2002 Microchip Technology Inc.

Preliminary

DS41099C-page 1

FEATURES

Security

· Programmable 64-bit encoder crypt key

· Two 64-bit IFF keys

· Keys are read protected

· 32-bit bi-directional challenge and response using

one of two possible keys

· 69-bit transmission length

· 32-bit hopping code,

· 37-bit nonencrypted portion

· Programmable 28/32-bit serial number

· 60-bit, read protected seed for secure learning

· Two IFF encryption algorithms

· Delayed counter increment mechanism

· Asynchronous transponder communication

· Transmissions include button Queuing

information

Operating

· 2.0V to 6.3V operation

· Three switch inputs: S2, S1, S0 seven functions

· Battery-less bi-directional transponder capability

· Selectable baud rate and code word blanking

· Automatic code word completion

· Battery low detector

· PWM or Manchester data encoding

· Combined transmitter, transponder operation

· Anticollision of multiple transponders

· Passive proximity activation

· Device protected against reverse battery

· Intelligent damping for high Q LC-circuits

· 100 mV

sensitive LC input

Typical Applications

· Automotive remote entry systems

· Automotive alarm systems

· Automotive immobilizers

· Gate and garage openers

· Electronic door locks (Home/Office/Hotel)

· Burglar alarm systems

· Proximity access control

PACKAGE TYPES

BLOCK DIAGRAM

Other

· Simple programming interface

· On-chip tunable RC oscillator, ± 10%

· On-chip EEPROM

· 64-bit user EEPROM in Transponder mode

· Battery-low LED indication

· Serialized Quick Turn Programming (SQTP

)

· 8-pin PDIP/SOIC

· RF Enable output

· ASK and FSK PLL interface option

· Built in LC input amplifier

HCS4

S2/RFEN/LC1

LC0

LED

DATA

GND

PDIP, SOIC

Oscillator

Configuration Register

Power

Control

Wake-up

Logic

Address

Decoding

EEPROM

Debounce

Control

and

Queuer

LED

Control

DATA
Driver

PPM

Detector

DATA

PPM

Manch.

Encoder

r
ans

pond

i
tr

r
o

l Logic

d C

ounter

Encr

yption/I

ent

S0
S1

LED

LC0

DATA

RFEN/S2/LC1

HCS412

Code Hopping Encoder and Transponder

HCS412

DS41099C-page 2

Preliminary

2002 Microchip Technology Inc.

GENERAL DESCRIPTION

The HCS412 combines patented K

code hop-

ping technology with bi-directional transponder chal-
lenge-and-response security into a single chip solution
for logical and physical access control.

When used as a code hopping encoder, the HCS412 is
ideally suited to keyless entry systems; vehicle and
garage door access in particular. The same HCS412
can also be used as a secure bi-directional transponder
for contactless token verification. These capabilities
make the HCS412 ideal for combined secure access
control and identification applications, dramatically
reducing the cost of hybrid transmitter/transponder
solutions.

1.0

SYSTEM OVERVIEW

Key Terms

The following is a list of key terms used throughout this
data sheet. For additional information on terminology,
please refer to the K

introductory Technical Brief

(TB003).

· RKE - Remote Keyless Entry.

· PKE - Passive Keyless Entry.

· Button Status - Indicates what transponder but-

ton input(s) activated the transmission. Encom-
passes the 4 button status bits LC0, S2, S1 and
S0 (Figure 3-2).

· Code Hopping - A method by which a code,

viewed externally to the system, appears to
change unpredictably each time it is transmitted
(Section 1.1.3).

· Code word - A block of data that is repeatedly

transmitted upon button activation (Section 3.2).

· Transmission - A data stream consisting of

repeating code words.

· Crypt key - A unique and secret 64-bit number

used to encrypt and decrypt data. In a symmetri-
cal block cipher such as the K

algorithm,

the encryption and decryption keys are equal and
will therefore be referred to generally as the crypt
key.

· Encoder - A device that generates and encodes

data.

· Encryption Algorithm - A recipe whereby data is

scrambled using a crypt key. The data can only be
interpreted by the respective decryption algorithm
using the same crypt key.

· Decoder - A device that decodes data received

from an encoder.

· Transponder Reader (Reader, for short) - A

device that authenticates a token using bi-direc-
tional communication.

· Decryption algorithm - A recipe whereby data

scrambled by an encryption algorithm can be
unscrambled using the same crypt key.

· Learn Learning involves the receiver calculating

the transmitter's appropriate crypt key, decrypting
the received hopping code and storing the serial
number, synchronization counter value and crypt
key in EEPROM (Section 6.1). The K

prod-

uct family facilitates several learning strategies to
be implemented on the decoder. The following are
examples of what can be done.

- Simple Learning

The receiver uses a fixed crypt key, common
to all components of all systems by the same
manufacturer, to decrypt the received code
word's encrypted portion.

- Normal Learning

The receiver uses information transmitted
during normal operation to derive the crypt
key and decrypt the received code word's
encrypted portion.

- Secure Learn

The transmitter is activated through a special
button combination to transmit a stored 60-bit
seed value used to generate the transmitter's
crypt key. The receiver uses this seed value
to derive the same crypt key and decrypt the
received code word's encrypted portion.

· Manufacturer's code - A unique and secret 64-

bit number used to generate unique encoder crypt
keys. Each encoder is programmed with a crypt
key that is a function of the manufacturer's code.
Each decoder is programmed with the manufac-
turer code itself.

· Anticollision - A scheme whereby transponders

in the same field can be addressed individually
preventing simultaneous response to a command
(Section 4.3.1).

· IFF - Identify Friend or Foe (Section 1.2).

· Proximity Activation - A method whereby an

encoder automatically initiates a transmission in
response to detecting an inductive field
(Section 4.4.1).

· Transport code - An access code, `password'

known only by the manufacturer, allowing pro-
gram access to certain secure device memory
areas (Section 4.3.3).

· AGC - Automatic Gain Control.

2002 Microchip Technology Inc.

Preliminary

DS41099C-page 3

HCS412

1.1

Encoder Overview

The HCS412 code hopping transcoder is designed
specifically for passive entry systems; primarily vehicle
access. The transcoder portion of a passive entry sys-
tem is integrated into a transmitter, carried by the user
and operated to gain access to a vehicle or restricted
area. The HCS412 is meant to be a cost-effective yet
secure solution to such systems, requiring very few
external components (Figure 2-6).

1.1.1

LOW-END SYSTEM SECURITY RISKS

Most low-end keyless entry transmitters are given a
fixed identification code that is transmitted every time a
button is pushed. The number of unique identification
codes in a low-end system is usually a relatively small
number. These shortcomings provide an opportunity
for a sophisticated thief to create a device that `grabs'
a transmission and retransmits it later, or a device that
quickly `scans' all possible identification codes until the
correct one is found.

1.1.2

HCS412 SECURITY

The HCS412, on the other hand, employs the K

code hopping technology coupled with a transmission
length of 69 bits to virtually eliminate the use of code

`grabbing' or code `scanning'. The high security level of
the HCS412 is based on the patented K

technol-

ogy. A block cipher based on a block length of 32 bits
and a key length of 64 bits is used. The algorithm
obscures the information in such a way that even if the
transmission information (before coding) differs by only
one bit from that of the previous transmission, statisti-
cally greater than 50 percent of the next transmission's
encrypted bits will change.

1.1.3

HCS412 HOPPING CODE

The 16-bit synchronization counter is the basis behind
the transmitted code word changing for each transmis-
sion; it increments each time a button is pressed.

Once the device detects a button press, it reads the
button inputs and updates the synchronization counter.
The synchronization counter and crypt key are input to
the encryption algorithm and the output is 32 bits of
encrypted information. This encrypted data will change
with every button press, its value appearing externally
to `randomly hop around', hence it is referred to as the
hopping portion of the code word. The 32-bit hopping
code is combined with the button information and serial
number to form the code word transmitted to the
receiver. The code word format is explained in greater
detail in Section 3.2.

FIGURE 1-1:

BUILDING THE TRANSMITTED CODE WORD (ENCODER)

1.2

Identify Friend or Foe (IFF) Overview

Validation of a token first involves an authentication
device sending a random challenge to the token. The
token then replies with a calculated response that is a
function of the received challenge and the stored crypt
key. The authentication device, transponder reader,
performs the same calculation and compares it to the
token's response. If they match, the token is identified
as valid and the transponder reader can take appropri-
ate action.

The HCS412's 32-bit IFF response is generated using
one of two possible encryption algorithms and one of
two possible crypt keys; four combinations total. The
authenticating device precedes the challenge with a
five bit command word dictating which algorithm and
key to use in calculating the response.

The bi-directional communication path required for IFF
is typically inductive for short range (<10cm) transpon-
der applications and an inductive challenge, RF
response for longer range (~1.5m) passive entry appli-
cations.

Button Press

Information

EEPROM Array

32 Bits of

Encrypted Data

Serial Number

Transmitted Information

Crypt Key

Sync Counter

Serial Number

Encryption

Algorithm

HCS412

DS41099C-page 4

Preliminary

2002 Microchip Technology Inc.

2.0

DEVICE DESCRIPTION

2.1

Pinout Description

The HCS412's footprint is identical to other encoders in
the K

family, except for the two pins reserved for

low frequency communication.

TABLE 2-1:

PINOUT SUMMARY

FIGURE 2-1:

S0/S1 PIN DIAGRAM

FIGURE 2-2:

S2/RFEN/LC1 PIN DIAGRAM

FIGURE 2-3:

LC0 PIN DIAGRAM

Pin

Name

Pin

Number

Description

Button input pin with Schmitt Trigger detector and internal 60 k

(nominal) pull-down

resistor (Figure 2-1).

Button input pin with Schmitt Trigger detector and internal 60 k

(nominal) pull-down

resistor (Figure 2-1).

S2/RFEN/LC1

Multi-purpose input / output pin (Figure 2-2).

· Button input pin with Schmitt Trigger detector and internal pull-down resistor.

· RFEN output driver.

· LC1 low frequency (LF) antenna output driver for inductive responses and LC bias.

· Programming clock signal input.

LC0

Low frequency (LF) antenna input with automatic gain control for inductive reception and
low frequency output driver for inductive responses (Figure 2-3).

GND

Ground reference.

DATA

Transmission data output driver. Programming input / output data signal (Figure 2-4).

LED

LED output driver (Figure 2-5).

Positive supply voltage.

60 k

SWITCH

S0
S1

10V

100

VBIAS

SWITCH 2

INPUT

S2LC OPTION

LC
OUTPUT

RFEN

OUT

RECTIFIER AND

REGULATOR

10V

100

LC
INPUT

LC
OUTPUT

S2LC OPTION

AMP

DET

AND

LC0

HCS412

DS41099C-page 6

Preliminary

2002 Microchip Technology Inc.

2.2

Architecture Overview

2.2.1

WAKE-UP LOGIC AND POWER
DISTRIBUTION

The HCS412 automatically goes into a low-power
Standby mode once connected to the supply voltage.
Power is supplied to the minimum circuitry required to
detect a wake-up condition; button activation or LC sig-
nal detection.

The HCS412 will wake from Low-power mode when a
button input is pulled high or a signal is detected on the
LC0 LF antenna input pin. Waking involves powering
the main logic circuitry that controls device operation.
The button and transponder inputs are then sampled to
determine which input activated the device.

A button input activation places the device into Encoder
mode. A signal detected on the transponder input
places the device into Transponder mode. Encoder
mode has priority over Transponder mode so a signal
on the transponder input would be ignored if it occurred
simultaneously to a button activation; ignored until the
button input is released.

2.2.2

CONTROL LOGIC

A dedicated state machine, timer and a 32-bit shift reg-
ister perform the control, timing and data manipulation
in the HCS412. This includes the data encryption, data
output modulation and reading of and writing to the
onboard EEPROM.

2.2.3

EEPROM

The HCS412 contains nonvolatile EEPROM to store
configuration options, user data and the synchroniza-
tion counter.

The configuration options are programmed during pro-
duction and include the read protected security-related
information such as crypt keys, serial number and dis-
crimination value (Table 7-2).

The 64 bits (4x16-bit words) of user EEPROM are read/
write accessible through the low frequency communi-
cation path as well as in-circuit, wire programmable
during production.

The initial synchronization counter value is pro-
grammed during production. The counter is imple-
mented in Grey code and updated using bit writes to
minimize EEPROM writing over the life of the product.
The user need not worry about counter format conver-
sion as the transmitted counter value is in binary for-
mat.

Counter corruption is protected for by the use of a
semaphore word as well as by the internal circuitry
ensuring the EEPROM write voltage is at an accept-
able level prior to each write.

