HCS500
KEELOQ® Code Hopping Decoder
FEATURES
DESCRIPTION
Security
The Microchip Technology Inc. HCS500 is a code
hopping decoder designed for secure Remote Keyless
Entry (RKE) systems. The HCS500 utilizes the
patented KEELOQ code hopping system and highsecurity learning mechanisms to make this a canned
solution when used with the HCS encoders to
implement a unidirectional remote and access control
systems. The HCS500 can be used as a stand-alone
decoder or in conjunction with a microcontroller.
Encrypted Storage of Manufacturer’s Code
Encrypted Storage of Crypt Keys
Up to Seven Transmitters can be Learned
KEELOQ Code Hopping Technology
Normal and Secure Learning Mechanisms
Operating
• 3.0V—5.5V Operation
• Internal Oscillator
• Auto Bit Rate Detection
Other
•
•
•
•
•
Stand-Alone Decoder Chipset
External EEPROM for Transmitter Storage
Synchronous Serial Interface
1 Kbit user EEPROM
8-Pin PDIP/SOIJ Package
Typical Applications
•
•
•
•
•
•
•
Automotive Remote Entry Systems
Automotive Alarm Systems
Automotive Immobilizers
Gate and Garage Openers
Electronic Door Locks
Identity Tokens
Burglar Alarm Systems
PIN DIAGRAM
PDIP, SOIJ
VDD
1
EE_CLK
2
EE_DAT
3
MCLR
4
FIGURE 1:
HCS500
•
•
•
•
•
8
VSS
7
RFIN
6
S_CLK
5
S_DAT
BLOCK DIAGRAM
RFIN
Reception Register
DECRYPTOR
EE_DAT
External
EEPROM
CONTROL
EE_CLK
OSCILLATOR
S_DAT
S_CLK
MCLR
Compatible Encoders
All KEELOQ encoders and transponders configured for
the following setting:
•
•
•
•
•
•
PWM Modulation Format (1/3-2/3)
TE in the range from 100 us to 400 us
10 x TE Header
28-Bit Serial Number
16-Bit Synchronization Counter
Discrimination Bits Equal to Serial Number
8 LSbs
• 66- to 69-Bit Length Code Word.
2001-2015 Microchip Technology Inc.
The manufacturer’s code, crypt keys, and
synchronization information are stored in encrypted
form in external EEPROM. The HCS500 uses the
S_DAT and S_CLK inputs to communicate with a host
controller device.
The HCS500 operates over a wide voltage range of
3.0 volts to 5.5 volts. The decoder employs automatic
bit-rate detection, which allows it to compensate for
wide variations in transmitter data rate. The decoder
contains sophisticated error checking algorithms to
ensure only valid codes are accepted.
DS40000153E-page 1
HCS500
1.0
SYSTEM OVERVIEW
Key Terms
The following is a list of key terms used throughout this
data sheet. For additional information on KEELOQ and
code hopping, refer to Technical Brief 3 (TB003).
• RKE – Remote Keyless Entry
• Button Status – Indicates what button input(s)
activated the transmission. Encompasses the four
button Status bits S3, S2, S1 and S0 (Figure 7-2).
• Code Hopping – A method by which a code,
viewed externally to the system, appears to
change unpredictably each time it is transmitted.
• Code word – A block of data that is repeatedly
transmitted upon button activation (Figure 7-1).
• Transmission – A data stream consisting of
repeating code words (Figure 7-1).
• Crypt key – A unique and secret 64-bit number
used to encrypt and decrypt data. In a symmetrical block cipher such as the KEELOQ algorithm,
the encryption and decryption keys are equal and
will therefore be referred to generally as the crypt
key.
• Encoder – A device that generates and encodes
data.
• Encryption Algorithm – A recipe whereby data
is scrambled using a crypt key. The data can only
be interpreted by the respective decryption algorithm using the same crypt key.
• Decoder – A device that decodes data received
from an encoder.
• Decryption algorithm – A recipe whereby data
scrambled by an encryption algorithm can be
unscrambled using the same crypt key.
• Learn – Learning involves the receiver calculating
the transmitter’s appropriate crypt key, decrypting
the received hopping code and storing the serial
number, synchronization counter value and crypt
key in EEPROM. The KEELOQ product family
facilitates several learning strategies to be
implemented on the decoder. The following are
examples of what can be done.
- Simple Learning
The receiver uses a fixed crypt key, common
to all components of all systems by the same
manufacturer, to decrypt the received code
word’s encrypted portion.
- Normal Learning
The receiver uses information transmitted
during normal operation to derive the crypt
key and decrypt the received code word’s
encrypted portion.
