HCS509. KEELOQ Code Hopping Decoder* FEATURES PACKAGE TYPE BLOCK DIAGRAM DESCRIPTION. Security. Operating. Other. Typical Applications

Similar documents
HCS509. KEELOQ Code Hopping Decoder* PACKAGE TYPE FEATURES BLOCK DIAGRAM DESCRIPTION. Security. Operating. Other. Typical Applications

AN566. Using the PORTB Interrupt on Change as an External Interrupt USING A PORTB INPUT FOR AN EXTERNAL INTERRUPT INTRODUCTION

HCS410/WM. Crypto Read/Write Transponder Module FEATURES PACKAGE TYPES BLOCK DIAGRAM HCS410 IMMOBILIZER TRANSPONDER. Security. Operating.

MCP100/101. Microcontroller Supervisory Circuit with Push-Pull Output FEATURES PACKAGES DESCRIPTION BLOCK DIAGRAM

HCS512. Code Hopping Decoder* FEATURES PACKAGE TYPE BLOCK DIAGRAM DESCRIPTION. Security. Operating. Other. Typical Applications. Compatible Encoders

HCS200. Code Hopping Encoder FEATURES PACKAGE TYPES BLOCK DIAGRAM DESCRIPTION. Security. Operating. Other. Typical Applications PDIP, SOIC

TC1225 TC1226 TC1227. Inverting Dual ( V IN, 2V IN ) Charge Pump Voltage Converters FEATURES GENERAL DESCRIPTION TYPICAL APPLICATIONS

Using External RAM with PIC17CXX Devices PIC17C42 PIC17C43 PIC17C Microchip Technology Inc. DS91004A-page 1

HCS200. KEELOQ Code Hopping Encoder* PACKAGE TYPES FEATURES BLOCK DIAGRAM DESCRIPTION. Security. Operating. Other. Typical Applications PDIP, SOIC

TB003. An Introduction to KEELOQ Code Hopping INTRODUCTION. Remote Control Systems. The Solution. Code Scanning. Code Grabbing

Connecting Sensor Buttons to PIC12CXXX MCUs

TC4426 TC4427 TC A DUAL HIGH-SPEED POWER MOSFET DRIVERS GENERAL DESCRIPTION FEATURES ORDERING INFORMATION

27C K (32K x 8) CMOS EPROM FEATURES PACKAGE TYPES DESCRIPTION

AN663. Simple Code Hopping Decoder KEY FEATURES OVERVIEW

TCM828 TCM829. Switched Capacitor Voltage Converters FEATURES GENERAL DESCRIPTION APPLICATIONS ORDERING INFORMATION

HCS300. KEELOQ Code Hopping Encoder DESCRIPTION FEATURES PACKAGE TYPES HCS300 BLOCK DIAGRAM. Security. Operating. Other. Typical Applications

HCS201. Code Hopping Encoder

HCS515. Code Hopping Decoder PACKAGE TYPE FEATURES BLOCK DIAGRAM DESCRIPTION. Security. Operating. Other. Typical Applications. Compatible Encoders

PIC14C000. Errata Sheet for PIC14C000 Revision A. USING THE I 2 C MODULE IN SMBus MODE USING AN1 AND AN5 AS ANALOG INPUTS

TC4423 TC4424 TC4425 3A DUAL HIGH-SPEED POWER MOSFET DRIVERS GENERAL DESCRIPTION FEATURES ORDERING INFORMATION

HCS500. Code Hopping Decoder PACKAGE TYPE FEATURES BLOCK DIAGRAM DESCRIPTION. Security. Operating. Other. Typical Applications. Compatible Encoders

TC623. 3V, Dual Trip Point Temperature Sensor. Package Type. Features. Applications. General Description. Device Selection Table

Optical Pyrometer. Functions

HCS300. Code Hopping Encoder* FEATURES PACKAGE TYPES HCS300 BLOCK DIAGRAM DESCRIPTION. Security. Operating. Other. Typical Applications

TC643 INTEGRATED FAN / MOTOR DRIVER GENERAL DESCRIPTION FEATURES APPLICATIONS ORDERING INFORMATION

M TC3682/TC3683/TC3684

AN528. Implementing Wake-Up on Key Stroke. Implementing Wake-Up on Key Stroke INTRODUCTION IMPLEMENTATION FIGURE 1 - TWO KEY INTERFACE TO PIC16C5X

SUPER CHARGE PUMP DC-TO-DC VOLTAGE CONVERTER

TC52. Dual Channel Voltage Detector. Features. General Description. Typical Applications. Functional Block Diagram. Device Selection Table

DatasheetDirect.com. Visit to get your free datasheets. This datasheet has been downloaded by

TC1044S. Charge Pump DC-TO-DC Voltage Converter FEATURES GENERAL DESCRIPTION ORDERING INFORMATION

DatasheetDirect.com. Visit to get your free datasheets. This datasheet has been downloaded by

AN820. System Supervisors in ICSP TM Architectures CIRCUITRY BACKGROUND INTRODUCTION. MCP120 Output Stage. Microchip Technology Inc.

