HCS500
K
EE
L
OQ
®
Code Hopping Decoder
FEATURES
Security
•
•
•
•
•
Encrypted Storage of Manufacturer’s Code
Encrypted Storage of Crypt Keys
Up to Seven Transmitters can be Learned
K
EE
L
OQ
Code Hopping Technology
Normal and Secure Learning Mechanisms
DESCRIPTION
The Microchip Technology Inc. HCS500 is a code
hopping decoder designed for secure Remote Keyless
Entry (RKE) systems. The HCS500 utilizes the
patented K
EE
L
OQ
code hopping system and high-
security learning mechanisms to make this a canned
solution when used with the HCS encoders to
implement a unidirectional remote and access control
systems. The HCS500 can be used as a stand-alone
decoder or in conjunction with a microcontroller.
Operating
• 3.0V—5.5V Operation
• Internal Oscillator
• Auto Bit Rate Detection
PIN DIAGRAM
PDIP, SOIJ
V
DD
1
2
3
4
HCS500
8
7
6
5
V
SS
RFIN
S_CLK
S_DAT
Other
•
•
•
•
•
Stand-Alone Decoder Chipset
External EEPROM for Transmitter Storage
Synchronous Serial Interface
1 Kbit user EEPROM
8-Pin PDIP/SOIJ Package
EE_CLK
EE_DAT
MCLR
Typical Applications
•
•
•
•
•
•
•
Automotive Remote Entry Systems
Automotive Alarm Systems
Automotive Immobilizers
Gate and Garage Openers
Electronic Door Locks
Identity Tokens
Burglar Alarm Systems
FIGURE 1:
RFIN
BLOCK DIAGRAM
Reception Register
DECRYPTOR
EE_DAT
External
EEPROM
CONTROL
EE_CLK
S_DAT
S_CLK
OSCILLATOR
MCLR
Compatible Encoders
All K
EE
L
OQ
encoders and transponders configured for
the following setting:
•
•
•
•
•
•
PWM Modulation Format (1/3-2/3)
T
E
in the range from 100 us to 400 us
10 x T
E
Header
28-Bit Serial Number
16-Bit Synchronization Counter
Discrimination Bits Equal to Serial Number
8 LSbs
• 66- to 69-Bit Length Code Word.
The manufacturer’s code, crypt keys, and
synchronization information are stored in encrypted
form in external EEPROM. The HCS500 uses the
S_DAT and S_CLK inputs to communicate with a host
controller device.
The HCS500 operates over a wide voltage range of
3.0 volts to 5.5 volts. The decoder employs automatic
bit-rate detection, which allows it to compensate for
wide variations in transmitter data rate. The decoder
contains sophisticated error checking algorithms to
ensure only valid codes are accepted.
2001-2015 Microchip Technology Inc.
DS40000153E-page 1
HCS500
1.0
SYSTEM OVERVIEW
Key Terms
The following is a list of key terms used throughout this
data sheet. For additional information on K
EE
L
OQ
and
code hopping, refer to Technical Brief 3 (TB003).
•
RKE
– Remote Keyless Entry
•
Button Status
– Indicates what button input(s)
activated the transmission. Encompasses the four
button Status bits S3, S2, S1 and S0 (Figure
7-2).
•
Code Hopping
– A method by which a code,
viewed externally to the system, appears to
change unpredictably each time it is transmitted.
•
Code word
– A block of data that is repeatedly
transmitted upon button activation (Figure
7-1).
•
Transmission
– A data stream consisting of
repeating code words (Figure
7-1).
•
Crypt key
– A unique and secret 64-bit number
used to encrypt and decrypt data. In a symmetri-
cal block cipher such as the K
EE
L
OQ
algorithm,
the encryption and decryption keys are equal and
will therefore be referred to generally as the crypt
key.
•
Encoder
– A device that generates and encodes
data.
•
Encryption Algorithm
– A recipe whereby data
is scrambled using a crypt key. The data can only
be interpreted by the respective decryption algo-
rithm using the same crypt key.
•
Decoder
– A device that decodes data received
from an encoder.
