View HCS412_4606675.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

? 2011 microchip technology inc. ds41099d-page 1 features security ? programmable 64-bit encoder crypt key ? two 64-bit iff keys ? keys are read protected ? 32-bit bi-directional challenge and response using one of two possible keys ? 69-bit transmission length ? 32-bit hopping code, ? 37-bit nonencrypted portion ? programmable 28/32-bit serial number ? 60-bit, read protected seed for secure learning ? two iff encryption algorithms ? delayed counter increment mechanism ? asynchronous transponder communication ? transmissions include button queuing information operating ? 2.0v to 6.3v operation ? three switch inputs: s2, s1, s0 ? seven functions ? battery-less bi-directional transponder capability ? selectable baud rate and code word blanking ? automatic code word completion ? battery low detector ? pwm or manchester data encoding ? combined transmitter, transponder operation ? anticollision of multiple transponders ? passive proximity activation ? device protected against reverse battery ? intelligent damping for high q lc-circuits ? 100 mv pp sensitive lc input typical applications ? automotive remote entry systems ? automotive alarm systems ? automotive immobilizers ? gate and garage openers ? electronic door locks (home/office/hotel) ? burglar alarm systems ? proximity access control package types block diagram other ? simple programming interface ? on-chip tunable rc oscillator, 10% ? on-chip eeprom ? 64-bit user eeprom in transponder mode ? battery-low led indication ? serialized quick turn programming (sqtp sm ) ? 8-pin pdip/soic ? rf enable output ? ask and fsk pll interface option ? built in lc input amplifier HCS412 s0 s1 s2/rfen/lc1 lc0 v dd led data gnd 18 2 3 4 7 6 5 pdip, soic oscillator configuration register power control wake-up logic address decoding eeprom debounce control and queuer led control data driver ppm detector data ppm manch. encoder transponder circuitry control logic and counters encryption/increment logic register v dd s0 s1 led lc0 data rfen/s2/lc1 HCS412 k ee l oq ? code hopping encoder and transponder
HCS412 ds41099d-page 2 ? 2011 microchip technology inc. general description the HCS412 combines patented k ee l oq ? code hop- ping technology with bi-directional transponder chal- lenge-and-response security into a single chip solution for logical and physi cal access control. when used as a code hopping encoder, the HCS412 is ideally suited to keyless entry systems; vehicle and garage door access in particular. the same HCS412 can also be used as a secure bi-directional transponder for contactless token verification. these capabilities make the HCS412 ideal for combined secure access control and identification applications, dramatically reducing the cost of hybr id transmitter/transponder solutions. 1.0 system overview key terms the following is a list of key terms used throughout this data sheet. for additional information on terminology, please refer to the k ee l oq introductory technical brief (tb003). ? rke - remote keyless entry. ? pke - passive keyless entry. ? button status - indicates what transponder but- ton input(s) activated the transmission. encom- passes the 4 button status bits lc0, s2, s1 and s0 (figure 3-2). ? code hopping - a method by which a code, viewed externally to the system, appears to change unpredictably each time it is transmitted (section 1.1.3). ? code word - a block of data that is repeatedly transmitted upon button activation (section 3.2). ? transmission - a data stream consisting of repeating code words. ? crypt key - a unique and secret 64-bit number used to encrypt and decrypt data. in a symmetri- cal block cipher such as the k ee l oq algorithm, the encryption and decryption keys are equal and will therefore be referred to generally as the crypt key. ? encoder - a device that generates and encodes data. ? encryption algorithm - a recipe whereby data is scrambled using a crypt key. the data can only be interpreted by the respective decryption algorithm using the same crypt key. ? decoder - a device that decodes data received from an encoder. ? transponder reader (reader, for short) - a device that authenticates a token using bi-direc- tional communication. ? decryption algorithm - a recipe whereby data scrambled by an encryption algorithm can be unscrambled using the same crypt key. ? learn ? learning involves the receiver calculating the transmitter?s appropriat e crypt key, decrypting the received hopping code and storing the serial number, synchronization counter value and crypt key in eeprom (section 6.1). the k ee l oq prod- uct family facilitates several learning strategies to be implemented on the decoder. the following are examples of what can be done. - simple learning the receiver uses a fixed crypt key, common to all components of all systems by the same manufacturer, to decrypt the received code word?s encrypted portion. - normal learning the receiver uses information transmitted during normal operation to derive the crypt key and decrypt the received code word?s encrypted portion. - secure learn the transmitter is activated through a special button combination to tr ansmit a stored 60-bit seed value used to ge nerate the transmitter?s crypt key. the receiver uses this seed value to derive the same crypt key and decrypt the received code word?s encrypted portion. ? manufacturer?s code - a unique and secret 64- bit number used to generate unique encoder crypt keys. each encoder is programmed with a crypt key that is a function of the manufacturer?s code. each decoder is programmed with the manufac- turer code itself. ? anticollision - a scheme whereby transponders in the same field can be addressed individually preventing simultaneous response to a command (section 4.3.1). ? iff - identify friend or foe (section 1.2). ? proximity activation - a method whereby an encoder automatically init iates a transmission in response to detecting an inductive field (section 4.4.1). ? transport code - an access code, ?password? known only by the manufacturer, allowing pro- gram access to certain secure device memory areas (section 4.3.3). ? agc - automatic gain control.
? 2011 microchip technology inc. ds41099d-page 3 HCS412 1.1 encoder overview the HCS412 code hopping transcoder is designed specifically for passive entr y systems; primarily vehicle access. the transcoder por tion of a passive entry sys- tem is integrated into a transmitter, carried by the user and operated to gain access to a vehicle or restricted area. the HCS412 is meant to be a cost-effective yet secure solution to such s ystems, requiring very few external components (figure 2-6). 1.1.1 low-end system security risks most low-end keyless entry transmitters are given a fixed identification code that is transm itted every time a button is pushed. the numbe r of unique identification codes in a low-end system is usually a relatively small number. these shortcomings provide an opportunity for a sophisticated thief to create a device that ?grabs? a transmission and retransmits it later, or a device that quickly ?scans? all possible identification codes until the correct one is found. 1.1.2 HCS412 security the HCS412, on the other hand, employs the k ee l oq code hopping technology coupled with a transmission length of 69 bits to virtually eliminate the use of code ?grabbing? or code ?scanning?. the high security level of the HCS412 is based on the patented k ee l oq technol- ogy. a block cipher based on a block length of 32 bits and a key length of 64 bits is used. the algorithm obscures the information in such a way that even if the transmission information (before coding) differs by only one bit from that of the previous transmission, statisti- cally greater than 50 percent of the next transmission?s encrypted bits will change. 1.1.3 HCS412 hopping code the 16-bit synchronization counter is the basis behind the transmitted code word changing for each transmis- sion; it increments each time a button is pressed. once the device detects a button press, it reads the button inputs and updates the synchronization counter. the synchronization counter and crypt key are input to the encryption algorithm and the output is 32 bits of encrypted information. this encrypted data will change with every button press, its value appearing externally to ?randomly hop around?, hence it is referred to as the hopping portion of the code word. the 32-bit hopping code is combined with the button information and serial number to form the code word transmitted to the receiver. the code word format is explained in greater detail in section 3.2. figure 1-1: building the transmitted code word (encoder) 1.2 identify friend or foe (iff) overview validation of a token first involves an authentication device sending a random challenge to the token. the token then replies with a calculated response that is a function of the received challenge and the stored crypt key. the authentication device, transponder reader, performs the same calculation and compares it to the token?s response. if they ma tch, the token is identified as valid and the transponder reader can take appropri- ate action. the HCS412?s 32-bit iff response is generated using one of two possible encryption algorithms and one of two possible crypt keys; four combinations total. the authenticating device prec edes the challenge with a five bit command word dictating which algorithm and key to use in calculating the response. the bi-directional communication path required for iff is typically inductive for short range (<10cm) transpon- der applications and an inductive challenge, rf response for longer range (~1.5m) passive entry appli- cations. button press information eeprom array 32 bits of encrypted data serial number transmitted information crypt key sync counter serial number k ee l oq ? encryption algorithm
HCS412 ds41099d-page 4 ? 2011 microchip technology inc. 2.0 device description 2.1 pinout description the HCS412?s footprint is ident ical to other encoders in the k ee l oq family, except for the two pins reserved for low frequency communication. table 2-1: pinout summary figure 2-1: s0/s1 pin diagram figure 2-2: s2/rfe n/lc1 pin diagram figure 2-3: lc0 pin diagram pin name pin number description s0 1 button input pin with schmitt tr igger detector and internal 60 k (nominal) pull-down resistor (figure 2-1). s1 2 button input pin with schmitt tr igger detector and internal 60 k (nominal) pull-down resistor (figure 2-1). s2/rfen/lc1 3 multi-purpose input / output pin (figure 2-2). ? button input pin with schmitt trigger det ector and internal pull-down resistor. ? rfen output driver. ? lc1 low frequency (lf) antenna output driver for inductive responses and lc bias. ? programming clock signal input. lc0 4 low frequency (lf) antenna input with automatic gain control for inductive reception and low frequency output driver for inductive responses (figure 2-3). gnd 5 ground reference. data 6 transmission data output driver. programming input / output data signal (figure 2-4). led 7 led output driver (figure 2-5). v dd 8 positive supply voltage. 60 k switch in s0 s1 > 10v 100 vbias v dd switch 2 input s2lc option lc output rfen out > < > rectifier and regulator v dd 10v 100 lc input lc output s2lc option amp det and > < lc0
? 2011 microchip technology inc. ds41099d-page 5 HCS412 figure 2-4: data pin diagram figure 2-5: led pin diagram figure 2-6: typical application circuits 120 k oe data data in data out > < > led_on > led r HCS412 s0 s1 lc1 lc0 v dd led data gnd 18 2 3 4 7 6 5 HCS412 s0 s1 lc1 lc0 v dd led data gnd 18 2 3 4 7 6 5 rf HCS412 s0 s1 rfen lc0 v dd led data gnd 18 2 3 4 7 6 5 rf battery-less short range transponder long range / proximity activated transponder / encoder short range transponder with rfen control / long range encoder
HCS412 ds41099d-page 6 ? 2011 microchip technology inc. 2.2 architecture overview 2.2.1 wake-up logic and power distribution the HCS412 automatically goes into a low-power standby mode once connected to the supply voltage. power is supplied to the mi nimum circuitry required to detect a wake-up condition; button activation or lc sig- nal detection. the HCS412 will wake from low-power mode when a button input is pulled high or a signal is detected on the lc0 lf antenna input pin. waking involves powering the main logic circuitry that controls device operation. the button and transponder inputs are then sampled to determine which input activated the device. a button input activation places the device into encoder mode. a signal detected on the transponder input places the device into transponder mode. encoder mode has priority over transponder mode so a signal on the transponder input woul d be ignored if it occurred simultaneously to a button ac tivation; ignored until the button input is released. 2.2.2 control logic a dedicated state machine, timer and a 32-bit shift reg- ister perform the control, timing and data manipulation in the HCS412. this includes the data encryption, data output modulation and reading of and writing to the onboard eeprom. 2.2.3 eeprom the HCS412 contai ns nonvolatile eeprom to store configuration options, user data and the synchroniza- tion counter. the configuration options are programmed during pro- duction and include the read protected security-related information such as crypt keys, serial number and dis- crimination value (table 7-2). the 64 bits (4x16-bit words) of user eeprom are read/ write accessible through the low frequency communi- cation path as well as in-circuit, wire programmable during production. the initial synchronization counter value is pro- grammed during production. the counter is imple- mented in grey code and updated using bit writes to minimize eeprom writing over the life of the product. the user need not worry about counter format conver- sion as the transmitted counter value is in binary for- mat. counter corruption is protec ted for by the use of a semaphore word as well as by the internal circuitry ensuring the eeprom write voltage is at an accept- able level prior to each write. the eeprom is programm ed during production by clocking (s2 pin) the data into the data pin (section 7.0). certain eeprom locations can also be remotely read/written through the lf communication path (section 4.3). 2.2.4 configuration register the first activation after connecting power to the HCS412, the device retrieves the configuration from eeprom storage and buffers the information in a con- figuration register. the conf iguration register then dic- tates various device operation options including the rc oscillator tuning, the s2/r fen/lc1 pin configuration, low voltage trip point, modulation format,... 2.2.5 onboard rc oscillator and oscillator tune value (osct) the HCS412 has an onboard rc oscillator. as the rc oscillator is susceptible to variations in process param- eters, temperatur e and operating voltage, oscillator tuning is provided for more accurate timing character- istics. the 4-bit oscillator tune value (osct) (table 2-2) allows tuning within 4% of the optimal oscillator speed at the voltage and temperat ure used when tuning the device. a properly tuned oscillator is then accurate over temperature and voltage variations to within 10% of the tuned value. oscillator speed is significantly affected by changes in the device supply voltage. it is therefore best to tune the HCS412 such that the variance in oscillator speed be symmetrical about an operating mid-point (figure 2-7). ie... ? if the design is to run on a single lithium battery, tune the oscillator while supplying the HCS412 with ~2.5v (middle of the 3v to 2v usable battery life). ? if the design is to run on two lithium batteries, tune the oscillator while supplying the HCS412 with ~4v (middle of 6v to 2v battery life). ? if the design is to run on 5v, tune the oscillator while supplying the HCS412 with 5v. say the HCS412?s oscillator is tuned to be optimal at a 6v supply voltage but the device will operate on a sin- gle lithium battery. the resulting oscillator variance over temperature and voltage will not be 4% but will be more like -7% to -15%. programming using a supply voltage other than 5v may not be practical. in these cases, adjust the oscilla- tor tune value such that the device will run optimally at the target voltage. (i.e., if programming using 5v a device that will run at 3v, program the device to run slow at 5v such that it will run optimally at 3v).