AN562. Using Endurance Predictive Software. Using the Microchip Endurance Predictive Software INTRODUCTION TOTAL ENDURANCE PREDICTIVE SOFTWARE

MCP V 10-Bit A/D Converter with SPI Serial Interface FEATURES PACKAGE TYPES APPLICATIONS FUNCTIONAL BLOCK DIAGRAM DESCRIPTION

AN603. Continuous Improvement THE EEPROM TECHNOLOGY TEAM INTRODUCTION TO MICROCHIP'S CULTURE. Continuous Improvement is Essential

TC51. 1µA Voltage Detector with Output Delay TC51. General Description. Features. Applications. Device Selection Table. Functional Block Diagram


TC mA Charge Pump Voltage Converter with Shutdown. Features. Package Type. Applications. General Description. Device Selection Table

PIC16C622A PIC16F628 Migration

TC4467 TC4468 TC4469 LOGIC-INPUT CMOS QUAD DRIVERS GENERAL DESCRIPTION FEATURES APPLICATIONS ORDERING INFORMATION

M TC1426/TC1427/TC1428

Using the TC1142 for Biasing a GaAs Power Amplifier. CTL High-Side. FET Switch GND V IN V OUT TC GND. Inductorless Boost/Buck Regulator

27C64. 64K (8K x 8) CMOS EPROM PACKAGE TYPES FEATURES DESCRIPTION. This document was created with FrameMaker 404

TCM680 +5V TO ±10V VOLTAGE CONVERTER GENERAL DESCRIPTION FEATURES APPLICATIONS ORDERING INFORMATION

TC57 Series. Linear Regulator Controller GENERAL DESCRIPTION FEATURES TYPICAL APPLICATIONS ORDERING INFORMATION PART CODE TC57 XX 02 ECT XX

1.5A Dual Open-Drain MOSFET Drivers. 8-Pin PDIP/SOIC/CERDIP IN A A BOTTOM IN B B TOP A TOP B BOTTOM IN A B TOP IN B

HCS362. HCS362 Data Sheet Errata. Clarifications/Corrections to the Data Sheet: 1. Module: Low Voltage Detector LOW VOLTAGE DETECTOR

TC620/TC621. 5V, Dual Trip Point Temperature Sensors. Features. Package Type. Applications. Device Selection Table. General Description

MCP V Dual Channel 12-Bit A/D Converter with SPI Serial Interface PACKAGE TYPES FEATURES APPLICATIONS FUNCTIONAL BLOCK DIAGRAM DESCRIPTION

1.5A Dual High-Speed Power MOSFET Drivers. Temp. Range

TC1221/TC1222. High Frequency Switched Capacitor Voltage Converters with Shutdown in SOT Packages. 6-Pin SOT-23A. Features. General Description

rfpic Development Kit 1 Quick Start Guide

2-Wire Serial Temperature Sensor and Thermal Monitor

HCS512. KEELOQ Code Hopping Decoder DESCRIPTION FEATURES PACKAGE TYPE BLOCK DIAGRAM. Security. Operating. Other. Typical Applications

PIC16C65A. PIC16C65A Rev. A Silicon Errata Sheet. 2. Module: CCP (Compare Mode) 1. Module: CCP (Compare Mode) SWITCHING

AN797. TC4426/27/28 System Design Practice INTRODUCTION. FIGURE 1: TC4426 output. FIGURE 2: Output stage IC layout.

DatasheetDirect.com. Visit to get your free datasheets. This datasheet has been downloaded by

AN765. Using Microchip's Micropower LDOs INTRODUCTION APPLICATIONS. Optimizing Output Voltage Accuracy of 1070/1071 Adjustable LDOs

MCP3204/ V 4-Channel/8-Channel 12-Bit A/D Converters with SPI Serial Interface FEATURES PACKAGE TYPES APPLICATIONS FUNCTIONAL BLOCK DIAGRAM

TC7662A. Charge Pump DC-to-DC Converter. Features. Package Type. General Description. Applications. Device Selection Table. 8-Pin PDIP 8-Pin CERDIP

TC Low Power, Quad Input, 16-Bit Sigma-Delta A/D Converter Features Package Type 16-Pin PDIP 16-Pin QSOP TC3402 Applications

TB059. Using The MCP2150 Developer s Board With The MCP2155 INTRODUCTION MCP2150 DEVELOPER S BOARD LAYOUT

HCS365. KEELOQ Code Hopping Encoder PACKAGE TYPES FEATURES HCS365 BLOCK DIAGRAM GENERAL DESCRIPTION. Security. Operating. Other. Typical Applications

TC1029. Linear Building Block Dual Low Power Op Amp. General Description. Features. Applications. Device Selection Table. Functional Block Diagram

TC mA Fixed Low Dropout Positive Regulator TC2117. General Description. Features. Applications. Typical Application Device Selection Table

Voltage-To-Frequency/Frequency-To-Voltage Converters

27LV K (32K x 8) Low-Voltage CMOS EPROM FEATURES PACKAGE TYPES DESCRIPTION PDIP

TC652 Fan Control Demo Board User s Guide

Electromechanical Switch Replacement

HCS512. KEELOQ Code Hopping Decoder DESCRIPTION FEATURES PACKAGE TYPE BLOCK DIAGRAM. Security. Operating. Other. Typical Applications

Linear Building Block Low-Power Comparator with Op Amp and

HCS515. KEELOQ Code Hopping Decoder PACKAGE TYPE FEATURES BLOCK DIAGRAM DESCRIPTION. Security. Operating. Other. Typical Applications

4-1/2 Digit Analog-To-Digital Converter with On-Chip LCD Drivers

AN763. Latch-Up Protection For MOSFET Drivers INTRODUCTION. CONSTRUCTION OF CMOS ICs PREVENTING SCR TRIGGERING. Grounds. Equivalent SCR Circuit.

HCS361. KEELOQ Code Hopping Encoder. FEATURES Security DESCRIPTION PACKAGE TYPES HCS361 BLOCK DIAGRAM DESCRIPTION

HT600/680/ Series of Encoders

3 18 Series of Encoders

AN654. PWM, a Software Solution for the PIC16CXXX METHODS INTRODUCTION

TC1034/TC1035 Linear Building Block Single Operational Amplifiers in SOT Packages Features General Description Applications Device Selection Table

HT12A/HT12E 2 12 Series of Encoders

Electromechanical Timer Replacement Solutions Cubed Real-Time Clock

AN824. KEELOQ Encoders Oscillator Calibration OVERVIEW WHY CALIBRATION? CALIBRATION BASICS. Microchip Technology Inc.