•
Decryption algorithm
– A recipe whereby data
scrambled by an encryption algorithm can be
unscrambled using the same crypt key.
•
Learn
– Learning involves the receiver calculating
the transmitter’s appropriate crypt key, decrypting
the received hopping code and storing the serial
number, synchronization counter value and crypt
key in EEPROM. The K
EE
L
OQ
product family
facilitates several learning strategies to be
implemented on the decoder. The following are
examples of what can be done.
-
Simple Learning
The receiver uses a fixed crypt key, common
to all components of all systems by the same
manufacturer, to decrypt the received code
word’s encrypted portion.
-
Normal Learning
The receiver uses information transmitted
during normal operation to derive the crypt
key and decrypt the received code word’s
encrypted portion.
-
Secure Learn
The transmitter is activated through a special
button combination to transmit a stored 60-bit
seed value used to generate the transmitter’s
crypt key. The receiver uses this seed value
to derive the same crypt key and decrypt the
received code word’s encrypted portion.
•
Manufacturer’s code
– A unique and secret 64-
bit number used to generate unique encoder crypt
keys. Each encoder is programmed with a crypt
key that is a function of the manufacturer’s code.
Each decoder is programmed with the manufac-
turer code itself.
1.1
HCS Encoder Overview
The HCS encoders have a small EEPROM array which
must be loaded with several parameters before use.
The most important of these values are:
• A crypt key that is generated at the time of
production
• A 16-bit synchronization counter value
• A 28-bit serial number which is meant to be
unique for every encoder
The manufacturer programs the serial number for each
encoder at the time of production, while the ‘Key
Generation Algorithm’ generates the crypt key
(Figure
1-1).
Inputs to the key generation algorithm
typically consist of the encoder’s serial number and a
64-bit manufacturer’s code, which the manufacturer
creates.
Note:
The manufacturer code is a pivotal part of
the
system’s
overall
security.
Consequently, all possible precautions
must be taken and maintained for this
code.
DS40000153E-page 2
2001-2015 Microchip Technology Inc.
HCS500
FIGURE 1-1:
Production
Programmer
CREATION AND STORAGE OF CRYPT KEY DURING PRODUCTION
HCS500
EEPROM Array
Serial Number
Crypt Key
Sync Counter
Transmitter
Serial Number
Manufacturer’s
Code
Key
Generation
Algorithm
Crypt
Key
.
.
.
The 16-bit synchronization counter is the basis behind
the transmitted code word changing for each transmis-
sion; it increments each time a button is pressed. Due
to the code hopping algorithm’s complexity, each incre-
ment of the synchronization value results in greater
than 50% of the bits changing in the transmitted code
word.
Figure 1-2
shows how the key values in EEPROM are
used in the encoder. Once the encoder detects a button
press, it reads the button inputs and updates the syn-
chronization counter. The synchronization counter and
crypt key are input to the encryption algorithm and the
output is 32 bits of encrypted information. This data will
change with every button press, its value appearing
externally to ‘randomly hop around’, hence it is referred
to as the hopping portion of the code word. The 32-bit
hopping code is combined with the button information
and serial number to form the code word transmitted to
the receiver. The code word format is explained in
greater detail in
Section 7.2 “Code Word Organiza-
tion”.
A receiver may use any type of controller as a decoder,
but it is typically a microcontroller with compatible firm-
ware that allows the decoder to operate in conjunction
with an HCS500 based transmitter.
Section 3.0
“Decoder Operation”
provides detail on integrating
the HCS500 into a system.
A transmitter must first be ‘learned’ by the receiver
before its use is allowed in the system. Learning
includes calculating the transmitter’s appropriate crypt
key, decrypting the received hopping code and storing
the serial number, synchronization counter value and
crypt key in EEPROM.
In normal operation, each received message of valid
format is evaluated. The serial number is used to deter-
mine if it is from a learned transmitter. If from a learned
transmitter, the message is decrypted and the synchro-
nization counter is verified. Finally, the button status is
checked to see what operation is requested.
Figure 1-3
shows the relationship between some of the values
stored by the receiver and the values received from
the transmitter.