? 2011 microchip technology inc. ds41099d-page 7 HCS412 table 2-2: oscillator calibration value (osct) figure 2-7: hcs41 2 normalized rf te versus temp 2.2.6 low voltage detector the HCS412?s battery voltage detector detects when the supply voltage drops below a predetermined value. the value is selected by the low voltage trip point select (vlowsel) configuration option. the low voltage detector result is included in encoder transmissions (vlow) allowing the receiver to indicate when the transmitter batter y is low (figure 3-2). the HCS412 indicates a low battery condition by changing the led operation (figure 3-9). figure 2-8: typical voltage trip points table 2-3: vlowsel options table 2-4: vlow status bit 2.2.7 the s2/rfen/lc1 pin the s2/rfen/lc1 pin may be used as a button input, rf enable output or as an interface to the lf antenna. select between lc1 antenna interface and s2/rfen functionality with the butt on/transponder select (s2lc) configuration option (table 2-2). 2.2.7.1 s2 button input considerations the s2/rfen/lc1 pin defaults to lf antenna output lc1 when the HCS412 is first connected to the supply voltage (i.e., battery replacement). the configuration register controlling the pin?s function is loaded on the first device activation after battery replacement. a desired s2 input state is therefore enabled only after the first activation of either s0, s1 or lc0. the transponder bias circuitry switches off and the internal pull-down resistor is enabled when the s2/ rfen/lc1 pin reaches button input configuration. there will be an extra delay the first activation after connecting to the supply voltage while the HCS412 retrieves the configuration word and configures the pins accordingly. osct3:0 description 0111b slowest oscillator setting (long t e ) +: 0011b 0010b 0001b : slower (longer t e ) : 0000b nominal setting 1111b 1110b 1101b : faster (shorter t e ) : -: 1000b fastest oscillator setting (short t e ) 0.94 1.10 1.08 1.06 1.04 1.02 1.00 0.98 0.96 0.92 0.90 rf te rf te v dd legend = 2.0v = 3.0v = 6.0v normalized temperature c -50 -40 -30 -20 -10 0 10 20 30 40 50 60 70 80 90 note: values are for calibrated oscillator. rf te vlowsel nominal trip point description 0 2.2v for 3v battery applications 1 4.4v for 6v battery applications vlow description 0v dd is above selected trip voltage 1v dd is below selected trip voltage v low volts (v) -40 05085 2.0 1.6 1.8 2.2 2.4 2.6 temp (c) v low sel = 0 4.4 4.0 4.2 3.8 4.6 4.8 5.0 v low sel = 1 2.8 nominal v low trip point
HCS412 ds41099d-page 8 ? 2011 microchip technology inc. 2.2.7.2 transponder interface connecting an lc resonant circuit between the lc0 and the lc1 pins creates the bi-directional low fre- quency communication path with the HCS412. the internal circuitry on the HCS412 provides the fol- lowing functions: ? lf input amplifier and envelope detector to detect and shape the incoming low frequency excitation signal. ? 10v zener input protection from excessive antenna voltage generated when proximate to very strong magnetic fields. ? lf antenna clamping transistors for inductive responses back to the transponder reader. the antenna ends are shorted together, ?clamped?, dissipating the oscillatory energy. the reader detects this as a momentary load on its excitation antenna. ? damping circuitry that improves communication when using high-q lc antenna circuits. ? incoming lf energy rectification and regulation for the supply voltage in battery-less or low bat- tery transponder instances. during normal transponder oper ation, the lc1 pin func- tions to bias the lc0 agc amplifier input. the amplifier gain control sets the optimum level of amplification in respect to the incoming signal strength. the signal then passes through an envelope detector before interpreta- tion in the logic circuit. 2.2.7.3 rf enable output when the rf enable (rfen) configuration option is enabled, the rfen signal output is coordinated with the data output pin to prov ide typical ask or fsk pll activation. table 2-1: rfen option table 2-2: s2/rfen/lc1 configuration option 3.0 encoder operation 3.1 encoder activation 3.1.1 button activation the main way to enter encoder mode is when the wake-up circuit detects a button input activation; button input transition from gnd to v dd . the HCS412 control logic wakes and delays a switch debounce time prior to sampling the button inputs. the button input states, cumulatively called the button status, determine whether the HCS412 transmits a code hopping or seed transmission, table 3-1. additional button activations added during a transmis- sion will immediately reset the HCS412, perhaps leaving the current code word incomplete. the device will start a new transmission which includes the updated button code value. buttons removed during a transmission will have no effect unless no buttons remain activated. if no button activations remain, the minimum number of compete code words will be completed (section 3.4.1) and the device will return to standby mode. 3.1.2 proximity activation the other way to enter encoder mode is if the s2/lc option is configured for lc operation and the wake-up circuit detects a signal on the lc0 lf antenna input pin. this form of activation is called proximity activation as a code hopping transmission would be initiated when the device was proximate to a lf field. refer to section 4.4 for details on configuring the HCS412 for proximity activation. rfen description 0 rf enable output is disabled. 1 rf enable output is enabled. s2lc resulting s2/rfen/lc1 configuration 0 ? lc1 low frequency antenna output driver for inductive responses and lc bias. note: lc0 low frequency antenna input is also enabled. 1 ? s2 button input pin with schmitt trigger de tector and internal pull-down resistor. ? rfen output driver. note: lc0 and lc1 low frequency antenna interfaces are disabled and the transponder circuitry is switched off to reduce standby current.
? 2011 microchip technology inc. ds41099d-page 9 HCS412 table 3-1: encoder mode activation 3.2 transmitted code word the HCS412 transmits a 69-bit code word in response to a button or proximity activation (figure 3-1). each code word contains a 50% duty cycle preamble, header, 32 bits of encrypted data and 37 bits of fixed code data followed by a guard period before another code word can begin. the 32 bits of encrypted data include 4 button bits, 2 counter overflow bits, 10 discrimination bits and the 16- bit synchronization counter value (figure 3-2). the content of the 37 bits of fixed code data varies with the extended serial number (xser) option (figure 3-2). ? if the extended serial number option is disabled (xser = 0), the 37 bits include 5 status bits, 4 button status bits and the 28-bit serial number. ? if the extended serial number option is enabled (xser = 1), the 37 bits in clude 5 status bits and the 32-bit serial number. figure 3-1: code word format 4-bit button status seed tmpsd resulting transmission lc0 (note 1) s2 s1 s0 x 0 0 1 x x code hopping transmission x 0 1 0 x x code hopping transmission x 0 1 1 0 0 code hopping transmission 01 code hopping code words until time = t dsd , then seed code words. seed transmissions temporarily enabled until the 7lsb?s of the synchro- nization counter wrap 7fh to 00h. then only code hopping code words. 1 0 code hopping code words until time = t dsd , then seed code words. 1 1 code hopping transmission (2 key iff enabled) x 1 0 1 x x code hopping transmission x 1 0 0 x x code hopping transmission x 1 1 0 x x code hopping transmission x 1 1 1 0 0 code hopping transmission 01 limited seed transmissions - temporarily enabled until the 7lsb?s of the synchronization counter wrap 7fh to 00h. 1 0 seed transmission 1 1 code hopping transmission (2 key iff enabled) 1 0 0 0 x x proximity activated code hopping transmission. note 1: the transmitted button status will re flect the state of the lc0 input when the button inputs are sampled. preamble header encrypted portion of transmission fixed portion of transmission guard time t p t h t hop t fix t g 50% duty cycle
HCS412 ds41099d-page 10 ? 2011 microchip technology inc. figure 3-2: code word organization 3.2.1 queue counter (que) the que counter can be used to request secondary decoder functions using only a single transmitter but- ton. typically a decoder mu st keep track of incoming transmissions to determine when a double button press occurs, perhaps an unlock all doors request. the que counter removes this burden from the decoder by counting multiple button presses. the 2-bit que counter is incremented each time an active button input is released for at least the debounce time (t dbr ), then reactivated (button pressed again) within the queue time (t que ). the counter increments up from 0 to a maximum of 3, returning to 0 only after a different button activation or after button activations spaced greater than the queue time (t que ) apart. the current transmission aborts, after completing the minimum number of code words (section 3.4.1), when the active button input is released. a button re-activa- tion within queue time (t que ) then initiates a new transmission (new synchroni zation counter, encrypted data) using the updated que value. figure 3-3 shows the timing diagram to increment the queue counter value. figure 3-3: que counter timing diagram v low 1-bit fixed code portion (37 bits) que 2 bits crc 2 bits v low 1-bit ser 1 most sig 16 bits ser 0 least sig 16 bits but 4 bits counter overflow 2 bits discrim 10 bits synchronization 16 bits counter 15 0 s2 s1 s0 lc0 ovr1 ovr0 hopping code portion message (32 bits) q1 q0 c1 c0 msb lsb 69 data bits transmitted lsb first. 32-bit serial number (xser = 1) fixed code portion (37 bits) que 2 bits crc 2 bits but 4 bits s2 s1 s0 lc0 ser 0 least sig16 bits but 4 bits counter overflow 2 bits discrim 10 bits synchronization 16 bits counter 15 0 s2 s1 s0 lc0 ovr1 ovr0 hopping code portion message (32 bits) q1 q0 c1 c0 msb lsb 69 data bits transmitted lsb first. ser 1 12 msb?s 28-bit serial number (xser = 0) shaded data included in crc calculation input sx code words transmitted 1st button press all buttons released 2nd button press que1:0 = 00 2 synch cnt = x que1:0 = 01 2 synch cnt = x+1 t 2 = 0 t 1 > t dbp t 1 = 0 t dbr < t < t que
? 2011 microchip technology inc. ds41099d-page 11 HCS412 3.2.2 cycle redundancy check (crc) the crc bits may be used to check the received data integrity, but it is not recommended when operating near the low voltage trip point, see note below. the crc is calculated on the 65 previously transmitted bits (figure 3-2), detecting all single bit and 66% of all double bit errors. equation 3-1: crc calculation 3.2.3 low voltage detector status (vlow) the low voltage detector result is included in every transmitted code word. the HCS412 samples the voltage detector output at the onset of a transmission and just before the vlow bit is transmitted in each code word. the first sample is used in the crc calculation and the subsequent sam- ples determine what vlow value will be transmitted. the transmitted vlow status will be a ?0? as long as v dd remains above the selected low voltage trip point. vlow will change to a ?1? if v dd drops below the selected low voltage trip point. table 3-2: low voltage status bit table 3-3: low voltage trip point selection options 3.2.4 counter overfl ow bits (ovr1, ovr0) the counter overflow bits may be utilized to increase the synchronization counter range from the nominal 65,535 to 131,070 or 196,605. the bits must be programmed during production as ?1?s to be utilized. ovr0 is cleared the first time the syn- chronization counter wraps from ffffh to 0000h. ovr1 is cleared the second time the synchronization counter wraps to zero. the two bits remain at ?0? after all subsequent counter wraps. 3.2.5 extended serial number (xser) the extended serial number option determines whether the serial number is 28 or 32 bits. when configured for a 28-bit serial number, the most significant nibble of the 32 bits reserved for the serial number is replaced with a c opy of the 4-bit button sta- tus, figure 3-2. 