Synchronous clock from controller
RF input from receiver
Ground connection
No connection
No connection
Description
Note:
P = power, I = in, O = out, and ST = Schmitt Trigger input.
DS40183A-page 4
Preliminary
©
1998 Microchip Technology Inc.
HCS515
3.0
3.1
DECODER OPERATION
Learning a Transmitter to a Receiver
(Normal or Secure Learn)
Before the transmitter and receiver can work together,
the receiver must first ‘learn’ and store the following
information from the transmitter in EEPROM:
• A check value of the serial number
• The encoder decryption key
• The current synchronization counter value
The decoder must also store the manufacturer’s code
(Section 1.2) in protected memory. This code will
typically be the same for all of the decoders in a sys-
tem.
The HCS515 has seven memory slots, and, conse-
quently, can store up to seven transmitters. During the
learn procedure, the decoder searches for an empty
memory slot for storing the transmitter’s information.
When all of the memory slots are full, the decoder will
overwrite the last transmitter’s information. To erase all
of the memory slots at once, use the ERASE_ALL
command (C3H).
3.1.1
LEARNING PROCEDURE
3:
Learning a transmitter with an encoder
decryption key that is identical to a transmit-
ter already in memory replaces the existing
transmitter. In practice, this means that all
transmitters should have unique encoder
decryption keys. Learning a previously
learned transmitter does not use any addi-
tional memory slots.
The following checks are performed by the decoder to
determine if the transmission is valid during learn:
• The first code word is checked for bit integrity.
• The second code word is checked for bit integrity.
• The encoder decryption key is generated accord-
ing to the selected algorithm.
• The hopping code is decrypted.
• The discrimination value is checked.
• If all the checks pass, the key, serial number
check value, and synchronization counter values
are stored in EEPROM memory.
Figure 3-1 shows a flow chart of the learn sequence.
FIGURE 3-1:
LEARN SEQUENCE
Enter Learn
Mode
Wait for Reception
of a Valid Code
Wait for Reception
of Second
Non-Repeated
Valid Code
Generate Key
from Serial Number/
Seed Value
Use Generated Key
to Decrypt
Compare Discrimination
Value with Serial Number
Learning is initiated by sending the ACTIVATE_LEARN
(D2H) command to the decoder. The decoder acknowl-
edges reception of the command by pulling the data
line high.
For the HCS515 decoder to learn a new transmitter, the
following sequence is required:
1.
2.
Activate the transmitter once.
Activate the transmitter a second time. (In
secure learning mode, the seed transmission
must be transmitted during the second stage of
learn by activating the appropriate buttons on
the transmitter.)
The HCS515 will transmit a learn-status string,
indicating that the learn was successful.
The decoder has now learned the transmitter.
Repeat steps 1-3 to learn up to seven
transmitters
Note 1:
Learning will be terminated if two
nonsequential codes were received or if two
acceptable codes were not decoded within
30 seconds.
2:
If more than seven transmitters are learned,
the new transmitter will replace the last
transmitter learned. It is, therefore, not pos-
sible to erase lost transmitters by
repeatedly learning new transmitters. To
remove lost or stolen transmitters,
ERASE_ALL transmitters and relearn all
available transmitters.
3.
4.
Equal?
No
Yes
Learn successful. Store:
Serial number check value
Encoder decryption key
Sync. counter value
Exit
Learn
Unsuccessful
©
1998 Microchip Technology Inc.
Preliminary
DS40183A-page 5
京公网安备 11010802033920号
EEWORLD