TC Bit Digital-to-Analog Converter with Two-Wire Interface TC1321. General Description. Features. Applications. Device Selection Table

Design Alternatives To The TC682 For Performing Inverting Voltage Doubler Functions. DC/DC Converter +5V 6 V IN V OUT TC682 NC GND 5

Radio Encoder / Decoder IC s

W588AXXX Data Sheet. 8-BIT MCU WITH VOICE SYNTHESIZER (PowerSpeech TM Series) Table of Contents-

AN606. Low Power Design Using PICmicro Microcontrollers INTRODUCTION DESIGN TECHNIQUES RESISTOR TO LOWER POWER IN RC MODE CONTROL CIRCUIT

HT6010/HT6012/HT Series of Encoders

AN798. TC4420/4429 Universal Power MOSFET Interface IC INTRODUCTION PARAMETERS AND ATTRIBUTES OF THE TC4420/4429 TIMING. Rise and Fall Times

MIC5528. High Performance 500 ma LDO in Thin and Extra Thin DFN Packages. General Description. Features. Applications.

3.3V ZERO DELAY CLOCK BUFFER, SPREAD SPECTRUM COMPATIBLE

AN867. Temperature Sensing With A Programmable Gain Amplifier INTRODUCTION INTERFACING THE PGA TO THERMISTORS

HT6026 Remote Control Encoder

HCS365. KEELOQ Code Hopping Encoder PACKAGE TYPES FEATURES HCS365 BLOCK DIAGRAM GENERAL DESCRIPTION. Security. Operating. Other. Typical Applications

TC7650. Chopper Stabilized Operational Amplifier. Package Type. Features. Applications. Device Selection Table. 8-Pin DIP TC7650CPA.

HCS201. KEELOQ Code Hopping Encoder DESCRIPTION FEATURES PACKAGE TYPES HCS201 BLOCK DIAGRAM. Security. Operating. Other. Typical Applications

HCS101. Fixed Code Encoder FEATURES PACKAGE TYPES HCS101 BLOCK DIAGRAM DESCRIPTION. Operating. Other. Typical Applications

TC1030. Linear Building Block Quad Low Power Op Amp with Shutdown Modes. General Description. Features. Applications. Device Selection Table

3.3V ZERO DELAY CLOCK MULTIPLIER

Transcription:

KEELOQ Code Hopping Decoder* HCS509 FEATURES Security Secure storage of manufacturer s key Secure storage of transmitter s keys NTQ109 compatible learning mode Up to six transmitters Master transmitter supported KEELOQ code hopping technology Operating 3.0V 6.0V operation 4 MHz RC oscillator Learning indication on repeat Auto baud rate detection Other NTQ109 functional replacement Stand alone decoder On-chip EEPROM for transmitter storage Four binary function outputs 15 functions 18-pin DIP/SOIC package Typical Applications Automotive remote entry systems Automotive alarm systems Automotive immobilizers Gate and garage openers Electronic door locks Identity tokens Burglar alarm systems Compatible Encoders NTQ106, NTQ105, NTQ104 HCS200, HCS300/301, HCS360/361 DESCRIPTION The HCS509 is a code hopping decoder designed for secure Remote Keyless Entry (RKE) systems. The HCS509 utilizes the patented KEELOQ code hopping system and high security learning mechanisms to make this a canned solution when used with the HCS encoders to implement a unidirectional remote keyless entry system. PACKAGE TYPE PDIP, SOIC BLOCK DIAGRAM RFIN LRNIN REPEAT SEL MCLR GND F1 [S0] F2 [S1] F3 F1L EEPROM OSCIN OSCILLATOR 1 2 3 4 5 6 7 8 9 HCS509 The manufacturer s key, transmitter keys, and synchronization information are stored in protected on-chip EEPROM. The HCS509 uses the DAT and CLK inputs to load the manufacturer s key and cannot be read out of the device. The HCS509 operates over a wide voltage range of 3.0 volts to 6.0 volts. The decoder employs automatic baud rate detection which allows it to compensate for wide variations in transmitter data rate. The decoder contains sophisticated error checking algorithms to ensure only valid codes are accepted. 18 17 16 15 14 13 12 11 10 67-Bit Reception Register CONTROL OUTPUT F1 F2 F3 F1L RFIN MODE OSCIN NC VDD DAT [S3] CLK [S2] DELAY MASTER DECRYPTOR CONTROL DAT [S3] CLK [S2] LRNIN MODE MCLR REPEAT MASTER Keeloq is a trademark of *Code hopping patents issued in Europe, U. S. A., and R. S. A. Patents Numbers US: 5,517,187; Europe: 0459781 1996 Preliminary DS40147A-page 1

1.0 KEELOQ SYSTEM OVERVIEW 1.1 Key Terms Manufacturer s Code a 64-bit word, unique to each manufacturer, used to produce a unique encryption key in each transmitter (encoder). Decryption Key a unique 64-bit key generated or programmed into the decoder. The decryption key controls the encryption algorithm and is stored in EEPROM on the decoder device. Learn The receiver uses the same information that is transmitted during normal operation to derive the transmitter s secret key, decrypt the discrimination value and the synchronization counter in learning mode to match a transmitter to a receiver. The encryption/decryption key is a function of the manufacturer s key and the device serial number. The HCS encoders and decoders employ the KEELOQ code hopping technology and an encryption algorithm to achieve a high level of security. Code hopping is a method by which the code transmitted from the transmitter to the receiver is different every time a button is pushed. This method, coupled with a transmission length of 66 bits, virtually eliminates the use of code grabbing or code scanning. 1.2 HCS Encoder Overview The HCS encoders have a small EEPROM array which must be loaded with several parameters before use. The most important of these values are: A 28-bit serial number which is meant to be unique for every encoder An encryption key that is generated at the time of production A 16-bit synchronization value The serial number for each encoder is programmed by the manufacturer at the time of production. The generation of the encryption key is done using a key generation algorithm (Figure 1-1). Typically, inputs to the key generation algorithm are the serial number of the encoder and a 64-bit manufacturer s code. The manufacturer s code is chosen by the system manufacturer and must be carefully controlled. The manufacturer s code is a pivotal part of the overall system security. FIGURE 1-1: CREATION AND STORAGE OF ENCRYPTION KEY DURING PRODUCTION Manufacturer s Code Transmitter Serial Number or Seed Key Generation Algorithm Encryption Key HCSXXX EEPROM Array Serial Number Encryption Key Sync Counter... DS40147A-page 2 Preliminary 1996