3.2.6 discrimination value (disc) the discrimination value is a 10-bit fixed value typi- cally used by the decoder in a post-decryption check. it may be any value, but in a typical system it will be programmed as the 10 least significant bits of the serial number. the discrimination bits are part of the information that form the encrypted portion of the transmission (figure 3-2). after the receiver has decrypted a trans- mission, the discrimination bits are checked against the receiver?s stored value to verify that the decryption process was valid. if the discrimination value was pro- grammed equal to the 10 lsb?s of the serial number then it may merely be compared to the respective bits of the received serial number. 3.2.7 seed code word data format the seed code word transmission allows for what is known as a secure learning function, increasing a sys- tem?s security. the seed code word also consists of 69 bits, but the 32 bits of code hopping data and the 28 bits of fixed data are replaced by a 60-bit seed value that was stored during production (figure 3-4 ). instead of using the normal key generation inputs to create the crypt key, this seed value is used. seed transmissions are either: ? permanently enabled ? permanently disabled ? temporarily enabled (limited) until the 7 least sig- nificant bits of the synchronization counter wrap from 7fh to 00h. the seed enable (seed) and temporary seed enable (tmpsd) configuration options control the function (table 3-4). note: the crc may be wrong when the operat- ing voltage is near v low trip point. v low is sampled twice each transmission, once for the crc calculation (data output is low) and once when the v low bit is transmitted (data output is high). v dd varying slightly during a transmission could lead to a differ- ent v low status transmitted than that used in the crc calculation. work around: if the crc is incorrect, recalculate for the opposite value of v low . vlow description 0v dd is above trip voltage (vlowsel) 1v dd is below trip voltage (vlowsel) vlowsel nominal trip point description 0 2.2v for 3v battery applications 1 4.4v for 6v battery applications crc 1 [] n1 + crc 0 [] n di n = crc 0 [] n1 + crc 0 [] n di n () crc 1 [] n = crc 1 0 , [] 0 0 = and with and di n the nth transmission bit 0 n 64
HCS412 ds41099d-page 12 ? 2011 microchip technology inc. figure 3-4: seed code word data format table 3-4: seed transmission options 3.3 transmission data modulation the data modulation format is selectable between pulse width modulation (pwm) and manchester using the data modulation (mod) configuration option. regardless of the modulation format, each code word contains a leading 50% dut y cycle preamble and a syn- chronization header to wake the receiver and provide synchronization events for the receive routine. each code word also contains a trailing guard time, separat- ing code words. manchester encoding further includes a leading and closing ?1? around each 69-bit data block. the same code word repeats as long as the same input pins remain active, until a time-out occurs or a delayed seed transmission is activated. the modulated data timing is typically referred to in multiples of a basic timing element (rft e ). ?rf? t e because the data pin output is typically sent through a rf transmitter to the decoder or transponder reader. rft e may be selected using the transmission baud rate (rfbsl) configuration option (table 3-6). table 3-5: transmission modulation timing * enabling long preambles extends the first code word?s preamble to t lpre milliseconds. table 3-6: baud rate selection (rfbsl) seed tmpsd description 0 0 seed transmissions permanently disabled 0 1 limited seed transmissions (note 1) - temporarily enabled until the 7 lsb?s of the synchronization counter wrap from 7fh to 00h 1 0 seed transmissions permanently enabled (note 1) 1 1 seed transmissions permanently disabled (2 key iff enabled) note 1: refer to table 3-1 for appropriate bu tton activation of seed transmissions. que 2 bits crc 2 bits v low 1-bit but 4 bits sdval3 12 most sig bits s2 s1 s0 lc0 note: seed transmissions only allowed when appr opriate configuration bits are set. sdval2 16 bits sdval1 16 bits sdval0 16 least sig bits q1 q0 c1 c0 lsb 69 data bits transmitted lsb first. msb shaded data included in crc calculation period pwm manchester units preamble 31* 31* rft e header 10 4 rft e data 207 142 rft e guard 46 31 rft e rfbsl1:0 cwbe pwm rft e manchester rft e transmit... 00b x 400 s 800 s all code words 01b 0 200 s 400 s all code words 1 200 s 400 s every other code word 10b 0 100 s 200 s all code words 1 100 s 200 s every other code word 11b 0 100 s 200 s all code word 1 100 s 200 s every fourth code word
? 2011 microchip technology inc. ds41099d-page 13 HCS412 figure 3-5: pwm transmission format?mod = 0 figure 3-6: manchester tran smission format?mod = 1 3.4 encoder special features 3.4.1 code word completion and minimum code words the code word completion feature ensures that entire code words are transmitted, ev en if the active button is released before the code word transmission is com- plete. if the button is held down beyond the time for one code word, multiple complete code words will result. the device default is that a momentary button press will transmit at least one complete code word. enable the minimum four code words (mtx4) configuration option to extend this feature such that a minimum of 4 code words are completed on a momentary button acti- vation. 3.4.2 auto-shutoff the auto-shutoff function prevents battery drain should a button get stuck for a long period of time. the time period (t to ) is approximately 20 seconds, after which the device will enter time-out mode. the device will stop transmitting in time-out mode but there will be leakage across the stuck button input?s internal pull-down resistor. the current draw will there- fore be higher than when in standby mode. 3.4.3 code word blanking enable federal communications commission (fcc) part 15 rules specify the limits on worst case average funda- mental power and harmonics that can be transmitted in a 100 ms window. for fcc approval purposes, it may therefore be advantageous to minimize the transmis- sion duty cycle. this can be achieved by minimizing the on-time of the individual bits as well as by blanking out consecutive code words. total transmission: preamble sync encrypt fixed guard 1 code word preamble sync encrypt logic "1" guard time 31 rft e preamble, 50% duty cycle encrypted portion fixed code portion logic "0" 10t e header t e t e t e code word long preamble (lpre) disabled total transmission: sync encrypt fixed guard 1 code word preamble sync encrypt preamble code word guard 50% duty header encrypted fixed code start bit stop bit time portion portion bit 0 bit 1 bit 2 logic "0" logic "1" t e t e preamble
HCS412 ds41099d-page 14 ? 2011 microchip technology inc. the code word blanking enable (cwbe) option may be used to reduce the average power of a transmission by transmitting only every second or every fourth code word ( figure 3-7 ). this selectable feature is determined in conjunction with the baud rate selection bit rfbsl ( ta b l e 3 - 7 ). enabling the cwbe option may similarly allow the user to transmit a higher amplitude transmission as the time averaged power is reduced. cwbe effectively halves the rf on-time for a given transmission so the rf out- put power could theoretically be doubled while main- taining the same time averaged output power. figure 3-7: code word blanking table 3-7: code word blanking enable (cwbe) 3.4.4 delayed increment (dinc) the HCS412?s delayed increment feature advances the synchronization counter by 12 a period of t to after the encoder activation occurs, for additional security. the next activation will show a synchronization counter increase of 13, not 1. if the active button is released before the time-out t to has elapsed, the device stops transmitting but remains powered for the duration of the time-out period. the device will then advance the stored synchronization counter by 12 before powering down. if the active button is released before the time-out t to has elapsed and another activation occurs while wait- ing out the time-out period, the time-out counter will reset and the resulting transmission will contain syn- chronization counter value +1. 3.4.5 pll interface if the rfen/s2/lc1 pin is configured as an rf enable output, the pin?s behavior is coordinated with the data pin to enable a typical pll?s ask or fsk mode. the pll interface (afsk) configuration option controls the output as shown in figure 3-8. table 3-8: pll interface(afsk) 3.4.6 led output during normal operation (good battery), while transmit- ting data the device?s led pin will periodically be driven low as indicated in figure 3-9. if the supply voltage drops below the trip point specified by vldwsel, the led pin will be driven low only once for a longer period of time. 3.4.7 long preamble (lpre) enabling the long preamble configuration option extends the first code wo rd?s 50% duty cycle preamble to a ?long? preamble time t lpre . the longer preamble will be a square wave at the selected rft e (figure 3-10). rfbsl1:0 cwbe pwm rft e manchester rft e transmit... 00b x 400 s 800 s all code words 01b 0 200 s 400 s all code words 1 200 s 400 s every other code word 10b 0 100 s 200 s all code words 1 100 s 200 s every other code word 11b 0 100 s 200 s all code word 1 100 s 200 s every fourth code word cwbe disabled (all words transmitted) cwbe enabled (1 out of 2 transmitted) a 2a rf output amplitude = a cwbe enabled (1 out of 4 transmitted) 4a code word code word code word code word code word code word code word code word code word code word code word code word code word code word note: if delayed increment is enabled, the que counter will not reset to 0 until timeout t to has elapsed . afsk description 0 ask pll setup 1 fsk pll setup
? 2011 microchip technology inc. ds41099d-page 15 HCS412 figure 3-8: rf enable/ask/fsk options figure 3-9: led operation figure 3-10: long preamble enabled (lpre) switch s2/rfen/lc1 data s2/rfen/lc1 data t ledon afsk = 0 , rfen = 1 switch afsk = 1, rfen = 0 t td code word code word code word code word code word code word switch led data led normal operation switch low voltage operation t ledon t ledoff data t ledl code word code word code word code word code word code word t lpre first code word first code word - long preamble second code word - normal preamble third code word - normal preamble consecutive code words header
HCS412 ds41099d-page 16 ? 2011 microchip technology inc. 3.4.8 qlvs features setting the HCS412?s special qlvs (?quick secure learning?) configuration option enables the following options: ? reduces the time (t dsd ) before a delayed seed transmission begins. ? disables data modulation when the led pin is driven low (figure 3-11). - if the pll interface op tion is set to ask, the data pin will go low while the led pin is low. - if the pll interface option is set to fsk, the data pin will go high and the rfen output will go low while the led pin is low. if the bat- tery is low, the HCS412 transmits only until the led goes on. ? if the temporary seed (tmpsd) option is enabled, seed transmission capability can be dis- abled by applying the button sequence shown in figure 3-12 figure 3-11: led, data, rfen interaction when qlvs is set figure 3-12: seed disable waveform switch led data s2/rfen/lc1 data s2/rfen/lc1 t ledon t td afsk = 1 (fsk) afsk = 0 (ask) qlvs = 1, rfen = 1 s0, s1 1200 ms 50 ms 50 ms
? 2011 microchip technology inc. ds41099d-page 17 HCS412 table 3-9: encoder timing specifications v dd = +2.0 to 6.6v commercial (c):t amb = 0 c to +70 c industrial (i): t amb = -40 c to +85 c parameter symbol min. typ. max. unit remarks time to second button press t bp 44 + code word time 58 + code word time 63 + code word time ms note 1 transmit delay from button detect t td 20 30 40 ms note 2 debounce delay on button press t dbp 14 20 26 ms debounce delay on button release t dbr 20 ms auto-shutoff time-out period t to 18 20 22 s note 3 long preamble t lpre 64 ms led on time t ledon 32 ms note 4 led off time t ledoff 480 ms note 4 led on time (v dd < v low trip point) t ledl 200 ms note 5 time to delayed seed transmission t dsd 3s queue time t que 30 ms note 1: t bp is the time in which a second button can be presse d without completion of the first code word where the intention was to press the combination of buttons. 2: transmit delay maximum value, if the previo us transmission was su ccessfully transmitted. 3: the auto-shutoff time-out period is not tested. 4: the led times specified for v dd > v trip specified by v low in the configuration word. 5: led on time if v dd < v trip specified by v low in the configuration word.
