HCS410T-I/ST_技术文档

M

HCS410

Code Hopping Encoder and Transponder*

FEATURES

PACKAGE TYPES

Security

PDIP, SOIC

• Two programmable 64-bit encoder keys

• 16/32-bit bi-directional challenge and response

using one of two keys

S0

S1

1

2

3

4

8

7

6

5

VDD

LC0

• 69-bit transmission length

• 32-bit unidirectional code hopping, 37-bit

nonencrypted portion

S2/LED

LC1

PWM

GND

• Encoder keys are read protected

• Programmable 28/32-bit serial number

• 60/64-bit, read-protected seed for secure learning

• Three IFF encryption algorithms

• Delayed increment mechanism

1

8

7

6

5

S2/LED

LC1

GND

PWM

S1

S0

VDD

LC0

TSSOP

2

3

4

• Asynchronous transponder communication

• Queuing information transmitted

BLOCK DIAGRAM

Operating

• 2.0V to 6.6V operation, 13V encoder only

operation

Oscillator

VDD

Power

Control

• Three switch inputs [S2, S1, S0]—seven functions

• Batteryless bi-directional transponder

• Selectable baud rate and code word blanking

• Automatic code word completion

• Battery low signal transmitted

Conﬁguration Register

Address

EEPROM

S0

S1

Debounce

Decoding

Wakeup

Logic

Control

and

Queuer

• Nonvolatile synchronization

• PWM or Manchester RF encoding

• Combined transmitter, transponder operation

• Anti-collision of multiple transponders

• Passive proximity activation

• Device protected against reverse battery

• Intelligent damping for high Q LC-circuits

S2

LED

Control

PPM

Detector

LCI0

LCI1

PWM

PPM

Manch.

Encoder

Other

• 37-bit nonencrypted part contains 28/32-bit serial

number, 4/0-bit function code, 1-bit battery low,

2-bit CRC, 2-bit queue

PWM

Driver

• Simple programming interface

• On-chip tunable RC oscillator (±10%)

• On-chip EEPROM

• 64-bit user EEPROM in transponder mode

• Battery-low LED indication

• SQTP serialization quick-time programming

• 8-pin PDIP/SOIC/TSSOP and die

Typical Applications

• Automotive remote entry systems

• Automotive alarm systems

• Automotive immobilizers

• Gate and garage openers

• Electronic door locks (Home/Ofﬁce/Hotel)

• Burglar alarm systems

• Proximity access control

KEELOQ is a registered trademark of Microchip Technology Inc.

*Code hopping encoder patents issued in Europe, U.S.A., R.S.A.—U.S.A.: 5,517,187; Europe: 0459781

1997 Microchip Technology Inc.

Preliminary

DS40158C-page 1

HCS410

Table of Contents

1.0 System Overview ....................................................................................................................................................3

1.1 Key Terms ........................................................................................................................................................3

1.2 KEELOQ Code Hopping Encoders .....................................................................................................................4

1.3 KEELOQ IFF ......................................................................................................................................................5

2.0 Device Operation ....................................................................................................................................................6

2.1 Pinout Description ............................................................................................................................................7

2.2 Code Hopping Mode (CH Mode) .....................................................................................................................8

2.3 Code Hopping Mode Special Features ..........................................................................................................11

2.4 IFF Mode ........................................................................................................................................................14

2.5 IFF Opcodes ..................................................................................................................................................17

2.6 IFF Special Features ......................................................................................................................................18

2.7 LED Indicator .................................................................................................................................................18

3.0 EEPROM Organization and Configuration ............................................................................................................19

3.1 Encoder Key 1 and 2 .....................................................................................................................................19

3.2 Discrimination Value and Overflow ................................................................................................................19

3.3 16-bit Synchronization Counter ......................................................................................................................19

3.4 60/64-bit Seed Word/Transport Code ............................................................................................................20

3.5 Encoder Serial Number ..................................................................................................................................20

3.6 User Data .......................................................................................................................................................20

3.7 Configuration Data .........................................................................................................................................21

4.0 Integrating the HCS410 into a System ..................................................................................................................23

4.1 Key Generation ..............................................................................................................................................23

4.2 Learning an HCS410 to a Receiver ...............................................................................................................24

4.3 CH Mode Decoder Operation ........................................................................................................................25

4.4 IFF Decoder Operation ..................................................................................................................................27

5.0 Electrical Characteristics .......................................................................................................................................28

HCS410 Product Identification System ........................................................................................................................35

DS40158C-page 2

Preliminary

1997 Microchip Technology Inc.

HCS410

DESCRIPTION

1.0

SYSTEM OVERVIEW

The HCS410 is a code hopping transponder device

designed for secure entry systems. The HCS410 uti-

lizes the patented KEELOQ code hopping system and

bi-directional challenge-and-response for logical and

physical access control. High security learning mecha-

nisms make this a turnkey solution when used with the

KEELOQ decoders. The encoder keys and synchroniza-

tion information are stored in protected on-chip

EEPROM.

1.1

Key Terms

• Anticollision – Allows two transponders to be in

the ﬁles simultaneously and be veriﬁed individu-

ally.

• CH Mode – Code Hopping Mode. The HCS410

transmits a 69-bit transmission each time it is acti-

vated, with at least 32-bits changing each time the

encoder is activated.

• Encoder Key – A unique 64-bit key generated and

programmed into the encoder during the manu-

facturing process. The encoder key controls the

encryption algorithm and is stored in EEPROM on

the encoder device.

A low cost batteryless transponder can be imple-

mented with the addition of an inductor and two capac-

itors. A packaged module including the inductor and

capacitor will also be offered.

A single HCS410 can be used as an encoder for

Remote Keyless Entry (RKE) and a transponder for

immobilization in the same circuit and thereby dramat-

ically reducing the cost of hybrid transmitter/transpon-

der circuits.

• IFF – Identify friend or foe is a means of validating

a token. A decoder sends a random challenge to

the token and checks that the response of the

token is a valid response.

• KEELOQ Encryption Algorithm – The high security

level of the HCS410 is based on the patented

KEELOQ technology. A block cipher encryption

algorithm based on a block length of 32 bits and a

key length of 64 bits is used. The algorithm

obscures the information in such a way that even

if the unencrypted/challenge information differs by

only one bit from the information in the previous

transmission/challenge, the next coded transmis-

sion/response will be totally different. Statistically,

if only one bit in the 32-bit string of information

changes, approximately 50 percent of the coded

transmission will change.

• Learn – The HCS product family facilitates several

learning strategies to be implemented on the

decoder. The following are examples of what can

be done.

Normal Learn –The receiver uses the same infor-

mation that is transmitted during normal operation to

derive the transmitter’s encoder key, decrypt the dis-

crimination value and the synchronization counter.

Secure Learn* – The transmitter is activated through

a special button combination to transmit a stored

60-bit value (random seed) that can be used for key

generation or be part of the key. Transmission of the

random seed can be disabled after learning is com-

pleted.

• Manufacturer’s Code – A 64-bit word, unique to

each manufacturer, used to produce a unique

encoder key in each transmitter (encoder).

• Passive Proximity Activation – When the HCS410

is brought into in a magnetic ﬁeld without a

command given by the base station, the HCS410

can be programmed to give an RF transmission.

• Transport Code – A 32-bit transport code needs

to be given before the HCS410 can be inductively

programmed. This prevents accidental

programming of the HCS410.

*Secure Learn patent pending.

1997 Microchip Technology Inc.

Preliminary

DS40158C-page 3

HCS410

The HCS410 has a small EEPROM array which must

be loaded with several parameters before use. The

most important of these values are:

1.2

KEELOQ Code Hopping Encoders

When the HCS410 is used as a code hopping encoder

device, it is ideally suited to keyless entry systems,

primarily for vehicles and home garage door openers.

It is meant to be a cost-effective, yet secure solution to

such systems. The encoder portion of a keyless entry

system is meant to be carried by the user and operated

to gain access to a vehicle or restricted area.

• A 28/32-bit serial number which is meant to be

unique for every encoder

• 64-bit seed value

• A 64-bit encoder key that is generated at the time

of production

• A 16-bit synchronization counter value.

• Conﬁguration options

Most keyless entry systems transmit the same code

from a transmitter every time a button is pushed. The

relative number of code combinations for a low end

system is also a relatively small number. These

shortcomings provide the means for a sophisticated

thief to create a device that ‘grabs’ a transmission and

retransmits it later or a device that scans all possible

combinations until the correct one is found.

The 16-bit synchronization counter value is the basis

for the transmitted code changing for each transmis-

sion, and is updated each time a button is pressed.

Because of the complexity of the code hopping encryp-

tion algorithm, a change in one bit of the synchroniza-

tion counter value will result in a large change in the

actual transmitted code.

The HCS410 employs the KEELOQ code hopping tech-

nology and an encryption algorithm to achieve a high

level of security. Code hopping is a method by which

the code transmitted from the transmitter to the

receiver is different every time a button is pushed. This

method, coupled with a transmission length of 69 bits,

virtually eliminates the use of code ‘grabbing’ or code

‘scanning’.

Once the encoder detects that a button has been

pressed, the encoder reads the button and updates the

synchronization counter. The synchronization counter

value, the function bits, and the discrimination value are

then combined with the encoder key in the encryption

algorithm, and the output is 32 bits of encrypted infor-

mation (Figure 1-1). The code hopping portion pro-

vides up to four billion changing code combinations.