The EEPROM is programmed during production by
clocking (S2 pin) the data into the DATA pin
(Section 7.0). Certain EEPROM locations can also be
remotely read/written through the LF communication
path (Section 4.3).

2.2.4

CONFIGURATION REGISTER

The first activation after connecting power to the
HCS412, the device retrieves the configuration from
EEPROM storage and buffers the information in a con-
figuration register. The configuration register then dic-
tates various device operation options including the RC
oscillator tuning, the S2/RFEN/LC1 pin configuration,
low voltage trip point, modulation format,...

2.2.5

ONBOARD RC OSCILLATOR AND
OSCILLATOR TUNE VALUE (OSCT)

The HCS412 has an onboard RC oscillator. As the RC
oscillator is susceptible to variations in process param-
eters, temperature and operating voltage, oscillator
tuning is provided for more accurate timing character-
istics.

The 4-bit Oscillator Tune Value (OSCT) (Table 2-2)
allows tuning within ±4% of the optimal oscillator speed
at the voltage and temperature used when tuning the
device. A properly tuned oscillator is then accurate over
temperature and voltage variations to within ±10% of
the tuned value.

Oscillator speed is significantly affected by changes in
the device supply voltage. It is therefore best to tune
the HCS412 such that the variance in oscillator speed
be symmetrical about an operating mid-point
(Figure 2-7). ie...

· If the design is to run on a single lithium battery,

tune the oscillator while supplying the HCS412
with ~2.5V (middle of the 3V to 2V usable battery
life).

· If the design is to run on two lithium batteries, tune

the oscillator while supplying the HCS412 with
~4V (middle of 6V to 2V battery life).

· If the design is to run on 5V, tune the oscillator

while supplying the HCS412 with 5V.

Say the HCS412's oscillator is tuned to be optimal at a
6V supply voltage but the device will operate on a sin-
gle lithium battery. The resulting oscillator variance
over temperature and voltage will not be ±4% but will
be more like -7% to -15%.

Programming using a supply voltage other than 5V
may not be practical. In these cases, adjust the oscilla-
tor tune value such that the device will run optimally at
the target voltage. (i.e., If programming using 5V a
device that will run at 3V, program the device to run
slow at 5V such that it will run optimally at 3V).

2002 Microchip Technology Inc.

Preliminary

DS41099C-page 7

HCS412

TABLE 2-2:

OSCILLATOR CALIBRATION
VALUE (OSCT)

FIGURE 2-7:

HCS412 NORMALIZED RF

VERSUS TEMP

2.2.6

LOW VOLTAGE DETECTOR

The HCS412's battery voltage detector detects when
the supply voltage drops below a predetermined value.
The value is selected by the Low Voltage Trip Point
Select (VLOWSEL) configuration option.

The low voltage detector result is included in encoder
transmissions (VLOW) allowing the receiver to indicate
when the transmitter battery is low (Figure 3-2).

The HCS412 indicates a low battery condition by
changing the LED operation (Figure 3-9).

FIGURE 2-8:

TYPICAL VOLTAGE TRIP
POINTS

TABLE 2-3:

VLOWSEL OPTIONS

TABLE 2-4:

VLOW STATUS BIT

2.2.7

THE S2/RFEN/LC1 PIN

The S2/RFEN/LC1 pin may be used as a button input,
RF enable output or as an interface to the LF antenna.
Select between LC1 antenna interface and S2/RFEN
functionality with the button/transponder select (S2LC)
configuration option (Table 2-2).

2.2.7.1

S2 BUTTON INPUT CONSIDERATIONS

The S2/RFEN/LC1 pin defaults to LF antenna output
LC1 when the HCS412 is first connected to the supply
voltage (i.e., battery replacement).

The configuration register controlling the pin's function
is loaded on the first device activation after battery
replacement. A desired S2 input state is therefore
enabled only after the first activation of either S0, S1 or
LC0. The transponder bias circuitry switches off and
the internal pull-down resistor is enabled when the S2/
RFEN/LC1 pin reaches button input configuration.

There will be an extra delay the first activation after
connecting to the supply voltage while the HCS412
retrieves the configuration word and configures the
pins accordingly.

OSCT3:0

Description

0111b

Slowest Oscillator Setting (long T

)

0011b

0010b

0001b

Slower (longer T

)

0000b

Nominal Setting

1111b

1110b

1101b

Faster (shorter T

)

1000b

Fastest Oscillator Setting (short T

)

0.94

1.10

1.08

1.06

1.04

1.02

1.00

0.98

0.96

0.92

0.90

LEGEND

= 2.0V
= 3.0V
= 6.0V

NORMALIZED

Temperature °C

-50 -40 -30 -20 -10 0

10 20 30 40 50 60 70 80 90

Note:

Values are for calibrated oscillator.

VLOWSEL

Nominal

Trip

Point

Description

2.2V

for 3V battery applications

4.4V

for 6V battery applications

VLOW

Description

is above selected trip voltage

is below selected trip voltage

LOW

Volts (V)

-40

2.0

1.6

1.8

2.2

2.4

2.6

Temp (°C)

LOW

sel = 0

4.4

4.0

4.2

3.8

4.6

4.8

5.0

LOW

sel = 1

2.8

Nominal V

LOW

trip point

HCS412

DS41099C-page 8

Preliminary

2002 Microchip Technology Inc.

2.2.7.2

TRANSPONDER INTERFACE

Connecting an LC resonant circuit between the LC0
and the LC1 pins creates the bi-directional low fre-
quency communication path with the HCS412.

The internal circuitry on the HCS412 provides the fol-
lowing functions:

· LF input amplifier and envelope detector to detect

and shape the incoming low frequency excitation
signal.

· 10V zener input protection from excessive

antenna voltage generated when proximate to
very strong magnetic fields.

· LF antenna clamping transistors for inductive

responses back to the transponder reader. The
antenna ends are shorted together, `clamped',
dissipating the oscillatory energy. The reader
detects this as a momentary load on its excitation
antenna.

· Damping circuitry that improves communication

when using high-Q LC antenna circuits.

· Incoming LF energy rectification and regulation

for the supply voltage in battery-less or low bat-
tery transponder instances.

During normal transponder operation, the LC1 pin func-
tions to bias the LC0 AGC amplifier input. The amplifier
gain control sets the optimum level of amplification in
respect to the incoming signal strength. The signal then
passes through an envelope detector before interpreta-
tion in the logic circuit.

2.2.7.3

RF ENABLE OUTPUT

When the RF enable (RFEN) configuration option is
enabled, the RFEN signal output is coordinated with
the DATA output pin to provide typical ASK or FSK PLL
activation.

TABLE 2-1:

RFEN OPTION

TABLE 2-2:

S2/RFEN/LC1 CONFIGURATION OPTION

3.0

ENCODER OPERATION

3.1

Encoder Activation

3.1.1

BUTTON ACTIVATION

The main way to enter Encoder mode is when the
wake-up circuit detects a button input activation; button
input transition from GND to V

. The HCS412 control

logic wakes and delays a switch debounce time prior to
sampling the button inputs. The button input states,
cumulatively called the button status, determine
whether the HCS412 transmits a code hopping or seed
transmission, Table 3-1.

Additional button activations added during a transmis-
sion will immediately RESET the HCS412, perhaps
leaving the current code word incomplete. The device
will start a new transmission which includes the
updated button code value.

Buttons removed during a transmission will have no
effect unless no buttons remain activated. If no button
activations remain, the minimum number of compete
code words will be completed (Section 3.4.1) and the
device will return to Standby mode.

3.1.2

PROXIMITY ACTIVATION

The other way to enter Encoder mode is if the S2/LC
option is configured for LC operation and the wake-up
circuit detects a signal on the LC0 LF antenna input pin.
This form of activation is called Proximity activation as
a code hopping transmission would be initiated when
the device was proximate to a LF field.

Refer to Section 4.4 for details on configuring the
HCS412 for Proximity Activation.

RFEN

Description

RF Enable output is disabled.

RF Enable output is enabled.

S2LC

Resulting S2/RFEN/LC1 Configuration

· LC1 low frequency antenna output driver for inductive responses and LC bias.

Note: LC0 low frequency antenna input is also enabled.

· S2 button input pin with Schmitt Trigger detector and internal pull-down resistor.

· RFEN output driver.

Note: LC0 and LC1 low frequency antenna interfaces are disabled and the transponder circuitry is

switched off to reduce standby current.

2002 Microchip Technology Inc.

Preliminary

DS41099C-page 9

HCS412

TABLE 3-1:

ENCODER MODE ACTIVATION

3.2

Transmitted Code Word

The HCS412 transmits a 69-bit code word in response
to a button or proximity activation (Figure 3-1). Each
code word contains a 50% duty cycle preamble,
header, 32 bits of encrypted data and 37 bits of fixed
code data followed by a guard period before another
code word can begin.

The 32 bits of Encrypted Data include 4 button bits, 2
counter overflow bits, 10 discrimination bits and the 16-
bit synchronization counter value (Figure 3-2).

The content of the 37 bits of Fixed Code Data varies
with the extended serial number (XSER) option
(Figure 3-2).

· If the extended serial number option is disabled

(XSER = 0), the 37 bits include 5 status bits, 4
button status bits and the 28-bit serial number.

· If the extended serial number option is enabled

(XSER = 1), the 37 bits include 5 status bits and
the 32-bit serial number.

FIGURE 3-1:

CODE WORD FORMAT

4-Bit Button Status

SEED

TMPSD

Resulting Transmission

LC0

(Note 1)

Code hopping transmission

Code hopping code words until time = T

DSD

, then seed code words.

SEED transmissions temporarily enabled until the 7lsb's of the synchro-
nization counter wrap 7Fh to 00h. Then only code hopping code words.

Code hopping code words until time = T

DSD

, then seed code words.

Code hopping transmission (2 key IFF enabled)

Code hopping transmission

Limited SEED transmissions - temporarily enabled until the 7lsb's of the
synchronization counter wrap 7Fh to 00h.

SEED transmission

Code hopping transmission (2 key IFF enabled)

Proximity activated code hopping transmission.

Note 1: The transmitted button status will reflect the state of the LC0 input when the button inputs are sampled.

Preamble

Header

Encrypted Portion
of Transmission

Fixed Portion of
Transmission

Guard

Time

HOP

FIX

50% Duty Cycle

HCS412

DS41099C-page 10

Preliminary

2002 Microchip Technology Inc.

FIGURE 3-2:

CODE WORD ORGANIZATION

3.2.1

QUEUE COUNTER (QUE)

The QUE counter can be used to request secondary
decoder functions using only a single transmitter but-
ton. Typically a decoder must keep track of incoming
transmissions to determine when a double button press
occurs, perhaps an unlock all doors request. The QUE
counter removes this burden from the decoder by
counting multiple button presses.

The 2-bit QUE counter is incremented each time an
active button input is released for at least the
Debounce Time (T

DBR

), then reactivated (button

pressed again) within the Queue Time (T

QUE

). The

counter increments up from 0 to a maximum of 3,
returning to 0 only after a different button activation or
after button activations spaced greater than the Queue
Time (T

QUE

) apart.

The current transmission aborts, after completing the
minimum number of code words (Section 3.4.1), when
the active button input is released. A button re-activa-
tion within Queue Time (T

QUE

) then initiates a new

transmission (new synchronization counter, encrypted
data) using the updated QUE value.

Figure 3-3 shows the timing diagram to increment the
queue counter value.

FIGURE 3-3:

QUE COUNTER TIMING DIAGRAM

LOW

1-Bit

Fixed Code Portion (37 Bits)

QUE

2 Bits

CRC

2 Bits

LOW

1-Bit

SER 1

Most Sig 16 Bits

SER 0

Least Sig 16 Bits

BUT

4 Bits

Counter

Overflow

2 Bits

DISCRIM

10 Bits

Synchronization

16 Bits

Counter

S0 LC0 OVR1

OVR0

Hopping Code Portion Message (32 Bits)

Q1 Q0 C1 C0

MSb

LSb

69 Data bits

Transmitted LSb first.

32-bit Serial Number (XSER = 1)

Fixed Code Portion (37 Bits)

QUE

2 Bits

CRC

2 Bits

BUT

4 Bits

S0 LC0

SER 0

Least Sig16 Bits

BUT

4 Bits

Counter

Overflow

2 Bits

DISCRIM

10 Bits

Synchronization

16 Bits

Counter

S0 LC0 OVR1

OVR0

Hopping Code Portion Message (32 Bits)

Q1 Q0 C1 C0

MSb

LSb

69 Data bits

Transmitted LSb first.