HCS412 ds41099d-page 18 ? 2011 microchip technology inc. 4.0 transponder operation 4.1 iff mode the HCS412?s iff mode allows it to function as a bi- directional token or transponder. iff mode capabilities include the following. ? a bi-directional challenge and response sequence for iff validation. HCS412 iff responses may be directed to use one of two available encryption algorithms and one of two available crypt keys. ? read selected eeprom areas. ? write selected eeprom areas. ? request a code hopping transmission. ? proximity activation of a code hopping transmis- sion. 4.2 iff communication the transponder reader initiates each communication by turning on the low frequency field, then waits for a HCS412 to acknowledge the field. the HCS412 enters iff mode upon detecting a signal on the lc0 lf antenna input pin. once the incoming signal has remained high for at least the power-up time t pu , the device responds with a field acknowledge sequence indicating that the it has detected the lf field, is in iff mode and is ready to receive commands (figure 4-1). the HCS412 will repeat the field acknowl- edge sequence every 255 lf te ?s if the field remains but no command is received (figure 4-1). the transponder reader follows the HCS412?s field acknowledge by sending the desired 5-bit command and associated data. lf commands are always pre- ceded by a 2 lf te low start pulse and are pulse position modulated (ppm) as shown in figure 4-2. the last command or data bit should be followed by leaving the field on for a minimum of 6 lf te . HCS412 ppm data responses are preceded by a 1 lf te low pulse, followed by a 01b preamble before the data begins (figure 4-4). the responses are sent either on the lc antenna output alone or on both the lc out- put and the data pin, depending on the device config- uration (section 4.4.2). this allows for short-range lf responses as well as long-range rf responses. data to and from the HCS412 is always sent least sig- nificant bit first. the data length and modulation format vary according to the command and the transmission path. data length and commands: ? read and write transfers 16 bits of data. ? challenge and response transfers 32 bits of data. modulation format and transmission path: ? lf responses on the lc output are pulse position modulated (ppm) according to figure 4-2. ? rf responses on the data pin modulate accord- ing to standard encoder transmissions (figure 3-5, figure 3-6). communication with the HCS412 over the low fre- quency path (lc pins) uses a basic timing element, lf te . the low frequency baud rate select option, lfbsl, sets lf te to either 100 s or 200 s (table 4-1). the response on the data pin uses the encoder mode?s rf timing element (rf te ) and the modulation format set by the mod configuration option (table 3-6). the rf responses use the standard encoder mode for- mat with the 32-bit hopping portion replaced by the response data (figure 4-19). if the response is only 16 bits, the 32 bits will contain 2 copies of the response (figure 4-16). table 4-1: low frequency baud rate select bits 4.2.1 calculating communication te the HCS412?s internal oscillator will vary 10% over the device?s rated voltage and temperature range. when the oscillator varies, both its transmitted t e and expected t e when receiving will vary. communication reliability with the token may be improved by calculating the HCS412?s t e from the field acknowledge sequence and using this measured time element in communication to and in reception routines from the token. always begin and end the time measurement on rising edges. whether lf or rf, the falling edge decay rates may vary but the rising edge relationships should remain consistent. a common t e calculation method would be to time an 8 t e sequence, then divide the value down to determine the single t e value. an 8 t e measurement will give good resolution and may be easily right-shifted (divide by 2) three times for the math portion of the calculation (figure 4-1). accurately measuring t e is important for communicat- ing to an HCS412 as well as for inductive programming a device. the configuration word sent during program- ming contains the 4-bit oscillator tuning value. accu- rately determining t e allows the programmer to calculate the correct oscillator tuning bits to place in the configuration word, whether the device oscillator needs to be sped up or slowed down to meet its desired t e . lfbsl lf te 0 200 s 1 100 s
? 2011 microchip technology inc. ds41099d-page 19 HCS412 figure 4-1: field acknowledge sequence figure 4-2: lc pin pulse position modulation (ppm) 3lf te t pu 3lf te 3lf te 2lf te command t ato communication from reader to HCS412 filed ack sequence from HCS412 to reader 8lf te inductive comms rf comms 8lf te (data) (lc) rf comms (data) field ack sequence repeats every 255 lf te if no command is received. 255lf te 255lf te (lc) inductive comms 0 1 0 1 start or previous bit transponder reader communication to the HCS412 HCS412 response ba ck to the reader 2 lf te 2 lf te 4 lf te 2 lf te 2 lf te lf te lf te lf te start or previous bit extending the high time is acceptable but the low time should minimally be 1 lf te. t bitc t bitc t bitr t bitr the HCS412 determines bit values from rising edge to rising edge times.
HCS412 ds41099d-page 20 ? 2011 microchip technology inc. 4.3 iff commands table 4-2: list of available iff commands opcode command anticollision command (section 4.3.1) 00000 select HCS412, used if anticollision enabled read commands (section 4.3.2) 00001 read configuration word 00010 read low serial number (least significant 16 bits) 00011 read high serial number (most significant 16 bits) 00100 read user eeprom 0 00101 read user eeprom 1 00110 read user eeprom 2 00111 read user eeprom 3 program command (section 4.3.5) 01000 program HCS412 eeprom write commands (section 4.3.3) 01001 write configuration word 01010 write low serial number (least significant 16 bits) 01011 write high serial number (most significant 16 bits) 01100 write user eeprom 0 01101 write user eeprom 1 01110 write user eeprom 2 01111 write user eeprom 3 challenge and response commands (section 4.3.6) 10000 challenge and response using key-1 and iff algorithm 10001 challenge and response using key-1 and hop algorithm 10100 challenge and response using key-2 and iff algorithm 10101 challenge and response using key-2 and hop algorithm request hopping code command (section 4.3.7) 11000 request hopping code transmission default iff command (section 4.3.8) 11100 enable default iff communication
? 2011 microchip technology inc. ds41099d-page 21 HCS412 4.3.1 anticollision multiple tokens in the same inductive field will simulta- neously respond to inductive commands. the responses will collide making token authentication impossible. enabling anticollision allows addressing of an individual token, regardless how many tokens are in the field. the HCS412 method is that all tokens trained to a given vehicle will have the same 25 msb?s of their serial number. the serial numbers of up to 8 tokens trained to access a given vehicle will differ only in the 3 lsb?s. think of the 25 msb?s of the HCS412's serial number as the vehicle id and the 3 lsb?s as the token id. the vehicle id associates the token with a given vehicle and the token id makes it a uniquely addressable (selectable) 1 of 8 possible tokens authorized to access the vehicle. the transponder reader addresses an individual token, HCS412, by sending a ? select encoder ? command. the command is followed by from 1 to 25 bits of the HCS412's serial number, starting with bit 3 (least sig- nificant bit firs t) (figure 4-3). clocking out ?1?s then increm ents the 3 lsb?s, the first ?1? setting the bits to 000b . when the value matches the 3 lsb?s of a token, the token responds with an encoder select acknowledge. the reader must halt clocking out further ?1?s or risk selecting multiple tokens. any remaining tokens in the field will be unselected, responding only if a new device selection sequence selects them. removing the field will also reset a selected/unselecte d state if removed long enough to result in a device reset. the ability to isolate a single HCS412 for communica- tion greatly depends on the nu mber of most significant serial number bits included in the device selection sequence. the more serial number bits sent, the more narrow the device selection. all bits not transmitted are treated as wildcards. sending only 1 bit, bit 3 as a ?0?, will only narrow the number of tokens allowed to respond to all with bit 3 equal to ?0?. when the transpon- der reader sends the full 25 msb?s of the serial number, it narrows all possible tokens down to only those trained to the vehicle - only those tokens whose serial number?s 25 msb?s match. table 4-3: device select command figure 4-3: anticollision - device selection command description expected data in response 00000 select HCS412, used if anticolli- sion enabled the desired HCS412?s serial number encoder select acknowledge if serial number match 1 to 25 bits of the serial number, encoder select ack 0 0 0 0 0 inductive comms rf comms t esa command ?1? ?1? t otd start 2 lf te activate field ack delay to command command delay to serial most sig x bits 3 lsb?s clock serial of serial number delay ack bit 27 bit 26 bit 25 bit 24 bit 23 bit 22 bit 21 bit 20 bit 19 bit 18 bit 17 bit 16 bit 15 bit 14 bit 13 bit 12 bit 11 bit 10 bit 9 bit 8 bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 28-bit serial number 1 to 25 bits of the serial number, starting with bit 3. communication from reader to HCS412 communication from HCS412 to reader 2ms 000b 010b ?1? 001b 011b ?1? 4th ?1? interrupted by ack, indicating selection @ lsb = 011b send ?1?s to increment 3lsb?s lsb msb bit 3 start 2 lf te start 2 lf te bit x bit 4 bit 5 starting with bit 3. :
HCS412 ds41099d-page 22 ? 2011 microchip technology inc. 4.3.2 read the transponder reader sends one of seven possible read commands indicating which 16-bit eeprom word to retrieve (table 4-4). the HCS412 retrieves the data and returns the 16-bit response. each read response is preceded by a 1lf te low start pulse and ?01b? preamble (figure 4-4). the following locations are available to read: ? the 64-bit general purpose user eeprom. (user[3:0]). ? the 32-bit serial number (ser[1:0]). the serial number is also transmitted in each code hopping transmission. ? the16-bit configuration word containing all non- security related options. figure 4-4: read 4.3.3 write the transponder reader sends one of seven possible write commands (table 4-5) indicating which 16-bit eeprom word to write to. t he 16-bit data to be written follows the command. the HCS412 will attempt to write the value into eeprom and respond with an acknowl- edge sequence if successful. the following locations are available to write: ? the 64-bit general purpose user eeprom. (user[3:0]) (figure 4-6). ? the 32-bit serial number (ser[1:0]). the serial number is also transmitted in each code hopping transmission (figure 4-5). ? the16-bit configuration word containing all non- security related configuration options. if the con- figuration is written, th e device must be reset before the new settings take effect (figure 4-5). a transport code, write access password, protects the serial number and configuration word from undesired modification. for these locations the reader must follow the write command with the appropriate 28-bit trans- port code, then the 16 bits of data to write. only a cor- rect match with the transport code programmed during production will allow write access to the serial number and configuration word (figure 4-5). the delay to a successful write acknowledge will vary depending on the number of bits changed. table 4-4: list of read commands command description expected data in response 00001 read configuration word none 16-bit configuration word 00010 read low serial number none lower 16 bits of serial number (ser0) 00011 read high serial number none higher 16 bits of serial number (ser1) 00100 read user eeprom 0 none 16 bits of user eeprom usr0 00101 read user eeprom 1 none 16 bits of user eeprom usr1 00110 read user eeprom 2 none 16 bits of user eeprom usr2 00111 read user eeprom 3 none 16 bits of user eeprom usr3 16-bit start t rt 01 2 lf te 01b preamble command response communication from reader to HCS412 communication from HCS412 to reader bit0 bit1 bit2 0 0 ack start 1 lf te t pu t ato activate field ack delay to command command delay until response 16-bit response 6 lf te lsb msb lsb msb
? 2011 microchip technology inc. ds41099d-page 23 HCS412 table 4-5: list of write commands figure 4-5: write to seria l number or configuration figure 4-6: write to user area command description expected data in response if write is successful 01001 write configuration word 28- bit transport code; 16-bit configuration word write acknowledge pulse 01010 write low serial number 28-bit transport code; least significant 16 bits of the serial number (ser0) write acknowledge pulse 01011 write high serial number 28-bit tr ansport code; most significant 16 bits of the serial number (ser1) write acknowledge pulse 01100 write user eeprom 0 16 bit user eeprom usr0 write acknowledge pulse 01101 write user eeprom 1 16 bit user eeprom usr1 write acknowledge pulse 01110 write user eeprom 2 16 bit user eeprom usr2 write acknowledge pulse 01111 write user eeprom 3 16 bit user eeprom usr3 write acknowledge pulse activate field ack delay to command command delay to tcode transport write ack delay before write ack 28-bit delay to data code 16 bits data transport code 28-bit bit0 bit1 t wr command t otd write delay communication from reader to HCS412 communication from HCS412 to reader start 2 lf te start 2 lf te start 2 lf te ack ack t ttd t pu t ato lsb msb lsb msb 16 data bits lsb msb 1 0 0 command ack write delay bit0 bit1 1 0 16 t wr ack communication from reader to HCS412 communication from HCS412 to reader start 2 lf te start 2 lf te t otd t pu t ato activate field ack delay to command command delay to data 16 bits data write ack delay before write ack lsb msb data bits lsb msb 1