DS40000153E-page 2
- Secure Learn
The transmitter is activated through a special
button combination to transmit a stored 60-bit
seed value used to generate the transmitter’s
crypt key. The receiver uses this seed value
to derive the same crypt key and decrypt the
received code word’s encrypted portion.
• Manufacturer’s code – A unique and secret 64bit number used to generate unique encoder crypt
keys. Each encoder is programmed with a crypt
key that is a function of the manufacturer’s code.
Each decoder is programmed with the manufacturer code itself.
1.1
HCS Encoder Overview
The HCS encoders have a small EEPROM array which
must be loaded with several parameters before use.
The most important of these values are:
• A crypt key that is generated at the time of
production
• A 16-bit synchronization counter value
• A 28-bit serial number which is meant to be
unique for every encoder
The manufacturer programs the serial number for each
encoder at the time of production, while the ‘Key
Generation Algorithm’ generates the crypt key
(Figure 1-1). Inputs to the key generation algorithm
typically consist of the encoder’s serial number and a
64-bit manufacturer’s code, which the manufacturer
creates.
Note:
The manufacturer code is a pivotal part of
the
system’s
overall
security.
Consequently, all possible precautions
must be taken and maintained for this
code.
2001-2015 Microchip Technology Inc.
HCS500
FIGURE 1-1:
CREATION AND STORAGE OF CRYPT KEY DURING PRODUCTION
Production
Programmer
HCS500
Transmitter
Serial Number
EEPROM Array
Serial Number
Crypt Key
Sync Counter
Manufacturer’s
Code
Key
Generation
Algorithm
The 16-bit synchronization counter is the basis behind
the transmitted code word changing for each transmission; it increments each time a button is pressed. Due
to the code hopping algorithm’s complexity, each increment of the synchronization value results in greater
than 50% of the bits changing in the transmitted code
word.
Figure 1-2 shows how the key values in EEPROM are
used in the encoder. Once the encoder detects a button
press, it reads the button inputs and updates the synchronization counter. The synchronization counter and
crypt key are input to the encryption algorithm and the
output is 32 bits of encrypted information. This data will
change with every button press, its value appearing
externally to ‘randomly hop around’, hence it is referred
to as the hopping portion of the code word. The 32-bit
hopping code is combined with the button information
and serial number to form the code word transmitted to
the receiver. The code word format is explained in
greater detail in Section 7.2 “Code Word Organization”.
FIGURE 1-2:
.
.
.
Crypt
Key
A receiver may use any type of controller as a decoder,
but it is typically a microcontroller with compatible firmware that allows the decoder to operate in conjunction
with an HCS500 based transmitter. Section 3.0
“Decoder Operation” provides detail on integrating
the HCS500 into a system.
A transmitter must first be ‘learned’ by the receiver
before its use is allowed in the system. Learning
includes calculating the transmitter’s appropriate crypt
key, decrypting the received hopping code and storing
the serial number, synchronization counter value and
crypt key in EEPROM.
In normal operation, each received message of valid
format is evaluated. The serial number is used to determine if it is from a learned transmitter. If from a learned
transmitter, the message is decrypted and the synchronization counter is verified. Finally, the button status is
checked to see what operation is requested. Figure 1-3
shows the relationship between some of the values
stored by the receiver and the values received from
the transmitter.
BUILDING THE TRANSMITTED CODE WORD (ENCODER)
EEPROM Array
Crypt Key
Sync Counter
KEELOQ
Encryption
Algorithm
Serial Number
Button Press
Information
Serial Number
32 Bits
Encrypted Data
Transmitted Information
2001-2015 Microchip Technology Inc.
DS40000153E-page 3
HCS500
FIGURE 1-3:
BASIC OPERATION OF RECEIVER (DECODER)
1 Received Information
EEPROM Array
Button Press
Information
Serial Number
2
32 Bits of
Encrypted Data
Manufacturer Code
Check for
Match
Serial Number
Sync Counter
Crypt Key
3
KEELOQ
Decryption
Algorithm
Decrypted
Synchronization
Counter
4
Check for
Match
Perform Function
5 Indicated by
button press
Note: Circled numbers indicate the order of execution.
2.0
PIN ASSIGNMENT
The description of the pins of the HCS500 decoder is
provided in Table 2-1.