The 16-bit synchronization value is the basis for the transmitted code changing for each transmission and is updated each time a button is pressed. Because of the complexity of the code hopping encryption algorithm, a change in one bit of the synchronization value will result in a large change in the actual transmitted code. There is a relationship (Figure 1-2) between the key values in EEPROM and how they are used in the encoder. Once the encoder detects that a button has been pressed, the encoder reads the button and updates the synchronization counter. The synchronization value is then combined with the encryption key in the encryption algorithm, and the output is 32 bits of encrypted information. This data will change with every button press, hence, it is referred to as the hopping portion of the code word. The 32-bit hopping code is combined with the button information and the serial number to form the code word transmitted to the receiver. 1.3 HCS Decoder Overview Before a transmitter can be used with a particular receiver, the transmitter must be learned by the receiver. Upon learning a transmitter, information is stored by the receiver so that it may track the transmitter, including the serial number of the transmitter, the current synchronization value for that transmitter, and the same encryption key that is used on the transmitter. If a receiver receives a message of valid format, the serial number is checked and, if it is from a learned transmitter, the message is decrypted and the decrypted synchronization counter is checked against what is stored. If the synchronization value is verified, then the button status is checked to see what operation is needed. Figure 1-3 shows the relationship between some of the values stored by the receiver and the values received from the transmitter. FIGURE 1-2: BASIC OPERATION OF TRANSMITTER (ENCODER) Transmitted Information EEPROM Array KEELOQ Encryption Algorithm 32 Bits of Encrypted Data Serial Number Button Press Information Encryption Key Sync Counter Serial Number FIGURE 1-3: BASIC OPERATION OF RECEIVER (DECODER) EEPROM Array Decryption Key Sync Counter Serial Number Manufacturer Code Check for Match KEELOQ Decryption Algorithm Check for Match Decrypted Synchronization Counter Button Press Information Serial Number 32-Bits of Encrypted Data Received Information 1996 Preliminary DS40147A-page 3

2.0 PIN ASSIGNMENT PIN Decoder Function I/O (1) Buffer Type (1) Description 1 LRNIN I TTL Learn input - initiates learning, 10K pull-up required on input 2 REPEAT O TTL Repeat output - Indicates repeated codes 3 SEL I TTL Connect to VDD 4 MCLR I ST Master clear input 5 Ground P Ground connection 6 F1 [S0] O TTL Function 1 output (Also S0) 7 F2 [S1] O TTL Function 2 output (Also S1) 8 F3 O TTL Function 3 output 9 F1L O TTL Function 1 latched 10 MASTER O TTL Master transmitter output 11 DELAY O TTL Delayed transmission output 12 CLK [S2] I/O TTL/ST (2) Clock in programming mode (Also S2 output) (Note 3) 13 DAT [S3] I/O TTL/ST (2) Data in programming mode (Also S3 output) (Note 3) 14 VDD P Power connection 15 NC No connection 16 OSCIN (4 MHz) I ST Oscillator in recommended values 10 k¾ and 10pF 17 MODE I TTL Input to select learning or preprogramming mode 18 RFIN I TTL RF input from receiver Note 1: P = power, I = in, O = out, and ST = Schmitt Trigger input. 2: This buffer is a Schmitt Trigger input when used in serial programming mode. 3: Pin 12 and Pin 13 have a dual purpose. During reset these pins are used to determine if programming mode is selected in which case they are the clock and data lines. In normal operation mode these pins are the upper 2-bits of the button code [S3 S2]. DS40147A-page 4 Preliminary 1996

3.0 DESCRIPTION OF FUNCTIONS 3.1 Master Transmitter transmission command is received or when the same transmissions are received consecutively for 4 seconds. In learning mode the decoder can be set up so that the first transmitter that is learned becomes the master transmitter. The master transmitter will not be erased when more than the maximum transmitters are learned. The master transmitter can be used to implement higher privileges in a system such as activating learning. When the master transmitter is activated the associated function outputs as well as the MASTER output are activated. To implement a master learn the MASTER output can be inverted to control the LRNIN input. 3.2 Delayed Mode The delayed mode can be used to implement a function associated with activating a transmitter for an extended period of time such as panic. Delayed mode is handled differently for encoders with delay mode transmission commands (NTQ106, HCS360/361) than encoders without delay mode transmission commands (HCS200/ 300/301). The DELAY output is activated when a delay 3.3 Repeat The REPEAT output is activated for 50 ms every time a repeated code is received. The REPEAT output is also used to indicate successful learning. The transmitter should be activated during the first and second steps of learning until the REPEAT output goes high. 3.4 Latched The F1L (Function 1 latched) output can be used to implement a nonvolatile latch function. F1L will change state every time F1 is activated and return to the state it was in after power loss. 4.0 OUTPUT MAPPING The HCS509 supports the NTQ109 s output format. These are: F1, F2, F1L, F3, REPEAT, MASTER, and DELAY outputs. Additional to these outputs the HCS509 also supports a binary output of the function code [S3 S2 S1 S0] which allows the decoder to use all the button codes of the new HCS encoders (Table 4-1). FIGURE 4-1: FUNCTION OUTPUT TABLE Function Code DAT[S3] CLK[S2] F3 F2[S1] F1[S0] F1L Description 0001 0 0 0 0 1 T F1 on NTQ109, F1L toggle/binary output 0010 0 0 0 1 0 NC F2 on NTQ109/Binary output 0011 0 0 1 0 0 NC F3 on NTQ109/BInary output 0100 0 1 0 0 0 NC Binary output [S3 S2 S1 S0] 0101 0 1 0 0 1 NC Binary output [S3 S2 S1 S0] 0110 0 1 0 1 0 NC Binary output [S3 S2 S1 S0] 0111 0 1 0 1 1 NC Binary output [S3 S2 S1 S0] 1000 1 0 0 0 0 NC Binary output [S3 S2 S1 S0] Note: NC = No Change; T = Toggle. 1996 Preliminary DS40147A-page 5