HCS412 ds41099d-page 24 ? 2011 microchip technology inc. 4.3.4 bulk erase a bulk erase resets the HCS412?s memory map to all zeros. the transponder reader selects the appropriate device through anticollision, as need be, issues the program command followed by the device?s 28-bit transport code, then resets the device by removing the field for 100 ms. resetting the device after the program command results in a bulk erase, resetting the eeprom memory map to all zeros. this is important to remember as the reader must now communicate to the device using the communication options resulting from a zero?d configu- ration word - baud rates, modulation format, etc. (table 5-1). figure 4-7: bulk erase 4.3.5 program inductive programming a HCS412 begins with a bulk erase sequence (section 4.3.4), followed by issuing the program command and the desired eeprom memory map?s 18x16-bit words (section 5.0). the HCS412 will send a write acknowledge after each word has been successfully writt en, indicating the device is ready to receive the next 16-bit word. after a complete 18 word memory map has been received and written, the HCS412 ppm modulates 18 bursts of 16-bit words on the lc pins for write verifica- tion. each word follows the standard HCS412 response format with a leading 1lf te low start pulse and ?01b? preamble (figure 4-10). since the bulk erase resets the configuration options to all zeros, the oscillator tuning value will also be cleared. the correct tuning value is required when the program- ming sequence sends the new configuration word. the value may either be obtained by reading the configura- tion word prior to bulk erase to extract the value or by determining t e from the field acknowledge sequence and calculating the tuning value appropriately (section 4.2.1). table 4-6: program commands figure 4-8: program sequence - first word transport code 28-bit 0 0 0 1 0 100ms program t otd communication from reader to HCS412 communication from HCS412 to reader start 2 lf te start 2 lf te ack 6ms t pu t ato activate field ack delay to command command delay to tcode transport 28-bit delay code device reset command lsb msb lsb msb command description expected data in response 01000 program HCS412 eeprom transport code (28 bits); com- plete memory map: 18 x 16-bit words (288 bits) write acknowledge pulse after each 16-bit word, 288 bits trans- mitted in 18 bursts of 16-bit words activate field ack delay to command command delay to tcode transport write ack delay before write ack 28-bit delay to data code 16 bits data repeat 18 times for programming transport code 28-bit 0 0 0 1 0 t wr program t otd write delay 16 communication from reader to HCS412 communication from HCS412 to reader start 2 lf te start 2 lf te start 2 lf te ack ack t ttd t pu t ato command lsb msb lsb msb data bits lsb msb
? 2011 microchip technology inc. ds41099d-page 25 HCS412 figure 4-9: program seque nce - consecutive words figure 4-10: progra mming - verification 4.3.6 iff challenge and response the transponder reader send s one of four possible iff commands indicating which crypt key and which algo- rithm to use to encrypt the challenge (table 4-7). the command is followed by the 32-bit challenge, typi- cally a random number. the HCS412 encrypts the challenge using the designated crypt key and algorithm and responds with the 32-bit encrypted result. the reader authenticates the response by comparing it to the expected value. the second crypt key and t he seed value occupy the same eeprom storage area. to use the second crypt key for iff, the seed en able (seed) and the tempo- rary seed enable (tmpsd) c onfiguration options must be disabled. table 4-7: challenge and response commands communication from reader to HCS412 communication from HCS412 to reader ack program command transport code 16-bit word 1 key1_1, key1_0 successful write acknowledge successful write acknowledge successful write acknowledge successful write acknowledge 16-bit word 2 key1_3, key1_2 16-bit word 17 cnt1, cnt0 16-bit word 18 reserved (all 0?s) lsb key1_0 msb key1_1 lsb key1_2 msb key1_3 lsb cnt0 msb cnt1 lsb reserved msb reserved write 18x16-bit words total. start verify communication from reader to HCS412 communication from HCS412 to reader ack program command transport code 16-bit word 1 key1_1, key1_0 successful write acknowledge 16-bit word 18 all zeros successful write acknowledge write 18x16-bit words total. 1lf te start + ?01b? + 16-bit word 1 key1_1, key1_0 1lf te start + ?01b? + 16-bit word 2 key1_3, key1_2 1lf te start + ?01b? + 16-bit word 17 cnt1, cnt0 1lf te start + ?01b? + 16-bit word 18 reserved (all 0?s) verify 18x16-bit words total. lsb key1_0 msb key1_1 lsb key1_2 msb key1_3 lsb cnt0 msb cnt1 lsb reserved msb reserved 0 1 01b preamble start 1 lf te 16-bit response lsb msb 3lf te delay between each 16-bit word approximately 1ms delay before verify begins. 1lf te start + ?01b? + 16-bit word 2 key1_5, key1_4 lsb key1_4 msb key1_5 note: if seed transmissions are not appropriately disabled, the HCS412 will default to using key1 for iff. command description expected data in response 10000 iff using key-1 and iff algorithm 32-bit challenge 32-bit response 10001 iff using key-1 and hop algorithm 32-bit challenge 32-bit response 10100 iff using key-2 and iff algorithm 32-bit challenge 32-bit response 10101 iff using key-2 and hop algorithm 32-bit challenge 32-bit response
HCS412 ds41099d-page 26 ? 2011 microchip technology inc. figure 4-11: iff challenge and response 4.3.7 code hopping request the command tells the HCS412 to increment the syn- chronization counter and build the 32-bit code hopping portion of the code word. ? if rf echo is disabled, the data will be transmitted on the lc lines only (figure 4-12). ? if rf echo is enabled, the data will be transmitted in a code word on the data line followed by the data transmitted on the lc lines. the data line is transmitted first for passive entry support (figure 4-13). the data format will be the same as described in section 3.2. table 4-8: request hopping code commands figure 4-12: code hopping re quest (rf echo disabled) figure 4-13: code hopping request (rf echo enabled) 32-bit 32-bit command t it ack bit0 bit1 bit2 0 1 t otd t pu t ato start 2 lf te start 2 lf te 01 01b preamble communication from reader to HCS412 communication from HCS412 to reader activate field ack delay to command command delay to data 32-bit challenge delay before response 32-bit response lsb msb challenge lsb msb response lsb msb start 1 lf te command description expected data in response 11000 request hopping code transmission none 32-bit hopping code t oth 32-bit ppm command start 2 lf te t pu communication from reader to HCS412 communication from HCS412 to reader response t ato 0 0 0 1 1 ack start 1 lf te 01 01b preamble activate field ack delay to command command delay before response 32-bit response lsb msb lsb msb opcode (request preamble header fixed code (37 bits) hop code (32 bits) lf communication from reader to HCS412 lf communication from HCS412 to reader data (rf) inductive (lf) lsb msb lsb msb hop code) field ack field ack 32-bit ppm response
? 2011 microchip technology inc. ds41099d-page 27 HCS412 4.3.8 enable default iff communication the enable default iff communication com- mand defaults certain HCS412 communication options such that the transponder reader may communicate to the device with a common (safe) protocol. the default setting remains for the duration of the communication, returning to normal only after a device reset. default iff communication settings: ? anticollision disabled ? rf echo disabled ?200 s lf baud rate. table 4-9: default iff communication commands figure 4-14: enable defa ult iff communication 4.4 iff communication special features table 4-10: lf communication special features (lfsp) 4.4.1 passive proximity activation (lfsp = 10) enabling the proximity activation configuration option allows the HCS412 to transmit a hopping code trans- mission in response to a signal present on the lc0 pin. the HCS412 sends out field acknowledge sequence in response to detecting the lf field (figure 4-1). if the HCS412 does not receive a command before the sec- ond field acknowledge sequence [within 255 lft e ?s], it will transmit a normal code hopping transmission for 2 seconds on the data pin. after 2 seconds the HCS412 reverts to normal transponder mode. the 2 second transmission does not repeat when the device is in the presence of a continuous lf field. the HCS412 must be reset, re move and reapply the lf field, to activate another transmission. the button status used in the code hopping transmis- sion indicates a proximity activation by clearing the s0, s1 and s2 button activation flags. figure 4-15: proximity activation command description expected data in response 11100 enable default iff communication none none communication from reader to HCS412 communication from HCS412 to reader ack pulses inductive comms rf comms 0 0 1 1 1 t ato activate field ack delay to command command delay next command command start 2 lf te lsb msb lfsp1:0 description 00 no special options enabled 01 anticollision enabled (section 4.3.1) 10 proximity activation enabled 11 anticollision and rf echo enabled data (rf) ack lf communication from reader to HCS412 lf communication from HCS412 to reader inductive (lf) no command received from reader for 255 lf te . transmit hopping code for 2 seconds
HCS412 ds41099d-page 28 ? 2011 microchip technology inc. 4.4.2 anticollision and rf echo (lfsp = 11) in addition to enabling anticollision, this mode adds that all HCS412 responses and acknowledges are echoed on the data output line. responses are first transmit- ted on the data line, followed by the equivalent data transmitted on the lf lc lines (figure 4-16, figure 4-17). lf communication from t he token to the transponder reader has much less range than lf communication from the reader to the token. transmitting the informa- tion on the data line increases communication range by enabling longer range rf talk back. the information is sent on the data line first to benefit longer range passive-entry authentication times. figure 4-16: rf echo option and read command figure 4-17: rf echo option and iff command figure 4-18: rf echo option and request hopping code command data (rf) command (read) response (16 bits) preamble header next ack fixed code (37 bits) response (32 bits) ack t pu t ato lf communication from reader to HCS412 lf communication from HCS412 to reader t oth inductive (lf) 32-bit response 16-bit response 16-bit response lsb msb lsb msb opcode (iff) response (32 bits) preamble header next ack fixed code (37 bits) response (32 bits) lf communication from reader to HCS412 lf communication from HCS412 to reader data (rf) inductive (lf) lsb msb lsb msb preamble header fixed code (37 bits) hop code (32 bits) lf communication from reader to HCS412 lf communication from HCS412 to reader data (rf) lsb msb lsb msb field ack 32-bit ppm response next field ack t oth t ato request hopping code opcode inductive (lf)
? 2011 microchip technology inc. ds41099d-page 29 HCS412 4.4.3 intelligent damping (idamp) a high q-factor lc antenna circuit connected to the HCS412 will continue to resonate after a strong lf field is removed, slowly decayi ng. the slow decay makes fast communication near the reader difficult as data bit low times disappear. if the intelligent damping option is enabled, the HCS412 will clamp the lc pins through a 2 k resistor for 5 s every 1/4 lf te , whenever the HCS412 is expecting data from the transponder reader. the intel- ligent damping pulses start 12.5 lf te after the acknowledge sequence is complete and continue for 12.5 lf te . if the HCS412 detects data from the reader while sending out damping pulses, it will continue to send the damping pulses. table 4-11: intelligent damping (idamp) figure 4-19: intelligent damping table 4-12: lf timing specifications idamp description 0 intelligent damping enabled 1 intelligent damping disabled 12.5 lf te 12.5 lf te 5 s 1/4 lf te 5 s damp pulses bit from reader field ack parameter symbol min. typ. max. units time element iffb = 0 iffb = 1 lf te 180 90 200 100 220 110 s power-up time t pu 4.267.8ms acknowledge to opcode time t ato 13 lf te ppm command bit time data = 0 data = 1 t bitc ? ? 4 6 ? ? lf te ppm response bit time data = 0 data = 1 t bitr ? ? 2 3 ? ? lf te read response time t rt ?13?lf te iff response time t it 3.87 4.3 4.73 ms opcode to data input time t otd 2.6 ? ? ms transport code to data input time t ttd 2.2 ? ? ms encoder select acknowledge time t esa ?lf te +100 ? s iff eeprom write time (16 bits) t wr ?30?ms op code to hop code response time t oth 10.26 11.4 12.54 ms
HCS412 ds41099d-page 30 ? 2011 microchip technology inc. 5.0 configuration summary table 5-1 summarizes the available HCS412 options. table 5-1: HCS412 configuration summary symbol reference section description key1 64-bit encoder key 1 sdval section 3.2.7 60-bit seed value transmitted in ch mode if (seed = 1 and tmpsd = 0) or if (seed = 0 and tmpsd = 1). key2 lsb 60 bits of encoder key 2. 4 msb?s set to xxxx. ( note 1 ) tcode section 4.3.3 28-bit transport code afsk section 3.4.5 pll interface select. 0 = ask 1 = fsk rfen section 2.2.7 rf enable output active. 0 = disable 1 = enable lpre section 3.4.7 long preamble enable. 0 = disable 1 = enable qlvs section 3.4.8 special features enable. 0 = disable 1 = enable osct section 2.2.5 oscillator tune value. 1000b fastest 0000b nominal 0111b slowest vlowsel section 2.2.6 low voltage trip point select 0 = 2.2 volt 1 = 4.4 volt idamp section 4.4.3 intelligent damping enable 0 = enable 1 = disable lfsp section 4.4 lf communication special features lfsp1:0 active feature 00b none 01b anticollision 10b prox activation 11b rf echo lfbsl section 4.2 iff baud rate select (lf te ) 0 = 200 us 1 = 100 us mod section 3.3 data pin modulation format 0 = pwm 1 = manch cwbe section 3.4.3 code word blanking enable 0 = disable 1 = enable mtx4 section 3.4.1 minimum four code words 0 = disable 1 = enable rfbsl section 3.3 transmission baud rate (rf te ) rfbsl1:0 pwm manch 00b 400 us 800 us 01b 200 us 400 us 10b 100 us 200 us 11b 100 us 200 us s2lc section 3.4.1 s2/rfen/lc1 pin configuration bit. 0 = lc 1 = s input ? reserved, set to 0 ? ? tmpsd section 3.2.7 temporary seed enable ( note 1 ) 0 = disable 1 = enable seed section 3.2.7 seed transmission enable ( note 1 ) 0 = disable 1 = enable xser section 3.2.5 extended serial number 0 = disable 1 = enable dinc section 3.4.4 delayed increment 0 = disable 1 = enable disc section 3.2.6 10-bit discrimination value ovr section 3.2.4 counter overflow value ser 32-bit serial number usr 64-bit user eeprom area cnt 16-bit synchronization counter ? reserved set 0000h note 1: if iff with key2 is enabled onl y if tmpsd = 1 and seed = 1.