TABLE 2-1:
DECODER PIN ASSIGNMENT
PIN
Decoder
Function
I/O(1)
Buffer Type(1)
1
VDD
P
—
2
EE_CLK
O
TTL
Clock to I 2C™ EEPROM
3
EE_DAT
I/O
TTL
Data to I 2C™ EEPROM
Description
Power Connection
4
MCLR
I
ST
Master clear input
5
S_DAT
I/O
TTL
Synchronous data from controller
6
S_CLK
I
TTL
Synchronous clock from controller
7
RFIN
I
TTL
RF input from receiver
8
GND
P
—
Ground connection
Note: P = power, I = in, O = out, and ST = Schmitt Trigger input.
DS40000153E-page 4
2001-2015 Microchip Technology Inc.
HCS500
3.0
DECODER OPERATION
3.2
3.1
Learning a Transmitter to a
Receiver (Normal or Secure Learn)
Learning is initiated by sending the ACTIVATE_LEARN
(D2H) command to the decoder. The decoder
acknowledges reception of the command by pulling the
data line high.
Before the transmitter and receiver can work together,
the receiver must first ‘learn’ and store the following
information from the transmitter in EEPROM:
• A check value of the serial number
• The crypt key
• The current synchronization counter value
For the HCS500 decoder to learn a new transmitter, the
following sequence is required:
1.
2.
The decoder must also store the manufacturer’s code
(Section 1.1 “HCS Encoder Overview”) in protected
memory. This code will typically be the same for all of
the decoders in a system.
The HCS500 has seven memory slots, and,
consequently, can store up to seven transmitters.
During the learn procedure, the decoder searches for
an empty memory slot for storing the transmitter’s
information. When all of the memory slots are full, the
decoder will overwrite the last transmitter’s information.
To erase all of the memory slots at once, use the
ERASE_ALL command (C3H).
Learning Procedure
3.
4.
Activate the transmitter once.
Activate the transmitter a second time. (In
Secure Learning mode, the seed transmission
must be transmitted during the second stage of
learn by activating the appropriate buttons on
the transmitter.)
The HCS500 will transmit a learn-status string,
indicating that the learn was successful.
The decoder has now learned the transmitter.
Repeat steps 1-3 to learn up to seven
transmitters
Note 1: Learning will be terminated if two
nonsequential codes were received or if
two acceptable codes were not decoded
within 30 seconds.
2: If more than seven transmitters are
learned, the new transmitter will replace
the last transmitter learned. It is, therefore,
not possible to erase lost transmitters by
repeatedly learning new transmitters. To
remove lost or stolen transmitters,
ERASE_ALL transmitters and relearn all
available transmitters.
3: Learning a transmitter with a crypt key that
is identical to a transmitter already in memory replaces the existing transmitter. In
practice, this means that all transmitters
should have unique crypt keys. Learning a
previously learned transmitter does not use
any additional memory slots.
2001-2015 Microchip Technology Inc.
DS40000153E-page 5
HCS500
The following checks are performed by the decoder to
determine if the transmission is valid during learn:
• The first code word is checked for bit integrity
• The second code word is checked for bit integrity
• The crypt key is generated according to the
selected algorithm
• The hopping code is decrypted
• The discrimination value is checked
• If all the checks pass, the key, serial number
check value, and synchronization counter values
are stored in EEPROM memory
3.3
The decoder waits for a transmission and checks the
serial number to determine if it is a learned transmitter.
If it is, it takes the code hopping portion of the
transmission and decrypts it, using the crypt key. It
uses the discrimination value to determine if the
decryption was valid. If everything up to this point is
valid, the synchronization counter value is evaluated.
3.4
1.
FIGURE 3-1:
2.
3.
Enter Learn
Mode
4.
5.
Wait for Reception
of a Valid Code
6.
Wait for Reception
of Second
Non-Repeated
Valid Code
Validation Steps
Validation consists of the following steps:
Figure 3-1 shows a flow chart of the learn sequence.
LEARN SEQUENCE
Validation of Codes
Search EEPROM to find the Serial Number
Check Value Match
Decrypt the Hopping Code
Compare the 10 bits of the discrimination value
with the lower 10 bits of serial number
Check if the synchronization counter value falls
within the first synchronization window.
Check if the synchronization counter value falls
within the second synchronization window.
If a valid transmission is found, update the
synchronization counter, else use the next
transmitter block, and repeat the tests.
Generate Key
from Serial Number/
Seed Value
Use Generated Key
to Decrypt
Compare Discrimination
Value with Serial Number
Equal?
No
Yes
Learn successful. Store:
Learn
Unsuccessful
Serial number check value
crypt key
Sync. counter value
Exit
DS40000153E-page 6
2001-2015 Microchip Technology Inc.
HCS500
FIGURE 3-2:
DECODER OPERATION
Start
Yes
Does
Ser # Check Val
Match?