This data will change with every button press, hence, it

is referred to as the code hopping portion of the code

word.

The 32-bit code hopping portion is combined with the

button information and the serial number to form the

code word transmitted to the receiver. The code word

format is explained in detail in Section 2.2.

FIGURE 1-1: BASIC OPERATION OF A CODE HOPPING TRANSMITTER (ENCODER)

Transmitted Information

KEELOQ

Encryption

Algorithm

Button Press

Information

32 Bits of

Encrypted Data

Serial Number

EEPROM Array

Encoder Key

Sync Counter

Serial Number

DS40158C-page 4

Preliminary

1997 Microchip Technology Inc.

HCS410

The HCS410 can do either 16 or 32-bit IFF. The

HCS410 has two encryption algorithms that can be

used to generate a response to a challenge. In addition

there are up to two encoder keys that can be used by

the HCS410. Typically each HCS410 will be pro-

grammed with a unique encoder key(s).

1.3

KEELOQ IFF

The HCS410 can be used as an IFF transponder for

veriﬁcation of a token. In IFF mode the HCS410 is ide-

ally suited for authentication of a key before disarming

a vehicle immobilizer. Once the key has been inserted

in the car’s ignition the decoder would inductively poll

the key validating it before disarming the immobilizer.

In IFF mode, the HCS410 will wait for a command from

the base station and respond to the command. The

command can either request a read/write from user

EEPROM or an IFF challenge response. A given 16 or

32-bit challenge will produce a unique 16/32-bit

response, based on the IFF key and IFF algorithm

used.

IFF validation of the token involves a random challenge

being sent by a decoder to a token.The token then gen-

erates a response to the challenge and sends this

response to the decoder (Figure 1-2).The decoder cal-

culates an expected response using the same chal-

lenge. The expected response is compared to the

response received from the token. If the responses

match, the token is identiﬁed as a valid token and the

decoder can take appropriate action.

FIGURE 1-2: IBASIC OPERATION OF AN IFF TOKEN

Challenge Received from Decoder

Read by Decoder

EEPROM Array

IFF Key

KEELOQ

IFF

Algorithm

Response

Serial Number

1997 Microchip Technology Inc.

Preliminary

DS40158C-page 5

HCS410

Figure 2-4 shows how to use the HCS410 with a 12V

battery as a code hopping transmitter. The circuit uses

the internal regulator, normally used for charging a

capacitor/battery in LC mode, to generate a 6V supply

for the HCS410.

2.0

DEVICE OPERATION

The HCS410 can either operate as a normal code hop-

ping transmitter with one or two IFF keys (Figure 2-1) or

as purely an IFF token with two IFF keys (Figure 2-2

and Figure 2-3). When used as a code hopping trans-

mitter the HCS410 only needs the addition of buttons

and RF circuitry for use as a transmitter. Adding the

transponder function to the transmitter requires the

addition of an inductor and two capacitors as shown in

Figure 2-1 and Figure 2-2. A description of each pin is

given in Table 2-1. Table 2-2 shows the function codes

for using the HCS410.

FIGURE 2-4: HCS410 ENCODER WITH 12V

BATTERY

12V

6.3V

1

8

2

3

7

6

FIGURE 2-1: COMBINED TRANSMITTER/

TRANSPONDER CIRCUIT

RF

4

5

1

8

2

3

7

6

1 µF

RF

4

5

FIGURE 2-5: LED CONNECTION TO

S2/LED OUTPUT

VDD

FIGURE 2-2: TRANSPONDER CIRCUIT

1

8

Pulse

220Ω

2

3

7

6

30Ω

1 µF

S2/LED

4

5

60k

FIGURE 2-6: LC PIN BLOCK DIAGRAM

FIGURE 2-3: 2-WIRE, 1 OR 2-KEY IFF

TOKEN

LCI1

100Ω

VDD

15V

6.7V

1

8

1 µF

Rectiﬁer,

Damping,

Clamping

2

3

7

6

Data I/O

Damp

LCI0

100Ω

4

5

Out

15V

Detector

MOD

DS40158C-page 6

Preliminary

1997 Microchip Technology Inc.

HCS410

• S[0:1] – are inputs with Schmitt Trigger detectors

and an internal 60kΩ (nominal) pull-down

resistors.

2.1

Pinout Description

The HCS410 has the same footprint as all of the other

devices in the KEELOQ family, except for the two pins

that are reserved for transponder operations and the

LED that is now located at the same position as the S2

switch input.

• S2/LED – uses the same input detection circuit as

S0/S1 but with an added PMOS transistor con-

nected to VDD capable of sourcing enough current

to drive an LED.

• LC[0:1] – is the transponder interface pins to be

connected to an LC circuit for inductive communi-

cation. LC0 is connected to a detector for data

input. Data output is achieved by clamping LC0

and LC1 to GND through two NMOS transistors.

These pins are also connected to a rectiﬁer and a

regulator, providing power to the rest of the logic

and for charging an external power source (Bat-

tery/Capacitor) through VDD.

TABLE 2-1:

PINOUT DESCRIPTION

Name

Pin Number

Description

S0

S1

1

2

3

4

5

6

Switch input 0

Switch input 1

S2/LED

LC1

Switch input 2/LED output, Clock pin for programming mode

Transponder interface pin

VSS

Ground reference connection

PWM

Pulse width modulation (PWM)

output pin/Data pin for

programming mode

LC0

VDD

7

8

Transponder interface pin.

Positive supply voltage connection

TABLE 2-2:

FUNCTION CODES

LC0

S2

S1

S0

Comments

1

2

0

1

0

Normal Code Hopping transmission

Delayed seed transmission if allowed by SEED and TMPSD/Normal

Code Hopping transmission

3

0

1

4

5

6

0

1

0

1

0

1

0

Normal Code Hopping transmission

Immediate seed transmission if allowed by SEED and TMPSD/Normal

Code Hopping transmission

7

8

0

1

0

1

0

1

0

Transponder mode

1997 Microchip Technology Inc.

Preliminary

DS40158C-page 7

HCS410

If, during the transmit process, it is detected that a new

button(s) has been added, a reset will immediately be

forced and the code word will not be completed. Please

note that buttons removed will not have any effect on

the code word unless no buttons remain pressed in

which case the current code word will be completed

and the power down will occur. If, after a button combi-

nation is pressed, and the same button combination is

pressed again within 2 seconds of the ﬁrst press, the

current transmission will be aborted and a new trans-

mission will start with the queue counter (QUE)

incremented.

2.2

Code Hopping Mode (CH Mode)

The HCS410 wakes up upon detecting a switch closure

and then delays approximately 30 ms for switch

debounce (Figure 2-7). The synchronization counter

value, ﬁxed information, and switch information are

encrypted to form the code hopping portion. The

encrypted or code hopping portion of the transmission

changes every time a button is pressed, even if the

same button is pushed again. Keeping a button

pressed for a long time results in the same code word

being transmitted until the button is released or time-

out occurs. A code that has been transmitted will not

occur again for more than 64K transmissions. Overﬂow

information programmed into the encoder can be used

by the decoder to extend the number of unique trans-

missions to more than 192k.

FIGURE 2-7: CODE HOPPING ENCODER OPERATION

Power-up

(A button has been

pressed (Note1)

Sample Inputs

No

Yes

Complete current

Transmitted

7 complete code

words?

code word while

checking buttons

(Note 2)

Stop transmitting

immediately

Update Sync Info

Encrypt With

Encoder Key

Yes

No

Buttons

pressed?

(Note 1)

No

Buttons

pressed?

(Note 1)

No

2 second

time-out

completed?

Transmit

Yes

No

Yes

20 second

time-out

Same as

Yes

No

Yes

20-second

timeout

DINC Set?

No

completed?

Yes

No

Buttons added?

No

Yes

DINC

Set?

No

Yes

No

Increase sync

counter

Increment queue

counter

Power down

by 12

All buttons

released?

(Note 1)

Yes

Note 1: 30 ms debounce on press and release of all buttons.

2: Completes a minimum of 3 code words if MTX3 is set.

DS40158C-page 8

Preliminary

1997 Microchip Technology Inc.

HCS410

2.2.1

TRANSMISSION DATA FORMAT

The HCS410 transmits a 69-bit code word when a but-

ton is pressed. The 69-bit word is constructed from a

Fixed Code portion and Code Hopping portion

(Figure 2-8).

The HCS410 transmission (CH Mode) is made up of

several parts (Figure 2-10 and Figure 2-11). Each

transmission is begun with a preamble and a header,

followed by the encrypted and then the ﬁxed data. The

actual data is 69 bits which consists of 32 bits of

encrypted data and 37 bits of ﬁxed data. Each trans-

mission is followed by a guard period before another

transmission can begin. Refer to Table 5-4

and Table 5-5 for transmission timing speciﬁcations.

The Encrypted Data is generated from 4 function bits,

2 overﬂow bits, and 10 discrimination bits, and the 16-

bit synchronization counter value (Figure 2-8).

The Nonencrypted Code Data is made up of 2 QUE

bits, 2 CRC bits, a VLOW bit, 4 function bits, and the

28-bit serial number. If the extended serial number

(32 bits) is selected, the 4 function code bits will not be

transmitted (Figure 2-8).

The combined encrypted and nonencrypted sections

increase the number of combinations to 1.47 x 10

20

.