? 2011 microchip technology inc. ds41099d-page 31 HCS412 6.0 integrating the HCS412 into a system use of the HCS412 in a syst em requires a compatible decoder. this decoder is typi cally a microcontroller with compatible firmware. microchip will provide (via a free license agreement) firmware routines that accept transmissions from the HCS412 and decrypt the hopping code portion of the data stream. these routines provide system designers the means to develop their own decoding system. 6.1 learning a transmitter to a receiver a transmitter must first be 'learned' by a decoder before its use is allowed in the system. several learning strat- egies are possible, figure 6-1 details a typical learn sequence. core to each, the decoder must minimally store each learned transmitter's serial number and cur- rent synchronization counter value in eeprom. addi- tionally, the decoder typically stores each transmitter's unique crypt key. the maximum number of learned transmitters will therefore be relative to the available eeprom. a transmitter's serial number is transmitted in the clear but the synchronization counter only exists in the code word's encrypted portion. the decoder obtains the counter value by decrypting using the same key used to encrypt the information. the k ee l oq algorithm is a symmetrical block cipher so the encryption and decryp- tion keys are identical and referred to generally as the crypt key. the encoder receives its crypt key during manufacturing. the decoder is programmed with the ability to generate a crypt key as well as all but one required input to the key ge neration routine; typically the transmitter's serial number. figure 6-1 summarizes a typical learn sequence. the decoder receives and authenticates a first transmis- sion; first button press. authentication involves gener- ating the appropriate crypt key, decrypting, validating the correct key usage via the discrimination bits and buffering the counter value. a second transmission is received and authenticated. a final check verifies the counter values were seque ntial; consecutive button presses. if the learn s equence is successfully com- plete, the decoder stores the learned transmitter's serial number, current synch ronization counter value and appropriate crypt key. from now on the crypt key will be retrieved from eeprom during normal opera- tion instead of recalculating it for each transmission received. certain learning strategies have been patented and care must be take n not to infringe. figure 6-1: typical learn sequence enter learn mode wait for reception of a valid code generate key from serial number use generated key to decrypt compare discrimination value with fixed value equal wait for reception of second valid code compare discrimination value with fixed value use generated key to decrypt equal counters encryption key serial number synchronization counter sequential ? ? ? exit learn successful store: learn unsuccessful no no no yes yes yes
HCS412 ds41099d-page 32 ? 2011 microchip technology inc. 6.2 decoder operation figure 6-2 summarizes normal decoder operation. the decoder waits until a transmission is received. the received serial number is compared to the eeprom table of learned transmitters to first determine if this transmitter's use is allow ed in the system. if from a learned transmitter, the transmission is decrypted using the stored crypt key and authenticated via the discrimination bits for appropriate crypt key usage. if the decryption was valid the synchronization value is evaluated. figure 6-2: typical decoder operation 6.3 synchronization with decoder (evaluating the counter) the k ee l oq technology patent scope includes a sophisticated synchronization technique that does not require the calculation and storage of future codes. the technique securely blocks invalid transmissions while providing transparent resynchronization to transmitters inadvertently activated away from the receiver. figure 6-3 shows a 3-partition, rotating synchronization window. the size of each window is optional but the technique is fundamental. each time a transmission is authenticated, the intended function is executed and the transmission's synchroni zation counter value is stored in eeprom. from t he currently stored counter value there is an initial "s ingle operation" forward win- dow of 16 codes. if the difference between a received synchronization counter and the last stored counter is within 16, the intended function will be executed on the single button press and the new synchronization coun- ter will be stored. storing the new synchronization counter value effectively rota tes the entire synchroniza- tion window. a "double operation" (resynchronization) window fur- ther exists from the sing le operation window up to 32k codes forward of the currently stored counter value. it is referred to as "double operation" because a trans- mission with synchronization c ounter value in this win- dow will require an additional, sequential counter transmission prior to executing the intended function. upon receiving the sequential transmission the decoder executes the intend ed function and stores the synchronization counter valu e. this resynchronization occurs transparently to the user as it is human nature to press the button a second ti me if the first was unsuc- cessful. the third window is a "blocked window" ranging from the double operation window to the currently stored synchronization counter value. any transmission with synchronization counter value within this window will be ignored. this window excludes previously used, perhaps code-grabbed transmissions from accessing the system. ? transmission received does serial number match ? decrypt transmission is decryption valid ? is counter within 16 ? is counter within 32k ? update counter execute command save counter in temp location start no no no no yes yes yes yes yes no and no note: the synchronization method described in this section is only a typical implementation and because it is usually implemented in firmware, it can be altered to fit the needs of a particular system.
? 2011 microchip technology inc. ds41099d-page 33 HCS412 figure 6-3: synchronization window figure 6-4: basic operation of receiver (decoder) note: circled numbers indicate sequence of events. blocked entire window rotates to eliminate use of previously used codes single operation window window (32k codes) (16 codes) double operation (resynchronization) window (32k codes) stored synchronization counter value button press information eeprom array manufacturer code 32 bits of encrypted data serial number received information decrypted synchronization counter check for match sync counter serial number k ee l oq ? decryption algorithm 1 3 4 check for match 2 perform function indicated by button press 5 crypt key
HCS412 ds41099d-page 34 ? 2011 microchip technology inc. 7.0 programmi ng the HCS412 the HCS412 requires some parameters programmed into the device before it can be used. the programming cycle allows the user to input all 288 bits in a serial data stream, which are then stored internally in eeprom. programming is initiated by forcing the data line high, after the s2 line has been held high for the appropriate length of time line (table 7-1 and figure 7-2). a delay is required after entering program mode while the automatic bulk erase c ycle completes. the bulk erase writes all eeprom locations to zeros. the device is then programmed by clocking in the eeprom memory map (least significant bit first) 16 bits at a time, using s2 as the clock line and data as the data-in line. after each 16-bit word is loaded, a pro- gramming delay is required for the internal program cycle to complete. this del ay can take up to twc. the HCS412 will signal a ?write complete? after writing each 16-bit word by sending out a series of ack pulses t ackh high, t ackl low on data. the ack pulses con- tinue until s2 is dropped. programming verification is allowed only once, after the programming cycle (figure 7 -3), by reading back the eeprom memory map. reading is done by clocking the s2 line and reading the data bits on data, again least significant bit first. fo r security reasons, it is not possible to execute a veri fy function without first pro- gramming the eeprom. figure 7-1: creation and storage of crypt key during production figure 7-2: programming waveforms figure 7-3: verify waveforms note: to ensure that the device does not acci- dentally enter programming mode, data should never be pulled high by the circuit connected to it. special care should be taken when driving pnp rf transistors. transmitter manufacturer?s serial number code crypt key key generation algorithm serial number crypt key sync counter . . . HCS412 production programmer eeprom array data enter program mode (data) (clock) note 1: s0 and s1 button inputs to be held to ground during the entire programming sequence. bit 0 bit 1 bit 2 bit 3 bit 14 bit 15 bit 16 bit 17 t ph 1 t pbw t ps repeat for each word (18 times total) t ph 2 t clkh t clkl t wc t ds s2 data for word 1 t dh t clkl initiate data polling here write cycle complete here t ackl t ack h calibration pulses t p h old ack ack ack data for word 0 (key1_0) (key1_1) data (clock) (data) note: if a verify operation is to be done, then it must imm ediately follow the program cycle. end of programming cycle beginning of verify cycle bit 1 bit 2 bit 3 bit 15 bit 14 bit 16 bit 17 bit190 bit191 t wc data from word 0 t dv s2 bit 0 bit191 bit190 ack
? 2011 microchip technology inc. ds41099d-page 35 HCS412 7.1 eeprom organization table 7-1: HCS412 eeprom organization table 7-2: programming/ver ify timing requirements 16bit word bits 1514131211109876543210 1 key1_1 key1_0 (key1 lsb) 2 key1_3 key1_2 3 key1_5 key1_4 4 key1_7 (key1 msb) key1_6 5 seed_1 / key2_1 seed_0 / key2_0 (seed and key2 lsb) 6 seed_3 / key2_3 seed_2 / key2_2 7 seed_5 / key2_5 / tcode_1 seed_4 / key2_4 / tcode_0 (tcode lsb) 8 qlvs lpre rfen afsk seed_7 / key2_7 / tcode_3 (msb for all 3) seed_6 / key2_6 / tcode_2 9 set to 0 s2lc rfbsl mtx4 cwbe mod lfbsl lfsp idamp vlowsel osct 10 10 3210 10 ovr 10bit discrimination value dinc xser seed tmpsd 109876543210 11 ser1 ser0 12 ser3 ser2 13 usr0 msb usr0 lsb 14 usr1 msb usr1 lsb 15 usr2 msb usr2 lsb 16 usr3 msb usr3 lsb 17 cnt1 (counter msb) cnt0 (counter lsb) 18 reserved, set to 0 reserved, set to 0 v dd = 5.0v 10%, 25 c 5 c parameter symbol min. max. units program mode setup time t ps 25.0ms hold time 1 t ph 14.0 ? ms hold time 2 t ph 250 ? s bulk write time t pbw 4.0 ? ms program delay time t prog 4.0 ? ms program cycle time t wc 50 ? ms clock low time t clkl 50 ? s clock high time t clkh 50 ? s data setup time t ds 0? s data hold time t dh 18 ? s data out valid time t dv 30 s hold time t phold 100 ? s acknowledge low time t ackl 800 ? s acknowledge high time t ackh 800 ? s
HCS412 ds41099d-page 36 ? 2011 microchip technology inc. 8.0 development support the pic ? microcontrollers and dspic ? digital signal controllers are supported with a full range of software and hardware development tools: ? integrated development environment -mplab ? ide software ? compilers/assemblers/linkers - mplab c compiler for various device families - hi-tech c for various device families - mpasm tm assembler -mplink tm object linker/ mplib tm object librarian - mplab assembler/link er/librarian for various device families ? simulators - mplab sim software simulator ?emulators - mplab real ice? in-circuit emulator ? in-circuit debuggers - mplab icd 3 - pickit? 3 debug express ? device programmers - pickit? 2 programmer - mplab pm3 device programmer ? low-cost demonstratio n/development boards, evaluation kits, and starter kits 8.1 mplab integrated development environment software the mplab ide software brings an ease of software development previously unseen in the 8/16/32-bit microcontroller market. the mplab ide is a windows ? operating system-based app lication that contains: ? a single graphical interface to all debugging tools - simulator - programmer (sold separately) - in-circuit emulator (sold separately) - in-circuit debugger (sold separately) ? a full-featured editor with color-coded context ? a multiple project manager ? customizable data windows with direct edit of contents ? high-level source code debugging ? mouse over variable inspection ? drag and drop variables from source to watch windows ? extensive on-line help ? integration of select thir d party tools, such as iar c compilers the mplab ide allows you to: ? edit your source files (either c or assembly) ? one-touch compile or assemble, and download to emulator and simulator tools (automatically updates all project information) ? debug using: - source files (c or assembly) - mixed c and assembly - machine code mplab ide supports multiple debugging tools in a single development paradigm, from the cost-effective simulators, through low-cost in-circuit debuggers, to full-featured emulators. this eliminates the learning curve when upgrading to tools with increased flexibility and power.