SER 1

12 MSb's

28-bit Serial Number (XSER = 0)

Shaded data included in CRC calculation

Input
Sx

Code Words
Transmitted

1st Button Press

All Buttons Released

2nd Button Press

QUE1:0 = 00

Synch CNT = X

QUE1:0 = 01

Synch CNT = X+1

= 0

> T

DBP

= 0

DBR

< t < T

QUE

2002 Microchip Technology Inc.

Preliminary

DS41099C-page 11

HCS412

3.2.2

CYCLE REDUNDANCY CHECK (CRC)

The CRC bits may be used to check the received data
integrity, but it is not recommended when operating
near the low voltage trip point, see Note below.

The CRC is calculated on the 65 previously transmitted
bits (Figure 3-2), detecting all single bit and 66% of all
double bit errors.

EQUATION 3-1:

CRC CALCULATION

3.2.3

LOW VOLTAGE DETECTOR STATUS
(VLOW)

The low voltage detector result is included in every
transmitted code word.

The HCS412 samples the voltage detector output at
the onset of a transmission and just before the VLOW
bit is transmitted in each code word. The first sample is
used in the CRC calculation and the subsequent sam-
ples determine what VLOW value will be transmitted.

The transmitted VLOW status will be a `0' as long as
V

remains above the selected low voltage trip point.

VLOW will change to a `1' if V

drops below the

selected low voltage trip point.

TABLE 3-2:

LOW VOLTAGE STATUS BIT

TABLE 3-3:

LOW VOLTAGE TRIP POINT
SELECTION OPTIONS

3.2.4

COUNTER OVERFLOW BITS (OVR1,
OVR0)

The Counter Overflow Bits may be utilized to increase
the synchronization counter range from the nominal
65,535 to 131,070 or 196,605.

The bits must be programmed during production as `1's
to be utilized. OVR0 is cleared the first time the syn-
chronization counter wraps from FFFFh to 0000h.
OVR1 is cleared the second time the synchronization
counter wraps to zero. The two bits remain at `0' after
all subsequent counter wraps.

3.2.5

EXTENDED SERIAL NUMBER (XSER)

The Extended Serial Number option determines
whether the serial number is 28 or 32 bits.

When configured for a 28-bit serial number, the most
significant nibble of the 32 bits reserved for the serial
number is replaced with a copy of the 4-bit button sta-
tus, Figure 3-2.

3.2.6

DISCRIMINATION VALUE (DISC)

The Discrimination Value is a 10-bit fixed value typi-
cally used by the decoder in a post-decryption check.
It may be any value, but in a typical system it will be
programmed as the 10 Least Significant bits of the
serial number.

The discrimination bits are part of the information that
form the encrypted portion of the transmission
(Figure 3-2). After the receiver has decrypted a trans-
mission, the discrimination bits are checked against
the receiver's stored value to verify that the decryption
process was valid. If the discrimination value was pro-
grammed equal to the 10 LSb's of the serial number
then it may merely be compared to the respective bits
of the received serial number.

3.2.7

SEED CODE WORD DATA FORMAT

The Seed Code Word transmission allows for what is
known as a secure learning function, increasing a sys-
tem's security.

The seed code word also consists of 69 bits, but the 32
bits of code hopping data and the 28 bits of fixed data
are replaced by a 60-bit seed value that was stored
during production (Figure 3-4). Instead of using the
normal key generation inputs to create the crypt key,
this seed value is used.

Seed transmissions are either:

· permanently enabled

· permanently disabled

· temporarily enabled (limited) until the 7 Least Sig-

nificant bits of the synchronization counter wrap
from 7Fh to 00h.

The Seed Enable (SEED) and Temporary Seed Enable
(TMPSD) configuration options control the function
(Table 3-4).

Note: The CRC may be wrong when the operat-

ing voltage is near V

LOW

trip point. V

LOW

sampled twice each transmission, once for
the CRC calculation (DATA output is LOW)
and once when the V

LOW

bit is transmitted

(DATA output is HIGH). V

varying slightly

during a transmission could lead to a differ-
ent V

LOW

status transmitted than that used

in the CRC calculation.
Work around: If the CRC is incorrect,
recalculate for the opposite value of V

LOW

VLOW

Description

is above trip voltage (VLOWSEL)

is below trip voltage (VLOWSEL)

VLOWSEL

Nominal

Trip

Point

Description

2.2V

for 3V battery applications

4.4V

for 6V battery applications

CRC 1

[ ]

CRC 0

[ ]

CRC 0

[ ]

CRC 0

[ ]

(

)

CRC 1

[ ]

CRC 1 0

[

]

and

with

and Di

the nth transmission bit 0

HCS412

DS41099C-page 12

Preliminary

2002 Microchip Technology Inc.

FIGURE 3-4:

SEED CODE WORD DATA FORMAT

TABLE 3-4:

SEED TRANSMISSION OPTIONS

3.3

Transmission Data Modulation

The data modulation format is selectable between
Pulse Width Modulation (PWM) and Manchester using
the Data Modulation (MOD) configuration option.

Regardless of the modulation format, each code word
contains a leading 50% duty cycle preamble and a syn-
chronization header to wake the receiver and provide
synchronization events for the receive routine. Each
code word also contains a trailing guard time, separat-
ing code words. Manchester encoding further includes
a leading and closing `1' around each 69-bit data block.

The same code word repeats as long as the same input
pins remain active, until a time-out occurs or a delayed
seed transmission is activated.

The modulated data timing is typically referred to in
multiples of a Basic Timing Element (RFT

). `RF' T

because the DATA pin output is typically sent through a
RF transmitter to the decoder or transponder reader.

RFT

may be selected using the Transmission Baud

Rate (RFBSL) configuration option (Table 3-6).

TABLE 3-5:

TRANSMISSION
MODULATION TIMING

* Enabling long preambles extends the first code

word's preamble to T

LPRE

milliseconds.

TABLE 3-6:

BAUD RATE SELECTION (RFBSL)

SEED

TMPSD

Description

SEED transmissions permanently disabled

Limited SEED transmissions (Note 1) - temporarily enabled until the

7 LSb's of the synchronization counter wrap from 7Fh to 00h

SEED transmissions permanently enabled (Note 1)

SEED transmissions permanently disabled (2 key IFF enabled)

Note 1: Refer to Table 3-1 for appropriate button activation of SEED transmissions.

QUE

2 Bits

CRC

2 Bits

LOW

1-Bit

BUT

4 Bits

SDVAL3

12 Most Sig Bits

S2 S1 S0 LC0

Note: SEED transmissions only allowed when appropriate configuration bits are set.

SDVAL2

16 Bits

SDVAL1

16 Bits

SDVAL0

16 Least Sig Bits

Q1 Q0 C1 C0

LSb

69 Data bits

Transmitted

LSb first.

MSb

Shaded data included in CRC calculation

Period

PWM

Manchester

Units

Preamble

31*

RFT

Header

RFT

Data

207

142

RFT

Guard

RFT

RFBSL1:0

CWBE

PWM RFT

Manchester RFT

Transmit...

00b

400

800

All code words

01b

200

400

All code words

200

400

Every other code word

10b

100

200

All code words

100

200

Every other code word

11b

100

200

All code word

100

200

Every fourth code word

2002 Microchip Technology Inc.

Preliminary

DS41099C-page 13

HCS412

FIGURE 3-5:

PWM TRANSMISSION FORMAT--MOD = 0

FIGURE 3-6:

MANCHESTER TRANSMISSION FORMAT--MOD = 1

3.4

Encoder Special Features

3.4.1

CODE WORD COMPLETION AND
MINIMUM CODE WORDS

The code word completion feature ensures that entire
code words are transmitted, even if the active button is
released before the code word transmission is com-
plete. If the button is held down beyond the time for one
code word, multiple complete code words will result.

The device default is that a momentary button press
will transmit at least one complete code word. Enable
the Minimum Four Code Words (MTX4) configuration
option to extend this feature such that a minimum of 4
code words are completed on a momentary button acti-
vation.

3.4.2

AUTO-SHUTOFF

The Auto-shutoff function prevents battery drain should
a button get stuck for a long period of time. The time
period (T

) is approximately 20 seconds, after which

the device will enter Time-out mode.

The device will stop transmitting in Time-out mode but
there will be leakage across the stuck button input's
internal pull-down resistor. The current draw will there-
fore be higher than when in Standby mode.

3.4.3

CODE WORD BLANKING ENABLE

Federal Communications Commission (FCC) part 15
rules specify the limits on worst case average funda-
mental power and harmonics that can be transmitted in
a 100 ms window. For FCC approval purposes, it may
therefore be advantageous to minimize the transmis-
sion duty cycle. This can be achieved by minimizing the
on-time of the individual bits as well as by blanking out
consecutive code words.

TOTAL TRANSMISSION:

Preamble Sync Encrypt

Fixed

Guard

1 CODE WORD

Preamble Sync

Encrypt

LOGIC "1"

Guard

Time

31 RFT

Preamble, 50% Duty Cycle

Encrypted

Portion

Fixed Code

Portion

LOGIC "0"

10T

Header

CODE WORD

Long Preamble (LPRE) disabled

TOTAL TRANSMISSION:

Sync

Encrypt

Fixed

Guard

1 CODE WORD

Preamble

Sync

Encrypt

Preamble

CODE WORD

Guard

50% Duty

Header

Encrypted

Fixed Code

START bit

STOP bit

Time

Portion

bit 0 bit 1 bit 2

LOGIC "0"

LOGIC "1"

Preamble

HCS412

DS41099C-page 14

Preliminary

2002 Microchip Technology Inc.

The Code Word Blanking Enable (CWBE) option may
be used to reduce the average power of a transmission
by transmitting only every second or every fourth code
word (Figure 3-7). This selectable feature is
determined in conjunction with the baud rate selection
bit RFBSL (Table 3-7).

Enabling the CWBE option may similarly allow the user
to transmit a higher amplitude transmission as the time
averaged power is reduced. CWBE effectively halves
the RF on-time for a given transmission so the RF out-
put power could theoretically be doubled while main-
taining the same time averaged output power.

FIGURE 3-7:

CODE WORD BLANKING

TABLE 3-7:

CODE WORD BLANKING ENABLE (CWBE)

3.4.4

DELAYED INCREMENT (DINC)

The HCS412's Delayed Increment feature advances
the synchronization counter by 12 a period of T

after

the encoder activation occurs, for additional security.
The next activation will show a synchronization counter
increase of 13, not 1.

If the active button is released before the time-out T

has elapsed, the device stops transmitting but remains
powered for the duration of the time-out period. The
device will then advance the stored synchronization
counter by 12 before powering down.

If the active button is released before the time-out T

has elapsed and another activation occurs while wait-
ing out the time-out period, the time-out counter will
RESET and the resulting transmission will contain syn-
chronization counter value +1.

3.4.5

PLL INTERFACE

If the RFEN/S2/LC1 pin is configured as an RF enable
output, the pin's behavior is coordinated with the DATA
pin to enable a typical PLL's ASK or FSK mode.

The PLL Interface (AFSK) configuration option controls
the output as shown in Figure 3-8.

TABLE 3-8:

PLL INTERFACE(AFSK)

3.4.6

LED OUTPUT

During normal operation (good battery), while transmit-
ting data the device's LED pin will periodically be driven
low as indicated in Figure 3-9.

If the supply voltage drops below the trip point specified
by VLDWSEL, the LED pin will be driven low only once
for a longer period of time.

3.4.7

LONG PREAMBLE (LPRE)

Enabling the Long Preamble configuration option
extends the first code word's 50% duty cycle preamble
to a `long' preamble time T

LPRE

. The longer preamble

will be a square wave at the selected RFT

(Figure 3-10).

RFBSL1:0

CWBE

PWM RFT

Manchester RFT

Transmit...

00b

400

800

All code words

01b

200

400

All code words

200

400

Every other code word

10b

100

200

All code words

100

200

Every other code word

11b

100

200

All code word

100

200

Every fourth code word

CWBE Disabled

(All words transmitted)

CWBE Enabled

(1 out of 2 transmitted)

RF Output Amplitude = A

CWBE Enabled

(1 out of 4 transmitted)

Code

Word

Code

Word

Code
Word

Code

Word

Code
Word

Code

Word

Code

Word

Code

Word

Code

Word

Code

Word

Code

Word

Code

Word

Code

Word

Note: If delayed increment is enabled, the QUE

counter will not reset to 0 until timeout T

has elapsed.