5.0 MODE CONFIGURATION Function DAT[S3] CLK[S2] F3 F2[S1] F1[S0] F1L Description Code The HCS509 decoder has two modes of operation. The 1001 1 0 0 0 1 nonlearning NC Binary mode output supports [S3 up S2 to S1 4 S0] transmitters and 1010 1 0 0 1 0 the learning NC mode Binary supports output [S3 up S2 to 6 S1 transmitters. S0] 1011 1 0 0 1 1 The nonlearning NC Binary mode output must [S3 be S2 used S1 S0] where transmitters 1100 1 1 0 0 0 are NC preprogrammed Binary output at [S3 the S2 factory S1 S0] and learning 1101 1 1 0 0 1 capability NC is not Binary required. output In [S3 this S2 mode S1 S0] there need not 1110 1 1 0 1 0 be a NC relationship Binary between output [S3 the S2 serial S1 S0] number and the 1111 1 1 0 1 1 decryption NC key. Binary output [S3 S2 S1 S0] Note: NC = No Change; T = Toggle. The learning mode does not store the decryption key but derives it from the serial number and manufacterer s key each time it is required. In nonlearning mode, the serial number, synchronization counter, and decryption key must be programmed for each transmitter in the system. The manufacturer s key is not required in preprogram mode. In learning mode, the only information that needs to be programmed is the manufacturer s key. Transmitters are learned into the HCS509 through the normal learn procedure. DS40147A-page 6 Preliminary 1996

6.0 DECODER OPERATION 6.1 Learning a Transmitter to a Receiver The learning mode is selected when the mode pin is low. In order for a transmitter to be used with a decoder, the transmitter must first be learned. When a transmitter is learned to a decoder, the decoder stores the serial number and current synchronization value in EEPROM. The decoder must keep track of these values for every transmitter that is learned (Figure 6-1). The maximum number of transmitters that can be learned is five and one master transmitter. The decoder must also store the manufacturer s key in order to learn a transmitter and will typically be the same for all decoders in a system. In learning mode the decoder assigns 6 memory slots. A learning pointer is used to point to the next learning position. The learning pointer can be set up to point to the first (master) memory slot. If LRN_PTR is initialized to the master position, the first transmitter learned will learn in the master position. This transmitter learned into the system will then become the master transmitter. If initialized to the transmitter 1 position, the first transmitter will learn into transmitter 1. Transmitters will be learned into the memory slots until position five is reached. The learning pointer then wraps back to transmitter 1. Transmitters can be erased by repeated learning. However, the master transmitter will be fixed into the system and cannot be erased. FIGURE 6-1: ASSIGNMENT OF MEMORY SLOTS Master Transmitter 1 Transmitter 2 Transmitter 3 Transmitter 4 Transmitter 5 It must be stated that various patents exist on learning strategies and care must be taken not to infringe these patents when using the HCS509 in a system. To learn a new transmitter to the HCS509 decoder, the following sequence is required: 1. Enter learning mode by pulling LRNIN low for longer than 32 ms. 2. Activate the transmitter until the REPEAT output goes high indicating reception of a valid code. 3. Activate the transmitter a second time until the REPEAT goes high again. 4. The transmitter is now learned into the decoder. 5. Repeat steps 1-4 to learn up to 6 transmitters. 6. Learning will be terminated if two non-sequential codes were received or if two acceptable codes were not decoded within 30 seconds. The following checks are performed on the decoder to determine if the transmission is valid during learn: The first code word is checked for bit integrity. The hopping code is decrypted. The discrimination value is compared to the serial number. The second code word is checked for bit integrity. The hopping code is decrypted. The function codes of the first transmission and second transmission are compared. The synchronization counters of the hopping codes are compared to check that they are sequential codes. If all the checks pass, the serial number and synchronization counters are stored in EEPROM memory. Figure 6-2 shows a flow chart of the learn sequence. Note: Whenever a transmission with the same serial number as the Master transmitter is received during learn, learn will ignore the transmission and wait for the next. Only if a serial number other than the master serial number is received will learn continue. Learn will terminate if no transmissions are received for more than 30 seconds. 6.1.1 LEARNING PROCEDURE Learning is activated by taking the LRNIN input low for longer than 32 ms. This input requires an external pullup resistor. The learn input can be either pulled low using a manual learn button or by feeding the MASTER output inverted back to the LRNIN input (Master learn activation). 1996 Preliminary DS40147A-page 7

FIGURE 6-2: LEARN SEQUENCE 6.3 Validation of Codes Enter Learn Mode Wait for Reception of a Valid Code Generate Key from Serial Number Use Generated Key to Decrypt Wait for Reception of Second Non-Repeated Valid Code Use Generated Key to Decrypt Compare Discrimination Value with Serial Number The HCS509 is a single chip functional replacement for the NTQ109 and NTQ106 decoder chipset. The HCS509 treats all transmitters as NTQ104/105/106 equivalent transmitters. This means that the full code (66- or 67-bits) is received but only 56 bits are interpreted. Serial numbers are truncated to 24 bits to be compatible with the NTQ104/105/106. In a typical decoder operation (Figure 6-3), the key generation on the decoder side is done by taking the serial number from a transmission and combining that with the manufacturer s key to create the same secret key that was used by the transmitter. Once the secret key is obtained, the rest of the transmission can be decrypted. The decoder waits for a transmission and checks the serial number to determine if it is a learned transmitter. If it is, it takes the encrypted portion of the transmission and decrypts it using the decryption key. It uses the discrimination bits to determine if the decryption was valid. If everything up to this point is valid, the synchronization value is evaluated. Equal? Yes No Counters Sequential? Yes No Learn successful Store: Serial number Synchronization counter Learn Unsuccessful Exit 6.2 Preprogramming Transmitters into the Decoder in Nonlearning Mode The nonlearning mode is selected when the mode pin is high. This mode can be used where there is no relationship between the serial number and the decryption key or where the relationship is not the relationship used on the NTQ109. Transmitter information can be programmed at the time of manufacture. This does not allow the learning of additional transmitters at a later stage. DS40147A-page 8 Preliminary 1996