FIGURE 2-8: HOP CODE WORD ORGANIZATION (RIGHT-MOST BIT IS CLOCKED OUT FIRST)

Fixed Code Data

Encrypted Code Data

Button

Status*

Button

Status

Overﬂow (2 bits)

and

CRC

(2 bit)

VLOW

(1 bit)

QUE

(Q1, Q0

bit)

28-bit

Serial Number

16-bit

Synchronization

Counter Value

Discrimination

(4 bits)

bits (10 bits)

S2 S1 S0 0

MSB

LSB

69 bits

of Data

Transmitted

CRC

(2 bits)

VLOW

+

Serial Number and

Button Status (32 bits)

QUE

(2 bits)

+

32 bits of Encrypted Data

(1 bit)

* Optional.

FIGURE 2-9: SEED CODE WORD ORGANIZATION

Fixed Code Data

Button*

Status

CRC

(2 bit)

VLOW

(1 bit)

QUE0

(Q1, Q0

bit)

Unencrypted

SEED

(4 bits)

S2 S1 S0 0

69 bits

of Data

Transmitted

CRC

(2 bits)

VLOW Button

+

SEED

(60 bits)

QUE

(2 bits)

+

(1 bit) (4 bits)

* Optional.

1997 Microchip Technology Inc.

Preliminary

DS40158C-page 9

HCS410

2.2.2

TRANSMISSION DATA MODULE

The same code word is continuously sent as long as

the input pins are kept high with a guard time separat-

ing the code words. All of the timing values are in mul-

tiples of a Basic Timing Element (TE), which can be

changed using the baud rate option bits.

The Data Modulation Format is selectable between

Pulse Width Modulation (PWM) format and Manchester

encoding. Both formats are preceded by a preamble

and synchronization header, followed by the 69-bits of

data. Manchester encoding has a leading and closing

‘1’ for each code word.

FIGURE 2-10: TRANSMISSION FORMAT—MANCH = 0

1 CODE WORD

Encrypt

TOTAL TRANSMISSION:

Guard

Preamble Sync Encrypt

TE

Sync

Fixed

Preamble

CODE WORD:

LOGIC "0"

LOGIC "1"

BIT

TE

6

1

3 5 7 9

4 6 8 10

1

2

4 5

2

14 15 16

Encrypted

TX Data

Fixed Code

Sync

Preamble

Guard

Time

Data

Code Word

FIGURE 2-11: TRANSMISSION FORMAT—MANCH = 1

1 CODE WORD

TOTAL TRANSMISSION:

Preamble Sync Encrypt

Fixed

Guard

TE

CODE WORD:

LOGIC "0"

LOGIC "1"

Stop bit

BPW

6

Start bit

1

3

2

4

14 15 16

1

2

4

5

Guard

Time

Encrypted

Data

Fixed Code

Data

Preamble

Sync

CODE WORD

DS40158C-page 10

Preliminary

1997 Microchip Technology Inc.

HCS410

constraints on the average power that can be

transmitted by a device, and CWBE effectively prevents

continuous transmission by only allowing the transmis-

sion of every second or fourth word. This reduces the

average power transmitted and hence, assists in FCC

approval of a transmitter device.

2.3

Code Hopping Mode Special Features

2.3.1

CODE WORD COMPLETION

Code word completion is an automatic feature that

ensures that the entire code word is transmitted, even

if the button is released before the transmission is com-

plete. The HCS410 encoder powers itself up when a

button is pushed and powers itself down after the com-

mand is ﬁnished (Figure 2-7). If MTX3 is set in the con-

ﬁguration word, a minimum of three transmissions will

be transmitted when the HCS410 is activated, even if

the buttons are released.

The HCS410 will either transmit all code words, 1 in 2

or 1 in 4 code words, depending on the baud rate

selected and the code word blanking option. See

Section 3.7 for additional details.

2.3.3

CRC (CYCLE REDUNDANCY CHECK) BITS

The CRC bits are calculated on the 65 previously trans-

mitted bits. The CRC bits can be used by the receiver

to check the data integrity before processing starts.The

CRC can detect all single bit and 66% of double bit

errors. The CRC is computed as follows:

If less than seven words have been transmitted when

the buttons are released, the HCS410 will complete the

current word. If more than seven words have been

transmitted, and the button is released, the PWM out-

put is immediately switched off.

2.3.2

CODE WORD BLANKING ENABLE

EQUATION 2-1:

CRC CALCULATION

Federal Communications Commission (FCC) part 15

rules specify the limits on fundamental power and

harmonics that can be transmitted. Power is calculated

on the worst case average power transmitted in a

100ms window. It is therefore advantageous to

minimize the duty cycle of the transmitted word. This

can be achieved by minimizing the duty cycle of the

individual bits and by blanking out consecutive words.

Code Word Blanking Enable (CWBE) is used for

CRC[1]_{n + 1}= CRC[0]_nDi_n

and

with

CRC[0]_{n + 1}= (CRC[0]_nDi_n) CRC[1]_n

CRC[1, 0]₀= 0

reducing the average power of

(Figure 2-12). Using the CWBE allows the user to

transmit higher amplitude transmission if the

a transmission

and Di the nth transmission bit 0 ≤ n ≤ 64

n

a

transmission length is shorter. The FCC puts

FIGURE 2-12: CODE WORD BLANKING ENABLE

Amplitude

One Code Word

CWBE Disabled

(All words transmitted)

A

CWBE Enabled

2A

(1 out of 2 transmitted)

CWBE Enabled

4A

(1 out of 4 transmitted)

Time

1997 Microchip Technology Inc.

Preliminary

DS40158C-page 11

HCS410

2.3.4

SEED TRANSMISSION

2.3.7

VLOW: VOLTAGE LOW INDICATOR

In order to increase the level of security in a system, it

is possible for the receiver to implement what is known

as a secure learning function. This can be done by uti-

lizing the seed value on the HCS410 which is stored in

EEPROM. Instead of the normal key generation

method being used to create the encoder key, this seed

value is used and there should not be any mathemati-

cal relationship between serial numbers and seeds for

the best security. See Section 3.7.3 for additional

details.

The VLOW bit is transmitted with every transmission

(Figure 2-8). VLOW is set when the operating voltage

has dropped below the low voltage trip point, approxi-

mately 2.2V or 4.4V selectable at 25°C. This VLOW sig-

nal is transmitted so the receiver can give an indication

to the user that the transmitter battery is low.

2.3.8

QUE0:QUE1: QUEUING INFORMATION

If a button is pressed, released for more than 30 ms,

and pressed again within 2 seconds of the ﬁrst press,

the QUE counter is incremented (Figure 2-7). The

transmission that the HCS410 is busy with is aborted

and a new transmission is begun with the new QUE bits

set. These bits can be used by the decoder to perform

secondary functions using only a single button without

the requirement that the decoder receive more than

one completed transmission. For example if none of the

QUE bits are set the decoder only unlocks the driver’s

door, if QUE0 is set (double press on the transmitter)

the decoder unlocks all the doors.

2.3.5

PASSIVE PROXIMITY ACTIVATION

If the HCS410 is brought into a magnetic ﬁeld it enters

IFF mode. In this mode it sends out ACK pulses on the

LC lines. If the HCS410 doesn't receive any response

to the ﬁrst set of ack pulses within 50 ms the HCS410

will transmit a normal code hopping transmission for 2

seconds if XPRF is set in the conﬁguration word. The

function code during this transmission is S2:S0 = 000.

2.3.6

AUTO-SHUTOFF

Note 1: The QUE will not overﬂow.

The Auto-shutoff function automatically stops the

device from transmitting if a button inadvertently gets

pressed for a long period of time. This will prevent the

device from draining the battery if a button gets

pressed while the transmitter is in a pocket or purse.

Time-out period is approximately 20 seconds.

2: The button must be pressed for more than

50 ms.

FIGURE 2-13: QUE COUNTER TIMING DIAGRAM

1st Button Press

All Buttons Released

2nd Button Press

Input

Sx

DIO

Transmission

QUE = 00

QUE = 01

2

TLOW>30 ms

t <2S

t = 0

t > 50 ms

•Patents have been applied for.

DS40158C-page 12

Preliminary

1997 Microchip Technology Inc.

HCS410

2.3.9

LED OUTPUT

2.3.11 OTHER CONFIGURABLE OPTIONS

The S2/LED line can be used to drive a LED when the

HCS410 is transmitting. If this option is enabled in the

conﬁguration word the S2 line is driven high periodi-

cally when the HCS410 is transmitting as shown in

Figure 2-14. The LED output operates with a 30 ms on

and 480 ms off duty cycle when the supply voltage is

above the level indicated by the VLOW bit in the conﬁg-

uration word. When the supply voltage drops below the

voltage indicated by the VLOW bit the HCS410 will indi-

cate this by turning the LED on for 200ms at the start of

a transmission and remain off for the rest of the trans-

mission.

Other conﬁgurable code hopping options include an

• Transmission-rate selection

• Extended serial number.

These are described in more detail in Section 3.7.

2.3.10 DELAYED INCREMENT

The HCS410 has a delayed increment feature that

increments the counter by 12, 20 seconds after the last

button press occurred.The 20-second time-out is reset

and the queue counter will increment if another press

occurs before the 20 seconds expires. The queue

counter is cleared after the buttons have been released

for more than 2 seconds. Systems that use this feature

will circumvent the latest jamming-code grabbing

attackers.