Yes
Decrypt Transmission
No
Is
decryption
valid?
Yes
Is
Yes
counter within
16?
Synchronization with Decoder
(Evaluating the Counter)
The KEELOQ technology patent scope includes a
sophisticated synchronization technique that does not
require the calculation and storage of future codes. The
technique securely blocks invalid transmissions while
providing transparent resynchronization to transmitters
inadvertently activated away from the receiver.
No Transmission
Received?
No
3.5
Execute
Command
and
Update
Counter
No
Is
No counter
within
16K?
Yes
Save Counter
in Temp Location
Figure 3-3 shows a 3-partition, rotating synchronization
window. The size of each window is optional but the
technique is fundamental. Each time a transmission is
authenticated, the intended function is executed and
the transmission's synchronization counter value is
stored in EEPROM. From the currently stored counter
value there is an initial “Single Operation” forward
window of 16 codes. If the difference between a
received synchronization counter and the last stored
counter is within 16, the intended function will be
executed on the single button press and the new
synchronization counter will be stored. Storing the new
synchronization counter value effectively rotates the
entire synchronization window.
A “Double Operation” (resynchronization) window
further exists from the Single Operation window up to
32K codes forward of the currently stored counter
value. It is referred to as “Double Operation” because a
transmission with synchronization counter value in this
window will require an additional, sequential counter
transmission prior to executing the intended function.
Upon receiving the sequential transmission the
decoder executes the intended function and stores the
synchronization counter value. This resynchronization
occurs transparently to the user as it is human nature
to press the button a second time if the first was
unsuccessful.
The third window is a “Blocked Window” ranging from
the double operation window to the currently stored
synchronization counter value. Any transmission with
synchronization counter value within this window will
be ignored. This window excludes previously used,
perhaps code-grabbed transmissions from accessing
the system.
2001-2015 Microchip Technology Inc.
DS40000153E-page 7
HCS500
FIGURE 3-3:
SYNCHRONIZATION WINDOW
Entire Window
rotates to eliminate
use of previously
used codes
Blocked
Window
(32K Codes)
Stored
Synchronization
Counter Value
Double Operation
(resynchronization)
Window
(32K Codes)
DS40000153E-page 8
Single Operation
Window
(16 Codes)
2001-2015 Microchip Technology Inc.
HCS500
4.0
INTERFACING TO A
MICROCONTROLLER
acknowledge by taking the clock line high. The decoder
then takes the data line low. The microcontroller can
then begin clocking a data stream out of the HCS500.
The data stream consists of:
The HCS500 interfaces to a microcontroller via a
synchronous serial interface. A clock and data line are
used to communicate with the HCS500. The
microcontroller controls the clock line. There are two
groups of data transfer messages. The first is from the
decoder whenever the decoder receives a valid
transmission. The decoder signals reception of a valid
code by taking the data line high (maximum of 500 ms)
The microcontroller then services the request by
clocking out a data string from the decoder. The data
string contains the function code, the Status bit, and
block indicators. The second is from the controlling
microcontroller to the decoder in the form of a defined
command set.
•
•
•
•
•
Start bit ‘0’.
Two Status bits [REPEAT, VLOW].
4-bit function code [S3 S2 S1 S0].
Stop bit ‘1’.
Four bits indicating which block was used
[TX3…TX0].
• Four bits indicating the number of transmitters
learned into the decoder [CNT3…CNT0].
• 64 bits of the received transmission with the
hopping code decrypted.
Note:
Figure 4-1 shows the HCS500 decoder and the I/O
interface lines necessary to interface to a
microcontroller.
4.1
Data is always clocked in/out Least
Significant Bit (LSb) first.
The decoder will terminate the transmission of the data
stream at any point where the clock is kept low for
longer than 1 ms. Therefore, the microcontroller can
only clock out the required bits. A maximum of 80 bits
can be clocked out of the decoder.
Valid Transmission Message
The decoder informs the microcontroller of a valid
transmission by taking the data line high for up to
500 ms. The controlling microcontroller must
FIGURE 4-1:
HCS500 DECODER AND I/O INTERFACE LINES
VDD
RF RECEIVER
1K
1
2
3
4
A0
Vcc
A1
WP
A2
SCL
Vss
SD
8
1
7
2
6
3
5
4
24LC02
2001-2015 Microchip Technology Inc.