6.4 Validation Steps Validation consists of the following steps: Search EEPROM to find the Serial Number Match Decrypt the Hopping Code Compare the User Bits and the 8 bits of discrimination value with the lower 8 bits of serial number Check if the synchronization counter falls within the first synchronization window. Check if the synchronization counter falls within the second synchronization window. If a valid transmission is found, update the synchronization counter, else use the next transmitter block and repeat the tests. FIGURE 6-3: No DECODER OPERATION Start Transmission Received? Yes No Does Serial Number Match? Yes Decrypt Transmission No No Is Decryption Valid? Yes Is Counter Within 16? No Is Counter Within 32K? Yes Execute Command and Update Counter 6.5 Synchronization with Decoder The KEELOQ technology features a sophisticated synchronization technique (Figure 6-4) which does not require the calculation and storage of future codes. If the stored counter value for that particular transmitter and the counter value that was just decrypted are within a formatted window of 16, the counter is stored and the command is executed. If the counter value was not within the single operation window, but is within the double operation window of 32K window, the transmitted synchronization value is stored in temporary location, and it goes back to waiting for another transmission. When the next valid transmission is received, it will check the new value with the one in temporary storage. If the two values are sequential, it is assumed that the counter had just gotten out of the single operation window, but is now back in sync, so the new synchronization value is stored and the command executed. If a transmitter has somehow gotten out of the double operation window, the transmitter will not work and must be relearned. Since the entire window rotates after each valid transmission, codes that have been used are part of the blocked (32K) codes and are no longer valid. This eliminates the possibility of grabbing a previous code and retransmitting to gain entry. FIGURE 6-4: Entire Window rotates to eliminate use of previously used codes SYNCHRONIZATION WINDOW Blocked (32K Codes) Double Operation (32K Codes) Current Position Single Operation Window (16 Codes) Yes Save Counter in Temp Location 1996 Preliminary DS40147A-page 9

7.0 INTEGRATING THE HCS509 INTO A SYSTEM The HCS509 can act as a stand alone decoder or be interfaced to a microcontroller. Typical stand alone applications include garage door openers and electronic door locks. In stand alone applications the HCS509 will handle learning, reception, decryption and validation of the received code and generate the appropriate output. For a garage door opener the HCS509 input will be connected to a RF receiver and the output to a relay driver to connect a motor controller. Typical systems where the HCS509 will be connected to a microcontroller include vehicle and home security systems. The HCS509 input will be connected to a RF receiver and the function outputs to the microcontroller. The HCS509 will handle all the decoding functions and the microcontroller all the system functions. DS40147A-page 10 Preliminary 1996

8.0 DIFFERENCES BETWEEN NTQ109 AND THE HCS509 For those users familiar with the NTQ109, Table 8-1 lists the differences between the NTQ109 and the HCS509 decoders. TABLE 8-1: DIFFERENCES Item Differences 1 Added binary button outputs. For F1, F2, and F3 function codes the HCS509 will function similarly to the NTQ109, but for F4 and higher the HCS509 displays the binary value of the received function code [S3 S2 S1 S0] by using the F1, F2, DAT, and CLK lines of the HCS509. 2 Learn Mode Pin. This enable the user to select between to modes of operation for the HCS509. The first, allows a maximum of six transmitters but then only the normal Keygen learn method is allowed. The second, allows the user to use a different learning method but requires that the transmitters be preprogrammed into EEPROM using the factory programming interface. In this mode a maximum of four transmitters are allowed. This ton The ping stor ond then Item Differences Reason 3 The HCS509 has an added test after reset to determine whether programming mode should be entered or not. This interface is used to initialize the HCS509 s learn pointer, manufacturer s key and transmitter memory blocks. 4 Automatic Delay Function activation. If a repeated transmission is received for 4 seconds after the function output was activated an automatic delay function will be activated. The HCS509 has internal EEPROM memory, and the only access to it is through a factory programming interface. Therefore, to initialize the HCS509 it is necessary to check for the factory programming activation sequence after reset. The HCS200/300 s decoders don t have a delay function option, and to enable these transmitters to emulate the delay function, normally used as a panic, this feature was added. 1996 Preliminary DS40147A-page 11

9.0 KEELOQ ENCODERS 9.1 Transmission Format (PWM) The KEELOQ encoder transmission is made up of several parts (Figure 9-1). Each transmission begins with a preamble and a header, followed by the encrypted and then the fixed data. The actual data is 56/66/67 bits which consists of 32 bits of encrypted data and 24/34/35 bits of non-encrypted data. Each transmission is followed by a guard period before another transmission can begin. The encrypted portion provides up to four billion changing code combinations and includes the button status bits (based on which buttons were activated) along with the synchronization counter value and some discrimination bits. The non-encrypted portion is comprised of the status bits, the function bits, and the 24/ 28-bit serial number. The encrypted and non-encrypted combined sections increase the number of combinations to 7.38 x 10 19. 9.2 Code Word Organization The HCSXXX encoder transmits a 66/67-bit code word when a button is pressed. The 66/67-bit word is constructed from a Fixed Code portion and an Encrypted Code portion (Figure 9-2). The Encrypted Data is generated from four button bits, two overflow counter bits, ten discrimination bits, and the 16-bit synchronization value. The Non-encrypted Data is made up from 2 status bits, 4 function bits, and the 28/32-bit serial number. FIGURE 9-1: CODE WORD TRANSMISSION FORMAT LOGIC 0 Bit Period LOGIC 1 Encrypted Portion Fixed Portion of Guard Preamble Header of Transmission Transmission Time TP TH THOP TFIX TG FIGURE 9-2: CODE WORD ORGANIZATION Non-encrypted Data Encrypted Data CRC1* Repeat CRC0* Vlow (1 bit) Button Status (4 bits) 28-bit Serial Number Button Status (4 bits) Discrimination bits (12 bits) 16-bit Sync Value 3/2 bits + Serial Number and Button Status (32 bits) + 32 bits of Encrypted Data 66/67 bits of Data Transmitted *HCS360/361 DS40147A-page 12 Preliminary 1996