FIGURE 2-14: LED INDICATION DURING TRANSMISSION

S Input

LED

VDD = VLOW Level

LED

VDD < VLOW LEVEL

200 ms

280 ms

30 ms

400 ms

1997 Microchip Technology Inc.

Preliminary

DS40158C-page 13

HCS410

2.4.1

IFF MODE ACTIVATION

2.4

IFF Mode

The HCS410 will enter IFF mode if the capacitor/induc-

tor resonant circuit generates a voltage greater than

approximately 1.0 volts on LC0. After the veriﬁed appli-

cation of power and elapse of the normal reset period,

the device will start responding by pulsing the DATA line

(LC0/1) with pulses as shown in Figure 2-17. This

action will continue until the pulse train is terminated by

receiving a start signal of duration 2TE, on the LC

inputs before the next expected marker pulse. The

device now enters the IFF mode and expects to receive

an ‘Opcode’ and a 0/16/32-bit Data-stream to react on.

The data rate (TE) is determined by the TBSL bits in the

conﬁguration word. See Section 3.0 for additional

details.

IFF mode allows the decoder to perform an IFF valida-

tion, to write to the user EEPROM and to read from the

user EEPROM. Each operation consists of the decoder

sending an opcode data and the HCS410 giving a

response.

There are two IFF modes: IFF1 and IFF2. IFF1 allows

only one key IFF, while IFF2 allows two keys to be used.

Note: When IFF2 is enabled, seed transmissions

will not be allowed.

It is possible to use the HCS410 as an IFF token with-

out using a magnetic ﬁeld for coupling. The HCS410

can be directly connected to the data line of the

decoder as shown in Figure 2-3. The HCS410 gets its

power from the data line as it would in normal transpon-

der mode. The communication is identical to the com-

munication used in transponder mode.

2.4.2

IFF DECODER COMMANDS

As shown in Figure 2-15, a logic 1 and 0 are differenti-

ated by the time between two rising edges. A long pulse

indicates a 1; a short pulse, a 0.

FIGURE 2-15: MODULATION FOR IFF COMMUNICATION

PPM Decoder Commands

PPM Encoder Response

Start or

0

3 TE

1 TE

TE TE

1

5 TE

1 TE

2 TE

TE

FIGURE 2-16: OVERVIEW OF IFF OPERATION

IFF

Activate

Opcode

32/16-bit Challenge

WRITE

32/16-bit IFF Response

OK

Opcode

16 bit Data

READ

Activate

Opcode

16 bit Data

Opcode

DS40158C-page 14

Preliminary

1997 Microchip Technology Inc.

HCS410

FIGURE 2-17: DECODER IFF COMMANDS AND WAVEFORMS

Read

Ack pulses

0 1

Response

16 bits

Start

2 TE

TRT

Write/Program

TE

TBITC

TWR

Transport

Code

32 bits

TOTD

TTTD

Data

16 bits

Ack pulses

Opcode

Writing

Only when writing Serial

Number, Conﬁg or IFF

programming

Repeat 18 times for programming

Challenge

16/32 bits

Response

16/32 bits

Ack pulses

Opcode

TOTD

Encoder Select

Encoder

Select

Ack

Serial number

1 to 32 bits

TABLE 2-3:

IFF TIMING PARAMETERS

Parameter

Symbol

Minimum

Typical

Maximum

Units

Time Element

IFFB = 0

TE

—

200

100

—

µs

TE

IFFB = 1

PPM Command Bit Time

Data = 1

TBITC

TBITR

3.5

5.5

4

6

—

Data = 0

PPM Response Bit Time

Data = 1

—

2

3

—

Data = 0

PPM Command Minimum High Time

Response Time (Minimum for Read)

Opcode to Data Input Time

TPMH

TRT

1.5

6.5

1.8

6.8

—

30

TE

ms

TOTD

TTTD

TWR

Transport Code to Data Input Time

IFF EEPROM Write Time (16 bits)

1997 Microchip Technology Inc.

Preliminary

DS40158C-page 15

HCS410

2.4.3

HCS410 RESPONSES

2.4.6

IFF READ

The responses from the HCS410 are in PPM format.

See Figure 2-17 for additional information

The decoder can read USER[0:3], SER[0:1], and the

conﬁguration word in the EEPROM. After the data has

been read, the device is ready to receive a command

again.

2.4.4

IFF RESPONSE

Each read command is followed by a 16-bit data

response. The response always starts with a leading

The 16/32-bit response to a 16/32-bit challenge, is

transmitted once, after which the device is ready to

accept another command. The same applies to the

result of a Read command. The opcode written to the

device speciﬁes the challenge length and algorithm

used.

preamble of 01 and then the 16-bits of data.

2

2.4.7

IFF PROGRAMMING

Upon receiving a programming opcode and the trans-

port code, the EEPROM is erased (Section 3.4).

Thereafter, the ﬁrst 16 bits of data can be written. After

indicating that a write command has been successfully

completed the device is ready to receive the next 16

bits. After a complete memory map was received, it will

be transmitted in PPM format on the LC pins as 16-bit

words. This enables wireless programming of the

device.

2.4.5

IFF WRITE

The decoder can write to USER[0:3], SER[0:1], and the

conﬁguration word in the EEPROM.

After the HCS410 has written the word into the

EEPROM, it will give two acknowledge pulses (TE wide

and TE apart) on the LC pins.

When writing to the serial number or conﬁguration

word, the user must send the transport code before the

write will begin (Section 3.4) .

After the EEPROM is erased, the conﬁguration word is

reloaded. This results in oscillator tuning bits of 0000

being used during programming. When using IFF pro-

gramming, the user should read the conﬁguration word

and store the oscillator bits in the memory map to be

programmed. A program command should be sent and

the next set of ACK pulses transmitted by the HCS410

should be used to determine the TE. A second program

command can then be sent, and the device pro-

grammed using the TE just calibrated.

Note: If the conﬁguration word is written, the

device must be reset to allow the new con-

ﬁguration settings to come into effect.

FIGURE 2-18: IFF INDUCTIVE IN RF OUT

Encoder

Select ACK

Response

(16 bits)

Opcode

(Read)

LCI0/1

PWM

Preamble

Response

(32 bits)

Header

Fixed Code

(37 bits)

32-bit Response

16-bit 16-bit

Response Response

DS40158C-page 16

Preliminary

1997 Microchip Technology Inc.

HCS410

2.5

IFF Opcodes

TABLE 2-4:

Command

00000

LIST OF IFF COMMANDS

Description

Expected data In

Response

Select HCS410, used if Anticolli- 1 to 32 bits of the serial number Encoder select acknowledge if

sion enabled

(SER)

None

SER match

00001

00010

Read conﬁguration word

Read high serial number

16-bit conﬁguration word

Higher 16 bits of serial number

(SER1)

00011

Read low serial number

None

Lower 16 bits of serial number

(SER0)

00100

00101

00110

00111

01000

Read user area 0

None

16 Bits of User EEPROM USR0

16 Bits of User EEPROM USR1

16 Bits of User EEPROM USR2

16 Bits of User EEPROM USR3

Read user area 1

Read user area 2

Read user area 3

Program HCS410 EEPROM

Transport code (32 bits); Com-

plete memory map: 18 x 16 bit

words (288 bits)

Write acknowledge pulse after

each 16-bit word, 288 bits trans-

mitted in 18 bursts of 16-bit

words

01001

01010

01011

Write conﬁguration word

Write high serial number

Write low serial number

Transport code (32 bits); 16 Bit

conﬁguration word

Write acknowledge pulse

Transport code (32 bits); Higher Write acknowledge pulse

16 bits of serial number (SER1)

Transport code (32 bits); Lower

16 bits of serial number (SER0)

Write acknowledge pulse

01100

01101

01110

01111

1X000

Write user area 0

Write user area 1

Write user area 2

Write user area 3

16 Bits of User EEPROM USR0 Write acknowledge pulse

16 Bits of User EEPROM USR1 Write acknowledge pulse

16 Bits of User EEPROM USR2 Write acknowledge pulse

16 Bits of User EEPROM USR3 Write acknowledge pulse

IFF1 using key-1 and IFF

algorithm

32-Bit Challenge

32 Bit Response

1X001

1X100

1X101

IFF1 using key-1 and HOP

algorithm

32-Bit Challenge

IFF2 32-bit using key-2 and IFF 32-Bit Challenge

algorithm

IFF2 32-bit using key-2 and HOP 32-Bit Challenge

algorithm

1997 Microchip Technology Inc.

Preliminary

DS40158C-page 17

HCS410

2.6.2

TRANSPONDER IN/RF OUT

2.6

IFF Special Features

When in transponder mode with ACOLI and XPRF set,

the outputs of the HCS410’s LC0:LC1 pins are echoed

on the PWM output line. After transmitting the data on

the LC pins, the data is then transmitted on the PWM

line. The transmission format mirrors a code hopping

transmission. The response replaces the 32-bit code

hopping portion of the transmission. If the response is

a 16-bit response, the 16 bits are duplicated to make up

the 32-bit code hopping portion. The preamble, serial

number, CRC, and queuing bits are all transmitted as

normal (Figure 2-18).

2.6.1

ANTI-COLLISION (ACOLI)

When the ACOLI bit is set in the conﬁguration word,

anti-collision mode is entered. The HCS410 will start

sending ACK pulses when it enters a magnetic ﬁeld.