VDD
Vss
EE_CLK
RFIN
EE_DAT
S_CLK
MCLR
S_DAT
HCS500
8
SYNC CLOCK
7
6
SYNC DATA
5
MICRO RESET
DS40000153E-page 9
HCS500
FIGURE 4-2:
DECODER VALID TRANSMISSION MESSAGE
TPP1
TPP3
TCLKL
TCLKH
TDS
S_CLK
TCLKH
TCLA
TDHI
0
S_DAT
REPT VLOW S0
S1
S2
Decoder Signal Valid
Transmission
1
CNT0
CNT3 TX0
RX62 RX63
Ci
4.2.2
Command Mode
Cii
COLLISION DETECTION
The HCS500 uses collision detection to prevent
clashes between the decoder and microcontroller.
Whenever the decoder receives a valid transmission
the following sequence is followed:
MICROCONTROLLER COMMAND
MODE ACTIVATION
The microcontroller command consists of four parts.
The first part activates the Command mode, the
second part is the actual command, the third is the
address accessed, and the last part is the data. The
microcontroller starts the command by taking the clock
line high for up to 500 ms. The decoder acknowledges
the start-up sequence by taking the data line high. The
microcontroller takes the clock line low, after which the
decoder will take the data line low, tri-state the data line
and wait for the command to be clock in. The data must
be set up on the rising edge and will be sampled on the
falling edge of the clock line.
FIGURE 4-3:
RX1
Received String
B
4.2.1
RX0
TX3
Information
A
4.2
S3
• The decoder first checks to see if the clock line is
high. If the clock line is high, the valid
transmission notification is aborted, and the
microcontroller Command mode request is
serviced.
• The decoder takes the data line high and checks
that the clock line does not go high within 50 s. If
the clock line goes high, the valid transmission
notification is aborted and the Command mode
request is serviced.
• If the clock line goes high after 50 s but before
500 ms, the decoder will acknowledge by taking
the data line low.
• The microcontroller can then start to clock out the
80-bit data stream of the received transmission.
MICROCONTROLLER COMMAND MODE ACTIVATION
TCLKL
TREQ
TSTART
TADDR
TCMD
TCLKH
TDATA
TDS
CLK
C Data
LSB
MSB
LSB
MSB
LSB
MSB
TACK
TRESP
Decoder
Data
Start Command
A
DS40000153E-page 10
Command Byte
B
Address Byte
C
Data Byte
D
E
2001-2015 Microchip Technology Inc.
HCS500
4.2.3
COMMAND ACTIVATION TIMES
The command activation time (Table 4-1) is defined as
the maximum time the microcontroller has to wait for a
response from the decoder. The decoder will abort and
service the command request. The response time
depends on the state of the decoder when the
Command mode is requested.
TABLE 4-1:
4.2.4
DECODER COMMANDS
The command byte specifies the operation required by
the controlling microcontroller. Table 4-2 lists the
commands.
COMMAND ACTIVATION TIMES
Decoder State
Min
Max
While receiving transmissions
—
2.5 ms BPWMAX = 2.7 ms
During the validation of a received transmission
—
3 ms
During the update of the sync counters
—
40 ms
During learn
—
170 ms
Note:
*These parameters are characterized but not tested.
TABLE 4-2:
DECODER COMMANDS
Instruction
Command Byte
Operation
F016
Read a byte from user EEPROM
WRITE
E116
Write a byte to user EEPROM
ACTIVATE_LRN
D216
Activate a learn sequence on the decoder
ERASE_ALL
C316
Activate an erase all function on the decoder
PROGRAM
B416
Program manufacturer’s code and Configuration byte
READ
2001-2015 Microchip Technology Inc.
DS40000153E-page 11
HCS500
4.2.5
READ BYTE/S FROM USER
EEPROM
4.2.6
The Write command (Figure 4-5) is used to write a
location in the user EEPROM. The address byte is
truncated to seven bits (C to D). The data is clocked in
Least Significant bit first. The clock line must be
asserted to initiate the write. Sequential writes of bytes
are possible by clocking in the byte and then asserting
the clock line (D – F). The decoder will terminate the
Write command if no clock pulses are received for a
period longer than 1.2 ms. After a successful write
sequence, the decoder will acknowledge by taking the
data line high and keeping it high until the clock line
goes low.
The Read command (Figure 4-4) is used to read bytes
from the user EEPROM. The offset in the user
EEPROM is specified by the address byte which is
truncated to seven bits (C to D). After the address, a
dummy byte must be clocked in (D to E). The EEPROM
data byte is clocked out on the next rising edge of the
clock line with the Least Significant bit first (E to F).
Sequential reads are possible by repeating sequence E
to F within 1 ms after the falling edge of the previous
byte’s Most Significant Bit (MSb) bit. During the
sequential read, the address value will wrap after 128
bytes. The decoder will terminate the Read command
if no clock pulses are received for a period longer than
1.2 ms.