10.0 ELECTRICAL CHARACTERISTICS FOR HCS509 Absolute Maximum Ratings Ambient temperature under bias...-55 C to +125 C Storage temperature...-65 C to +150 C Voltage on any pin with respect to VSS (except VDD)... -0.6V to VDD +0.6V Voltage on VDD with respect to Vss...0 to +7.5V Total power dissipation (Note 1)...800 mw Maximum current out of VSS pin...150 ma Maximum current into VDD pin...100 ma Input clamp current, Iik (VI < 0 or VI > VDD)...± 20 ma Output clamp current, IOK (V0 < 0 or V0 >VDD)...± 20 ma Maximum output current sunk by any I/O pin...25 ma Maximum output current sourced by any I/O pin...20 ma Note: Power dissipation is calculated as follows: Pdis = VDD x {IDD - IOH} + {(VDD VOH) x IOH} + (VOl x IOL) NOTICE: Stresses above those listed under Absolute Maximum Ratings may cause permanent damage to the device. This is a stress rating only and functional operation of the device at those or any other conditions above those indicated in the operation listings of this specification is not implied. Exposure to maximum rating conditions for extended periods may affect device reliability. 1996 Preliminary DS40147A-page 13

TABLE 10-1: DC CHARACTERISTICS Standard Operating Conditions (unless otherwise stated) DC CHARACTERISTICS Operating temperature -40 C TA +85 C for industrial and 0 C TA +70 C for commercial Symbol Characteristic Min Typ ( ) Max Units Conditions VDD Supply Voltage 3.0 6.0 V VPOR VDD start voltage to VSS V ensure Reset SVDD VDD rise rate to ensure Reset 0.05* V/ms IDD Supply Current TABLE 10-2: FIGURE 10-1: AC CHARACTERISTICS 1.8 7.3 4.5 10 RESET WATCHDOG TIMER, OSCILLATOR START-UP TIMER AND POWER-UP TIMER TIMING ma ma FOSC = 4 MHz, VDD = 5.5V (During EEPROM programming) VIL Input Low Voltage VSS 0.16 VDD V except MCLR = 0.2 VDD VIH Input High Voltage 0.48 VDD VDD V except MCLR = 0.85 VDD VOL Output Low Voltage 0.6 V IOL = 8.5 ma, VDD = 4.5V VOH Output High Voltage VDD - 0.7 V IOH = -3.0 ma, VDD = 4.5V Data in Typ column is at 5.0V, 25 C unless otherwise stated. These parameters are for design guidance only and are not tested. * These parameters are characterized but not tested. Note: Negative current is defined as coming out of the pin. Symbol Characteristic Min Typ Max Units Conditions FOSC Oscillator frequency 2.7 4 6.21 MHz Rext=10K, Cext=10pF FBAUD Auto baudrate range 500 3200 bps TOD Output delay 48 75 237 ms TA Output activation time 322 500 740 ms TRPT REPEAT activation time 32 50 74 ms TLRN LRNIN activation time 21 32 ms TMCLR MCLR low time 150 ns TOV Time output valid 150 222 ms VDD MCLR TMCLR TOV I/O Pins DS40147A-page 14 Preliminary 1996

FIGURE 10-2: OUTPUT ACTIVATION 1 Code Word 50ms RFIN TOD F1/F2/F3 MASTER TA Note 1 TA F1L Note 2 TRPT REPEAT Note 3 DELAY NTQXXX Note 4 DELAY HCSXXX TA 0s 1s 2s 3s 4s 5s Note 1: Output is activated if master transmitter is detected. 2: F1L will change state every time F1 is activated. 3: Output is activated when delay command is received from encoder. 4: Output is activated if HCSXXX transmission is received from more than 4 seconds. 1996 Preliminary DS40147A-page 15

FIGURE 10-3: TEST CIRCUIT VDD LOW VOLTAGE DETECTOR VI G VO ND 1K VDD 10K 10 pf P1 4 3 16 15 MCLR SEL OSC1 NC V D D G ND 14 NC RFIN LRNIN REPEAT F1[S0] F2[S1] F3 F1L MASTER DELAY CLK DAT HCS509 5 17 18 1 2 6 78 9 10 11 12 13 12V GND 1 23 1 RF INPUT VDD 10K LEARN INIT 1N4004/7 100 µf POWER SUPPLY P2 P3 10K 10K LM7805 VDD VI G VO ND 100µF 1K REPEAT 1K 1K 1K 1K 1K F1 F2 F3 F1L MASTER 1K DELAY P1 P2 P3 Programming Pads DS40147A-page 16 Preliminary 1996

HCS509 Product Identification System To order or to obtain information, e.g., on pricing or delivery, please use the listed part numbers, and refer to the factory or the listed sales offices. HCS509 /P Package: Temperature Range: P = DIP (300 mil Body), 18-lead SN = SOIC (300 mil body), 18-lead Blank = 0 C to +70 C I = -40 C to +85 C Device: HCS509 Code Hopping Decoder HCS509T Code Hopping Decoder (Tape and Reel) DS40147A-page 17 Preliminary 1996