? 2011 microchip technology inc. ds41099d-page 37 HCS412 8.2 mplab c compilers for various device families the mplab c compiler code development systems are complete ansi c compilers for microchip?s pic18, pic24 and pic32 families of microcontrollers and the dspic30 and dspic33 families of digital signal control- lers. these compilers provide powerful integration capabilities, superior code optimization and ease of use. for easy source level debugging, the compilers provide symbol information that is optimized to the mplab ide debugger. 8.3 hi-tech c for various device families the hi-tech c compiler code development systems are complete ansi c comp ilers for microchip?s pic family of microcontrollers and the dspic family of digital signal controllers. these compilers provide powerful integration capabilities, omniscient code generation and ease of use. for easy source level debugging, the compilers provide symbol information that is optimized to the mplab ide debugger. the compilers include a macro assembler, linker, pre- processor, and one-step driver, and can run on multiple platforms. 8.4 mpasm assembler the mpasm assembler is a full-featured, universal macro assembler for pic10/12/16/18 mcus. the mpasm assembler generates relocatable object files for the mplink object linker, intel ? standard hex files, map files to detail memory usage and symbol reference, absolute lst files that contain source lines and generated machine code and coff files for debugging. the mpasm assembler features include: ? integration into mplab ide projects ? user-defined macros to streamline assembly code ? conditional assembly for multi-purpose source files ? directives that allow complete control over the assembly process 8.5 mplink object linker/ mplib object librarian the mplink object linker combines relocatable objects created by the mpasm assembler and the mplab c18 c compiler. it can link relocatable objects from precompiled libraries, using directives from a linker script. the mplib object librarian manages the creation and modification of library files of precompiled code. when a routine from a library is called from a source file, only the modules that contain that routine will be linked in with the application. this allows large libraries to be used efficiently in many different applications. the object linker/libra ry features include: ? efficient linking of single libraries instead of many smaller files ? enhanced code maintainability by grouping related modules together ? flexible creation of libraries with easy module listing, replacement, deletion and extraction 8.6 mplab assembler, linker and librarian for various device families mplab assembler produces relocatable machine code from symbolic assembly language for pic24, pic32 and dspic devices. mplab c compiler uses the assembler to produce its object file. the assembler generates relocatable object files that can then be archived or linked with other relocatable object files and archives to create an exec utable file. notable features of the assembler include: ? support for the entire device instruction set ? support for fixed-point and floating-point data ? command line interface ? rich directive set ? flexible macro language ? mplab ide compatibility
HCS412 ds41099d-page 38 ? 2011 microchip technology inc. 8.7 mplab sim software simulator the mplab sim software simulator allows code development in a pc-hosted environment by simulat- ing the pic ? mcus and dspic ? dscs on an instruction level. on any give n instruction, the data areas can be examined or modified and stimuli can be applied from a comprehensive stimulus c ontroller. registers can be logged to files for further run-time analysis. the trace buffer and logic analyzer display extend the power of the simulator to record and track program execution, actions on i/o, most peripherals and internal registers. the mplab sim software simulator fully supports symbolic debugging using the mplab c compilers, and the mpasm and mplab assemblers. the soft- ware simulator offers the flexibility to develop and debug code outside of the hardware laboratory envi- ronment, making it an excellent, economical software development tool. 8.8 mplab real ice in-circuit emulator system mplab real ice in-circuit emulator system is microchip?s next generation high-speed emulator for microchip flash dsc and mcu devices. it debugs and programs pic ? flash mcus and dspic ? flash dscs with the easy-to-use, powerful graphical user interface of the mplab integrated devel opment environment (ide), included with each kit. the emulator is connected to the design engineer?s pc using a high-speed usb 2.0 interface and is connected to the target with either a connector compatible with in- circuit debugger systems (rj11) or with the new high- speed, noise tolerant, low-voltage differential signal (lvds) interconnection (cat5). the emulator is field upgradable through future firmware downloads in mplab ide. in upcoming releases of mplab ide, new devices will be supported, and new features will be added. mplab real ice offers significant advantages over competitive emulators including low-cost, full-sp eed emulation, run-time variable watches, trace analysis, complex breakpoints, a ruggedized probe interface and long (up to three meters) interconnection cables. 8.9 mplab icd 3 in-circuit debugger system mplab icd 3 in-circuit debugger system is micro- chip's most cost effective high-speed hardware debugger/programmer for microchip flash digital sig- nal controller (dsc) and microcontroller (mcu) devices. it debugs and programs pic ? flash microcon- trollers and dspic ? dscs with the powerful, yet easy- to-use graphical user interface of mplab integrated development environment (ide). the mplab icd 3 in-circuit debugger probe is con- nected to the design engineer's pc using a high-speed usb 2.0 interface and is connected to the target with a connector compatible with the mplab icd 2 or mplab real ice systems (rj-11). mplab icd 3 supports all mplab icd 2 headers. 8.10 pickit 3 in-circuit debugger/ programmer and pickit 3 debug express the mplab pickit 3 allows debugging and program- ming of pic ? and dspic ? flash microcontrollers at a most affordable price point using the powerful graphical user interface of the mp lab integrated development environment (ide). the mplab pickit 3 is connected to the design engineer's pc using a full speed usb interface and can be connec ted to the target via an microchip debug (rj-11) connector (compatible with mplab icd 3 and mplab real ice). the connector uses two device i/o pins and the reset line to imple- ment in-circuit debugging and in-circuit serial pro- gramming?. the pickit 3 debug express include the pickit 3, demo board and microcontroller, hookup cables and cdrom with user?s guide, lessons, tutorial, compiler and mplab ide software.
? 2011 microchip technology inc. ds41099d-page 39 HCS412 8.11 pickit 2 development programmer/debugger and pickit 2 debug express the pickit? 2 development programmer/debugger is a low-cost development tool with an easy to use inter- face for programming and debugging microchip?s flash families of microcontrollers. the full featured windows ? programming interface supports baseline (pic10f, pic12f5xx, pic16f5xx), midrange (pic12f6xx, pic16f), pi c18f, pic24, dspic30, dspic33, and pic32 families of 8-bit, 16-bit, and 32-bit microcontrollers, and many microchip serial eeprom products. with microchip?s powerful mplab integrated development environmen t (ide) the pickit? 2 enables in-circuit debugging on most pic ? microcon- trollers. in-circuit-debugging runs, halts and single steps the program while the pic microcontroller is embedded in the application. when halted at a break- point, the file registers ca n be examined and modified. the pickit 2 debug express include the pickit 2, demo board and microcontroller, hookup cables and cdrom with user?s guide, lessons, tutorial, compiler and mplab ide software. 8.12 mplab pm3 device programmer the mplab pm3 device programmer is a universal, ce compliant device programmer with programmable voltage verification at v ddmin and v ddmax for maximum reliability. it features a large lcd display (128 x 64) for menus and error messages and a modu- lar, detachable socket asse mbly to support various package types. the icsp? ca ble assembly is included as a standard item. in stand-alone mode, the mplab pm3 device programmer can read, verify and program pic devices without a pc co nnection. it can also set code protection in this mode. the mplab pm3 connects to the host pc via an rs-232 or usb cable. the mplab pm3 has high-speed communications and optimized algorithms for quick programming of large memory devices and incorporates an mmc card for file storage and data applications. 8.13 demonstration/development boards, evaluation kits, and starter kits a wide variety of demonstr ation, development and evaluation boards for various pic mcus and dspic dscs allows quick application development on fully func- tional systems. most boards include prototyping areas for adding custom circuitry and provide application firmware and source code for examination and modification. the boards support a variety of features, including leds, temperature sensors, sw itches, speakers, rs-232 interfaces, lcd displays, potentiometers and additional eeprom memory. the demonstration and development boards can be used in teaching environments, for prototyping custom circuits and for learning about various microcontroller applications. in addition to the picdem? and dspicdem? demon- stration/development board series of circuits, microchip has a line of evaluation kits and demonstration software for analog filter design, k ee l oq ? security ics, can, irda ? , powersmart battery management, seeval ? evaluation system, sigma-delta adc, flow rate sensing, plus many more. also available are starter kits that contain everything needed to experience the specified device. this usually includes a single application and debug capability, all on one board. check the microchip web page (www.microchip.com) for the complete list of demonstration, development and evaluation kits.
HCS412 ds41099d-page 40 ? 2011 microchip technology inc. 9.0 electrical characteristics table 9-1: absolute maximum rating symbol item rating units v dd supply voltage -0.3 to 6.6 v v in * input voltage -0.3 to v dd + 0.3 v v out output voltage -0.3 to v dd + 0.3 v i out max output current 50 ma t stg storage temperature -55 to +125 c (note) t lsol lead soldering temp 300 c (note) v esd esd rating (human body model) 4000 v note: stresses above those listed under ?absolute maximu m ratings? may cause pe rmanent damage to the device. * if a battery is inserted in reverse, the protection circuitry switc hes on, protecting the device and draining the battery. table 9-2: dc and transponder characteristics commercial (c): t amb = 0c to 70c industrial (i): t amb = -40c to 85c 2.0v < v dd < 6.3v parameter symbol min typ 1 max unit conditions average operating current note 2 i dd (avg) ? 200 500 av dd = 6.3v programming current i ddp 2.3 4.0 ma v dd = 6.3v standby current i dds ? 0.1 500 na lc = off else < 5 a high level input voltage v ih 0.55 v dd ?v dd + 0.3 v low level input voltage v il -0.3 ? 0.15 v dd v high level output voltage v oh 0.8 v dd 0.8 v dd ?? v v dd = 2v, i oh =- .45 ma v dd = 6.3v, i oh ,= -2 ma low level output voltage v ol ? ? ? ? 0.08 v dd 0.08 v dd v v dd = 2v, i oh = 0.5 ma v dd = 6.3v, i oh = 5 ma led output current i led 3.0 4.0 7.0 ma v dd = 3.0v, v led = 1.5v switch input resistor r s 40 60 80 k s0/s1 not s2 data input resistor r data 80 120 160 k lc input current i lc ? ? 10.0 ma v lcc =10 v p - p lc input clamp voltage v lcc ?10? vi lc <10 ma lc induced output current v ddi ?2.0mav lcc > 10v lc induced output voltage v ddv ? ? 4.5 4.0 ? ? v 10 v < v lcc , i dd = 0 ma 10 v < v lcc , i dd = -1 ma carrier frequency fc ? 125 khz lc input sensitivity v lcs ?100?mv pp note 3 note 1: typical values at 25c. 2: no load connected. 3: not tested.