FIGURE 4-4:
WRITE BYTE/S TO USER EEPROM
READ BYTES FROM USER EEPROM
TRD
TRD
CLK
C DATA
LSB
MSB
LSB
MSB
LSB
MSB
MSB
LSB
Decoder
DATA
Start Command
A
FIGURE 4-5:
Address Byte
Command Byte
B
Dummy Byte
C
Data Byte
D
F
E
WRITE BYTES TO USER EEPROM
TACK
TWR
TRESP
CLK
C DATA
LSB
MSB
LSB
MSB
LSB
MSB
TACK2
Decoder
DATA
Start Command
A
DS40000153E-page 12
Address Byte
Command Byte
B
C
Data Byte
D
Acknowledge
E
F
2001-2015 Microchip Technology Inc.
HCS500
4.2.7
ACTIVATE LEARN
Upon reception of the second transmission, the
decoder will respond with a learn status message
(Figure 4-8).
The activate Learn command (Figure 4-6) is used to
activate a transmitter learning sequence on the
decoder. The command consists of a Command mode
activation sequence, a command byte, and two dummy
bytes. The decoder will respond by taking the data line
high to acknowledge that the command was valid and
that learn is active.
The learn status message after
transmission consists of the following:
second
• 1 Start bit.
• The function code [S3:S0] of the message is zero,
indicating that this is a status string.
• The RESULT bit indicates the result of the learn
sequence. The RESULT bit is set if successful
and cleared otherwise.
• The OVR bit will indicate whether an exiting
transmitter is over written. The OVR bit will be set
if an existing transmitter is learned over.
• The [CNT3…CNT0] bits will indicate the number
of transmitters learned on the decoder.
• The [TX3…TX0] bits indicate the block number
used during the learning of the transmitter.
Upon reception of the first transmission, the decoder
will respond with a learn status message (Figure 4-7).
During learn, the decoder will acknowledge the
reception of the first transmission by taking the data line
high for 60 ms. The controlling microcontroller can
clock out at most eight bits, which will all be zeros. All
of the bits of the status byte are zero, and this is used
to distinguish between a learn time-out status string
and the first transmission received string. The
controlling microcontroller must ensure that the clock
line does not go high 60 ms after the falling edge of the
data line, for this will terminate learn.
FIGURE 4-6:
the
LEARN MODE ACTIVATION
TACK
TLRN
TRESP
CLK
C DATA
MSB
LSB
Decoder
DATA
Start Command
A
LSB
Command Byte
LSB
MSB
TACK2
Dummy Byte
Dummy Byte
B
FIGURE 4-7:
MSB
Acknowledge
D
C
E
F
LEARN STATUS MESSAGE AFTER FIRST TRANSMISSION
TCA
TCLL
TDS
TCLKH
CLK
TCLH
TCLA
TCLKL
TDHI
0
Decoder
Data
0
Command Request
A
FIGURE 4-8:
0
0
0
0
0
0
Status Byte
B
C
LEARN STATUS MESSAGE AFTER SECOND TRANSMISSION
TCA
TCLL
TCLKL
TDS
TCLKH
CLK
TCLH
TCLA
TDHI
0 OVR RSLT
Decoder
Data
Communications Request
A
0
0
0
0
1
CNT0
CNT3 TX0
TX3
RX0
Learn Status Bits
B
2001-2015 Microchip Technology Inc.
RX1
RX62 RX63
Decoded Tx
Ci
Cii
DS40000153E-page 13
HCS500
4.2.8
ERASE ALL
The Erase All command (Figure 4-9) erases all the
transmitters in the decoder. After the command and two
dummy bytes are clocked in, the clock line must be
asserted to activate the command. After a successful
completion of an erase all command, the data line is
asserted until the clock line goes low.
4.3
Stand-Alone Mode
The HCS500 decoder can also be used in stand-alone
applications. The HCS500 will activate the data line for
up to 500 ms if a valid transmission was received, and
this output can be used to drive a relay circuit. To
activate Learn or Erase All commands, a button must
be connected to the CLK input. User feedback is
indicated on an LED connected to the DATA output line.
If the CLK line is pulled high, using the learn button, the
LED will switch on. After the CLK line is kept high for
longer than two seconds, the decoder will switch the
LED line off, indicating that learn will be entered if the
button is released. If the CLK line is kept high for
another six seconds, the decoder will activate an
ERASE_ALL Command.
Learn mode can be aborted by taking the clock line
high until the data line goes high (LED switches on).