WORLDWIDE SALES AND SERVICE AMERICAS Corporate Office 2355 West Chandler Blvd. Chandler, AZ 85224-6199 Tel: 480-786-7200 Fax: 480-786-7277 Technical Support: 480-786-7627 Web Address: http://www.microchip.com Atlanta 500 Sugar Mill Road, Suite 200B Atlanta, GA 30350 Tel: 770-640-0034 Fax: 770-640-0307 Boston 5 Mount Royal Avenue Marlborough, MA 01752 Tel: 508-480-9990 Fax: 508-480-8575 Chicago 333 Pierce Road, Suite 180 Itasca, IL 60143 Tel: 630-285-0071 Fax: 630-285-0075 Dallas 4570 Westgrove Drive, Suite 160 Addison, TX 75248 Tel: 972-818-7423 Fax: 972-818-2924 Dayton Two Prestige Place, Suite 150 Miamisburg, OH 45342 Tel: 937-291-1654 Fax: 937-291-9175 Detroit Tri-Atria Office Building 32255 Northwestern Highway, Suite 190 Farmington Hills, MI 48334 Tel: 248-538-2250 Fax: 248-538-2260 Los Angeles 18201 Von Karman, Suite 1090 Irvine, CA 92612 Tel: 949-263-1888 Fax: 949-263-1338 New York 150 Motor Parkway, Suite 202 Hauppauge, NY 11788 Tel: 631-273-5305 Fax: 631-273-5335 San Jose 2107 North First Street, Suite 590 San Jose, CA 95131 Tel: 408-436-7950 Fax: 408-436-7955 AMERICAS (continued) Toronto 5925 Airport Road, Suite 200 Mississauga, Ontario L4V 1W1, Canada Tel: 905-405-6279 Fax: 905-405-6253 ASIA/PACIFIC Hong Kong Microchip Asia Pacific Unit 2101, Tower 2 Metroplaza 223 Hing Fong Road Kwai Fong, N.T., Hong Kong Tel: 852-2-401-1200 Fax: 852-2-401-3431 Beijing Microchip Technology, Beijing Unit 915, 6 Chaoyangmen Bei Dajie Dong Erhuan Road, Dongcheng District New China Hong Kong Manhattan Building Beijing 100027 PRC Tel: 86-10-85282100 Fax: 86-10-85282104 India India Liaison Office No. 6, Legacy, Convent Road Bangalore 560 025, India Tel: 91-80-229-0061 Fax: 91-80-229-0062 Japan Microchip Technology Intl. Inc. Benex S-1 6F 3-18-20, Shinyokohama Kohoku-Ku, Yokohama-shi Kanagawa 222-0033 Japan Tel: 81-45-471-6166 Fax: 81-45-471-6122 Korea Microchip Technology Korea 168-1, Youngbo Bldg. 3 Floor Samsung-Dong, Kangnam-Ku Seoul, Korea Tel: 82-2-554-7200 Fax: 82-2-558-5934 Shanghai Microchip Technology RM 406 Shanghai Golden Bridge Bldg. 2077 Yan an Road West, Hong Qiao District Shanghai, PRC 200335 Tel: 86-21-6275-5700 Fax: 86 21-6275-5060 ASIA/PACIFIC (continued) Singapore Microchip Technology Singapore Pte Ltd. 200 Middle Road #07-02 Prime Centre Singapore 188980 Tel: 65-334-8870 Fax: 65-334-8850 Taiwan, R.O.C Microchip Technology Taiwan 10F-1C 207 Tung Hua North Road Taipei, Taiwan, ROC Tel: 886-2-2717-7175 Fax: 886-2-2545-0139 EUROPE United Kingdom Arizona Microchip Technology Ltd. 505 Eskdale Road Winnersh Triangle Wokingham Berkshire, England RG41 5TU Tel: 44 118 921 5858 Fax: 44-118 921-5835 Denmark Microchip Technology Denmark ApS Regus Business Centre Lautrup hoj 1-3 Ballerup DK-2750 Denmark Tel: 45 4420 9895 Fax: 45 4420 9910 France Arizona Microchip Technology SARL Parc d Activite du Moulin de Massy 43 Rue du Saule Trapu Batiment A - ler Etage 91300 Massy, France Tel: 33-1-69-53-63-20 Fax: 33-1-69-30-90-79 Germany Arizona Microchip Technology GmbH Gustav-Heinemann-Ring 125 D-81739 München, Germany Tel: 49-89-627-144 0 Fax: 49-89-627-144-44 Italy Arizona Microchip Technology SRL Centro Direzionale Colleoni Palazzo Taurus 1 V. Le Colleoni 1 20041 Agrate Brianza Milan, Italy Tel: 39-039-65791-1 Fax: 39-039-6899883 11/15/99 Microchip received QS-9000 quality system certification for its worldwide headquarters, design and wafer fabrication facilities in Chandler and Tempe, Arizona in July 1999. The Company s quality system processes and procedures are QS-9000 compliant for its PICmicro 8-bit MCUs, KEELOQ code hopping devices, Serial EEPROMs and microperipheral products. In addition, Microchip s quality system for the design and manufacture of development systems is ISO 9001 certified. All rights reserved. 1999 Microchip Technology Incorporated. Printed in the USA. 11/99 Printed on recycled paper. Information contained in this publication regarding device applications and the like is intended for suggestion only and may be superseded by updates. No representation or warranty is given and no liability is assumed by Microchip Technology Incorporated with respect to the accuracy or use of such information, or infringement of patents or other intellectual property rights arising from such use or otherwise. Use of Microchip s products as critical components in life support systems is not authorized except with express written approval by Microchip. No licenses are conveyed, implicitly or otherwise, under any intellectual property rights. The Microchip logo and name are registered trademarks of in the U.S.A. and other countries. All rights reserved. All other trademarks mentioned herein are the property of their respective companies. 1999