FIGURE 1-2:
EEPROM Array
Crypt Key
Sync Counter
Serial Number
BUILDING THE TRANSMITTED CODE WORD (ENCODER)
K
EE
L
OQ
Encryption
Algorithm
Button Press
Information
Serial Number
32 Bits
Encrypted Data
Transmitted Information
2001-2015 Microchip Technology Inc.
DS40000153E-page 3
HCS500
FIGURE 1-3:
BASIC OPERATION OF RECEIVER (DECODER)
1 Received Information
EEPROM Array
Button Press
Information
Serial Number
32 Bits of
Encrypted Data
Manufacturer Code
2
Check for
Match
Serial Number
Sync Counter
Crypt Key
3
K
EE
L
OQ
Decryption
Algorithm
Decrypted
Synchronization
Counter
Perform Function
5 Indicated by
button press
4
Check for
Match
Note:
Circled numbers indicate the order of execution.
2.0
PIN ASSIGNMENT
The description of the pins of the HCS500 decoder is
provided in
Table 2-1.
TABLE 2-1:
PIN
1
2
3
4
5
6
7
8
DECODER PIN ASSIGNMENT
I/O
(1)
P
O
I/O
I
I/O
I
I
P
Buffer Type
(1)
—
TTL
TTL
ST
TTL
TTL
TTL
—
Power Connection
Clock to I
2
C
™
EEPROM
Data to I
2
C™ EEPROM
Master clear input
Synchronous data from controller
Synchronous clock from controller
RF input from receiver
Ground connection
Description
Decoder
Function
V
DD
EE_CLK
EE_DAT
MCLR
S_DAT
S_CLK
RFIN
GND
Note:
P = power, I = in, O = out, and ST = Schmitt Trigger input.
DS40000153E-page 4
2001-2015 Microchip Technology Inc.
HCS500
3.0
3.1
DECODER OPERATION
Learning a Transmitter to a
Receiver (Normal or Secure Learn)
3.2
Learning Procedure
Before the transmitter and receiver can work together,
the receiver must first ‘learn’ and store the following
information from the transmitter in EEPROM:
• A check value of the serial number
• The crypt key
• The current synchronization counter value
The decoder must also store the manufacturer’s code
(Section
1.1 “HCS Encoder Overview”)
in protected
memory. This code will typically be the same for all of
the decoders in a system.
The HCS500 has seven memory slots, and,
consequently, can store up to seven transmitters.
During the learn procedure, the decoder searches for
an empty memory slot for storing the transmitter’s
information. When all of the memory slots are full, the
decoder will overwrite the last transmitter’s information.
To erase all of the memory slots at once, use the
ERASE_ALL command (C3H).
Learning is initiated by sending the ACTIVATE_LEARN
(D2H) command to the decoder. The decoder
acknowledges reception of the command by pulling the
data line high.
For the HCS500 decoder to learn a new transmitter, the
following sequence is required:
1.
2.
Activate the transmitter once.
Activate the transmitter a second time. (In
Secure Learning mode, the seed transmission
must be transmitted during the second stage of
learn by activating the appropriate buttons on
the transmitter.)
The HCS500 will transmit a learn-status string,
indicating that the learn was successful.
The decoder has now learned the transmitter.
Repeat steps 1-3 to learn up to seven
transmitters
Note 1:
Learning will be terminated if two
nonsequential codes were received or if
two acceptable codes were not decoded
within 30 seconds.
2:
If more than seven transmitters are
learned, the new transmitter will replace
the last transmitter learned. It is, therefore,
not possible to erase lost transmitters by
repeatedly learning new transmitters. To
remove lost or stolen transmitters,
ERASE_ALL transmitters and relearn all
available transmitters.
3:
Learning a transmitter with a crypt key that
is identical to a transmitter already in mem-
ory replaces the existing transmitter. In
practice, this means that all transmitters
should have unique crypt keys. Learning a
previously learned transmitter does not use
any additional memory slots.
3.
4.
2001-2015 Microchip Technology Inc.
DS40000153E-page 5
微控制器 MCU
京公网安备 11010802033920号
Copyright © 2005-2026 EEWORLD.com.cn, Inc. All rights reserved
电子工程世界