During learn, the data line will give feedback to the user
and, therefore, must not be connected to the relay drive
circuitry.
Note:
The REPS bit must be cleared in the
Configuration byte in Stand-Alone mode.
After taking the clock low and before a transmitter is
learn, any low-to-high change on the clock line may
terminate learn. This has learn implications when a
switch with contact bounce is used.
4.4
Erase All Command and Erase
Command
The Table 4-3 describes two versions of the Erase All
command.
TABLE 4-3:
ERASE ALL COMMAND
Command
Byte
Subcommand
Byte
C316
0016
Erase all
transmitters.
0116
Erase all transmitters except ‘1’. The
first transmitter in
memory is not
erased.
C316
DS40000153E-page 14
Subcommand 01 can be used where a transmitter with
permanent status is implemented in the microcontroller
software. Use of subcommand 01 ensures that the
permanent transmitter remains in memory even when
all other transmitters are erased. The first transmitter
learned after any of the following events is the first
transmitter in memory and becomes the permanent
transmitter:
1.
2.
4.5
Programming of the manufacturer’s code.
Erasing of all transmitters
(subcommand 00 only).
Test mode
A special test mode is activated after:
1.
2.
Programming of the manufacturer’s code.
Erasing of all transmitters.
Test mode can be used to test a decoder before any
transmitters are learned on it. Test mode enables testing of decoders without spending the time to learn a
transmitter. Test mode is terminated after the first
successful learning of an ordinary transmitter. In Test
mode, the decoder responds to a test transmitter. The
test transmitter has the following properties:
1.
2.
3.
4.
crypt key = manufacturer’s code.
Serial number = any value.
Discrimination bits = lower ten bits of the serial
number.
Synchronization counter value = any value
(synchronization information is ignored).
Because the synchronization counter value is ignored
in Test mode, any number of test transmitters can be
used, even if their synchronization counter values are
different.
4.6
Power Supply Supervisor
Reliable operation of the HCS500 requires that the
contents of the EEPROM memory be protected against
erroneous writes. To ensure that erroneous writes do
not occur after supply voltage “brown-out” conditions,
the use of a proper power supply supervisor device
(like Microchip part MCP100-450) is imperative.
Description
2001-2015 Microchip Technology Inc.
HCS500
FIGURE 4-9:
ERASE ALL
TACK
TERA
TRESP
CLK
C DATA
LSB
MSB
LSB
MSB
LSB
MSB
TACK2
Decoder
DATA
Start Command
A
Subcommand Byte
Command Byte
B
Dummy Byte
Acknowledge
D
C
E
F
FIGURE 4-10: STAND-ALONE MODE LEARN/ERASE-ALL TIMING
TPP1
TPP2
TPP3
TPP4
CLK
DATA
Learn Activation
A
B
Erase-All Activation
Successful
C
E
D
FIGURE 4-11: TYPICAL STAND-ALONE APPLICATION CIRCUIT
OUTPUT
Vcc
Vcc
VCC
RF
Receiver
LEARN
1K
1
2
3
4
A0
A1
A2
VSS
VCC
WP
SCL
SDA
RELAY SPST
1
2
3
4
8
7
6
5
VDD
VSS 8
EECLK RFIN 7
EEDAT SCLK 6
5
MCLR SDAT
HCS500
24LC02B
22 F
VCC
Power Supply
Supervisor
Vi
10K
10K
LED
RST
MCP100-4.5
Note:
NPN
10K
In-circuit
Programming
Probe Pads (Note)
Because each HCS500 is individually matched to its EEPROM, in-circuit programming is
strongly recommended.
2001-2015 Microchip Technology Inc.
DS40000153E-page 15
HCS500
5.0
DECODER PROGRAMMING
The decoder uses a 2K, 24LC02B serial EEPROM. The memory is divided between system memory that stores the
transmitter information (read protected) and user memory (read/write). Commands to access the user memory are
described in Sections 4.2.5 and 4.2.6.
The following information stored in system memory needs to be programmed before the decoder can be used:
• 64-bit manufacturer’s code
• Decoder Configuration byte
Note 1: These memory locations are read protected and can only be written to using the program command with
the device powered up.
2: The contents of the system memory is encrypted by a unique 64-bit key that is stored in the HCS500. To
initialize the system memory, the HCS500’s program command must be used. The EEPROM and HCS500
are matched, and the devices must be kept together. In-circuit programming is therefore recommended.