AFSK

Description

ASK PLL Setup

FSK PLL Setup

HCS412

DS41099C-page 16

Preliminary

2002 Microchip Technology Inc.

3.4.8

QLVS FEATURES

Setting the HCS412's special QLVS (`Quick Secure
Learning') configuration option enables the following
options:

· Reduces the time (T

DSD

) before a delayed seed

transmission begins.

· Disables DATA modulation when the LED pin is

driven low (Figure 3-11).

- If the PLL Interface option is set to ASK, the

DATA pin will go low while the LED pin is low.

- If the PLL Interface option is set to FSK, the

DATA pin will go high and the RFEN output
will go low while the LED pin is low. If the bat-
tery is low, the HCS412 transmits only until
the LED goes on.

· If the Temporary Seed (TMPSD) option is

enabled, seed transmission capability can be dis-
abled by applying the button sequence shown in
Figure 3-12

FIGURE 3-11: LED, DATA, RFEN INTERACTION WHEN QLVS IS SET

FIGURE 3-12: SEED DISABLE WAVEFORM

SWITCH

LED

DATA

S2/RFEN/LC1

DATA

S2/RFEN/LC1

LEDON

AFSK = 1 (FSK)

AFSK = 0 (ASK)

QLVS = 1, RFEN = 1

S0, S1

1200 ms

50 ms

2002 Microchip Technology Inc.

Preliminary

DS41099C-page 17

HCS412

TABLE 3-9:

ENCODER TIMING SPECIFICATIONS

= +2.0 to 6.6V

Commercial (C):T

AMB

= 0

C to +70

Industrial

(I): T

AMB

= -40

C to +85

Parameter

Symbol

Min.

Typ.

Max.

Unit

Remarks

Time to second button press

44 + Code

Word Time

58 + Code

Word Time

63 + Code

Word Time

Note 1

Transmit delay from button detect

Note 2

Debounce delay on button press

DBP

Debounce delay on button release

DBR

Auto-shutoff time-out period

Note 3

Long preamble

LPRE

LED on time

LEDON

Note 4

LED off time

LEDOFF

480

Note 4

LED on time (V

< V

LOW

Trip Point)

LEDL

200

Note 5

Time to delayed SEED
transmission

DSD

Queue Time

QUE

Note 1: T

is the time in which a second button can be pressed without completion of the first code word where the

intention was to press the combination of buttons.

2: Transmit delay maximum value, if the previous transmission was successfully transmitted.
3: The auto-shutoff time-out period is not tested.
4: The LED times specified for V

> V

TRIP

specified by V

LOW

in the configuration word.

5: LED on time if V

< V

TRIP

specified by V

LOW

in the configuration word.

HCS412

DS41099C-page 18

Preliminary

2002 Microchip Technology Inc.

4.0

TRANSPONDER OPERATION

4.1

IFF Mode

The HCS412's IFF Mode allows it to function as a bi-
directional token or transponder. IFF mode capabilities
include the following.

· A bi-directional challenge and response sequence

for IFF validation. HCS412 IFF responses may be
directed to use one of two available encryption
algorithms and one of two available crypt keys.

· Read selected EEPROM areas.

· Write selected EEPROM areas.

· Request a code hopping transmission.

· Proximity Activation of a code hopping transmis-

sion.

4.2

IFF Communication

The transponder reader initiates each communication
by turning on the low frequency field, then waits for a
HCS412 to Acknowledge the field.

The HCS412 enters IFF mode upon detecting a signal
on the LC0 LF antenna input pin. Once the incoming
signal has remained high for at least the power-up time
T

, the device responds with a field Acknowledge

sequence indicating that the it has detected the LF
field, is in IFF Mode and is ready to receive commands
(Figure 4-1). The HCS412 will repeat the field Acknowl-
edge sequence every 255 LF

`s if the field remains

but no command is received (Figure 4-1).

The transponder reader follows the HCS412's field
Acknowledge by sending the desired 5-bit command
and associated data. LF commands are always pre-
ceded by a 2 LF

low START pulse and are Pulse

Position Modulated (PPM) as shown in Figure 4-2. The
last command or data bit should be followed by leaving
the field on for a minimum of 6 LF

HCS412 PPM data responses are preceded by a 1
LF

low pulse, followed by a 01b preamble before the

data begins (Figure 4-4). The responses are sent either
on the LC antenna output alone or on both the LC out-
put and the DATA pin, depending on the device config-
uration (Section 4.4.2). This allows for short-range LF
responses as well as long-range RF responses.

Data to and from the HCS412 is always sent Least Sig-
nificant bit first. The data length and modulation format
vary according to the command and the transmission
path.

Data Length and Commands:

· Read and Write transfers 16 bits of data.

· Challenge and Response transfers 32 bits of data.

Modulation Format and Transmission Path:

· LF responses on the LC output are Pulse Position

Modulated (PPM) according to Figure 4-2.

· RF responses on the DATA pin modulate accord-

ing to standard encoder transmissions
(Figure 3-5, Figure 3-6).

Communication with the HCS412 over the low fre-
quency path (LC pins) uses a basic Timing Element,
LF

. The Low Frequency Baud Rate Select option,

LFBSL, sets LF

to either 100

s or 200

(Table 4-1).

The response on the DATA pin uses the Encoder
mode's RF Timing Element (RF

) and the modulation

format set by the MOD configuration option (Table 3-6).
The RF responses use the standard Encoder mode for-
mat with the 32-bit hopping portion replaced by the
response data (Figure 4-19). If the response is only 16
bits, the 32 bits will contain 2 copies of the response
(Figure 4-16).

TABLE 4-1:

LOW FREQUENCY BAUD
RATE SELECT BITS

4.2.1

CALCULATING COMMUNICATION TE

The HCS412's internal oscillator will vary ±10% over
the device's rated voltage and temperature range.
When the oscillator varies, both its transmitted T

and

expected T

when receiving will vary.

Communication reliability with the token may be
improved by calculating the HCS412's T

from the field

Acknowledge sequence and using this measured time
element in communication to and in reception routines
from the token.

Always begin and end the time measurement on rising
edges. Whether LF or RF, the falling edge decay rates
may vary but the rising edge relationships should
remain consistent. A common T

calculation method

would be to time an 8 T

sequence, then divide the

value down to determine the single T

value. An 8 T

measurement will give good resolution and may be
easily right-shifted (divide by 2) three times for the math
portion of the calculation (Figure 4-1).

Accurately measuring T

is important for communicat-

ing to an HCS412 as well as for inductive programming
a device. The configuration word sent during program-
ming contains the 4-bit oscillator tuning value. Accu-
rately determining T

allows the programmer to

calculate the correct oscillator tuning bits to place in the
configuration word, whether the device oscillator needs
to be sped up or slowed down to meet its desired T

LFBSL

200

100

2002 Microchip Technology Inc.

Preliminary

DS41099C-page 19

HCS412

FIGURE 4-1:

FIELD ACKNOWLEDGE SEQUENCE

FIGURE 4-2:

LC PIN PULSE POSITION MODULATION (PPM)

3LF

2LF

Command

ATO

Communication from reader to HCS412

Filed ACK Sequence from HCS412 to reader

8LF

Inductive

Comms

8LF

(DATA)

(LC)

Comms

(DATA)

Field Ack sequence repeats every 255 LF

if no command is received.

255LF

(LC)

Inductive

Comms

Start or

bit

Transponder reader communication to the HCS412

HCS412 response back to the reader

2 LF

4 LF

2 LF

Start or

bit

Extending the high time
is acceptable but the low
time should minimally
be 1 LF

TE.

BITC

BITR

The HCS412 determines
bit values from rising edge
to rising edge times.

HCS412

DS41099C-page 20

Preliminary

2002 Microchip Technology Inc.

4.3

IFF Commands

TABLE 4-2:

LIST OF AVAILABLE IFF COMMANDS

Opcode

Command

Anticollision Command
(Section 4.3.1)

00000

Select HCS412, used if Anticollision enabled

Read Commands
(Section 4.3.2)

00001

Read configuration word

00010

Read low serial number (least significant 16 bits)

00011

Read high serial number (most significant 16 bits)

00100

Read user EEPROM 0

00101

Read user EEPROM 1

00110

Read user EEPROM 2

00111

Read user EEPROM 3

Program Command
(Section 4.3.5)

01000

Program HCS412 EEPROM

Write Commands
(Section 4.3.3)

01001

Write configuration word

01010

Write low serial number (least significant 16 bits)

01011

Write high serial number (most significant 16 bits)

01100

Write user EEPROM 0

01101

Write user EEPROM 1

01110

Write user EEPROM 2

01111

Write user EEPROM 3

Challenge and Response Commands
(Section 4.3.6)

10000

Challenge and Response using key-1 and IFF algorithm

10001

Challenge and Response using key-1 and HOP algorithm

10100

Challenge and Response using key-2 and IFF algorithm

10101

Challenge and Response using key-2 and HOP algorithm

Request Hopping Code Command
(Section 4.3.7)

11000

Request Hopping Code transmission

Default IFF Command
(Section 4.3.8)

11100

Enable default IFF communication

2002 Microchip Technology Inc.

Preliminary

DS41099C-page 21

HCS412

4.3.1

ANTICOLLISION

Multiple tokens in the same inductive field will simulta-
neously respond to inductive commands. The
responses will collide making token authentication
impossible. Enabling anticollision allows addressing of
an individual token, regardless how many tokens are in
the field.

The HCS412 method is that all tokens trained to a
given vehicle will have the same 25 MSb's of their serial
number. The serial numbers of up to 8 tokens trained to
access a given vehicle will differ only in the 3 LSb's.
Think of the 25 MSb's of the HCS412's serial number
as the vehicle ID and the 3 LSb's as the token ID. The
vehicle ID associates the token with a given vehicle
and the token ID makes it a uniquely addressable
(selectable) 1 of 8 possible tokens authorized to access
the vehicle.

The transponder reader addresses an individual token,
HCS412, by sending a `

SELECT ENCODER

' command.

The command is followed by from 1 to 25 bits of the
HCS412's serial number, starting with bit 3 (Least Sig-
nificant bit first) (Figure 4-3).

Clocking out `1's then increments the 3 LSb's, the first
`1' setting the bits to

000b

. When the value matches

the 3 LSb's of a token, the token responds with an
Encoder Select Acknowledge. The reader must halt
clocking out further `1's or risk selecting multiple
tokens. Any remaining tokens in the field will be unse-
lected, responding only if a new device selection
sequence selects them. Removing the field will also
RESET a selected/unselected state if removed long
enough to result in a device RESET.

The ability to isolate a single HCS412 for communica-
tion greatly depends on the number of Most Significant
serial number bits included in the device selection
sequence. The more serial number bits sent, the more
narrow the device selection. All bits not transmitted are
treated as wildcards. Sending only 1 bit, bit 3 as a `0',
will only narrow the number of tokens allowed to
respond to all with bit 3 equal to `0'. When the transpon-
der reader sends the full 25 MSb's of the serial number,
it narrows all possible tokens down to only those
trained to the vehicle - only those tokens whose serial
number's 25 MSb's match.

TABLE 4-3:

DEVICE SELECT COMMAND

FIGURE 4-3:

ANTICOLLISION - DEVICE SELECTION

Command

Description

Expected data In

Response

00000

Select HCS412, used if Anticolli-
sion enabled

The desired HCS412's serial

number

Encoder select Acknowledge if
serial number match

1 to 25 bits of the

Serial Number,

Encoder

Select

ACK

Inductive

Comms

ESA

Command

OTD

Start

2 LF

Activate

Field

ACK

Delay to

Command

Delay to

Serial

Most Sig X Bits

3 LSb's

Clock Serial

of Serial Number

Delay

ACK

Bit

28-bit Serial Number

1 to 25 bits of the

Serial Number,

starting with Bit 3.

Communication from reader to HCS412

Communication from HCS412 to reader

2ms

000b

010b

001b

011b

4th `1' interrupted

by ACK, indicating

selection @ LSb =

011b

Send `1's to
increment 3LSb's

Bit

Start

2 LF

Start

2 LF

Bit

starting with Bit 3.

HCS412

DS41099C-page 22

Preliminary

2002 Microchip Technology Inc.

4.3.2

READ

The transponder reader sends one of seven possible
read commands indicating which 16-bit EEPROM word
to retrieve (Table 4-4). The HCS412 retrieves the data
and returns the 16-bit response.

Each Read response is preceded by a 1LF

low

START pulse and `01b' preamble (Figure 4-4).

The following locations are available to read:

· The 64-bit general purpose user EEPROM.

(USER[3:0]).

· The 32-bit serial number (SER[1:0]). The serial

number is also transmitted in each code hopping
transmission.