The ACK pulses stop as soon as the HCS410 detects

a start bit from the decoder. A ‘select encoder’ opcode

(00000) is then sent out by the decoder, followed by a

32-bit serial number. If the serial number matches the

HCS410’s serial number, the HCS410 will acknowl-

edge with the acknowledge sequence as shown in

Figure 2-19. The HCS410 can then be addressed as

normal. If the serial number does not match, the IFF

encoder will stop transmitting ACK pulses until it is

either removed from the ﬁeld or the correct serial num-

ber is given.

This feature will be used in applications which use RF

for long distance unidirectional authentication and

short distance IFF.

2.6.3

INTELLIGENT DAMPING

If the LC circuit on the transponder has a high Q-factor,

the circuit will keep on resonating for a long time after

the ﬁeld has been shut down by the decoder. This

makes fast communication from the decoder to the

HCS410 difﬁcult. If the IDAMP bit is set to 0, the

HCS410 will clamp the LC pins for 5 µs every 1/4 TE,

whenever the HCS410 is expecting data from the

decoder. Refer to Figure 2-18 for timing details. This

option can be set in the conﬁguration word.

FIGURE 2-19: SERIAL NUMBER CORRECT

ACKNOWLEDGE SEQUENCE

TE

LC0/1

3 TE

TE

2.7

LED Indicator

If a signal is detected on LC0, the LED pin goes high for

30 ms every 8s (IFFB = 0) or 4s (IFFB 1) to indicate that

the power source is charging.

FIGURE 2-20: LED INDICATOR WHEN CHARGING POWER SOURCE

LC0

LED

IFFB = 0

4s

8s

30 ms

LED

IFFB = 1

2s

4s

30 ms

DS40158C-page 18

Preliminary

1997 Microchip Technology Inc.

HCS410

3.1

Encoder Key 1 and 2

3.0

EEPROM ORGANIZATION AND

CONFIGURATION

The 64-bit encoder key1 is used by the transmitter to

create the encrypted message transmitted to the

receiver in Code Hopping Mode. An IFF operation, can

use encoder key1 or key2 to generate the response to

a challenge received. The key(s) is created and pro-

grammed at the time of production using a key genera-

tion algorithm. Inputs to the key generation algorithm

are the serial number or seed for the particular

transmitter being used and a secret manufacturer’s

code. While a number of key generation algorithms are

supplied by Microchip, a user may elect to create their

own method of key generation. This may be done pro-

viding that the decoder is programmed with the same

means of creating the key for decryption purposes. If a

seed is used (CH Mode), the seed will also form part of

the input to the key generation algorithm.

The HCS410 has nonvolatile EEPROM memory which

is used to store user programmable options. This infor-

mation includes encoder keys, serial number, and up to

64-bits of user information.

The HCS410 has two modes in which it operates as

speciﬁed by the conﬁguration word. In the ﬁrst mode

the HCS410 has a single encoder key which is used for

encrypting the code hopping portion of a CH Mode

transmission and generating a response during IFF val-

idation. Seed transmissions are allowed in this mode.

In the second mode the HCS410 is a transponder

device with two encoder keys.

The two different operating modes of the HCS410 lead

to different EEPROM memory maps.

In IFF1 mode, the HCS410 can act as a code hopping

encoder with Seed transmission, and as an IFF token

with one key.

3.2

Discrimination Value and Overﬂow

The discrimination value forms part of the code hop-

ping portion of a code hopping transmission. The least

signiﬁcant 10 bits of the discrimination value are typi-

cally set to the least signiﬁcant bits of the serial number.

The most signiﬁcant 2 bits of the discrimination value

are the overﬂow bits (OVR1: OVR0).These are used to

extend the range of the synchronization counter. When

IFF1 Mode

64-bit Encoder Key 1

64-bit Seed/Transport Code

(SEED0, SEED1, SEED2, SEED3)

32-bit Serial Number

the synchronization counter wraps from FFFF to

16

(SER0, SER1)

0000 OVR0 is cleared and the second time a wrap

16

occurs OVR1 is cleared.

64-bit User Area

Once cleared, the overﬂow bits cannot be set again,

thereby creating a permanent record of the counter

overﬂow.

(USR0, USR1, USER2, USR3)

10-bit Discrimination Value and 2 Overﬂow Bits.

16-bit Synchronization Counter

Conﬁguration Data

3.3

16-bit Synchronization Counter

In IFF2 mode, the HCS410 is able to act as a code hop-

ping transmitter and an IFF token with two encoder

keys.

This is the 16-bit synchronization counter value that is

used to create the code hopping portion for transmis-

sion. This value will be changed after every transmis-

sion. The synchronization counter is not used in IFF

mode.

IFF2 Mode

64-bit Encoder Key 1

64-bit Encoder Key 2/Transport Code

32-bit Serial Number

(SER0, SER1)

64-bit User EEPROM

(USR0, USR1, USER2, USR3)

10-bit Discrimination Value and 2 Overﬂow Bits.

16-bit Synchronization Counter

Conﬁguration Data

*Patents have been applied for.

1997 Microchip Technology Inc.

Preliminary

DS40158C-page 19

HCS410

3.4

60/64-bit Seed Word/Transport Code

3.5

Encoder Serial Number

This is the 60-bit seed code that is transmitted when

seed transmission is selected. This allows the system

designer to implement the secure learn feature or use

this ﬁxed code word as part of a different key genera-

tion/tracking process or purely as a ﬁxed code trans-

mission. The seed is not available in IFF2-mode. A

Seed transmission can be initiated in two ways,

depending on the button inputs (Figure 3-1)

There are 32 bits allocated for the serial number and a

selectable conﬁguration bit (XSER) determines

whether 32 or 28 bits will be transmitted. The serial

number is meant to be unique for every transmitter.

3.6

User Data

The 64-bit user EEPROM can be reprogrammed and

read at any time using the IFF interface.

Seed transmission is available for function codes

(Table 2-2) S[2:0] = 111 and S[2:0] = 011 (delayed).

The delayed seed transmission starts with a normal

code hopping transmission being transmitted for 3 sec-

onds, before switching to a seed transmission.The two

seed transmissions are shown in Figure 3-1.

The least signiﬁcant 32-bits of the seed are used as the

transport code.The transport code is used to write-pro-

tect the serial number, conﬁguration word, as well as

preventing accidental programming of the HCS410

when in IFF mode.

Note: If both SEED and TMPSD are set, IFF2

mode is enabled.

FIGURE 3-1: SEED TRANSMISSION

All examples shown with XSER = 1 & SEED = 1

When S[2:0] = 111, the 3-second delay is not applicable:

Que [1:0], CRC [1:0], SEED_3 (12 bits)

VLOW, S[2:0]

SEED_2

SEED_1

SEED_0

Data transmission direction

16-bit Data Word

16-bit Counter

Encrypt

For S[2:0] = 011 before the 3-second delay:

Que [1:0], CRC [1:0]

+ VLOW, S [2:0]

SER_1

SER_0

Encrypted Data

Data transmission direction

For S[2:0] = 011 after the 3-second delay (Note 1):

Que [1:0], CRC [1:0], SEED_3 (12 bits) SEED_2

SEED_1

SEED_0

VLOW, S [2:0]

Data transmission direction

Note 1: For Seed Transmission, SEED_3 and SEED_2 are transmitted instead of SER_1 and SER_0, respectively.

*Patents have been applied for.

DS40158C-page 20

Preliminary

1997 Microchip Technology Inc.

HCS410

3.7.2

If IDAMP is set to ‘1’ intelligent damping is disabled.

3.7.3 SEED,TMPSD: SEED TRANSMISSION

IDAMP: INTELLIGENT DAMPING

3.7

Conﬁguration Data

The conﬁguration data is used to select various

encoder options. Further explanations of each of the

bits are described in the following sections.

TABLE 3-1:

CONFIGURATION OPTIONS

SEED

TMPSD

Description

0

1

0

1

0

1

No Seed

Symbol

Description

Seed Limited

Always Enabled

IFF2/No Seed

CWBE Code Word Blanking Enable

IDAMP Intelligent Damping for High Q LC Tank.

SEED/ Enable Seed Transmissions

IFF2

3.7.4

OSC: OSCILLATOR TUNING BITS

TMPSD/ Temporary Seed Transmissions

IFF2

These bits allow the onboard oscillator to be tuned to

within 10% of the nominal oscillator speed over both

temperature and voltage.

OSC0:3 Onboard Oscillator Tuning Bits

MTX3

VLOW Low Voltage Trip Point Selection

LED Enable LED output

BSL0:1 Baudrate Select

Minimum 3 Code Words Transmitted

TABLE 3-2:

OSC

OSCILLATOR TUNING

Description

1000

Fastest

1001

1010

TBSL

Transponder Baud Page

MANCH Manchester Modulation Mode

ACOLI Anti Collision Communication Enable

•

Faster

Nominal

Slower

XPRF

DINC

XSER

Passive Proximity Activation

Delayed Increment Enable

Extended Serial Number

1111

0000

0001

0010

•

3.7.1

CWBE: CODE WORD BLANKING ENABLE

BSL: BAUD RATE SELECT

Selecting this option allows code blanking as shown in

Table 3-3. If this option is not selected, all code words

are transmitted.

0110

0111

Slowest

TABLE 3-3:

BAUD RATE SELECTION

Code Hopping Transmissions (TE)

Transponder Communication (TE)

Codes Word

Transmitted*

BSL 1

BSL 0

PWM

Manchester

TBSL

PPM

0

1

0

1

0

1

400 µs

200 µs

100 µs

800 µs

400 µs

200 µs

All

0

—

1

200 µs

—

1 of 2

1 of 4

—

100 µs

*If code word blanking is enabled.