5.1
Configuration Byte
The decoder is configured during initialization by setting the appropriate bits in the Configuration byte. The following
table list the options:
TABLE 5-1:
Bit
5.1.1
DECODER INITIALIZATION USING CONFIGURATION BYTE
Mnemonic
Description
0
LRN_MODE
Learning mode selection
LRN_MODE = ‘0’—Normal Learn
LRN_MODE = ‘1’—Secure Learn
1
LRN_ALG
Algorithm selection
LRN_ALG = ‘0’—KEELOQ Decryption Algorithm
LRN_ALG = ‘1’—XOR Algorithm
2
REPEAT
Repeat Transmission enable
0 = Disable
1 = Enabled
3
Not Used
Reserved
4
Not Used
Reserved
5
Not Used
Reserved
6
Not Used
Reserved
7
Not Used
Reserved
LRN_MODE
LRN_MODE selects between two learning modes. With LRN_MODE = 0, the Normal (serial number derived) mode is
selected; with LRN_MODE = 1, the Secure (seed derived) mode is selected. See Section 6.0 “Key Generation” for
more detail on learning modes.
5.1.2
LRN_ALG
LRN_ALG selects between the two available algorithms. With LRN_ALG = 0 selected, the KEELOQ decryption algorithm
is selected; with LRN_ALG = 1, the XOR algorithm is selected. See Section 6.0 “Key Generation” for more detail on
learning algorithms.
5.1.3
REPEAT
The HCS500 can be configured to indicate repeated transmissions. In a stand-alone configuration, repeated
transmissions must be disabled.
DS40000153E-page 16
2001-2015 Microchip Technology Inc.
HCS500
5.2
Programming Waveform
5.3
The programming command consists of the following:
•
•
•
•
•
A total of 80 bits are clocked into the decoder. The 8-bit
command byte is clocked in first, followed by the 8-bit
Configuration byte and the 64-bit manufacturer’s code.
The data must be clocked in Least Significant Bit (LSB)
first. The decoder will then encrypt the manufacturer’s
code using the decoder’s unique 64-bit EEPROM crypt
key. After completion of the programming EEPROM,
the decoder will acknowledge by taking the data line
high (G to H). If the data line goes high within 30 ms
after the clock goes high, programming also fails.
Command Request Sequence (A to B)
Command Byte (B to C)
Configuration Byte (C to D)
Manufacturer’s Code Eight Data Bytes (D to G)
Activation and Acknowledge Sequence (G to H)
FIGURE 5-1:
Programming Data String
PROGRAMMING WAVEFORM
TCMD
TCLKL
TPP1
TPP3
TADDR
TCLKH
TDATA
TDATA
TACK
TWT2
TDS
CLK
C DATA
LSB
MSB
LSB
MSB
MSB
LSB
MSB
TPP2TPP4
TAW
DECODER
DATA
Start Command
A
Configuration Byte
Command Byte
B
2001-2015 Microchip Technology Inc.
C
Least Significant Byte
D
E
Most Significant Byte
F
Acknowledge
G
H
DS40000153E-page 17
HCS500
6.0
KEY GENERATION
The HCS500 supports three learning schemes which are selected during the initialization of the system EEPROM. The
learning schemes are:
• Normal learn using the KEELOQ decryption algorithm
• Secure learn using the KEELOQ decryption algorithm
• Secure learn using the XOR algorithm
6.1
Normal (Serial Number derived) Learn using the KEELOQ Decryption Algorithm
This learning scheme uses the KEELOQ decryption algorithm and the 28-bit serial number of the transmitter to derive
the crypt key. The 28-bit serial number is patched with predefined values as indicated below to form two 32-bit seeds.
SourceH = 60000000 00000000H + Serial Number | 28 Bits
SourceL = 20000000 00000000H + Serial Number | 28 Bits
Then, using the KEELOQ decryption algorithm and the manufacturer’s code the crypt key is derived as follows:
KeyH Upper 32 bits = F KEELOQ Decryption (SourceH) | 64-Bit Manufacturer’s Code
KeyL Lower 32 bits = F KEELOQ Decryption (SourceL) | 64-Bit Manufacturer’s Code
6.2
Secure (Seed Derived) Learn using the KEELOQ Decryption Algorithm
This scheme uses the secure seed transmitted by the encoder to derive the two input seeds. The decoder always uses
the lower 64 bits of the transmission to form a 60-bit seed. The upper four bits are always forced to zero.
For 32-bit seed encoders (HCS200, HCS201, HCS300, HCS301):
SourceH = Serial Number Lower 28 bits
SourceL = Seed 32 bits
For 48-bit seed encoders (HCS360, HCS361):
SourceH = Serial Number (with upper four bits set to zero) Upper 16 bits
工商网监
湘ICP备2023018690号