· The16-bit Configuration word containing all non-

security related options.

FIGURE 4-4:

READ

4.3.3

WRITE

The transponder reader sends one of seven possible
write commands (Table 4-5) indicating which 16-bit
EEPROM word to write to. The 16-bit data to be written
follows the command. The HCS412 will attempt to write
the value into EEPROM and respond with an Acknowl-
edge sequence if successful.

The following locations are available to write:

· The 64-bit general purpose user EEPROM.

(USER[3:0]) (Figure 4-6).

· The 32-bit serial number (SER[1:0]). The serial

number is also transmitted in each code hopping
transmission (Figure 4-5).

· The16-bit Configuration word containing all non-

security related configuration options. If the con-
figuration is written, the device must be RESET
before the new settings take effect (Figure 4-5).

A Transport Code, write access password, protects the
serial number and configuration word from undesired
modification. For these locations the reader must follow
the

WRITE

command with the appropriate 28-bit trans-

port code, then the 16 bits of data to write. Only a cor-
rect match with the transport code programmed during
production will allow write access to the serial number
and configuration word (Figure 4-5).

The delay to a successful write Acknowledge will vary
depending on the number of bits changed.

TABLE 4-4:

LIST OF READ COMMANDS

Command

Description

Expected data In

Response

00001

Read Configuration word

None

16-bit Configuration word

00010

Read low serial number

None

Lower 16 bits of serial number (SER0)

00011

Read high serial number

None

Higher 16 bits of serial number (SER1)

00100

Read user EEPROM 0

None

16 Bits of User EEPROM USR0

00101

Read user EEPROM 1

None

16 Bits of User EEPROM USR1

00110

Read user EEPROM 2

None

16 Bits of User EEPROM USR2

00111

Read user EEPROM 3

None

16 Bits of User EEPROM USR3

16-bit

Start

0 1

2 LF

01b Preamble

Command

Response

Communication from reader to HCS412

Communication from HCS412 to reader

bit

ACK

Start

1 LF

ATO

Activate

Field

ACK

Delay to

Command

Delay until
Response

16-bit Response

6 LF

2002 Microchip Technology Inc.

Preliminary

DS41099C-page 23

HCS412

TABLE 4-5:

LIST OF WRITE COMMANDS

FIGURE 4-5:

WRITE TO SERIAL NUMBER OR CONFIGURATION

FIGURE 4-6:

WRITE TO USER AREA

Command

Description

Expected data In

Response if Write is Successful

01001

Write Configuration word

28-bit Transport code; 16-Bit

configuration word

Write Acknowledge pulse

01010

Write low serial number

28-bit Transport code; Least Significant

16 bits of the serial number (SER0)

Write Acknowledge pulse

01011

Write high serial number

28-bit Transport code; Most Significant

16 bits of the serial number (SER1)

Write Acknowledge pulse

01100

Write user EEPROM 0

16 Bit User EEPROM USR0

Write Acknowledge pulse

01101

Write user EEPROM 1

16 Bit User EEPROM USR1

Write Acknowledge pulse

01110

Write user EEPROM 2

16 Bit User EEPROM USR2

Write Acknowledge pulse

01111

Write user EEPROM 3

16 Bit User EEPROM USR3

Write Acknowledge pulse

Activate

Field

ACK

Delay to

Command

Delay to
TCODE

Transport

Write ACK

Delay before Write

ACK

28-bit

Delay to

Data

Code

16 bits Data

Transport

Code

28-bit

t
0

t
1

Command

OTD

Write Delay

Communication from reader to HCS412

Communication from HCS412 to reader

Start

2 LF

Start

2 LF

Start

2 LF

ACK

TTD

ATO

Data Bits

Command

ACK

Write Delay

t
0

t
1

ACK

Communication from reader to HCS412

Communication from HCS412 to reader

Start

2 LF

Start

2 LF

OTD

ATO

Activate

Field

ACK

Delay to

Command

Delay to

Data

16 bits Data

Write ACK

Delay before Write

ACK

Data Bits

HCS412

DS41099C-page 24

Preliminary

2002 Microchip Technology Inc.

4.3.4

BULK ERASE

A Bulk Erase resets the HCS412's memory map to all
zeros. The transponder reader selects the appropriate
device through anticollision, as need be, issues the

PROGRAM

command followed by the device's 28-bit

transport code, then resets the device by removing the
field for 100 ms.

Resetting the device after the

PROGRAM

command

results in a bulk erase, resetting the EEPROM memory
map to all zeros. This is important to remember as the
reader must now communicate to the device using the
communication options resulting from a zero'd configu-
ration word - baud rates, modulation format, etc.
(Table 5-1).

FIGURE 4-7:

BULK ERASE

4.3.5

PROGRAM

Inductive programming a HCS412 begins with a bulk
erase sequence (Section 4.3.4), followed by issuing
the

PROGRAM

command and the desired EEPROM

memory map's 18x16-bit words (Section 5.0). The
HCS412 will send a write Acknowledge after each word
has been successfully written, indicating the device is
ready to receive the next 16-bit word.

After a complete 18 word memory map has been
received and written, the HCS412 PPM modulates 18
bursts of 16-bit words on the LC pins for write verifica-

tion. Each word follows the standard HCS412 response
format with a leading 1LF

low START pulse and `01b'

preamble (Figure 4-10).

Since the bulk erase resets the configuration options to
all zeros, the oscillator tuning value will also be cleared.
The correct tuning value is required when the program-
ming sequence sends the new configuration word. The
value may either be obtained by reading the configura-
tion word prior to bulk erase to extract the value or by
determining T

from the field Acknowledge sequence

and calculating the tuning value appropriately
(Section 4.2.1).

TABLE 4-6:

PROGRAM COMMANDS

FIGURE 4-8:

PROGRAM SEQUENCE - FIRST WORD

Transport

Code

28-bit

100ms

Program

OTD

Communication from reader to HCS412

Communication from HCS412 to reader

Start

2 LF

Start

2 LF

ACK

6ms

ATO

Activate

Field

ACK

Delay to

Command

Delay to
TCODE

Transport

28-bit

Delay

Code

Device Reset

Command

Command

Description

Expected data In

Response

01000

Program HCS412 EEPROM

Transport code (28 bits); Com-
plete memory map: 18 x 16-bit

words (288 bits)

Write Acknowledge pulse after
each 16-bit word, 288 bits trans-
mitted in 18 bursts of 16-bit words

Activate

Field

ACK

Delay to

Command

Delay to
TCODE

Transport

Write ACK

Delay before Write

ACK

28-bit

Delay to

Data

Code

16 bits Data

Repeat 18 times for programming

Transport

Code

28-bit

Program

OTD

Write Delay

Communication from reader to HCS412

Communication from HCS412 to reader

Start

2 LF

Start

2 LF

Start

2 LF

ACK

TTD

ATO

Command

Data Bits

2002 Microchip Technology Inc.

Preliminary

DS41099C-page 25

HCS412

FIGURE 4-9:

PROGRAM SEQUENCE - CONSECUTIVE WORDS

FIGURE 4-10: PROGRAMMING - VERIFICATION

4.3.6

IFF CHALLENGE AND RESPONSE

The transponder reader sends one of four possible IFF
commands indicating which crypt key and which algo-
rithm to use to encrypt the challenge (Table 4-7).

The command is followed by the 32-bit challenge, typi-
cally a random number. The HCS412 encrypts the
challenge using the designated crypt key and algorithm
and responds with the 32-bit encrypted result. The
reader authenticates the response by comparing it to
the expected value.

The second crypt key and the seed value occupy the
same EEPROM storage area. To use the second crypt
key for IFF, the Seed Enable (SEED) and the Tempo-
rary Seed Enable (TMPSD) configuration options must
be disabled.

TABLE 4-7:

CHALLENGE AND RESPONSE COMMANDS

Communication from reader to HCS412

Communication from HCS412 to reader

ACK

r
og

r
ans

por

-bi

t
W

,
KEY

Succe

ssful W

r
ite

Ackno

wledg

Succe

ssful W

r
ite

Ackno

wledg

Succe

ssful W

r
ite

Ackno

wledg

Succe

ssful W

r
ite

Ackno

wledg

-bi

t
W

,
KEY

-bi

t
W

CNT

,
CNT

-bi

t
W

r
v

(

ll 0

)

b K

1_1

b K

1_2

b K

1_3

b C

CNT

b R

ser

b R

Write 18x16-bit

words total.

Start
Verify

Communication from reader to HCS412

Communication from HCS412 to reader

r
ogr

and

r
anspo

rt C

ode

16-

t W

1_1

, K

1_0

ccessful W

r
i
t
e

cknow

l
edg

16-

t W

All

r
o

ccessful W

r
i
t
e

cknow

l
edg

Write 18x16-bit

words total.

1LF

t
art +

16-

t W

1_1

, K

1_0

1LF

Sta

r
t + `0

16-

t W

1_3

, K

1_2

1LF

Sta

r
t + `0

16-

t W

CNT

,
CNT

1LF

Sta

r
t + `0

16-

t W

r
v

(

ll 0

'
s)

Verify 18x16-bit

words total.

b K

1_0

b K

1_1

b K

1_2

b K

1_3

b CNT

b Res

01b Preamble

Start

1 LF

16-bit

Response

3LF

Delay between

each 16-bit word

Approximately 1ms

delay before verify
begins.

1LF

Sta

r
t + `0

16-

t W

1_5

, K

1_4

b K

1_4

b K

1_5

Note: If seed transmissions are not appropriately

disabled, the HCS412 will default to using
KEY1 for IFF.

Command

Description

Expected data In

Response

10000

IFF using key-1 and IFF algorithm

32-Bit Challenge

32-Bit Response

10001

IFF using key-1 and HOP algorithm

32-Bit Challenge

32-Bit Response

10100

IFF using key-2 and IFF algorithm

32-Bit Challenge

32-Bit Response

10101

IFF using key-2 and HOP algorithm

32-Bit Challenge

32-Bit Response

HCS412

DS41099C-page 26

Preliminary

2002 Microchip Technology Inc.

FIGURE 4-11: IFF CHALLENGE AND RESPONSE

4.3.7

CODE HOPPING REQUEST

The command tells the HCS412 to increment the syn-
chronization counter and build the 32-bit code hopping
portion of the code word.

· If RF Echo is disabled, the data will be transmitted

on the LC lines only (Figure 4-12).

· If RF Echo is enabled, the data will be transmitted

in a code word on the DATA line followed by the
data transmitted on the LC lines. The DATA line is
transmitted first for passive entry support
(Figure 4-13).

The data format will be the same as described in
Section 3.2.

TABLE 4-8:

REQUEST HOPPING CODE COMMANDS

FIGURE 4-12: CODE HOPPING REQUEST (RF ECHO DISABLED)

FIGURE 4-13: CODE HOPPING REQUEST (RF ECHO ENABLED)

32-bit

Command

ACK

t
0

t
1

t
2

OTD

ATO

Start

2 LF

Start

2 LF

0 1

01b Preamble

Communication from reader to HCS412

Communication from HCS412 to reader

Activate

Field

ACK

Delay to

Command

Delay to

Data

32-bit Challenge

Delay before

Response

32-bit

Response

Challenge

Response

Start

1 LF

Command

Description

Expected data In

Response

11000

Request Hopping Code transmission

None

32-Bit Hopping Code

OTH

32-Bit PPM

Command

Start

2 LF

Communication from reader to HCS412

Communication from HCS412 to reader

Response

ATO

ACK

Start

1 LF

0 1

01b Preamble

Activate

Field

ACK

Delay to

Command

Delay before

Response

32-bit Response

cod

(
R

ues

l
e

ead

d C

(
37 b

i
ts)

(
32 bi

ts)

LF Communication from reader to HCS412

LF Communication from HCS412 to reader

DATA (RF)

Inductive (LF)

op C

ode

)

Field
ACK

Field

ACK

32-Bit PPM

Response

2002 Microchip Technology Inc.

Preliminary

DS41099C-page 27

HCS412

4.3.8

ENABLE DEFAULT IFF COMMUNICATION

The

ENABLE DEFAULT IFF COMMUNICATION

com-

mand defaults certain HCS412 communication options
such that the transponder reader may communicate to
the device with a common (safe) protocol. The default
setting remains for the duration of the communication,
returning to normal only after a device RESET.

Default IFF communication settings:

· Anticollision disabled

· RF echo disabled

· 200

s LF baud rate.

TABLE 4-9:

DEFAULT IFF COMMUNICATION COMMANDS

FIGURE 4-14: ENABLE DEFAULT IFF COMMUNICATION

4.4

IFF Communication Special Features

TABLE 4-10:

LF COMMUNICATION
SPECIAL FEATURES (LFSP)

4.4.1

PASSIVE PROXIMITY ACTIVATION
(LFSP = 10)

Enabling the Proximity Activation configuration option
allows the HCS412 to transmit a hopping code trans-
mission in response to a signal present on the LC0 pin.

The HCS412 sends out Field Acknowledge Sequence
in response to detecting the LF field (Figure 4-1). If the
HCS412 does not receive a command before the sec-
ond field Acknowledge sequence [within 255 LFT

`s], it

will transmit a normal code hopping transmission for 2
seconds on the DATA pin. After 2 seconds the HCS412
reverts to normal transponder mode.

The 2 second transmission does not repeat when the
device is in the presence of a continuous LF field. The
HCS412 must be RESET, remove and reapply the LF
field, to activate another transmission.

The button status used in the code hopping transmis-
sion indicates a proximity activation by clearing the S0,
S1 and S2 button activation flags.

FIGURE 4-15: PROXIMITY ACTIVATION

Command

Description

Expected data In

Response

11100

Enable default IFF communication

None

Communication from reader to HCS412

Communication from HCS412 to reader

ACK

pulses

Inductive Comms

RF Comms

ATO

Activate

Field

ACK

Delay to

Command

Delay

Next Command

Command

Start

2 LF

LFSP1:0

Description

No special options enabled

Anticollision enabled (Section 4.3.1)

Proximity Activation enabled

Anticollision and RF Echo enabled

DATA (RF)

ACK

LF Communication from reader to HCS412

LF Communication from HCS412 to reader

Inductive

(LF)

No command received from

reader for 255 LF

Transmit hopping code for 2

seconds

HCS412

DS41099C-page 28

Preliminary

2002 Microchip Technology Inc.

4.4.2

ANTICOLLISION AND RF ECHO
(LFSP = 11)

In addition to enabling anticollision, this mode adds that
all HCS412 responses and Acknowledges are echoed
on the DATA output line. Responses are first transmit-
ted on the DATA line, followed by the equivalent data
transmitted on the LF LC lines (Figure 4-16,
Figure 4-17).

LF communication from the token to the transponder
reader has much less range than LF communication
from the reader to the token. Transmitting the informa-
tion on the DATA line increases communication range
by enabling longer range RF talk back.

The information is sent on the DATA line first to benefit
longer range passive-entry authentication times.

FIGURE 4-16: RF ECHO OPTION AND READ COMMAND

FIGURE 4-17: RF ECHO OPTION AND IFF COMMAND

FIGURE 4-18: RF ECHO OPTION AND REQUEST HOPPING CODE COMMAND

DATA (RF)

spo

(
16 bi

t
s

)

ead

xt ACK

d C

7 b

i
t
s

)

spo

2 b

i
t
s

)

ACK

ATO

LF Communication from reader to HCS412

LF Communication from HCS412 to reader

OTH

Inductive

(LF)

32-Bit Response

16-Bit

Response

16-Bit

Response

cod

)

spo

2 b

i
t
s

)

l
e

ead

xt ACK

d C

7 b

i
t
s

)

spo

(
32 b

i
t
s

)

LF Communication from reader to HCS412

LF Communication from HCS412 to reader

DATA (RF)

Inductive (LF)

ade

i
x

ed C

ode

(37

)

(32

)

LF Communication from reader to HCS412

LF Communication from HCS412 to reader

DATA (RF)

Field
ACK

32-Bit PPM

Response

Field

Ack

OTH

ATO

Request Hopping

Code Opcode

Inductive

(LF)

2002 Microchip Technology Inc.

Preliminary

DS41099C-page 29

HCS412

4.4.3

INTELLIGENT DAMPING (IDAMP)

A high Q-factor LC antenna circuit connected to the
HCS412 will continue to resonate after a strong LF field
is removed, slowly decaying. The slow decay makes
fast communication near the reader difficult as data bit
low times disappear.

If the Intelligent Damping option is enabled, the
HCS412 will clamp the LC pins through a 2 k

resistor

for 5

s every 1/4 LF

, whenever the HCS412 is

expecting data from the transponder reader. The intel-
ligent damping pulses start 12.5 LF

after the

Acknowledge sequence is complete and continue for
12.5 LF

. If the HCS412 detects data from the reader

while sending out damping pulses, it will continue to
send the damping pulses.

TABLE 4-11:

INTELLIGENT DAMPING
(IDAMP)

FIGURE 4-19: INTELLIGENT DAMPING

TABLE 4-12:

LF TIMING SPECIFICATIONS

IDAMP

Description

Intelligent damping enabled

Intelligent damping disabled

12.5 LF

1/4 LF

DAMP PULSES

Bit From

reader

Field
ACK

Parameter

Symbol

Min.

Typ.

Max.

Units

Time Element

IFFB = 0
IFFB = 1

180

200
100

220

110

Power-up Time

4.2

7.8

Acknowledge to Opcode Time

ATO

PPM Command Bit Time

Data = 0
Data = 1

BITC

--
--

4
6

--
--

PPM Response Bit Time

Data = 0
Data = 1

BITR

--
--

2
3

--
--

Read Response Time

IFF Response Time

3.87

4.3

4.73

Opcode to Data Input Time

OTD

2.6

Transport Code to Data Input Time

TTD

2.2

Encoder Select Acknowledge Time

ESA

+100

IFF EEPROM Write Time (16 bits)

Op Code to Hop Code Response Time

OTH

10.26

11.4

12.54

HCS412

DS41099C-page 30

Preliminary

2002 Microchip Technology Inc.

5.0

CONFIGURATION SUMMARY

Table 5-1 summarizes the available HCS412 options.

TABLE 5-1:

HCS412 CONFIGURATION SUMMARY

Symbol

Reference

Section

Description

KEY1

64-bit Encoder Key 1

SDVAL

Section 3.2.7

60-bit seed value transmitted in CH Mode if (SEED = 1 AND TMPSD = 0) or if (SEED
= 0 AND TMPSD = 1).

KEY2

LSB 60 bits of Encoder Key 2. 4 MSb's set to XXXX. (Note 1)

TCODE

Section 4.3.3

28-bit Transport Code

AFSK

Section 3.4.5

PLL Interface Select.

0 = ASK

1 = FSK

RFEN

Section 2.2.7

RF Enable output active.

0 = Disable

1 = Enable

LPRE

Section 3.4.7

Long Preamble Enable.

0 = Disable

1 = Enable

QLVS

Section 3.4.8

Special Features Enable.

0 = Disable

1 = Enable

OSCT

Section 2.2.5

Oscillator Tune Value.

1000b

Fastest

0000b

Nominal

0111b

Slowest

VLOWSEL

Section 2.2.6

Low Voltage Trip Point Select

0 = 2.2 Volt

1 = 4.4 Volt

IDAMP

Section 4.4.3

Intelligent Damping Enable

0 = Enable

1 = Disable

LFSP

Section 4.4

LF Communication Special Features

LFSP1:0

Active Feature

00b

None

01b

Anticollision

10b

Prox Activation

11b

RF Echo

LFBSL

Section 4.2

IFF Baud Rate Select (LF

)

0 = 200 us

1 = 100 us

MOD

Section 3.3

DATA pin modulation format

0 = PWM

1 = Manch

CWBE

Section 3.4.3

Code word Blanking Enable

0 = Disable

1 = Enable

MTX4

Section 3.4.1

Minimum Four Code words

0 = Disable

1 = Enable

RFBSL

Section 3.3

Transmission Baud Rate (RF

)

RFBSL1:0

PWM

Manch

00b

400 us

800 us

01b

200 us

400 us

10b

100 us

200 us

11b

100 us

200 us

S2LC

Section 3.4.1

S2/RFEN/LC1 Pin Configuration bit.

0 = LC

1 = S Input

Reserved, Set to 0

TMPSD

Section 3.2.7

Temporary Seed Enable (Note 1)

0 = Disable

1 = Enable

SEED

Section 3.2.7

Seed Transmission Enable (Note 1)

0 = Disable

1 = Enable

XSER

Section 3.2.5

Extended Serial number

0 = Disable

1 = Enable

DINC

Section 3.4.4

Delayed Increment

0 = Disable

1 = Enable

DISC

Section 3.2.6

10-bit Discrimination value

OVR

Section 3.2.4

Counter Overflow Value

SER

32-bit Serial Number

USR

64-bit user EEPROM area

CNT

16-bit Synchronization counter

Reserved set 0000h

Note 1: If IFF with KEY2 is enabled only if TMPSD = 1 and SEED = 1.

2002 Microchip Technology Inc.

Preliminary

DS41099C-page 31

HCS412

6.0

INTEGRATING THE HCS412
INTO A SYSTEM

Use of the HCS412 in a system requires a compatible
decoder. This decoder is typically a microcontroller with
compatible firmware. Microchip will provide (via a free
license agreement) firmware routines that accept
transmissions from the HCS412 and decrypt the
hopping code portion of the data stream. These
routines provide system designers the means to
develop their own decoding system.

6.1

Learning a Transmitter to a
Receiver

A transmitter must first be 'learned' by a decoder before
its use is allowed in the system. Several learning strat-
egies are possible, Figure 6-1 details a typical learn
sequence. Core to each, the decoder must minimally
store each learned transmitter's serial number and cur-
rent synchronization counter value in EEPROM. Addi-
tionally, the decoder typically stores each transmitter's
unique crypt key. The maximum number of learned
transmitters will therefore be relative to the available
EEPROM.

A transmitter's serial number is transmitted in the clear
but the synchronization counter only exists in the code
word's encrypted portion. The decoder obtains the
counter value by decrypting using the same key used
to encrypt the information. The K

algorithm is a

symmetrical block cipher so the encryption and decryp-
tion keys are identical and referred to generally as the
crypt key. The encoder receives its crypt key during
manufacturing. The decoder is programmed with the
ability to generate a crypt key as well as all but one
required input to the key generation routine; typically
the transmitter's serial number.

Figure 6-1 summarizes a typical learn sequence. The
decoder receives and authenticates a first transmis-
sion; first button press. Authentication involves gener-
ating the appropriate crypt key, decrypting, validating
the correct key usage via the discrimination bits and
buffering the counter value. A second transmission is
received and authenticated. A final check verifies the
counter values were sequential; consecutive button
presses. If the learn sequence is successfully com-
plete, the decoder stores the learned transmitter's
serial number, current synchronization counter value
and appropriate crypt key. From now on the crypt key
will be retrieved from EEPROM during normal opera-
tion instead of recalculating it for each transmission
received.

Certain learning strategies have been patented and
care must be taken not to infringe.

FIGURE 6-1:

TYPICAL LEARN
SEQUENCE

Enter Learn

Mode

Wait for Reception

of a Valid Code

Generate Key

from Serial Number

Use Generated Key

to Decrypt

Compare Discrimination

Value with Fixed Value

Equal

Wait for Reception

of Second Valid Code

Compare Discrimination

Value with Fixed Value

Use Generated Key

to Decrypt

Equal

Counters

Encryption key

Serial number

Synchronization counter

Sequential

Exit

Learn successful Store:

Learn

Unsuccessful

Yes

HCS412

DS41099C-page 32

Preliminary

2002 Microchip Technology Inc.

6.2

Decoder Operation

Figure 6-2 summarizes normal decoder operation. The
decoder waits until a transmission is received. The
received serial number is compared to the EEPROM
table of learned transmitters to first determine if this
transmitter's use is allowed in the system. If from a
learned transmitter, the transmission is decrypted
using the stored crypt key and authenticated via the
discrimination bits for appropriate crypt key usage. If
the decryption was valid the synchronization value is
evaluated.

FIGURE 6-2:

TYPICAL DECODER
OPERATION

6.3

Synchronization with Decoder
(Evaluating the Counter)

The K

technology patent scope includes a

sophisticated synchronization technique that does not
require the calculation and storage of future codes. The
technique securely blocks invalid transmissions while
providing transparent resynchronization to transmitters
inadvertently activated away from the receiver.

Figure 6-3 shows a 3-partition, rotating synchronization
window. The size of each window is optional but the
technique is fundamental. Each time a transmission is
authenticated, the intended function is executed and
the transmission's synchronization counter value is
stored in EEPROM. From the currently stored counter
value there is an initial "Single Operation" forward win-
dow of 16 codes. If the difference between a received
synchronization counter and the last stored counter is
within 16, the intended function will be executed on the
single button press and the new synchronization
counter will be stored. Storing the new synchronization
counter value effectively rotates the entire synchroniza-
tion window.

A "Double Operation" (resynchronization) window fur-
ther exists from the Single Operation window up to 32K
codes forward of the currently stored counter value. It
is referred to as "Double Operation" because a trans-
mission with synchronization counter value in this win-
dow will require an additional, sequential counter
transmission prior to executing the intended function.
Upon receiving the sequential transmission the
decoder executes the intended function and stores the
synchronization counter value. This resynchronization
occurs transparently to the user as it is human nature
to press the button a second time if the first was unsuc-
cessful.

The third window is a "Blocked Window" ranging from
the double operation window to the currently stored
synchronization counter value. Any transmission with
synchronization counter value within this window will
be ignored. This window excludes previously used,
perhaps code-grabbed transmissions from accessing
the system.

Transmission

Received

Does

Serial Number

Match

Decrypt Transmission

Decryption

Valid

Counter

Within 16

Counter

Within 32K

Update

Counter

Execute

Command

Save Counter

in Temp Location

Start

Yes

and

Note:

The synchronization method described in
this section is only a typical implementation
and because it is usually implemented in
firmware, it can be altered to fit the needs
of a particular system.

HCS412

DS41099C-page 34

Preliminary

2002 Microchip Technology Inc.

7.0

PROGRAMMING THE HCS412

The HCS412 requires some parameters programmed
into the device before it can be used. The programming
cycle allows the user to input all 288 bits in a serial data
stream, which are then stored internally in EEPROM.

Programming is initiated by forcing the DATA line high,
after the S2 line has been held high for the appropriate
length of time line (Table 7-1 and Figure 7-2).

A delay is required after entering Program mode while
the automatic bulk erase cycle completes. The bulk
erase writes all EEPROM locations to zeros.

The device is then programmed by clocking in the
EEPROM memory map (Least Significant bit first) 16
bits at a time, using S2 as the clock line and DATA as
the data-in line. After each 16-bit word is loaded, a pro-
gramming delay is required for the internal program
cycle to complete. This delay can take up to Twc.

The HCS412 will signal a `write complete' after writing
each 16-bit word by sending out a series of ACK pulses
T

ACKH

high, T

ACKL

low on DATA. The ACK pulses con-

tinue until S2 is dropped.

Programming verification is allowed only once, after the
programming cycle (Figure 7-3), by reading back the
EEPROM memory map. Reading is done by clocking
the S2 line and reading the data bits on DATA, again
Least Significant bit first. For security reasons, it is not
possible to execute a Verify function without first pro-
gramming the EEPROM.

FIGURE 7-1:

CREATION AND STORAGE OF CRYPT KEY DURING PRODUCTION

FIGURE 7-2:

PROGRAMMING WAVEFORMS

FIGURE 7-3:

VERIFY WAVEFORMS

Note:

To ensure that the device does not acci-
dentally enter Programming mode, DATA
should never be pulled high by the circuit
connected to it. Special care should be
taken when driving PNP RF transistors.

Transmitter

Manufacturer's

Serial Number

Code

Crypt

Key

Generation

Algorithm

Serial Number

Crypt Key
Sync Counter

HCS412

Production
Programmer

EEPROM Array

DATA

Enter Program

Mode

(Data)

(Clock)

Note 1: S0 and S1 button inputs to be held to ground during the entire programming sequence.

Bit 0

Bit 1

Bit 2

Bit 3

Bit 14

Bit 15

Bit 16

Bit 17

PBW

Repeat for each word (18 times total)

CLKH

CLKL

Data for Word 1

CLKL

Initiate Data
Polling Here

Write Cycle
Complete Here

Calibration Pulses

Ack

Data for Word 0

(KEY1_0)

(KEY1_1)

DATA

(Clock)

(Data)

Note: If a Verify operation is to be done, then it must immediately follow the Program cycle.

End of Programming Cycle

Beginning of Verify Cycle

Bit 1 Bit 2

Bit 3

Bit 15

Bit 14

Bit 16 Bit 17

Bit190 Bit191

Data from Word 0

Bit 0

Bit191

Bit190

Ack

2002 Microchip Technology Inc.

Preliminary

DS41099C-page 35

HCS412

7.1

EEPROM Organization

TABLE 7-1:

HCS412 EEPROM ORGANIZATION

TABLE 7-2:

PROGRAMMING/VERIFY TIMING REQUIREMENTS

16Bit

Word

BITS

KEY1_1

KEY1_0 (KEY1 LSB)

KEY1_3

KEY1_2

KEY1_5

KEY1_4

KEY1_7 (KEY1 MSB)

KEY1_6

SEED_1 / KEY2_1

SEED_0 / KEY2_0 (SEED AND KEY2 LSB)

SEED_3 / KEY2_3

SEED_2 / KEY2_2

SEED_5 / KEY2_5 / TCODE_1

SEED_4 / KEY2_4 / TCODE_0 (TCODE LSB)

SEED_7 / KEY2_7 /

TCODE_3 (MSB for all 3)

SEED_6 / KEY2_6 / TCODE_2

t to

S2LC

RFBSL

MOD

BSL

LFSP

IDAM

VLOW

SEL

OSCT

OVR

10bit Discrimination Value

DINC

XSER

SEED

PSD

SER1

SER0

SER3

SER2

USR0 MSB

USR0 LSB

USR1 MSB

USR1 LSB

USR2 MSB

USR2 LSB

USR3 MSB

USR3 LSB

CNT1 (Counter MSB)

CNT0 (Counter LSB)

Reserved, set to 0

= 5.0V ± 10%, 25

C ± 5

Parameter

Symbol

Min.

Max.

Units

Program mode setup time

5.0

Hold time 1

4.0

Hold time 2

Bulk Write time

PBW

4.0

Program delay time

PROG

4.0

Program cycle time

Clock low time

CLKL

Clock high time

CLKH

Data setup time

Data hold time

Data out valid time

Hold time

PHOLD

100

Acknowledge low time

ACKL

800

Acknowledge high time

ACKH

800

HCS412

DS41099C-page 36

Preliminary

2002 Microchip Technology Inc.

8.0

ELECTRICAL CHARACTERISTICS

TABLE 8-1:

ABSOLUTE MAXIMUM RATING

Symbol

Item

Rating

Units

Supply voltage

-0.3 to 6.6

Input voltage

-0.3 to V

+ 0.3

OUT

Output voltage

-0.3 to V

+ 0.3

OUT

Max output current

STG

Storage temperature

-55 to +125

C (Note)

LSOL

Lead soldering temp

300

C (Note)

ESD

ESD rating (Human Body Model)

4000

Note:

Stresses above those listed under "ABSOLUTE MAXIMUM RATINGS" may cause permanent damage to the
device.

* If a battery is inserted in reverse, the protection circuitry switches on, protecting the device and draining the battery.

TABLE 8-2:

DC AND TRANSPONDER CHARACTERISTICS

Commercial (C): T

AMB

= 0°C to 70°C

Industrial (I):

AMB

= -40°C to 85°C

2.0V < V

< 6.3V

Parameter

Symbol

Min

Typ

Max

Unit

Conditions

Average operating current
Note 2

(avg)

200

500

= 6.3V

Programming current

DDP

2.3

4.0

= 6.3V

Standby current

DDS

0.1

500

LC = off else < 5

High level input voltage

0.55 V

+ 0.3

Low level input voltage

-0.3

0.15 V

High level output voltage

0.8 V

= 2V, I

=- .45 mA

= 6.3V, I

,= -2 mA

Low level output voltage

--
--

0.08 V

= 2V, I

= 0.5 mA

= 6.3V, I

= 5 mA

LED output current

LED

3.0

4.0

7.0

= 3.0V, V

LED

= 1.5V

Switch input resistor

S0/S1 not S2

DATA input resistor

DATA

120

160

LC input current

10.0

LCC

=10 V

LC input clamp voltage

LCC

<10 mA

LC induced output current

DDI

2.0

LCC

> 10V

LC induced output voltage

DDV

--
--

4.5
4.0

--
--

10 V < V

LCC

, I

= 0 mA

10 V < V

LCC

, I

= -1 mA

Carrier frequency

125

kHz

LC input sensitivity

LCS

100

Note 3

Note 1: Typical values at 25°C.

2: No load connected.
3: Not tested.

2002 Microchip Technology Inc.

Preliminary

DS41099C-page 37

HCS412

9.0

PACKAGING INFORMATION

Package Type:

8-Lead Plastic Dual In-line (P) 300 mil (PDIP)

Units

INCHES*

MILLIMETERS

Dimension Limits

MIN

NOM

MAX

MIN

NOM

MAX

Number of Pins

Pitch

.100

2.54

Top to Seating Plane

.140

.155

.170

3.56

3.94

4.32

Molded Package Thickness

.115

.130

.145

2.92

3.30

3.68

Base to Seating Plane

.015

0.38

Shoulder to Shoulder Width

.300

.313

.325

7.62

7.94

8.26

Molded Package Width

.240

.250

.260

6.10

6.35

6.60

Overall Length

.360

.373

.385

9.14

9.46

9.78

Tip to Seating Plane

.125

.130

.135

3.18

3.30

3.43

Lead Thickness

.008

.012

.015

0.20

0.29

0.38

Upper Lead Width

.045

.058

.070

1.14

1.46

1.78

Lower Lead Width

.014

.018

.022

0.36

0.46

0.56

Overall Row Spacing

.310

.370

.430

7.87

9.40

10.92

Mold Draft Angle Top

Mold Draft Angle Bottom

* Controlling Parameter

Notes:
Dimensions D and E1 do not include mold flash or protrusions. Mold flash or protrusions shall not exceed

JEDEC Equivalent: MS-001
Drawing No. C04-018

.010" (0.254mm) per side.

§ Significant Characteristic

HCS412

DS41099C-page 38

Preliminary

2002 Microchip Technology Inc.

Package Type:

8-Lead Plastic Small Outline (SN) Narrow, 150 mil (SOIC)

Foot Angle

Mold Draft Angle Bottom

Mold Draft Angle Top

0.51

0.42

0.33

.020

.017

.013

Lead Width

0.25

0.23

0.20

.010

.009

.008

Lead Thickness

0.76

0.62

0.48

.030

.025

.019

Foot Length

0.51

0.38

0.25

.020

.015

.010

Chamfer Distance

5.00

4.90

4.80

.197

.193

.189

Overall Length

3.99

3.91

3.71

.157

.154

.146

Molded Package Width

6.20

6.02

5.79

.244

.237

.228

Overall Width

0.25

0.18

0.10

.010

.007

.004

Standoff

1.55

1.42

1.32

.061

.056

.052

Molded Package Thickness

1.75

1.55

1.35

.069

.061

.053

Overall Height

1.27

.050

Pitch

Number of Pins

MAX

NOM

MIN

MAX

NOM

MIN

Dimension Limits

MILLIMETERS

INCHES*

Units

* Controlling Parameter

Notes:
Dimensions D and E1 do not include mold flash or protrusions. Mold flash or protrusions shall not exceed
.010" (0.254mm) per side.
JEDEC Equivalent: MS-012
Drawing No. C04-057

§ Significant Characteristic

2002 Microchip Technology Inc.

Preliminary

DS41099C-page 39

HCS412

9.1

Package Marking Information

Legend: MM...M Microchip part number information

XX...X

Customer specific information*

Year code (last 2 digits of calendar year)

Week code (week of January 1 is week `01')

NNN

Alphanumeric traceability code

Note:

In the event the full Microchip part number cannot be marked on one line, it will
be carried over to the next line thus limiting the number of available characters
for customer specific information.

Standard marking consists of Microchip part number, year code, week code and traceability code. For
marking beyond this, certain price adders apply. Please check with your Microchip Sales Office. For
SQTP devices, any special marking adders are included in SQTP price.

XXXXXXXX

XXXXXNNN

YYWW

8-Lead PDIP (300 mil)

Example

HCS412
XXXXX862

9925

8-Lead SOIC (150 mil)

XXXXXXXX

Example

NNN

XXXXYYWW

XXXXXXXX

862

XXXX9925

HCS412

DS41099C-page 40

Preliminary

2002 Microchip Technology Inc.

ON-LINE SUPPORT

Microchip provides on-line support on the Microchip
World Wide Web (WWW) site.

The web site is used by Microchip as a means to make
files and information easily available to customers. To
view the site, the user must have access to the Internet
and a web browser, such as Netscape or Microsoft
Explorer. Files are also available for FTP download
from our FTP site.

Connecting to the Microchip Internet Web Site

The Microchip web site is available by using your
favorite Internet browser to attach to:

www.microchip.com

The file transfer site is available by using an FTP ser-
vice to connect to:

ftp://ftp.microchip.com

The web site and file transfer site provide a variety of
services. Users may download files for the latest
Development Tools, Data Sheets, Application Notes,
User's Guides, Articles and Sample Programs. A vari-
ety of Microchip specific business information is also
available, including listings of Microchip sales offices,
distributors and factory representatives. Other data
available for consideration is:

· Latest Microchip Press Releases

· Technical Support Section with Frequently Asked

Questions

· Design Tips

· Device Errata

· Job Postings

· Microchip Consultant Program Member Listing

· Links to other useful web sites related to

Microchip Products

· Conferences for products, Development Systems,

technical information and more

· Listing of seminars and events

Systems Information and Upgrade Hot Line

The Systems Information and Upgrade Line provides
system users a listing of the latest versions of all of
Microchip's development systems software products.
Plus, this line provides information on how customers
can receive any currently available upgrade kits. The
Hot Line Numbers are:

1-800-755-2345 for U.S. and most of Canada, and

1-480-792-7302 for the rest of the world.

2002 Microchip Technology Inc.

Preliminary

DS41099C-page 41

HCS412

READER RESPONSE

It is our intention to provide you with the best documentation possible to ensure successful use of your Microchip prod-
uct. If you wish to provide your comments on organization, clarity, subject matter, and ways in which our documentation
can better serve you, please FAX your comments to the Technical Publications Manager at (480) 792-7578.

Please list the following information, and use this outline to provide us with your comments about this Data Sheet.

To:

Technical Publications Manager

RE:

Reader Response

Total Pages Sent

From: Name

Company

Address

City / State / ZIP / Country

Telephone: (_______) _________ - _________

Application (optional):

Would you like a reply? Y N

Device:

Literature Number:

Questions:

FAX: (______) _________ - _________

DS41099C

HCS412

What are the best features of this document?

How does this document meet your hardware and software development needs?

Do you find the organization of this data sheet easy to follow? If not, why?

What additions to the data sheet do you think would enhance the structure and subject?

What deletions from the data sheet could be made without affecting the overall usefulness?

Is there any incorrect or misleading information (what and where)?

How would you improve this document?

How would you improve our software, systems, and silicon products?

HCS412

DS41099C-page 42

Preliminary

2002 Microchip Technology Inc.

10.0

HCS412 PRODUCT IDENTIFICATION SYSTEM

To order or obtain information, e.g., on pricing or delivery, refer to the factory or the listed sales office.

Sales and Support

Package:

P = Plastic DIP (300 mil body), 8-lead

SN = Plastic SOIC (150 mil body), 8-lead

Temperature

- = 0°C to +70°C

Range:

I = 40°C to +85°C

Device:

HCS412

Code Hopping Encoder

HCS412T

Code Hopping Encoder (Tape and Reel) (SN only)

HCS412

Data Sheets
Products supported by a preliminary Data Sheet may have an errata sheet describing minor operational differences and recom-
mended workarounds. To determine if an errata sheet exists for a particular device, please contact one of the following:

Your local Microchip sales office

The Microchip Corporate Literature Center U.S. FAX: (480) 792-7277.

The Microchip Worldwide Site (www.microchip.com)

Please specify which device, revision of silicon and Data Sheet (include Literature #) you are using.

New Customer Notification System
Register on our web site (www.microchip.com/cn) to receive the most current information on our products.

2002 Microchip Technology Inc.

Preliminary

DS41099C - page 43

Information contained in this publication regarding device
applications and the like is intended through suggestion only
and may be superseded by updates. It is your responsibility to
ensure that your application meets with your specifications.
No representation or warranty is given and no liability is
assumed by Microchip Technology Incorporated with respect
to the accuracy or use of such information, or infringement of
patents or other intellectual property rights arising from such
use or otherwise. Use of Microchip's products as critical com-
ponents in life support systems is not authorized except with
express written approval by Microchip. No licenses are con-
veyed, implicitly or otherwise, under any intellectual property
rights.

Trademarks

The Microchip name and logo, the Microchip logo, FilterLab,
K

, microID, MPLAB, PIC, PICmicro, PICMASTER,

PICSTART, PRO MATE, SEEVAL and The Embedded Control
Solutions Company are registered trademarks of Microchip Tech-
nology Incorporated in the U.S.A. and other countries.

dsPIC, ECONOMONITOR, FanSense, FlexROM, fuzzyLAB,
In-Circuit Serial Programming, ICSP, ICEPID, microPort,
Migratable Memory, MPASM, MPLIB, MPLINK, MPSIM,
MXDEV, PICC, PICDEM, PICDEM.net, rfPIC, Select Mode
and Total Endurance are trademarks of Microchip Technology
Incorporated in the U.S.A.

Serialized Quick Turn Programming (SQTP) is a service mark
of Microchip Technology Incorporated in the U.S.A.

All other trademarks mentioned herein are property of their
respective companies.

Printed on recycled paper.

Microchip received QS-9000 quality system
certification for its worldwide headquarters,
design and wafer fabrication facilities in
Chandler and Tempe, Arizona in July 1999. The
Company's quality system processes and
procedures are QS-9000 compliant for its
PICmicro

8-bit MCUs, K

code hopping

devices, Serial EEPROMs and microperipheral
products. In addition, Microchip's quality
system for the design and manufacture of
development systems is ISO 9001 certified.

Microchip's Secure Data Products are covered by some or all of the following patents:
Code hopping encoder patents issued in Europe, U.S.A., and R.S.A. -- U.S.A.: 5,517,187; Europe: 0459781; R.S.A.: ZA93/4726
Secure learning patents issued in the U.S.A. and R.S.A. -- U.S.A.: 5,686,904; R.S.A.: 95/5429

DS41099C-page 44

Preliminary

2002 Microchip Technology Inc.

AMERICAS

Corporate Office

2355 West Chandler Blvd.
Chandler, AZ 85224-6199
Tel: 480-792-7200 Fax: 480-792-7277
Technical Support: 480-792-7627
Web Address: http://www.microchip.com

Rocky Mountain

2355 West Chandler Blvd.
Chandler, AZ 85224-6199
Tel: 480-792-7966 Fax: 480-792-7456

Atlanta

500 Sugar Mill Road, Suite 200B
Atlanta, GA 30350
Tel: 770-640-0034 Fax: 770-640-0307

Boston

2 Lan Drive, Suite 120
Westford, MA 01886
Tel: 978-692-3848 Fax: 978-692-3821

Chicago

333 Pierce Road, Suite 180
Itasca, IL 60143
Tel: 630-285-0071 Fax: 630-285-0075

Dallas

4570 Westgrove Drive, Suite 160
Addison, TX 75001
Tel: 972-818-7423 Fax: 972-818-2924

Detroit

Tri-Atria Office Building
32255 Northwestern Highway, Suite 190
Farmington Hills, MI 48334
Tel: 248-538-2250 Fax: 248-538-2260

Kokomo

2767 S. Albright Road
Kokomo, Indiana 46902
Tel: 765-864-8360 Fax: 765-864-8387

Los Angeles

18201 Von Karman, Suite 1090
Irvine, CA 92612
Tel: 949-263-1888 Fax: 949-263-1338

New York

150 Motor Parkway, Suite 202
Hauppauge, NY 11788
Tel: 631-273-5305 Fax: 631-273-5335

San Jose

Microchip Technology Inc.
2107 North First Street, Suite 590
San Jose, CA 95131
Tel: 408-436-7950 Fax: 408-436-7955

Toronto

6285 Northam Drive, Suite 108
Mississauga, Ontario L4V 1X5, Canada
Tel: 905-673-0699 Fax: 905-673-6509

ASIA/PACIFIC

Australia

Microchip Technology Australia Pty Ltd
Suite 22, 41 Rawson Street
Epping 2121, NSW
Australia
Tel: 61-2-9868-6733 Fax: 61-2-9868-6755

China - Beijing

Microchip Technology Consulting (Shanghai)
Co., Ltd., Beijing Liaison Office
Unit 915
Bei Hai Wan Tai Bldg.
No. 6 Chaoyangmen Beidajie
Beijing, 100027, No. China
Tel: 86-10-85282100 Fax: 86-10-85282104

China - Chengdu

Microchip Technology Consulting (Shanghai)
Co., Ltd., Chengdu Liaison Office
Rm. 2401, 24th Floor,
Ming Xing Financial Tower
No. 88 TIDU Street
Chengdu 610016, China
Tel: 86-28-6766200 Fax: 86-28-6766599

China - Fuzhou

Microchip Technology Consulting (Shanghai)
Co., Ltd., Fuzhou Liaison Office
Unit 28F, World Trade Plaza
No. 71 Wusi Road
Fuzhou 350001, China
Tel: 86-591-7503506 Fax: 86-591-7503521

China - Shanghai

Microchip Technology Consulting (Shanghai)
Co., Ltd.
Room 701, Bldg. B
Far East International Plaza
No. 317 Xian Xia Road
Shanghai, 200051
Tel: 86-21-6275-5700 Fax: 86-21-6275-5060

China - Shenzhen

Microchip Technology Consulting (Shanghai)
Co., Ltd., Shenzhen Liaison Office
Rm. 1315, 13/F, Shenzhen Kerry Centre,
Renminnan Lu
Shenzhen 518001, China
Tel: 86-755-2350361 Fax: 86-755-2366086

Hong Kong

Microchip Technology Hongkong Ltd.
Unit 901-6, Tower 2, Metroplaza
223 Hing Fong Road
Kwai Fong, N.T., Hong Kong
Tel: 852-2401-1200 Fax: 852-2401-3431

India

Microchip Technology Inc.
India Liaison Office
Divyasree Chambers
1 Floor, Wing A (A3/A4)
No. 11, O'Shaugnessey Road
Bangalore, 560 025, India
Tel: 91-80-2290061 Fax: 91-80-2290062

Japan

Microchip Technology Japan K.K.
Benex S-1 6F
3-18-20, Shinyokohama
Kohoku-Ku, Yokohama-shi
Kanagawa, 222-0033, Japan
Tel: 81-45-471- 6166 Fax: 81-45-471-6122

Korea

Microchip Technology Korea
168-1, Youngbo Bldg. 3 Floor
Samsung-Dong, Kangnam-Ku
Seoul, Korea 135-882
Tel: 82-2-554-7200 Fax: 82-2-558-5934

Singapore

Microchip Technology Singapore Pte Ltd.
200 Middle Road
#07-02 Prime Centre
Singapore, 188980
Tel: 65-6334-8870 Fax: 65-6334-8850

Taiwan

Microchip Technology Taiwan
11F-3, No. 207
Tung Hua North Road
Taipei, 105, Taiwan
Tel: 886-2-2717-7175 Fax: 886-2-2545-0139

EUROPE

Denmark

Microchip Technology Nordic ApS
Regus Business Centre
Lautrup hoj 1-3
Ballerup DK-2750 Denmark
Tel: 45 4420 9895 Fax: 45 4420 9910

France

Microchip Technology SARL
Parc d'Activite du Moulin de Massy
43 Rue du Saule Trapu
Batiment A - ler Etage
91300 Massy, France
Tel: 33-1-69-53-63-20 Fax: 33-1-69-30-90-79

Germany

Microchip Technology GmbH
Gustav-Heinemann Ring 125
D-81739 Munich, Germany
Tel: 49-89-627-144 0 Fax: 49-89-627-144-44

Italy

Microchip Technology SRL
Centro Direzionale Colleoni
Palazzo Taurus 1 V. Le Colleoni 1
20041 Agrate Brianza
Milan, Italy
Tel: 39-039-65791-1 Fax: 39-039-6899883

United Kingdom

Arizona Microchip Technology Ltd.
505 Eskdale Road
Winnersh Triangle
Wokingham
Berkshire, England RG41 5TU
Tel: 44 118 921 5869 Fax: 44-118 921-5820

03/01/02

ORLDWIDE

ALES

AND

ERVICE

ÐÐ»ÐµÐºÑ‚Ñ€Ð¾Ð½Ð½Ñ‹Ð¹ ÐºÐ¾Ð¼Ð¿Ð¾Ð½ÐµÐ½Ñ‚: HCS412T

Document Outline

Ð­Ð»ÐµÐºÑ‚Ñ€Ð¾Ð½Ð½Ñ‹Ð¹ ÐºÐ¾Ð¼Ð¿Ð¾Ð½ÐµÐ½Ñ‚: HCS412T

Document Outline

ÐÐ»ÐµÐºÑ‚Ñ€Ð¾Ð½Ð½Ñ‹Ð¹ ÐºÐ¾Ð¼Ð¿Ð¾Ð½ÐµÐ½Ñ‚: HCS412T