1997 Microchip Technology Inc.

Preliminary

DS40158C-page 21

HCS410

3.7.5

MTX3: MINIMUM CODE WORDS

COMPLETED

3.7.10 ACOLI: ANTI-COLLISION

COMMUNICATION AND

XPRF: TRANSPONDER ECHOING

ON PWM OUTPUT

If this bit is set, the HCS410 will transmit a minimum of

3 words before it powers itself down. If this bit is

cleared, the HCS410 will only complete the current

transmission. This feature will only work if VDD is con-

nected directly to the battery as shown in Figure 2-1.

ACOLI = 1, XPRF = 0

If ACOLI is set the anti-collision operation during bi-

directional transponder mode (IFF) is enabled. This

feature is useful in situations where multiple transpon-

ders enter the magnetic ﬁeld simultaneously.

3.7.6

VLOW: LOW VOLTAGE TRIP POINT

The low voltage trip point select bit is used to tell the

HCS410 what Vdd level is being used.This information

will be used by the device to determine when to send

the voltage low signal to the receiver. When this bit is

set, the Vdd level is assumed to be operating from a 5

volt or 6 volt supply. If the bit is cleared, then the Vdd

level is assumed to be 3.0 volts. Refer to Figure 5-3 for

voltage trip point. When the battery reaches the Vlow

point, the LED will ﬂash once for 200 ms on during a

code hopping transmission.

ACOLI = 0, XPRF = 1

If XPRF is set, and ACOLI is cleared, proximity activa-

tion is enabled. the HCS410 starts sending out ACK

pulses when it detects a magnetic ﬁeld. If the HCS410

doesn’t receive a start bit from the decoder within 50

ms of sending the ﬁrst set of ACK pulses, the HCS410

will transmit a code hopping transmission on LC and

PWM pins for 2 seconds.

ACOLI = 1, XPRF = 1

If both the ACOLI and XPRF are set, all of the HCS410

transponder responses are echoed on the PWM out-

put, as described in Section 2.6.2.

3.7.7

LED: OUTPUT ENABLE

If this bit is set, the S2 doubles as an LED output line.

If this bit is cleared (0), S2 is only used as an input.

3.7.11 DINC: DELAYED INCREMENT

3.7.8

TBSL: TRANSPONDER BAUD RATE

SELECT

If DINC is set to ‘1’, the delayed increment feature is

enabled. If DINC is cleared, the counter only incre-

ments once each time the button is pressed.

This option selects the baud rate for IFF communica-

tion between a TE of 100 µs or 200 µs.

3.7.12 XSER: EXTENDED SERIAL NUMBER

3.7.9

MANCH: MANCHESTER CODE

ENCODING

If XSER is set, the full 64-bit SEED number is

transmitted. If XSER is cleared, the four most signiﬁ-

cant bits of the serial number are substituted by

S[2:0] = S2:S1:S0: 0 and is compatible with the

HCS200/300/301.

MANCH selects between Manchester code modulation

and PWM modulation in code hopping mode. If

MANCH = 1, Manchester code modulation is selected.

If MANCH is cleared, PWM modulation is selected.

DS40158C-page 22

Preliminary

1997 Microchip Technology Inc.

HCS410

4.1

Key Generation

4.0

INTEGRATING THE HCS410

INTO A SYSTEM

The serial number for each transmitter is programmed

by the manufacturer at the time of production. The

generation of the encoder key is done using a key gen-

eration algorithm (Figure 4-1). Typically, inputs to the

key generation algorithm are the serial number of the

transmitter or seed value, and a 64-bit manufacturer’s

code.The manufacturer’s code is chosen by the system

manufacturer and must be carefully controlled. The

manufacturer’s code is a pivotal part of the overall

system security.

Use of the HCS410 in a system requires a compatible

decoder.This decoder is typically a microcontroller with

compatible ﬁrmware. Firmware routines that accept

transmissions from the HCS410, decrypt the code hop-

ping portion of the data stream and perform IFF func-

tions are available. These routines provide system

designers the means to develop their own decoding

system.

FIGURE 4-1: CREATION AND STORAGE OF ENCODER KEY DURING PRODUCTION

HCS410 EEPROM Array

Transmitter

Serial Number or

Seed

Serial Number

Encoder Key

Sync Counter

.

Key

Encoder

Key

Manufacturer’s

Code

Generation

Algorithm

1997 Microchip Technology Inc.

Preliminary

DS40158C-page 23

HCS410

The maximum number of transmitters that can be

learned is only a function of how much EEPROM

memory storage is available. The decoder must also

store the manufacturer’s code in order to learn an

HCS410, although this value will not change in a typical

system so it is usually stored as part of the microcon-

troller ROM code. Storing the manufacturer’s code as

part of the ROM code is also better for security rea-

sons.

4.2

Learning an HCS410 to a Receiver

In order for a transmitter to be used with a decoder, the

transmitter must ﬁrst be ‘learned’. Several learning

strategies can be followed in the decoder implementa-

tion. When a transmitter is learned to a decoder, it is

suggested that the decoder stores the serial number

and current synchronization counter value (synchroni-

zation counter stored in CH Mode only) in EEPROM.

The decoder must keep track of these values for every

transmitter that is learned (Figure 4-2 and Figure 4-3).

FIGURE 4-3: TYPICAL IFF LEARN

SEQUENCE

FIGURE 4-2: TYPICAL CH MODE LEARN

SEQUENCE

Enter Learn

Mode

Enter Learn

Mode

Wait for Reception

of a Valid Code

Wait for token

to be detected

Generate Key

from Serial Number

Use Generated Key

to Decrypt

Read

Serial Number

Compare Discrimination

Value with Fixed Value

Generate Key

From Serial

No

Equal

?

Number

Yes

Wait for Reception

of Second Valid Code

Perform IFF

with Token

Use Generated Key

to Decrypt

Compare Discrimination

Value with Fixed Value

Compare Token

and expected

response

No

Equal

?

Yes

Token and

Response

Equal?

No

Counters

Sequential

?

Yes

Learn successful

Store:

Learn

Unsuccessful

Learn successful Store:

Serial number

Encoder key

Serial number

Encoder key

Synchronization counter

Exit

DS40158C-page 24

Preliminary

1997 Microchip Technology Inc.

HCS410

4.3

CH Mode Decoder Operation

FIGURE 4-4: TYPICAL CH MODE

DECODER OPERATION

In a typical decoder operation (Figure 4-4), the key

generation on the decoder side is done by taking the

serial number from a transmission and combining that

with the manufacturer’s code to create the same

encoder key that is stored in the HCS410. Once the

encoder key is obtained, the rest of the transmission

can be decrypted.The decoder waits for a transmission

and immediately checks the serial number to

determine if it is a learned transmitter. If it is, the code

hopping portion of the transmission is decrypted using

the stored key. It uses the discrimination bits to deter-

mine if the decryption was valid. If everything up to this

point is valid, the synchronization counter value

is evaluated.

Start

No

Transmission

Received

?

Yes

Does

Serial Number

Match

No

?

Yes

Decrypt Transmission

Is

No

Decryption

Valid

?

Yes

Execute

Command

and

Update

Counter

Is

Counter

Within 16

?

Yes

No

Is

Counter

Within 32K

?

Yes

Save Counter

in Temp Location

1997 Microchip Technology Inc.

Preliminary

DS40158C-page 25

HCS410

4.3.1

SYNCHRONIZATION WITH DECODER

FIGURE 4-5: SYNCHRONIZATION WINDOW

Entire Window

rotates to eliminate

use of previously

used codes

The KEELOQ technology features a sophisticated

synchronization technique (Figure 4-5) which does not

require the calculation and storage of future codes. If

the stored counter value for that particular transmitter

and the counter value that was just decrypted are

within a window of say 16, the counter is stored and the

command is executed. If the counter value was not

within the single operation window, but is within the

double operation window of say 32K window, the trans-

mitted synchronization counter value is stored in tem-

porary location and it goes back to waiting for another

transmission. When the next valid transmission is

received, it will compare the new value with the one in

temporary storage. If the two values are sequential, it is

assumed that the counter had just gotten out of the sin-

gle operation ‘window’, but is now back in sync, so the

new synchronization counter value is stored and the

command executed. If a transmitter has somehow got-

ten out of the double operation window, the transmitter

will not work and must be relearned. Since the entire

window rotates after each valid transmission, codes

that have been used are part of the ‘blocked’ (32K)

codes and are no longer valid. This eliminates the pos-

sibility of grabbing a previous code and retransmitting

to gain entry.

Blocked

(32K Codes)

Current

Position

Double

Operation

(32K Codes)

Single Operation

Window (16 Codes)

Note: The synchronization method described in

this

section

is

only

a

typical

implementation and because it is usually

implemented in ﬁrmware, it can be altered

to ﬁt the needs of a particular system

FIGURE 4-6: BASIC OPERATION OF A CODE HOPPING RECEIVER (DECODER)

Check for

Match

EEPROM Array

KEELOQ

Decryption

Algorithm

Decrypted

Synchronization

Counter

Encoder Key

Sync Counter

Check for

Match

Serial Number

Manufacturer Code

32 Bits of

Encrypted Data

Button Press

Information

Serial Number

Received Information

DS40158C-page 26

Preliminary

1997 Microchip Technology Inc.

HCS410

4.4

IFF Decoder Operation

FIGURE 4-7: TYPICAL IFF DECODER

OPERATION

In a typical IFF decoder, the key generation on the

decoder side is done by reading the serial number from

a token and combining that with the manufacturer’s

code to recreate the encoder key that is stored on the

token. The decoder polls for the presence of a token.

Once detected the decoder reads the serial number. If

the token has been learned, the decoder sends a chal-

lenge and reads the token’s response. The decoder

uses the encoder key stored in EEPROM and decrypt

response. The decrypt response is compared to the

challenge. If they match the appropriate output is acti-

vated.

Start

No

Token

Detected?

Yes

Read Serial

Number

Does

Serial Number

Match?

No

Yes

Send Challenge

and Read

Response

Decrypt the

Response

Does

Challenge &

Decrypt response

Match?

No

Yes

Execute Command

FIGURE 4-8: BASIC OPERATION OF AN IFF RECEIVER (DECODER)

EEPROM Array

KEELOQ

IFF

Algorithm

Decrypted

Response

IFF Key

Serial Number

Manufacturer

Code

Check for

Match

Challenge

Serial Number

Response

Written to HCS410

Information read from HCS410

1997 Microchip Technology Inc.

Preliminary

DS40158C-page 27

HCS410

5.0

ELECTRICAL CHARACTERISTICS

TABLE 5-1:

ABSOLUTE MAXIMUM RATING

Item

Symbol

Rating

-0.3 to 6.6

Units

VDD

VIN*

Supply voltage

V

Input voltage

-0.3 to VDD + 0.3

50

V

VOUT

IOUT

Output voltage

V

Max output current

Storage temperature

Lead soldering temp

mA

TSTG

TLSOL

VESD

-55 to +125

300

C (Note)

V

ESD rating (Human Body Model) 4000

Note: Stresses above those listed under “ABSOLUTE MAXIMUM RATINGS” may cause permanent damage to

the device.

* If a battery is inserted in reverse, the protection circuitry switches on, protecting the device and draining the

battery.

TABLE 5-2:

DC AND TRANSPONDER CHARACTERISTICS

Commercial (C): Tamb = 0°C to 70°C

Industrial (I):

Tamb = -40°C to 85°C

2.0V < VDD < 6.3V

1

Parameter

Symbol

Min

Typ

Max

Unit

Conditions

VDD = 3.0V

50

100

300

2

Average operating current

IDD (avg)

IDDP

—

µA

160

VDD = 6.3V

Programming current

1.0

2.2

1.8

3.5

VDD = 3.0V

VDD = 6.3V

mA

Standby current

IDDS

VIH

VIL

—

0.1

100

VDD + 0.3

0.15 VDD

—

nA

V

High level input voltage

Low level input voltage

0.55 VDD

-0.3

—

V

0.8 VDD

VDD = 2V, IOH =- .45 mA

VDD = 6.3V, IOH,= -2 mA

High level output voltage

Low level output voltage

VOH

VOL

V

—

0.08 VDD

VDD = 2V, IOH = 0.5 mA

VDD = 6.3V,IOH = 5mA

LED output current

ILED

RS

3.0

40

80

—

4.0

60

7.0

80

mA

kΩ

mA

V

VDD = 3.0V, VLED = 1.5V

Switch input resistor

PWM input resistor

RPWM

ILC

120

—

160

10.0

—

LC input current

VLCC=15 VP-P

ILC <10 mA

VLCC > 10V

LC input clamp voltage

LC induced output current

LC induced output voltage

VLCC

VDDI

—

15

—

5.0

mA

5.0

4.5

6.3

5.6

6.8

10 V < VLCC, IDD = 0 mA

10 V < VLCC, IDD = -1 mA

VDDV

V

Carrier frequency

fc

L

—

125

900

1.8

—

kHz

µH

pF

External LC Inductor value

External LC Capacitor value

C

Note 1: Typical values at 25°C.

2: No load connected.

3: LC inputs are clamped at 15 volts.

DS40158C-page 28

Preliminary

1997 Microchip Technology Inc.

HCS410

FIGURE 5-1: POWER UP AND TRANSMIT TIMING

Button Press

Detect

Code Word Transmission

TBP

TTD

TDB

Code

Word

3

Code

Word

2

Code

Word

n

Word

PWM

1

TTO

Sn

TABLE 5-3:

POWER UP AND TRANSMIT TIMING REQUIREMENTS

VDD = +2.0 to 6.3V

Commercial (C):Tamb = 0°C to +70°C

Industrial

(I): Tamb = -40°C to +85°C

Parameter Symbol

Min

Typ.

Max

Unit

ms

Remarks

Time to second button press

TBP

34 + Code 38 + Code 42 + Code

Word Time Word Time Word Time

(Note 1)

Transmit delay from button detect

Debounce delay

TTD

TDB

TTO

TLST

TLH

34.2

27

18

—

38

30

41.8

33

22

—

ms

s

(Note 2)

(Note 3)

Auto-shutoff time-out period

Time to ﬁrst LED on

20

240

25

ms

LED high-time

—

LED high-time when battery low

LED low-time

TLHV

TLL

—

200

480

—

Note 1: TBP is the time in which a second button can be pressed without completion of the ﬁrst code word and the

intention was to press the combination of buttons.

2: Transmit delay maximum value if the previous transmission was successfully transmitted.

3: The auto-shutoff timeout period is not tested.

1997 Microchip Technology Inc.

Preliminary

DS40158C-page 29

HCS410

FIGURE 5-2: HCS410 NORMALIZED TE VS.TEMP

1.10

1.08

1.06

1.04

TE Max.

Typical

VDD LEGEND

= 2.0V

1.02

TE

= 3.0V

= 6.0V

1.00

0.98

0.96

0.94

0.92

0.90

TE Min.

-50 -40 -30 -20 -10

0

10 20 30 40 50 60 70 80 90

Temperature °C

Note: Values are for calibrated oscillator.

TABLE 5-4:

CODE WORD TRANSMISSION TIMING PARAMETERS—PWM MODE

Code Words Transmitted

VDD = +2.0V to 6.3V

Commercial (C):Tamb = 0°C to +70°C

BSL1 = 0,

BSL0 = 0

BSL1 = 0,

BSL0 = 1

Industrial

(I): Tamb = -40°C to +85°C

Number

of TE

Number

of TE

Symbol

Characteristic

Min.

Typ.

Max.

Min.

Typ.

Max.

Units

TE

TBP

TP

Basic pulse element

PWM bit pulse width

Preamble duration

Header duration

1

3

360

1080

12

400

1200

12.8

4.0

440

1320

14

1

3

180.0

540.0

5.76

200.0

600.0

6.0

220.0

660.0

7.04

µs

32

10

96

111

46

295

32

10

96

111

46

295

ms

TH

3.6

4.4

1.80

2.0

2.20

THOP

TFIX

TG

Code hopping duration

Fixed code duration

Guard time

35

38.4

44.4

18.4

118.0

42

17.28

19.98

8.3

19.20

22.20

9.6

21.12

24.42

10.1

39.96

16.6

106.2

48.84

20.2

129.8

—

Total transmit time

53.1

59.0

64.9

Note: The timing parameters are not tested but derived from the oscillator clock.

Code Words Transmitted

BSL1 = 0,

VDD = +2.0V to 6.3V

Commercial (C): Tamb = 0°C to +70°C

BSL1 = 1,

BSL0 = 0

Industrial

(I): Tamb = -40°C to +85°C

BSL0 = 1

Number

of TE

Number

of TE

Symbol

Characteristic

Min.

Typ.

Max.

Min.

Typ.

Max.

Units

TE

TBP

TP

Basic pulse element

PWM bit pulse width

Preamble duration

Header duration

1

3

180.0

540.0

5.76

200.0

600.0

6.0

220.0

660.0

7.04

1

3

90.0

270.0

2.88

0.90

8.64

9.99

41

100.0

300.0

3.0

110.0

330.0

3.52

µs

32

10

96

111

46

295

32

10

96

111

46

295

ms

TH

1.80

2.0

2.20

1.0

1.10

THOP

TFIX

TG

Code hopping duration

Fixed code duration

Guard time

17.28

19.98

8.3

19.20

22.2

9.6

21.12

24.42

10.1

9.60

11.1

4.6

10.56

12.21

5.1

—

Total transmit time

53.1

59.0

64.9

26.6

29.5

32.5

Note: The timing parameters are not tested but derived from the oscillator clock.

DS40158C-page 30

Preliminary

1997 Microchip Technology Inc.

HCS410

TABLE 5-5:

CODE WORD TRANSMISSION TIMING PARAMETERS—MANCHESTER MODE

Code Words Transmitted

VDD = +2.0V to 6.3V

Commercial (C): Tamb = 0°C to +70°C

BSL1 = 0,

BSL0 = 0

BSL1 = 0,

Industrial

(I): Tamb = -40°C to +85°C

BSL0 = 1

Typ.

Number

of TE

Number

of TE

Symbol

Characteristic

Min.

Typ.

Max.

Min.

Max.

Units

Basic pulse element

Preamble duration

Header duration

Start bit

1

720.0

23.04

2.88

800.0

25.60

3.20

880.0

28.16

3.52

1.0

32.0

4.0

2.0

64.0

74

360.0

11.52

1.44

400.0

12.80

1.60

440.0

14.08

1.76

µs

ms

TE

TP

32

4

TH

2

1.44

1.60

1.76

0.72

0.80

0.88

TSTART

THOP

TFIX

TSTOP

TG

Code hopping duration

Fixed code duration

Stop bit

64

74

2

46.08

53.28

1.44

51.20

59.20

1.60

56.32

65.12

1.76

23.04

26.64

0.72

25.60

29.60

0.80

28.16

32.56

0.88

2.0

32

Guard time

32

210

23.0

25.6

28.2

11.5

12.8

14.1

—

Total transmit time

151.2

168

184.8

210

75.6

84.0

92.4

Note: The timing parameters are not tested but derived from the oscillator clock.

Code Words Transmitted

BSL1 = 1,

VDD = +2.0V to 6.3V

Commercial (C): Tamb = 0°C to +70°C

BSL1 = 1,

BSL0 = 0

Industrial

(I): Tamb = -40°C to +85°C

BSL0 = 1

Number

of TE

Number

of TE

Symbol

Characteristic

Min.

Typ.

Max.

Min.

Typ.

Max.

Units

Basic pulse element

Preamble duration

Header duration

Start bit

1

360.0

11.52

1.44

400.0

12.80

1.60

440.0

14.08

1.76

1.0

32.0

4.0

2.0

64.0

74

180.0

5.76

0.72

0.36

11.52

13.32

0.36

5.8

200.0

6.40

0.80

0.40

12.80

14.8

0.40

6.4

220.0

7.04

0.88

0.44

14.08

16.28

0.44

7.0

µs

ms

TE

TP

32

4

TH

2

0.72

0.80

0.88

TSTART

THOP

TFIX

TSTOP

TG

Code hopping duration

Fixed code duration

Stop bit

64

74

2.0

32

210

23.04

26.64

0.72

25.60

29.60

0.80

28.16

32.56

0.88

2.0

32

Guard time

11.5

12.8

14.1

—

Total transmit time

75.6

84.0

92.4

210

37.8

42.0

46.2

Note: The timing parameters are not tested but derived from the oscillator clock.

FIGURE 5-3: TYPICAL VOLTAGE TRIP POINTS

Volts (V)

VLOW

5.0

4.8

4.6

4.4

4.2

4.0

3.8

VLOW sel = 1

2.8

VLOW sel = 0

2.6

2.4

2.2

2.0

1.8

1.6

Legend

Nominal VLOW trip point

Temp (C)

85

-40

0

50

1997 Microchip Technology Inc.

Preliminary

DS40158C-page 31

HCS410

NOTES:

DS40158C-page 32

Preliminary

1997 Microchip Technology Inc.

HCS410

NOTES:

1997 Microchip Technology Inc.

Preliminary

DS40158C-page 33

HCS410

NOTES:

DS40158C-page 34

Preliminary

1997 Microchip Technology Inc.

HCS410

HCS410 PRODUCT IDENTIFICATION SYSTEM

To order or obtain information, e.g., on pricing or delivery, refer to the factory or the listed sales ofﬁce.

HCS410 /P

—

P = Plastic DIP (300 mil Body), 8-lead

SN = Plastic SOIC (150 mil Body), 8-lead

ST = TSSOP (4.4 mm Body), 8-lead

Package:

Temperature

Range:

Blank = 0˚C to +70˚C

I = –40˚C to +85˚C

HCS410

HCS410T

Code Hopping Encoder

Code Hopping Encoder (Tape and Reel)

Device:

Sales and Support

Data Sheets

Products supported by a preliminary Data Sheet may have an errata sheet describing minor operational differences and recom-

mended workarounds. To determine if an errata sheet exists for a particular device, please contact one of the following:

1. Your local Microchip sales ofﬁce.

2. The Microchip Corporate Literature Center U.S. FAX: (602) 786-7277.

3. The Microchip’s Bulletin Board, via your local CompuServe number (CompuServe membership NOT required).

1997 Microchip Technology Inc.

Preliminary

DS40158C-page 35

M

WORLDWIDE SALES AND SERVICE

AMERICAS

ASIA/PACIFIC

ASIA/PACIFIC (CONTINUED)

Corporate Ofﬁce

Microchip Technology Inc.

Hong Kong

Microchip Asia Paciﬁc

Taiwan, R.O.C

Microchip Technology Taiwan

2355 West Chandler Blvd.

Chandler, AZ 85224-6199

RM 3801B, Tower Two

Metroplaza

10F-1C 207

Tung Hua North Road

Tel: 602-786-7200 Fax: 602-786-7277

Technical Support: 602 786-7627

Web: http://www.microchip.com

223 Hing Fong Road

Kwai Fong, N.T., Hong Kong

Tel: 852-2-401-1200 Fax: 852-2-401-3431

Taipei, Taiwan, ROC

Tel: 886-2-2717-7175 Fax: 886-2-2545-0139

Atlanta

Microchip Technology Inc.

500 Sugar Mill Road, Suite 200B

Atlanta, GA 30350

Tel: 770-640-0034 Fax: 770-640-0307

India

Microchip Technology Inc.

India Liaison Ofﬁce

No. 6, Legacy, Convent Road

Bangalore 560 025, India

EUROPE

United Kingdom

Arizona Microchip Technology Ltd.

505 Eskdale Road

Winnersh Triangle

Wokingham

Berkshire, England RG41 5TU

Tel: 44-1189-21-5858 Fax: 44-1189-21-5835

Tel: 91-80-229-0061 Fax: 91-80-229-0062

Boston

Microchip Technology Inc.

5 Mount Royal Avenue

Marlborough, MA 01752

Tel: 508-480-9990 Fax: 508-480-8575

Japan

Microchip Technology Intl. Inc.

Benex S-1 6F

3-18-20, Shinyokohama

Kohoku-Ku, Yokohama-shi

Kanagawa 222 Japan

France

Arizona Microchip Technology SARL

Zone Industrielle de la Bonde

2 Rue du Buisson aux Fraises

91300 Massy, France

Tel: 33-1-69-53-63-20 Fax: 33-1-69-30-90-79

Chicago

Microchip Technology Inc.

333 Pierce Road, Suite 180

Itasca, IL 60143

Tel: 81-45-471- 6166 Fax: 81-45-471-6122

Korea

Tel: 630-285-0071 Fax: 630-285-0075

Microchip Technology Korea

168-1, Youngbo Bldg. 3 Floor

Samsung-Dong, Kangnam-Ku

Seoul, Korea

Germany

Arizona Microchip Technology GmbH

Gustav-Heinemann-Ring 125

D-81739 Müchen, Germany

Tel: 49-89-627-144 0 Fax: 49-89-627-144-44

Dallas

Microchip Technology Inc.

14651 Dallas Parkway, Suite 816

Dallas, TX 75240-8809

Tel: 972-991-7177 Fax: 972-991-8588

Tel: 82-2-554-7200 Fax: 82-2-558-5934

Shanghai

Microchip Technology

RM 406 Shanghai Golden Bridge Bldg.

2077 Yan’an Road West, Hong Qiao District

Shanghai, PRC 200335

Italy

Dayton

Microchip Technology Inc.

Two Prestige Place, Suite 150

Miamisburg, OH 45342

Tel: 937-291-1654 Fax: 937-291-9175

Arizona Microchip Technology SRL

Centro Direzionale Colleoni

Palazzo Taurus 1 V. Le Colleoni 1

20041 Agrate Brianza

Milan, Italy

Tel: 39-39-6899939 Fax: 39-39-6899883

Tel: 86-21-6275-5700

Fax: 86 21-6275-5060

Los Angeles

Microchip Technology Inc.

18201 Von Karman, Suite 1090

Irvine, CA 92612

Singapore

Microchip Technology Taiwan

Singapore Branch

200 Middle Road

#07-02 Prime Centre

1/13/98

Tel: 714-263-1888 Fax: 714-263-1338

NewYork

Microchip Technology Inc.

Singapore 188980

Tel: 65-334-8870 Fax: 65-334-8850

150 Motor Parkway, Suite 202

Hauppauge, NY 11788

Tel: 516-273-5305 Fax: 516-273-5335

San Jose

Microchip Technology Inc.

2107 North First Street, Suite 590

San Jose, CA 95131

Tel: 408-436-7950 Fax: 408-436-7955

Toronto

Microchip Technology Inc.

5925 Airport Road, Suite 200

Mississauga, Ontario L4V 1W1, Canada

Tel: 905-405-6279 Fax: 905-405-6253

Printed on recycled paper.

Information contained in this publication regarding device applications and the like is intended for suggestion only and may be superseded by updates. No representation or warranty

is given and no liability is assumed by Microchip Technology Incorporated with respect to the accuracy or use of such information, or infringement of patents or other intellectual

property rights arising from such use or otherwise. Use of Microchip’s products as critical components in life support systems is not authorized except with express written approval

by Microchip. No licenses are conveyed, implicitly or otherwise, under any intellectual property rights. The Microchip logo and name are registered trademarks of Microchip Tech-

DS40158C-page 36

Preliminary

1997 Microchip Technology Inc.


型号：	HCS410T-I/ST
厂家：	MICROCHIP
描述：	暂无描述编码器
文件：	总36页 (文件大小：256K)
中文：	中文翻译
下载：	下载PDF数据表文档文件

HCS410T-I/ST [MICROCHIP]

相关型号：

HCS410T-IP

HCS410T-ISN

HCS410T-IST

HCS410T-P

HCS410T-SN

HCS410T-ST

HCS410T/SN

HCS410T/ST

HCS410_01

HCS410_11

HCS412

HCS412(8PDIP)