? 2011 microchip technology inc. ds41099d-page 41 HCS412 10.0 packaging information 10.1 package marking information legend: mm...m microchip part number information xx...x customer specific information* yy year code (last 2 digits of calendar year) ww week code (week of january 1 is week ?01?) nnn alphanumeric traceability code note : in the event the full microchip part num ber cannot be marked on one line, it will be carried over to the next line thus limiting the number of available characters for customer specific information. * standard marking consists of microchip part number, year code, week code and traceability code. for marking beyond this, certain price adders apply. pl ease check with your microchip sales office. for sqtp devices, any special marking adders are included in sqtp price. xxxxxxxx xxxxxnnn yyww 8-lead pdip example HCS412 xxxxx862 9925 8-lead soic xxxxxxxx example nnn xxxxyyww xxxxxxxx 862 xxxx9925
HCS412 ds41099d-page 42 ? 2011 microchip technology inc. 10.2 package details n e1 note 1 d 12 3 a a1 a2 l b1 b e e eb c
? 2011 microchip technology inc. ds41099d-page 43 HCS412 note: for the most current package drawings, please see the microchip packaging specification located at http://www.microchip.com/packaging
HCS412 ds41099d-page 44 ? 2011 microchip technology inc. note: for the most current package drawings, please see the microchip packaging specification located at http://www.microchip.com/packaging
? 2011 microchip technology inc. ds41099d-page 45 HCS412
HCS412 ds41099d-page 46 ? 2011 microchip technology inc. appendix a: additional information microchip?s secure data products are covered by some or all of the following: code hopping encoder patents issued in european countries and u.s.a. secure learning patents issued in european countries, u.s.a. and r.s.a. revision history revision d (june 2011) ? updated the following sections: development sup- port, the microchip web site, reader response and HCS412 product id entification system ? added new section appendix a ? minor formatting and text changes were incorporated throughout the document
? 2011 microchip technology inc. ds41099d-page 47 HCS412 the microchip web site microchip provides online support via our www site at www.microchip.com. this web site is used as a means to make files and information easily available to customers. accessible by using your favorite internet browser, the web site contains the following information: ? product support ? data sheets and errata, application notes and sample programs, design resources, user?s guides and hardware support documents, latest software releases and archived software ? general technical support ? frequently asked questions (faq), technical support requests, online discussion groups, microchip consultant program member listing ? business of microchip ? product selector and ordering guides, latest microchip press releases, listing of seminars and events, listings of microchip sales offices, distributors and factory representatives customer change notification service microchip?s customer notification service helps keep customers current on microchip products. subscribers will receive e-mail notification whenever there are changes, updates, revisions or errata related to a specified product family or de velopment tool of interest. to register, access the microchip web site at www.microchip.com. under ?support?, click on ?customer change notification? and follow the registration instructions. customer support users of microchip products can receive assistance through several channels: ? distributor or representative ? local sales office ? field application engineer (fae) ? technical support ? development systems information line customers should contact their distributor, representative or field application engineer (fae) for support. local sales offices are also available to help customers. a listing of sa les offices and locations is included in the back of this document. technical support is available through the web site at: http://micro chip.com/support
HCS412 ds41099d-page 48 ? 2011 microchip technology inc. reader response it is our intention to provide you with the best document ation possible to ensure succe ssful use of your microchip product. if you wish to provide your comments on organiz ation, clarity, subject matter, and ways in which our documentation can better serve you, please fax your comments to the technical publications manager at (480) 792-4150. please list the following information, and use this outli ne to provide us with your comments about this document. to: technical publications manager re: reader response total pages sent ________ from: name company address city / state / zip / country telephone: (_______) _________ - _________ application (optional): would you like a reply? y n device: literature number: questions: fax: (______) _________ - _________ ds41099d HCS412 1. what are the best features of this document? 2. how does this document meet your hardware and software development needs? 3. do you find the organization of this document easy to follow? if not, why? 4. what additions to the document do you th ink would enhance the structure and subject? 5. what deletions from the document could be made without affecting the overall usefulness? 6. is there any incorrect or misleading information (what and where)? 7. how would you improve this document?
? 2011 microchip technology inc. ds41099d-page 49 HCS412 HCS412 product ident ification system to order or obtain information, e.g., on pricing or deli very, refer to the factory or the listed sales office. package: p = plastic dip (300 mil body), 8-lead sn = plastic soic (150 mil body), 8-lead temperature - = 0c to +70c range: i = ?40c to +85c device: HCS412 = code hopping encoder HCS412 t = code hopping encoder (tape and reel) (sn only) HCS412 ?/x
HCS412 ds41099d-page 50 ? 2011 microchip technology inc. notes:
? 2011 microchip technology inc. ds41099d-page 51 information contained in this publication regarding device applications and the like is prov ided only for your convenience and may be superseded by updates. it is your responsibility to ensure that your application me ets with your specifications. microchip makes no representations or warranties of any kind whether express or implied, written or oral, statutory or otherwise, related to the information, including but not limited to its condition, quality, performance, merchantability or fitness for purpose . microchip disclaims all liability arising from this information and its use. use of microchip devices in life support and/or safe ty applications is entirely at the buyer?s risk, and the buyer agrees to defend, indemnify and hold harmless microchip from any and all damages, claims, suits, or expenses resulting fr om such use. no licenses are conveyed, implicitly or ot herwise, under any microchip intellectual property rights. trademarks the microchip name and logo, th e microchip logo, dspic, k ee l oq , k ee l oq logo, mplab, pic, picmicro, picstart, pic 32 logo, rfpic and uni/o are registered trademarks of microchip technology incorporated in the u.s.a. and other countries. filterlab, hampshire, hi-tech c, linear active thermistor, mxdev, mxlab, seeval and the embedded control solutions company are register ed trademarks of microchip technology incorporated in the u.s.a. analog-for-the-digital age, a pplication maestro, codeguard, dspicdem, dspicdem.net, dspicworks, dsspeak, ecan, economonitor, fansense, hi-tide, in-circuit serial programming, icsp, mindi, miwi, mpasm, mplab certified logo, mplib, mplink, mtouch, omniscient code generation, picc, picc-18, picdem, picdem.net, pickit, pictail, real ice, rflab, select mode, total endurance, tsharc, uniwindriver, wiperlock and zena are trademarks of microchip te chnology incorporated in the u.s.a. and other countries. sqtp is a service mark of mi crochip technology incorporated in the u.s.a. all other trademarks mentioned herein are property of their respective companies. ? 2011, microchip technology incorporated, printed in the u.s.a., all rights reserved. printed on recycled paper. isbn: 978-1-61341-231-2 note the following details of the code protection feature on microchip devices: ? microchip products meet the specification cont ained in their particular microchip data sheet. ? microchip believes that its family of products is one of the mo st secure families of its kind on the market today, when used i n the intended manner and under normal conditions. ? there are dishonest and possibly illegal meth ods used to breach the code protection fe ature. all of these methods, to our knowledge, require using the microchip pr oducts in a manner outside the operating specif ications contained in microchip?s data sheets. most likely, the person doing so is engaged in theft of intellectual property. ? microchip is willing to work with the customer who is concerned about the integrity of their code. ? neither microchip nor any other semiconduc tor manufacturer can guarantee the security of their code. code protection does not mean that we are guaranteeing the product as ?unbreakable.? code protection is constantly evolving. we at microchip are committed to continuously improving the code protection features of our products. attempts to break microchip?s c ode protection feature may be a violation of the digital millennium copyright act. if such acts allow unauthorized access to your softwa re or other copyrighted work, you may have a right to sue for relief under that act. microchip received iso/ts-16949:2002 certification for its worldwide headquarters, design and wafer fabrication facilities in chandler and tempe, arizona; gresham, oregon and design centers in california and india. the company?s quality system processes and procedures are for its pic ? mcus and dspic ? dscs, k ee l oq ? code hopping devices, serial eeproms, microperi pherals, nonvolatile memory and analog products. in addition, microchip?s quality system for the design and manufacture of development systems is iso 9001:2000 certified.
ds41099d-page 52 ? 2011 microchip technology inc. americas corporate office 2355 west chandler blvd. chandler, az 85224-6199 tel: 480-792-7200 fax: 480-792-7277 technical support: http://www.microchip.com/ support web address: www.microchip.com atlanta duluth, ga tel: 678-957-9614 fax: 678-957-1455 boston westborough, ma tel: 774-760-0087 fax: 774-760-0088 chicago itasca, il tel: 630-285-0071 fax: 630-285-0075 cleveland independence, oh tel: 216-447-0464 fax: 216-447-0643 dallas addison, tx tel: 972-818-7423 fax: 972-818-2924 detroit farmington hills, mi tel: 248-538-2250 fax: 248-538-2260 indianapolis noblesville, in tel: 317-773-8323 fax: 317-773-5453 los angeles mission viejo, ca tel: 949-462-9523 fax: 949-462-9608 santa clara santa clara, ca tel: 408-961-6444 fax: 408-961-6445 toronto mississauga, ontario, canada tel: 905-673-0699 fax: 905-673-6509 asia/pacific asia pacific office suites 3707-14, 37th floor tower 6, the gateway harbour city, kowloon hong kong tel: 852-2401-1200 fax: 852-2401-3431 australia - sydney tel: 61-2-9868-6733 fax: 61-2-9868-6755 china - beijing tel: 86-10-8569-7000 fax: 86-10-8528-2104 china - chengdu tel: 86-28-8665-5511 fax: 86-28-8665-7889 china - chongqing tel: 86-23-8980-9588 fax: 86-23-8980-9500 china - hangzhou tel: 86-571-2819-3180 fax: 86-571-2819-3189 china - hong kong sar tel: 852-2401-1200 fax: 852-2401-3431 china - nanjing tel: 86-25-8473-2460 fax: 86-25-8473-2470 china - qingdao tel: 86-532-8502-7355 fax: 86-532-8502-7205 china - shanghai tel: 86-21-5407-5533 fax: 86-21-5407-5066 china - shenyang tel: 86-24-2334-2829 fax: 86-24-2334-2393 china - shenzhen tel: 86-755-8203-2660 fax: 86-755-8203-1760 china - wuhan tel: 86-27-5980-5300 fax: 86-27-5980-5118 china - xian tel: 86-29-8833-7252 fax: 86-29-8833-7256 china - xiamen tel: 86-592-2388138 fax: 86-592-2388130 china - zhuhai tel: 86-756-3210040 fax: 86-756-3210049 asia/pacific india - bangalore tel: 91-80-3090-4444 fax: 91-80-3090-4123 india - new delhi tel: 91-11-4160-8631 fax: 91-11-4160-8632 india - pune tel: 91-20-2566-1512 fax: 91-20-2566-1513 japan - yokohama tel: 81-45-471- 6166 fax: 81-45-471-6122 korea - daegu tel: 82-53-744-4301 fax: 82-53-744-4302 korea - seoul tel: 82-2-554-7200 fax: 82-2-558-5932 or 82-2-558-5934 malaysia - kuala lumpur tel: 60-3-6201-9857 fax: 60-3-6201-9859 malaysia - penang tel: 60-4-227-8870 fax: 60-4-227-4068 philippines - manila tel: 63-2-634-9065 fax: 63-2-634-9069 singapore tel: 65-6334-8870 fax: 65-6334-8850 taiwan - hsin chu tel: 886-3-6578-300 fax: 886-3-6578-370 taiwan - kaohsiung tel: 886-7-213-7830 fax: 886-7-330-9305 taiwan - taipei tel: 886-2-2500-6610 fax: 886-2-2508-0102 thailand - bangkok tel: 66-2-694-1351 fax: 66-2-694-1350 europe austria - wels tel: 43-7242-2244-39 fax: 43-7242-2244-393 denmark - copenhagen tel: 45-4450-2828 fax: 45-4485-2829 france - paris tel: 33-1-69-53-63-20 fax: 33-1-69-30-90-79 germany - munich tel: 49-89-627-144-0 fax: 49-89-627-144-44 italy - milan tel: 39-0331-742611 fax: 39-0331-466781 netherlands - drunen tel: 31-416-690399 fax: 31-416-690340 spain - madrid tel: 34-91-708-08-90 fax: 34-91-708-08-91 uk - wokingham tel: 44-118-921-5869 fax: 44-118-921-5820 worldwide sales and service 05/02/11

▲Up To Search▲

Price & Availability of HCS412

	To Download HCS412 Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .