HCS410T/SN - Microchip Technology

FEATURES

Security

• Two programmable 64-bit encoder keys

• 16/32-bit bi-directional challenge and response

using one of two keys

• 69-bit transmission length

• 32-bit unidirectional code hopping, 37-bit non-

encrypted portion

• Encoder keys are read protected

• Programmable 28/32-bit serial number

• 60/64-bit, read-protected seed for secure learning

• Three IFF encryption algorithms

• Delayed increment mechanism

• Asynchronous transponder communication

• Queuing information transmitted

Operating

• 2.0V - 6.6V operation, 13V encoder only

operation

• Three switch inputs [S2, S1, S0]—seven functions

• Batteryless bi-directional transponder

• Selectable baud rate and code word blanking

• Automatic code word completion

• Battery low signal transmitted

• Non-volatile synchronization

• PWM or Manchester RF encoding

• Combined transmitter, transponder operation

• Anti-collision of multiple transponders

• Passive proximity activation

• Device protected against reverse battery

• Intelligent damping for high Q LC-circuits

Other

• 37-bit nonencrypted part contains 28/32-bit serial

number, 4/0-bit function code, 1-bit battery low,

2-bit CRC, 2-bit queue

• Simple programming interface

• On-chip tunable RC oscillator (±10%)

• On-chip EEPROM

• 64-bit user EEPROM in transponder mode

• Battery-low LED indication

• SQTP serialization quick-time programming

• 8-pin PDIP/SOIC/TSSOP and die

PACKAGE TYPES

BLOCK DIAGRAM

Typical Applications

• Automotive remote entry systems

• Automotive alarm systems

• Automotive immobilizers

• Gate and garage openers

• Electronic door locks (Home/Office/Hotel)

• Burglar alarm systems

• Proximity access control

HCS410

S2/LED

LC1

VDD

LC0

PWM

GND

PDIP, SOIC

HCS410

S2/LED

LC1

GND

PWM

VDD

LC0

TSSOP

Oscillator

Configuration Register

Power

Control

Wake-up

Logic

Address

Decoding EEPROM

Debounce

Control

and

Queuer

LED

Control

PWM

Driver

PPM

Detector

PWM

PPM

Manch.

Encoder

Transponder

Circuitry

Control Logic

and Counters

Encryption/Increment

Logic

VDD

LCI0

LCI1

PWM

*Secure Learn patent pending.

HCS410

KEELOQ® Code Hopping Encoder and Transponder

40158F.book Page 1 Wednesday, June 1, 2011 10:36 AM

HCS410

DESCRIPTION

The HCS410 is a code hopping transponder device

designed for secure entry systems. The HCS410 uti-

lizes the patented KEELOQ® code hopping system and

bi-directional challenge-and-response for logical and

physical access control. High security learning mecha-

nisms make this a turnkey solution when used with the

KEELOQ decoders. The encoder keys and synchroniza-

tion information are stored in protected on-chip

EEPROM.

A low cost batteryless transponder can be imple-

mented with the addition of an inductor and two capac-

itors. A packaged module including the inductor and

capacitor will also be offered.

A single HCS410 can be used as an encoder for

Remote Keyless Entry (RKE) and a transponder for

immobilization in the same circuit and thereby dramat-

ically reducing the cost of hybrid transmitter/transpon-

der circuits.

1.0 SYSTEM OVERVIEW

1.1 Key Terms

• Anti-Collision – Allows two transponders to be in

the files simultaneously and be verified individu-

ally.

• CH Mode – Code Hopping Mode. The HCS410

transmits a 69-bit transmission each time it is acti-

vated, with at least 32-bits changing each time the

encoder is activated.

• Encoder Key – A unique 64-bit key generated and

programmed into the encoder during the manu-

facturing process. The encoder key controls the

encryption algorithm and is stored in EEPROM on

the encoder device.

•IFF

– Identify friend or foe is a means of validating

a token. A decoder sends a random challenge to

the token and checks that the response of the

token is a valid response.

•K

EELOQ Encryption Algorithm – The high security

level of the HCS410 is based on the patented

KEELOQ technology. A block cipher encryption

algorithm based on a block length of 32 bits and a

key length of 64 bits is used. The algorithm

obscures the information in such a way that even

if the unencrypted/challenge information differs by

only one bit from the information in the previous

transmission/challenge, the next coded transmis-

sion/response will be totally different. Statistically,

if only one bit in the 32-bit string of information

changes, approximately 50 percent of the coded

transmission will change.

•Learn

– The HCS product family facilitates several

learning strategies to be implemented on the

decoder. The following are examples of what can

be done.

Normal Learn –The receiver uses the same infor-

mation that is transmitted during normal operation to

derive the transmitter’s encoder key, decrypt the dis-

crimination value and the synchronization counter.

Secure Learn* – The transmitter is activated through

a special button combination to transmit a stored

60-bit value (random seed) that can be used for key

generation or be part of the key. Transmission of the

random seed can be disabled after learning is com-

pleted.

• Manufacturer’s Code – A 64-bit word, unique to

each manufacturer, used to produce a unique

encoder key in each transmitter (encoder).

• Passive Proximity Activation – When the HCS410

is brought into in a magnetic field without a

command given by the base station, the HCS410

can be programmed to give an RF transmission.

• Transport Code – A 32-bit transport code needs to

be given before the HCS410 can be inductively

programmed. This prevents accidental

programming of the HCS410.

40158F.book Page 2 Wednesday, June 1, 2011 10:36 AM

HCS410

1.2 KEELOQ Code Hopping Encoders

When the HCS410 is used as a code hopping encoder

device, it is ideally suited to keyless entry systems,

primarily for vehicles and home garage door openers.

It is meant to be a cost-effective, yet secure solution to

such systems. The encoder portion of a keyless entry

system is meant to be carried by the user and operated

to gain access to a vehicle or restricted area.

Most keyless entry systems transmit the same code

from a transmitter every time a button is pushed. The

relative number of code combinations for a low end

system is also a relatively small number. These

shortcomings provide the means for a sophisticated

thief to create a device that ‘grabs’ a transmission and

retransmits it later or a device that scans all possible

combinations until the correct one is found.

The HCS410 employs the KEELOQ code hopping tech-

nology and an encryption algorithm to achieve a high

level of security. Code hopping is a method by which

the code transmitted from the transmitter to the

receiver is different every time a button is pushed. This

method, coupled with a transmission length of 69 bits,

virtually eliminates the use of code ‘grabbing’ or code

‘scanning’.

The HCS410 has a small EEPROM array which must

be loaded with several parameters before use. The

most important of these values are:

• A 28/32-bit serial number which is meant to be

unique for every encoder

• 64-bit seed value

• A 64-bit encoder key that is generated at the time

of production

• A 16-bit synchronization counter value.

• Configuration options

The 16-bit synchronization counter value is the basis

for the transmitted code changing for each transmis-

sion, and is updated each time a button is pressed.

Because of the complexity of the code hopping encryp-

tion algorithm, a change in one bit of the synchroniza-

tion counter value will result in a large change in the

actual transmitted code.

Once the encoder detects that a button has been

pressed, the encoder reads the button and updates the

synchronization counter. The synchronization counter

value, the function bits, and the discrimination value

are then combined with the encoder key in the

encryption algorithm, and the output is 32 bits of

encrypted information (Figure 1-1). The code hopping

portion provides up to four billion changing code com-

binations. This data will change with every button

press, hence, it is referred to as the code hopping

portion of the code word.

The 32-bit code hopping portion is combined with the

button information and the serial number to form the

code word transmitted to the receiver. The code word

format is explained in detail in Section 2.2.

FIGURE 1-1: BASIC OPERATION OF A CODE HOPPING TRANSMITTER (ENCODER)

KEELOQ®

Algorithm

Button Press

Information

Encryption

EEPROM Array

32 Bits of

Encrypted Data Serial Number

Transmitted Information

Encoder Key

Sync Counter

Serial Number

40158F.book Page 3 Wednesday, June 1, 2011 10:36 AM

HCS410

1.3 KEELOQ IFF

The HCS410 can be used as an IFF transponder for

verification of a token. In IFF mode the HCS410 is ide-

ally suited for authentication of a key before disarming

a vehicle immobilizer. Once the key has been inserted

in the car’s ignition the decoder would inductively poll

the key validating it before disarming the immobilizer.

IFF validation of the token involves a random challenge

being sent by a decoder to a token. The token then

generates a response to the challenge and sends this

response to the decoder (Figure 1-2). The decoder cal-

culates an expected response using the same chal-

lenge. The expected response is compared to the

response received from the token. If the responses

match, the token is identified as a valid token and the

decoder can take appropriate action.

The HCS410 can do either 16 or 32-bit IFF. The

HCS410 has two encryption algorithms that can be

used to generate a response to a challenge. In addition

there are up to two encoder keys that can be used by

the HCS410. Typically each HCS410 will be pro-

grammed with a unique encoder key(s).

In IFF mode, the HCS410 will wait for a command from

the base station and respond to the command. The

command can either request a read/write from user

EEPROM or an IFF challenge response. A given 16 or

32-bit challenge will produce a unique 16/32-bit

response, based on the IFF key and IFF algorithm

used.

FIGURE 1-2: BASIC OPERATION OF AN IFF TOKEN

IFF Key

Serial Number

KEELOQ®

IFF

Algorithm Serial Number

EEPROM Array

Challenge Received from Decoder

Response

Read by Decoder

40158F.book Page 4 Wednesday, June 1, 2011 10:36 AM

HCS410

2.0 DEVICE OPERATION

The HCS410 can either operate as a normal code hop-

ping transmitter with one or two IFF keys (Figure 2-1)

or as purely an IFF token with two IFF keys (Figure 2-2

and Figure 2-3). When used as a code hopping trans-

mitter the HCS410 only needs the addition of buttons

and RF circuitry for use as a transmitter. Adding the

transponder function to the transmitter requires the

addition of an inductor and two capacitors as shown in

Figure 2-1 and Figure 2-2. A description of each pin is

given in Table 2-1. Table 2-2 shows the function codes

for using the HCS410.

FIGURE 2-1: COMBINED TRANSMITTER/

TRANSPONDER CIRCUIT

FIGURE 2-2: TRANSPONDER CIRCUIT

FIGURE 2-3: 2-WIRE, 1 OR 2-KEY IFF

TOKEN

Figure 2-4 shows how to use the HCS410 with a 12V

battery as a code hopping transmitter. The circuit uses

the internal regulator, normally used for charging a

capacitor/battery in LC mode, to generate a 6V supply

for the HCS410.

FIGURE 2-4: HCS410 ENCODER WITH 12V

BATTERY

FIGURE 2-5: LED CONNECTION TO

S2/LED OUTPUT

FIGURE 2-6: LC PIN BLOCK DIAGRAM

1 µF

Data I/O

6.3V

12V

Pulse

VDD

S2/LED

220Ω

60k

30Ω

VDD

6.3V

Damp

Out

MOD

Detector

Rectifier,

Damping,

Clamping

15V

100Ω

LC1

LC0

40158F.book Page 5 Wednesday, June 1, 2011 10:36 AM

HCS410

2.1 Pinout Description

The HCS410 has the same footprint as all of the other

devices in the KEELOQ family, except for the two pins

that are reserved for transponder operations and the

LED that is now located at the same position as the S2

switch input.

• S[0:1] – are inputs with Schmitt Trigger detectors

and an internal 60k¾ (nominal) pull-down

resistors.

• S2/LED – uses the same input detection circuit as

S0/S1 but with an added PMOS transistor con-

nected to VDD capable of sourcing enough current

to drive an LED.

• LC[0:1] – is the transponder interface pins to be

connected to an LC circuit for inductive communi-

cation. LC0 is connected to a detector for data

input. Data output is achieved by clamping LC0

and LC1 to GND through two NMOS transistors.

These pins are also connected to a rectifier and a

regulator, providing power to the rest of the logic

and for charging an external power source (Bat-

tery/Capacitor) through VDD.

The input impedance of the LC pins is a function of

input voltage. At low voltages, the input impedance is

in the order of mega-ohms. When laying out a PC

board, care should be taken to ensure that there

is no cross coupling between the LC pins and

other traces on the board. Glitches on the LC lines

will cause the device to reset. A high-value resistor

(220 KW) between LC0 and GND can be added to

reduce sensitivity.

TABLE 2-1: PINOUT DESCRIPTION

Name Pin Number Description

S0 1 Switch input 0

S1 2 Switch input 1

S2/LED 3 Switch input 2/LED output, Clock pin for programming mode

LC1 4 Transponder interface pin

VSS 5 Ground reference connection

PWM 6 Pulse width modulation (PWM)

output pin/Data pin for

programming mode

LC0 7 Transponder interface pin

VDD 8 Positive supply voltage connection

TABLE 2-2: FUNCTION CODES

LC0 S2 S1 S0 Comments

10001Normal Code Hopping transmission

20010Normal Code Hopping transmission

30011

Delayed seed transmission if allowed by SEED and TMPSD/Normal

Code Hopping transmission

40100Normal Code Hopping transmission

50101Normal Code Hopping transmission

60110Normal Code Hopping transmission

70111

Immediate seed transmission if allowed by SEED and TMPSD/Normal

Code Hopping transmission

81000Transponder mode

40158F.book Page 6 Wednesday, June 1, 2011 10:36 AM

HCS410

2.2 Code Hopping Mode (CH Mode)

The HCS410 wakes up upon detecting a switch closure

and then delays approximately 30 ms for switch

debounce (Figure 2-7). The synchronization counter

value, fixed information, and switch information are

encrypted to form the code hopping portion. The

encrypted or code hopping portion of the transmission

changes every time a button is pressed, even if the

same button is pushed again. Keeping a button

pressed for a long time results in the same code word

being transmitted until the button is released or time-

out occurs. A code that has been transmitted will not

occur again for more than 64K transmissions. Overflow

information programmed into the encoder can be used

by the decoder to extend the number of unique trans-

missions to more than 192K.

If, during the transmit process, it is detected that a new

button(s) has been added, a reset will immediately be

forced and the code word will not be completed. Please

note that buttons removed will not have any effect on

the code word unless no buttons remain pressed in

which case the current code word will be completed

and the power down will occur. If, after a button combi-

nation is pressed, and the same button combination is

pressed again within 2 seconds of the first press, the

current transmission will be aborted and a new trans-

FIGURE 2-7: CODE HOPPING ENCODER OPERATION

20-second

time-out

Transmitted

2 second

time-out

completed?

All buttons

released?

Sample Inputs

Update Sync Info

Encrypt With

Transmit

Encoder Key

Power-up

(A button has been

pressed (Note1))

Buttons added?

Ye s

(Note 1)

7 complete code

words?

Complete current

code word while

checking buttons

(Note 2)

Stop transmitting

DINC Set?

Power down

Buttons

pressed?

(Note 1)

Same as

press?

Increment queue

counter

20 second

time-out

completed?

Buttons

pressed?

(Note 1)

Increase sync

counter

by 12

immediately

Ye s

Note 1: 30 ms debounce on press and release of all buttons.

2: Completes a minimum of 3 code words if MTX3 is set.

No DINC

Set?

Ye s

40158F.book Page 7 Wednesday, June 1, 2011 10:36 AM

HCS410

2.2.1 TRANSMISSION DATA FORMAT

The HCS410 transmission (CH Mode) is made up of

several parts (Figure 2-10 and Figure 2-11). Each

transmission is begun with a preamble and a header,

followed by the encrypted and then the fixed data. The

actual data is 69 bits which consists of 32 bits of

encrypted data and 37 bits of fixed data. Each trans-

mission is followed by a guard period before another

transmission can begin. Refer to Table 6-4

and Table 6-5 for transmission timing specifications.

The combined encrypted and nonencrypted sections

increase the number of combinations to 1.47 x 1020.

The HCS410 transmits a 69-bit code word when a but-

ton is pressed. The 69-bit word is constructed from a

Fixed Code portion and Code Hopping portion

(Figure 2-8).

The Encrypted Data is generated from 4 function bits,

2 overflow bits, and 10 discrimination bits, and the 16-

bit synchronization counter value (Figure 2-8).

The Nonencrypted Code Data is made up of 2 QUE

bits, 2 CRC bits, a VLOW bit, 4 function bits, and the

28-bit serial number. If the extended serial number

(32 bits) is selected, the 4 function code bits will not be

transmitted (Figure 2-8).

FIGURE 2-8: HOP CODE WORD ORGANIZATION (RIGHT-MOST BIT IS CLOCKED OUT FIRST)

FIGURE 2-9: SEED CODE WORD ORGANIZATION

Fixed Code Data Encrypted Code Data

69 bits

of Data

Tr a n s m i t te d

MSB LSB

CRC

(2 bit)

VLOW

(1 bit)

Button

Status*

(4 bits)

28-bit

Serial Number

Overflow (2 bits)

bits (10 bits)

16-bit

Synchronization

CRC

(2 bits)

VLOW

(1 bit) +Serial Number and

Button Status (32 bits) + 32 bits of Encrypted Data

QUE

(Q1, Q0

S2 S1 S0 0

Button

Status

(4 bits)

S2 S1 S0 0

(2 bits)

bit) Counter Value

Discrimination

and

* Optional.

Fixed Code Data

69 bits

of Data

Tr a n s m i t te d

CRC

(2 bit)

VLOW

(1 bit)

Button*

Status

(4 bits)

CRC

(2 bits)

VLOW

(1 bit) +

QUE

QUE0

(Q1, Q0

S2 S1 S0 0

(2 bits)

bit)

Unencrypted

Button

(4 bits)

SEED

(60 bits)

SEED

* Optional.

40158F.book Page 8 Wednesday, June 1, 2011 10:36 AM

HCS410

2.2.2 TRANSMISSION DATA MODULE

The Data Modulation Format is selectable between

Pulse Width Modulation (PWM) format and Manchester

encoding. Both formats are preceded by a preamble

and synchronization header, followed by the 69-bits of

data. Manchester encoding has a leading and closing

‘1’ for each code word.

The same code word is continuously sent as long as

the input pins are kept high with a guard time separat-

ing the code words. All of the timing values are in mul-

tiples of a Basic Timing Element (TE), which can be

changed using the baud rate option bits.

FIGURE 2-10: TRANSMISSION FORMAT—MANCH = 0

FIGURE 2-11: TRANSMISSION FORMAT—MANCH = 1

LOGIC "1"

Code Word

Guard

Time

Preamble Sync Encrypted

TX Data Fixed Code

BIT

LOGIC "0"

3579

46810

CODE WORD:

TOTAL TRANSMISSION: Preamble Sync Encrypt Fixed Guard

1 CODE WORD

12 45 6

Preamble Sync Encrypt

14 15 16

Data

Guard

Preamble Sync Encrypted Fixed Code

LOGIC "0"

CODE WORD:

TOTAL TRANSMISSION: Sync Encrypt Fixed Guard

1 CODE WORD

12 456

Preamble Sync Encrypt

14 15 16

LOGIC "1"

Start bit Stop bit

CODE WORD

Preamble

Time

Data

40158F.book Page 9 Wednesday, June 1, 2011 10:36 AM

HCS410

2.3 Code Hopping Mode Special Features

2.3.1 CODE WORD COMPLETION

Code word completion is an automatic feature that

ensures that the entire code word is transmitted, even

if the button is released before the transmission is com-

plete. The HCS410 encoder powers itself up when a

button is pushed and powers itself down after the com-

mand is finished (Figure 2-7). If MTX3 is set in the con-

figuration word, a minimum of three transmissions will

be transmitted when the HCS410 is activated, even if

the buttons are released.

If less than seven words have been transmitted when

the buttons are released, the HCS410 will complete the

current word. If more than seven words have been

transmitted, and the button is released, the PWM out-

put is immediately switched off.

2.3.2 CODE WORD BLANKING ENABLE

Federal Communications Commission (FCC) part 15

rules specify the limits on fundamental power and

harmonics that can be transmitted. Power is calculated

on the worst case average power transmitted in a

100ms window. It is therefore advantageous to

minimize the duty cycle of the transmitted word. This

can be achieved by minimizing the duty cycle of the

individual bits and by blanking out consecutive words.

Code Word Blanking Enable (CWBE) is used for

reducing the average power of a transmission

(Figure 2-12). Using the CWBE allows the user to

transmit a higher amplitude transmission if the

transmission length is shorter. The FCC puts

constraints on the average power that can be

transmitted by a device, and CWBE effectively

prevents continuous transmission by only allowing the

transmission of every second or fourth word. This

reduces the average power transmitted and hence,

assists in FCC approval of a transmitter device.

The HCS410 will either transmit all code words, 1 in 2

or 1 in 4 code words, depending on the baud rate

selected and the code word blanking option. See

Section 3.7 for additional details.

2.3.3 CRC (CYCLE REDUNDANCY CHECK) BITS

The CRC bits are calculated on the 65 previously trans-

mitted bits. The CRC bits can be used by the receiver

to check the data integrity before processing starts. The

CRC can detect all single bit and 66% of double bit

errors. The CRC is computed as follows:

EQUATION 2-1: CRC CALCULATION

and

with

and Din the nth transmission bit 0 ð n ð 64

FIGURE 2-12: CODE WORD BLANKING ENABLE

CRC 1[]

n1+CRC 0[]

nDin

⊕=

CRC 0[]

n1+CRC 0[]

nDin

⊕()CRC 1[]

⊕=

CRC 10,[]

00=

One Code Word

CWBE Disabled

(All words transmitted)

CWBE Enabled

(1 out of 2 transmitted)

Amplitude

CWBE Enabled

(1 out of 4 transmitted) 4A

Time

•Patents have been applied for.

40158F.book Page 10 Wednesday, June 1, 2011 10:36 AM

HCS410

2.3.4 SEED TRANSMISSION

In order to increase the level of security in a system, it

is possible for the receiver to implement what is known

as a secure learning function. This can be done by uti-

lizing the seed value on the HCS410 which is stored in

EEPROM. Instead of the normal key generation

method being used to create the encoder key, this seed

value is used and there should not be any mathemati-

cal relationship between serial numbers and seeds for

the best security. See Section 3.7.3 for additional

details.

2.3.5 PASSIVE PROXIMITY ACTIVATION

If the HCS410 is brought into a magnetic field it enters

IFF mode. In this mode it sends out ACK pulses on the

LC lines. If the HCS410 doesn't receive any response

to the first set of ack pulses within 50 ms the HCS410

will transmit a normal code hopping transmission for 2

seconds if XPRF is set in the configuration word. The

function code during this transmission is S2:S0 = 000.

2.3.6 AUTO-SHUTOFF

The Auto-shutoff function automatically stops the

device from transmitting if a button inadvertently gets

pressed for a long period of time. This will prevent the

device from draining the battery if a button gets

pressed while the transmitter is in a pocket or purse.

Time-out period is approximately 20 seconds.

2.3.7 VLOW: VOLTAGE LOW INDICATOR

The VLOW bit is transmitted with every transmission

(Figure 2-8). VLOW is set when the operating voltage

has dropped below the low voltage trip point, approxi-

mately 2.2V or 4.4V selectable at 25°C. This VLOW sig-

nal is transmitted so the receiver can give an indication

to the user that the transmitter battery is low.

2.3.8 QUE0:QUE1: QUEUING INFORMATION

If a button is pressed, released for more than 30 ms,

and pressed again within 2 seconds of the first press,

the QUE counter is incremented (Figure 2-7). The

transmission that the HCS410 is busy with is aborted

and a new transmission is begun with the new QUE bits

set. These bits can be used by the decoder to perform

secondary functions using only a single button without

the requirement that the decoder receive more than

one completed transmission. For example if none of

the QUE bits are set the decoder only unlocks the

driver’s door, if QUE0 is set (double press on the trans-

mitter) the decoder unlocks all the doors.

FIGURE 2-13: QUE COUNTER TIMING DIAGRAM

Note 1: The QUE will not overflow.

2: The button must be pressed for more than

50 ms.

Input

DIO

Transmission

1st Button Press All Buttons Released 2nd Button Press

TLOW>30 ms

t = 0 t > 50 ms

t <2S

t = 0

QUE = 002QUE = 012

40158F.book Page 11 Wednesday, June 1, 2011 10:36 AM

HCS410

2.3.9 LED OUTPUT

The S2/LED line can be used to drive a LED when the

HCS410 is transmitting. If this option is enabled in the

configuration word the S2 line is driven high periodi-

cally when the HCS410 is transmitting as shown in

Figure 2-14. The LED output operates with a 30 ms on

and 480 ms off duty cycle when the supply voltage is

above the level indicated by the VLOW bit in the config-

uration word. When the supply voltage drops below the

voltage indicated by the VLOW bit the HCS410 will indi-

cate this by turning the LED on for 200ms at the start of

a transmission and remain off for the rest of the trans-

mission.

2.3.10 DELAYED INCREMENT

The HCS410 has a delayed increment feature that

increments the counter by 12, 20 seconds after the last

button press occurred. The 20-second time-out is reset

and the queue counter will increment if another press

occurs before the 20 seconds expires. The queue

counter is cleared after the buttons have been released

for more than 2 seconds. Systems that use this feature

will circumvent the latest jamming-code grabbing

attackers.

2.3.11 OTHER CONFIGURABLE OPTIONS

Other configurable code hopping options include an

• Transmission-rate selection

• Extended serial number.

These are described in more detail in Section 3.7.

FIGURE 2-14: LED INDICATION DURING TRANSMISSION

200 ms 200 ms

480 ms

30 ms

S Input

LED

VDD = VLOW Level

LED

VDD < VLOW LEVEL

40158F.book Page 12 Wednesday, June 1, 2011 10:36 AM

HCS410

2.4 IFF Mode

IFF mode allows the decoder to perform an IFF valida-

tion, to write to the user EEPROM and to read from the

user EEPROM. Each operation consists of the decoder

sending an opcode data and the HCS410 giving a

response.

There are two IFF modes: IFF1 and IFF2. IFF1 allows

only one key IFF, while IFF2 allows two keys to be

used.

It is possible to use the HCS410 as an IFF token with-

out using a magnetic field for coupling. The HCS410

can be directly connected to the data line of the

decoder as shown in Figure 2-3. The HCS410 gets its

power from the data line as it would in normal transpon-

der mode. The communication is identical to the com-

munication used in transponder mode.

2.4.1 IFF MODE ACTIVATION

The HCS410 will enter IFF mode if the capacitor/induc-

tor resonant circuit generates a voltage greater than

approximately 1.0 volts on LC0. After the verified appli-

cation of power and elapse of the normal reset period,

the device will start responding by pulsing the DATA

line (LC0/1) with pulses as shown in Figure 2-17. This

action will continue until the pulse train is terminated by

receiving a start signal of duration 2TE, on the LC inputs

before the next expected marker pulse. The device

now enters the IFF mode and expects to receive an

‘Opcode’ and a 0/16/32-bit Data-stream to react on.

The data rate (T

E) is determined by the TBSL bits in the

configuration word. See Section 3.0 for additional

details.

2.4.2 IFF DECODER COMMANDS

As shown in Figure 2-15, a logic 1 and 0 are differenti-

ated by the time between two rising edges. A long

pulse indicates a 1; a short pulse, a 0.

FIGURE 2-15: MODULATION FOR IFF COMMUNICATION

FIGURE 2-16: OVERVIEW OF IFF OPERATION

Note: When IFF2 is enabled, seed transmissions

will not be allowed.

3 TETE

5 TE

TETE

2 TETE

Start or

bit

PPM Decoder Commands PPM Encoder Response

Activate Opcode 32/16-bit Challenge 32/16-bit IFF Response Opcode

Activate Opcode 16-bit Data OK Opcode

Activate Opcode 16-bit Data

IFF

WRITE

READ

Opcode

40158F.book Page 13 Wednesday, June 1, 2011 10:36 AM

HCS410

FIGURE 2-17: DECODER IFF COMMANDS AND WAVEFORMS

ACK pulses Opcode

Tr a n sp o r t

Code

32 bits

ACK

Writing

bit0

bit1

bit2

bit3

bit4

TBITC

Data

16 bits

TOTD TTTD

TWR

Only when writing Serial

Number, Config or IFF

programming

Serial number

1 to 32 bits

Encoder

Select

ACK

ACK pulses

Challenge

16/32 bits Response

16/32 bits

ACK pulses Opcode TOTD

Response

Start TRT 16 bits

Ack pulsesRead

Write/Program

Challenge

Encoder Select

2 TE

Repeat 18 times for programming

3TE3TE

TWR

Preamble

TABLE 2-3: IFF TIMING PARAMETERS

Parameter Symbol Minimum Typical Maximum Units

Time Element

IFFB = 0

IFFB = 1

TE—

—

200

100

—

μs

PPM Command Bit Time

Data = 1

Data = 0

TBITC 3.5

5.5

—

PPM Response Bit Time

Data = 1

Data = 0

TBITR —

—

PPM Command Minimum High Time TPMH 1.5 — — TE

Response Time (Minimum for Read) TRT 6.5 — — ms

Opcode to Data Input Time T

OTD 1.8 — — ms

Transport Code to Data Input Time TTTD 6.8 — — ms

IFF EEPROM Write Time (16 bits) TWR ——30ms

40158F.book Page 14 Wednesday, June 1, 2011 10:36 AM

HCS410

2.4.3 HCS410 RESPONSES

The responses from the HCS410 are in PPM format.

See Figure 2-17 for additional information. Every

response from the HCS410 is preceded by a “2 bit pre-

amble” of 012, and then 16/32 bits of data.

2.4.4 IFF RESPONSE

The 16/32-bit response to a 16/32-bit challenge, is

transmitted once, after which the device is ready to

accept another command. The same applies to the

result of a Read command. The opcode written to the

device specifies the challenge length and algorithm

used. The response always starts with a leading pre-

amble of 012 followed by the 16/32 bits of data.

2.4.5 IFF WRITE

The decoder can write to USER[0:3], SER[0:1], and the

configuration word in the EEPROM.

After the HCS410 has written the word into the

EEPROM, it will give two acknowledge pulses (TE wide

and TE apart) on the LC pins.

When writing to the serial number or configuration

word, the user must send the transport code before the

write will begin (Section 3.4) .

2.4.6 IFF READ

The decoder can read USER[0:3], SER[0:1], and the

configuration word in the EEPROM. After the data has

been read, the device is ready to receive a command

again.

Each read command is followed by a 16-bit data

response. The response always starts with a leading

preamble of 012 and then the 16-bits of data.

2.4.7 IFF PROGRAMMING

Upon receiving a programming opcode and the trans-

port code, the EEPROM is erased (Section 3.4). There-

after, the first 16 bits of data can be written. After

indicating that a write command has been successfully

completed the device is ready to receive the next 16

bits. After a complete memory map was received, it will

be transmitted in PPM format on the LC pins as 16-bit

words. This enables wireless programming of the

device.

After the EEPROM is erased, the configuration word is

reloaded. This results in oscillator tuning bits of 0000

being used during programming. When using IFF pro-

gramming, the user should read the configuration word

and store the oscillator bits in the memory map to be

programmed. A program command should be sent and

the next set of ACK pulses transmitted by the HCS410

should be used to determine the TE. A second program

command can then be sent, and the device pro-

grammed using the TE just calibrated.

Note: If the configuration word is written, the

device must be reset to allow the new con-

figuration settings to come into effect.

40158F.book Page 15 Wednesday, June 1, 2011 10:36 AM

HCS410

2.5 IFF Opcodes

TABLE 2-4: LIST OF IFF COMMANDS

Command Description Expected data In Response

00000 Select HCS410, used if Anti-

collision enabled

1 to 32 bits of the serial number

(SER)

Encoder select acknowledge if

SER match

00001 Read configuration word None 16-bit configuration word

00010 Read low serial number None Lower 16 bits of serial number

(SER0)

00011 Read high serial number None Higher 16 bits of serial number

(SER1)

00100 Read user area 0 None 16 Bits of User EEPROM USR0

00101 Read user area 1 None 16 Bits of User EEPROM USR1

00110 Read user area 2 None 16 Bits of User EEPROM USR2

00111 Read user area 3 None 16 Bits of User EEPROM USR3

01000 Program HCS410 EEPROM Transport code (32 bits); Com-

plete memory map: 18 x 16 bit

words (288 bits)

Write acknowledge pulse after

each 16-bit word, 288 bits trans-

mitted in 18 bursts of 16-bit

words

01001 Write configuration word Transport code (32 bits); 16 Bit

configuration word

Write acknowledge pulse

01010 Write low serial number Transport code (32 bits); Lower

16 bits of serial number (SER0)

Write acknowledge pulse

01011 Write high serial number Transport code (32 bits); Higher

16 bits of serial number (SER1)

Write acknowledge pulse

01100 Write user area 0 16 Bits of User EEPROM USR0 Write acknowledge pulse

01101 Write user area 1 16 Bits of User EEPROM USR1 Write acknowledge pulse

01110 Write user area 2 16 Bits of User EEPROM USR2 Write acknowledge pulse

01111 Write user area 3 16 Bits of User EEPROM USR3 Write acknowledge pulse

1X000 IFF1 using key-1 and IFF

algorithm

32-Bit Challenge 32-Bit Response

1X001 IFF1 using key-1 and HOP

algorithm

32-Bit Challenge 32-Bit Response

1X100 IFF2 32-bit using key-2 and IFF

algorithm

32-Bit Challenge 32-Bit Response

1X101 IFF2 32-bit using key-2 and HOP

algorithm

32-Bit Challenge 32-Bit Response

40158F.book Page 16 Wednesday, June 1, 2011 10:36 AM

HCS410

2.6 IFF Special Features

2.6.1 ANTI-COLLISION (ACOLI)

When the ACOLI bit is set in the configuration word,

anti-collision mode is entered. The HCS410 will start

sending ACK pulses when it enters a magnetic field.

The ACK pulses stop as soon as the HCS410 detects

a start bit from the decoder. A ‘select encoder’ opcode

(00000) is then sent out by the decoder, followed by a

32-bit serial number. If the serial number matches the

HCS410’s serial number, the HCS410 will acknowl-

edge with the acknowledge sequence as shown in

Figure 2-18. The HCS410 can then be addressed as

normal. If the serial number does not match, the IFF

encoder will stop transmitting ACK pulses until it is

either removed from the field or the correct serial num-

ber is given.

FIGURE 2-18: SERIAL NUMBER CORRECT

ACKNOWLEDGE SEQUENCE

2.6.2 TRANSPONDER IN/RF OUT

When in transponder mode with ACOLI and XPRF set,

the outputs of the HCS410’s LC0:LC1 pins are echoed

on the PWM output line. After transmitting the data on

the LC pins, the data is then transmitted on the PWM

line. The transmission format mirrors a code hopping

transmission. The response replaces the 32-bit code

hopping portion of the transmission. If the response is

a 16-bit response, the 16 bits are duplicated to make up

the 32-bit code hopping portion. The preamble, serial

number, CRC, and queuing bits are all transmitted as

normal (Figure 2-19).

This feature will be used in applications which use RF

for long distance unidirectional authentication and short

distance IFF.

2.6.3 INTELLIGENT DAMPING

If the LC circuit on the transponder has a high Q-factor,

the circuit will keep on resonating for a long time after

the field has been shut down by the decoder. This

makes fast communication from the decoder to the

HCS410 difficult. If the IDAMP bit is set to 0, the

HCS410 will clamp the LC pins for 5 µs every 1/4 TE,

whenever the HCS410 is expecting data from the

decoder. The intelligent dumping pulses start 64 TE

after the acknowledge pulses have been sent and con-

tinue for 64 TE. If the HSC410 detects data from the

base station while sending out dump pulses, the dump

pulses will continue to be sent. This option can be set

in the configuration word.

2.7 LED Indicator

If a signal is detected on LC0, the LED pin goes high for

30 ms every 8s (IFFB = 0) or 4s (IFFB 1) to indicate that

the power source is charging.

FIGURE 2-19: IFF INDUCTIVE IN RF OUT

FIGURE 2-20: LED INDICATOR WHEN CHARGING POWER SOURCE

LC0/1

3 TE3 TE

Note: If code word blanking is enabled, the

HCS410 will not give any ACK pulses after

a read, write or IFF.

Preamble

Header

Response

(32 bits)

Fixed Code

(37 bits)

PWM

LCI0/1

32-bit Response

16-bit

Response

16-bit

Response

Encoder

Select ACK Opcode

(Read)

Response

(2*+16 bits) Next

Ack

*2-bit preamble precedes the data.

LC0

LED

IFFB = 0

LED

IFFB = 1

4s 8s 30 ms

2s 4s 30 ms

*Patents have been applied for.

40158F.book Page 17 Wednesday, June 1, 2011 10:36 AM

HCS410

3.0 EEPROM ORGANIZATION AND

CONFIGURATION

The HCS410 has nonvolatile EEPROM memory which

is used to store user programmable options. This infor-

mation includes encoder keys, serial number, and up to

64-bits of user information.

The HCS410 has two modes in which it operates as

specified by the configuration word. In the first mode

the HCS410 has a single encoder key which is used for

encrypting the code hopping portion of a CH Mode

transmission and generating a response during IFF val-

idation. Seed transmissions are allowed in this mode.

In the second mode the HCS410 is a transponder

device with two encoder keys.

The two different operating modes of the HCS410 lead

to different EEPROM memory maps.

In IFF1 mode, the HCS410 can act as a code hopping

encoder with Seed transmission, and as an IFF token

with one key.

In IFF2 mode, the HCS410 is able to act as a code hop-

ping transmitter and an IFF token with two encoder

keys.

3.1 Encoder Key 1 and 2

The 64-bit encoder key1 is used by the transmitter to

create the encrypted message transmitted to the

receiver in Code Hopping Mode. An IFF operation, can

use encoder key1 or key2 to generate the response to

a challenge received. The key(s) is created and pro-

grammed at the time of production using a key genera-

tion algorithm. Inputs to the key generation algorithm

are the serial number or seed for the particular

transmitter being used and a secret manufacturer’s

code. While a number of key generation algorithms are

supplied by Microchip, a user may elect to create their

own method of key generation. This may be done pro-

viding that the decoder is programmed with the same

means of creating the key for decryption purposes. If a

seed is used (CH Mode), the seed will also form part of

the input to the key generation algorithm.

3.2 Discrimination Value and Overflow

The discrimination value forms part of the code hop-

ping portion of a code hopping transmission. The least

significant 10 bits of the discrimination value are typi-

cally set to the least significant bits of the serial number.

The most significant 2 bits of the discrimination value

are the overflow bits (OVR1: OVR0). These are used to

extend the range of the synchronization counter. When

the synchronization counter wraps from FFFF16 to

000016 OVR0 is cleared and the second time a wrap

occurs OVR1 is cleared.

Once cleared, the overflow bits cannot be set again,

thereby creating a permanent record of the counter

overflow.

3.3 16-bit Synchronization Counter

This is the 16-bit synchronization counter value that is

used to create the code hopping portion for transmis-

sion. This value will be changed after every transmis-

sion. The synchronization counter is not used in IFF

mode.

IFF1 Mode

64-bit Encoder Key 1

64-bit Seed/Transport Code

(SEED0, SEED1, SEED2, SEED3)

32-bit Serial Number

(SER0, SER1)

64-bit User Area

(USR0, USR1, USER2, USR3)

10-bit Discrimination Value and 2 Overflow Bits.

16-bit Synchronization Counter

Configuration Data

IFF2 Mode

64-bit Encoder Key 1

64-bit Encoder Key 2/Transport Code

32-bit Serial Number

(SER0, SER1)

64-bit User EEPROM

(USR0, USR1, USER2, USR3)

10-bit Discrimination Value and 2 Overflow Bits.

16-bit Synchronization Counter

Configuration Data

*Patents have been applied for.

40158F.book Page 18 Wednesday, June 1, 2011 10:36 AM

HCS410

3.4 60/64-bit Seed Word/Transport Code

This is the 60-bit seed code that is transmitted when

seed transmission is selected. This allows the system

designer to implement the secure learn feature or use

this fixed code word as part of a different key genera-

tion/tracking process or purely as a fixed code trans-

mission. The seed is not available in IFF2-mode. A

Seed transmission can be initiated in two ways,

depending on the button inputs (Figure 3-1).

Seed transmission is available for function codes

(Table 2-2) S[2:0] = 111 and S[2:0] = 011 (delayed). The

delayed seed transmission starts with a normal code

hopping transmission being transmitted for 3 seconds,

before switching to a seed transmission. The two seed

transmissions are shown in Figure 3-1.

The least significant 32-bits of the seed are used as the

transport code. The transport code is used to write-pro-

tect the serial number, configuration word, as well as

preventing accidental programming of the HCS410

when in IFF mode.

3.5 Encoder Serial Number

There are 32 bits allocated for the serial number and a

selectable configuration bit (XSER) determines

whether 32 or 28 bits will be transmitted. The serial

number is meant to be unique for every transmitter.

3.6 User Data

The 64-bit user EEPROM can be reprogrammed and

read at any time using the IFF interface.

FIGURE 3-1: SEED TRANSMISSION

Note: If both SEED and TMPSD are set, IFF2

mode is enabled.

All examples shown with XSER = 1 & SEED = 1

When S[2:0] = 111, the 3-second delay is not applicable:

Que [1:0], CRC [1:0], SEED_3 (12 bits) SEED_2 SEED_1 SEED_0

Data transmission direction

For S[2:0] = 011 before the 3-second delay: 16-bit Data Word 16-bit Counter

Encrypt

SER_1 SER_0 Encrypted Data

For S[2:0] = 011 after the 3-second delay (Note 1):

Data transmission direction

Note 1: For Seed Transmission, SEED_3 and SEED_2 are transmitted instead of SER_1 and SER_0, respectively.

SEED_3 (12 bits) SEED_2 SEED_1 SEED_0

Data transmission direction

VLOW, S[2:0]

Que [1:0], CRC [1:0]

+ VLOW, S [2:0]

Que [1:0], CRC [1:0],

VLOW, S [2:0]

40158F.book Page 19 Wednesday, June 1, 2011 10:36 AM

HCS410

3.7 Configuration Data

The configuration data is used to select various

encoder options. Further explanations of each of the

bits are described in the following sections.

3.7.1 CWBE: CODE WORD BLANKING ENABLE

BSL: BAUD RATE SELECT

Selecting this option allows code blanking as shown in

Table 3-3. If this option is not selected, all code words

are transmitted.

3.7.2 IDAMP: INTELLIGENT DAMPING

If IDAMP is set to ‘1’ intelligent damping is disabled.

3.7.3 SEED, TMPSD: SEED TRANSMISSION

* Seed transmissions are allowed till the sychroniza-

tion counter crosses a XX7F16 boundary. e.g. If the

counter is initialized to 000016 when the device is

programmed, seed transmissions will be allowed

until the counter wraps from 007F16 to 008016 giving

the user 127 transmissions before seed transmis-

sions are disabled.

3.7.4 OSC: OSCILLATOR TUNING BITS

These bits allow the onboard oscillator to be tuned to

within 10% of the nominal oscillator speed over both

temperature and voltage.

TABLE 3-1: CONFIGURATION OPTIONS

SEED

Symbol Description

CWBE Code Word Blanking Enable

IDAMP Intelligent Damping for High Q LC Tank.

SEED/

IFF2

Enable Seed Transmissions

TMPSD/

IFF2

Temporary Seed Transmissions

OSC0:3 Onboard Oscillator Tuning Bits

MTX3 Minimum 3 Code Words Transmitted

VLOW Low Voltage Trip Point Selection

LED Enable LED output

BSL0:1 Baudrate Select

TBSL Transponder Baud Rate

MANCH Manchester Modulation Mode

ACOLI Anti Collision Communication Enable

XPRF Passive Proximity Activation

DINC Delayed Increment Enable

XSER Extended Serial Number

SEED TMPSD Description

00No Seed/1 IFF Key

01Seed Limited*

10Always Enabled

11IFF2/No Seed/2

IFF Keys

TABLE 3-2: OSCILLATOR TUNING

OSC Description

1000 Fastest

1001

1010

•

1111

Faster

0000 Nominal

0001

0010

•

0110

Slower

0111 Slowest

TABLE 3-3: BAUD RATE SELECTION

Code Hopping Transmissions (TE) Transponder Communication (TE)

BSL 1 BSL 0 PWM Manchester Codes Word

Transmitted* TBSL PPM

00400 μs 800 μs All 0 200 μs

01200 μs 400 μs1 of 2 — —

10100 μs 200 μs1 of 2 — —

11100 μs 200 μs 1 of 4 1 100 μs

Note: *If code word blanking is enabled.

40158F.book Page 20 Wednesday, June 1, 2011 10:36 AM

HCS410

3.7.5 MTX3: MINIMUM CODE WORDS

COMPLETED

If this bit is set, the HCS410 will transmit a minimum of

3 words before it powers itself down. If this bit is

cleared, the HCS410 will only complete the current

transmission. This feature will only work if VDD is con-

nected directly to the battery as shown in Figure 2-1.

3.7.6 VLOW: LOW VOLTAGE TRIP POINT

The low voltage trip point select bit is used to tell the

HCS410 what Vdd level is being used. This information

will be used by the device to determine when to send

the voltage low signal to the receiver. When this bit is

set, the Vdd level is assumed to be operating from a 5

volt or 6 volt supply. If the bit is cleared, then the Vdd

level is assumed to be 3.0 volts. Refer to Figure 6-3 for

voltage trip point. When the battery reaches the Vlow

point, the LED will flash once for 200 ms on during a

code hopping transmission.

3.7.7 LED: OUTPUT ENABLE

If this bit is set, the S2 doubles as an LED output line.

If this bit is cleared (0), S2 is only used as an input.

3.7.8 TBSL: TRANSPONDER BAUD RATE

SELECT

This option selects the baud rate for IFF communica-

tion between a TE of 100 µs or 200 µs.

3.7.9 MANCH: MANCHESTER CODE

ENCODING

MANCH selects between Manchester code modulation

and PWM modulation in code hopping mode. If

MANCH = 1, Manchester code modulation is selected.

If MANCH is cleared, PWM modulation is selected.

3.7.10 ACOLI: ANTI-COLLISION

COMMUNICATION AND

XPRF: TRANSPONDER ECHOING

ON PWM OUTPUT

ACOLI = 1, XPRF = 0

If ACOLI is set the anti-collision operation during bi-

directional transponder mode (IFF) is enabled. This

feature is useful in situations where multiple transpon-

ders enter the magnetic field simultaneously.

ACOLI = 0, XPRF = 1

If XPRF is set, and ACOLI is cleared, proximity activa-

tion is enabled. the HCS410 starts sending out ACK

pulses when it detects a magnetic field. If the HCS410

doesn’t receive a start bit from the decoder within 50

ms of sending the first set of ACK pulses, the HCS410

will transmit a code hopping transmission PWM pin for

2 seconds.

ACOLI = 1, XPRF = 1

If both the ACOLI and XPRF are set, all of the HCS410

transponder responses are echoed on the PWM out-

put, as described in Section 2.6.2.

3.7.11 DINC: DELAYED INCREMENT

If DINC is set to ‘1’, the delayed increment feature is

enabled. If DINC is cleared, the counter only incre-

ments once each time the button is pressed.

3.7.12 XSER: EXTENDED SERIAL NUMBER

If XSER is set, bits 60 to 63 of the transmission are the

most significant bits of the serial number or seed. If

XSER bit is cleared, bits 60 to 63 of the transmission

are set to the function code used to activate the device

(S2:S1:S0:0).

40158F.book Page 21 Wednesday, June 1, 2011 10:36 AM

HCS410

4.0 INTEGRATING THE HCS410

INTO A SYSTEM

Use of the HCS410 in a system requires a compatible

decoder. This decoder is typically a microcontroller with

compatible firmware. Firmware routines that accept

transmissions from the HCS410, decrypt the code hop-

ping portion of the data stream and perform IFF func-

tions are available. These routines provide system

designers the means to develop their own decoding

system.

4.1 Key Generation

The serial number for each transmitter is programmed

by the manufacturer at the time of production. The

generation of the encoder key is done using a key gen-

eration algorithm (Figure 4-1). Typically, inputs to the

key generation algorithm are the serial number of the

transmitter or seed value, and a 64-bit manufacturer’s

code. The manufacturer’s code is chosen by the sys-

tem manufacturer and must be carefully controlled. The

manufacturer’s code is a pivotal part of the overall

system security.

FIGURE 4-1: CREATION AND STORAGE OF ENCODER KEY DURING PRODUCTION

Transmitter

Manufacturer’s

Serial Number or

Code

Encoder

Key

Generation

Algorithm

Serial Number

Encoder Key

Sync Counter

HCS410 EEPROM Array

Seed

40158F.book Page 22 Wednesday, June 1, 2011 10:36 AM

HCS410

4.2 Learning an HCS410 to a Receiver

In order for a transmitter to be used with a decoder, the

transmitter must first be ‘learned’. Several learning

strategies can be followed in the decoder implementa-

tion. When a transmitter is learned to a decoder, it is

suggested that the decoder stores the serial number

and current synchronization counter value (synchroni-

zation counter stored in CH Mode only) in EEPROM.

The decoder must keep track of these values for every

transmitter that is learned (Figure 4-2 and Figure 4-3).

FIGURE 4-2: TYPICAL CH MODE LEARN

SEQUENCE

The maximum number of transmitters that can be

learned is only a function of how much EEPROM

memory storage is available. The decoder must also

store the manufacturer’s code in order to learn an

HCS410, although this value will not change in a typical

system so it is usually stored as part of the microcon-

troller ROM code. Storing the manufacturer’s code as

part of the ROM code is also better for security rea-

sons.

FIGURE 4-3: TYPICAL IFF LEARN

SEQUENCE

Enter Learn

Mode

Wait for Reception

of a Valid Code

Generate Key

from Serial Number

Use Generated Key

to Decrypt

Compare Discrimination

Value with Fixed Value

Equal

Wait for Reception

of Second Valid Code

Compare Discrimination

Value with Fixed Value

Use Generated Key

to Decrypt

Equal

Counters

Encoder key

Serial number

Synchronization counter

Sequential

Exit

Learn successful Store: Learn

Unsuccessful

Ye s

Enter Learn

Wait for token

to be detected

Read

Generate Key

From Serial

Perform IFF

with Token

Compare Token

and expected

response

Token and

Response

Equal?

Exit

Serial Number

Ye s

Learn successful

Serial number

Encoder key

Number

Store:

Mode

40158F.book Page 23 Wednesday, June 1, 2011 10:36 AM

HCS410

4.3 CH Mode Decoder Operation

In a typical decoder operation (Figure 4-4), the key

generation on the decoder side is done by taking the

serial number from a transmission and combining that

with the manufacturer’s code to create the same

encoder key that is stored in the HCS410. Once the

encoder key is obtained, the rest of the transmission

can be decrypted. The decoder waits for a transmission

and immediately checks the serial number to determine

if it is a learned transmitter. If it is, the code hopping por-

tion of the transmission is decrypted using the stored

key. It uses the discrimination bits to determine if the

decryption was valid. If everything up to this point is

valid, the synchronization counter value is evaluated.

FIGURE 4-4: TYPICAL CH MODE

DECODER OPERATION

Transmission

Received

Does

Serial Number

Match

Decrypt Transmission

Decryption

Valid

Counter

Within 16

Counter

Within 32K

Update

Counter

Execute

Command

Save Counter

in Temp Location

Start

Ye s

and

40158F.book Page 24 Wednesday, June 1, 2011 10:36 AM

HCS410

4.3.1 SYNCHRONIZATION WITH DECODER

The KEELOQ technology features a sophisticated

synchronization technique (Figure 4-5) which does not

require the calculation and storage of future codes. If

the stored counter value for that particular transmitter

and the counter value that was just decrypted are

within a window of say 16, the counter is stored and the

command is executed. If the counter value was not

within the single operation window, but is within the

double operation window of say 32K window, the trans-

mitted synchronization counter value is stored in tem-

porary location and it goes back to waiting for another

transmission. When the next valid transmission is

received, it will compare the new value with the one in

temporary storage. If the two values are sequential, it is

assumed that the counter had just gotten out of the sin-

gle operation ‘window’, but is now back in sync, so the

new synchronization counter value is stored and the

command executed. If a transmitter has somehow got-

ten out of the double operation window, the transmitter

will not work and must be relearned. Since the entire

window rotates after each valid transmission, codes

that have been used are part of the ‘blocked’ (32K)

codes and are no longer valid. This eliminates the pos-

sibility of grabbing a previous code and retransmitting

to gain entry.

FIGURE 4-5: SYNCHRONIZATION WINDOW

FIGURE 4-6: BASIC OPERATION OF A CODE HOPPING RECEIVER (DECODER)

Note: The synchronization method described in

this section is only a typical

implementation and because it is usually

implemented in firmware, it can be altered

to fit the needs of a particular system

Blocked

Entire Window

rotates to eliminate

use of previously

used codes

Current

Position

(32K Codes)

Double

Operation

(32K Codes) Single Operation

Window (16 Codes)

Button Press

Information

EEPROM Array

Encoder Key

32 Bits of

Encrypted Data

Serial Number

Received Information

Decrypted

Synchronization

Counter

Check for

Match

Check for

Match

KEELOQ®

Algorithm

Decryption

Sync Counter

Serial Number

Manufacturer Code

40158F.book Page 25 Wednesday, June 1, 2011 10:36 AM

HCS410

4.4 IFF Decoder Operation

In a typical IFF decoder, the key generation on the

decoder side is done by reading the serial number from

a token and combining that with the manufacturer’s

code to recreate the encoder key that is stored on the

token. The decoder polls for the presence of a token.

Once detected the decoder reads the serial number. If

the token has been learned, the decoder sends a chal-

lenge and reads the token’s response. The decoder

uses the encoder key stored in EEPROM and decrypt

response. The decrypt response is compared to the

challenge. If they match the appropriate output is acti-

vated.

FIGURE 4-7: TYPICAL IFF DECODER

OPERATION

FIGURE 4-8: BASIC OPERATION OF AN IFF RECEIVER (DECODER)

Start

Tok e n

Detected?

Read Serial

Does

Serial Number

Match?

Send Challenge

and Read

Decrypt the

Response

Does

Challenge &

Match?

Execute Command

Ye s

Response

Number

Decrypt response

IFF Key

Serial Number

KEELOQ®

IFF

Algorithm

Decrypted

EEPROM Array

Manufacturer

Code

Serial Number Response Check for

Match

Response

Written to HCS410

Challenge

Information read from HCS410

40158F.book Page 26 Wednesday, June 1, 2011 10:36 AM

HCS410

5.0 DEVELOPMENT SUPPORT

The PIC® microcontrollers and dsPIC® digital signal

controllers are supported with a full range of software

and hardware development tools:

• Integrated Development Environment

- MPLAB® IDE Software

• Compilers/Assemblers/Linkers

- MPLAB C Compiler for Various Device

Families

- HI-TECH C for Various Device Families

- MPASMTM Assembler

-MPLINK

TM Object Linker/

MPLIBTM Object Librarian

- MPLAB Assembler/Linker/Librarian for

Various Device Families

• Simulators

- MPLAB SIM Software Simulator

•Emulators

- MPLAB REAL ICE™ In-Circuit Emulator

• In-Circuit Debuggers

- MPLAB ICD 3

- PICkit™ 3 Debug Express

• Device Programmers

- PICkit™ 2 Programmer

- MPLAB PM3 Device Programmer

• Low-Cost Demonstration/Development Boards,

Evaluation Kits, and Starter Kits

5.1 MPLAB Integrated Development

Environment Software

The MPLAB IDE software brings an ease of software

development previously unseen in the 8/16/32-bit

microcontroller market. The MPLAB IDE is a Windows®

operating system-based application that contains:

• A single graphical interface to all debugging tools

- Simulator

- Programmer (sold separately)

- In-Circuit Emulator (sold separately)

- In-Circuit Debugger (sold separately)

• A full-featured editor with color-coded context

• A multiple project manager

• Customizable data windows with direct edit of

contents

• High-level source code debugging

• Mouse over variable inspection

• Drag and drop variables from source to watch

windows

• Extensive on-line help

• Integration of select third party tools, such as

IAR C Compilers

The MPLAB IDE allows you to:

• Edit your source files (either C or assembly)

• One-touch compile or assemble, and download to

emulator and simulator tools (automatically

updates all project information)

• Debug using:

- Source files (C or assembly)

- Mixed C and assembly

- Machine code

MPLAB IDE supports multiple debugging tools in a

single development paradigm, from the cost-effective

simulators, through low-cost in-circuit debuggers, to

full-featured emulators. This eliminates the learning

curve when upgrading to tools with increased flexibility

and power.

40158F.book Page 27 Wednesday, June 1, 2011 10:36 AM

HCS410

5.2 MPLAB C Compilers for Various

Device Families

The MPLAB C Compiler code development systems

are complete ANSI C compilers for Microchip’s PIC18,

PIC24 and PIC32 families of microcontrollers and the

dsPIC30 and dsPIC33 families of digital signal control-

lers. These compilers provide powerful integration

capabilities, superior code optimization and ease of

use.

For easy source level debugging, the compilers provide

symbol information that is optimized to the MPLAB IDE

debugger.

5.3 HI-TECH C for Various Device

Families

The HI-TECH C Compiler code development systems

are complete ANSI C compilers for Microchip’s PIC

family of microcontrollers and the dsPIC family of digital

signal controllers. These compilers provide powerful

integration capabilities, omniscient code generation

and ease of use.

For easy source level debugging, the compilers provide

symbol information that is optimized to the MPLAB IDE

debugger.

The compilers include a macro assembler, linker, pre-

processor, and one-step driver, and can run on multiple

platforms.

5.4 MPASM Assembler

The MPASM Assembler is a full-featured, universal

macro assembler for PIC10/12/16/18 MCUs.

The MPASM Assembler generates relocatable object

files for the MPLINK Object Linker, Intel® standard HEX

files, MAP files to detail memory usage and symbol

reference, absolute LST files that contain source lines

and generated machine code and COFF files for

debugging.

The MPASM Assembler features include:

• Integration into MPLAB IDE projects

• User-defined macros to streamline

assembly code

• Conditional assembly for multi-purpose

source files

• Directives that allow complete control over the

assembly process

5.5 MPLINK Object Linker/

MPLIB Object Librarian

The MPLINK Object Linker combines relocatable

objects created by the MPASM Assembler and the

MPLAB C18 C Compiler. It can link relocatable objects

from precompiled libraries, using directives from a

linker script.

The MPLIB Object Librarian manages the creation and

modification of library files of precompiled code. When

a routine from a library is called from a source file, only

the modules that contain that routine will be linked in

with the application. This allows large libraries to be

used efficiently in many different applications.

The object linker/library features include:

• Efficient linking of single libraries instead of many

smaller files

• Enhanced code maintainability by grouping

related modules together

• Flexible creation of libraries with easy module

listing, replacement, deletion and extraction

5.6 MPLAB Assembler, Linker and

Librarian for Various Device

Families

MPLAB Assembler produces relocatable machine

code from symbolic assembly language for PIC24,

PIC32 and dsPIC devices. MPLAB C Compiler uses

the assembler to produce its object file. The assembler

generates relocatable object files that can then be

archived or linked with other relocatable object files and

archives to create an executable file. Notable features

of the assembler include:

• Support for the entire device instruction set

• Support for fixed-point and floating-point data

• Command line interface

• Rich directive set

• Flexible macro language

• MPLAB IDE compatibility

40158F.book Page 28 Wednesday, June 1, 2011 10:36 AM

HCS410

5.7 MPLAB SIM Software Simulator

The MPLAB SIM Software Simulator allows code

development in a PC-hosted environment by simulat-

ing the PIC® MCUs and dsPIC® DSCs on an instruction

level. On any given instruction, the data areas can be

examined or modified and stimuli can be applied from

a comprehensive stimulus controller. Registers can be

logged to files for further run-time analysis. The trace

buffer and logic analyzer display extend the power of

the simulator to record and track program execution,

actions on I/O, most peripherals and internal registers.

The MPLAB SIM Software Simulator fully supports

symbolic debugging using the MPLAB C Compilers,

and the MPASM and MPLAB Assemblers. The soft-

ware simulator offers the flexibility to develop and

debug code outside of the hardware laboratory envi-

ronment, making it an excellent, economical software

development tool.

5.8 MPLAB REAL ICE In-Circuit

Emulator System

MPLAB REAL ICE In-Circuit Emulator System is

Microchip’s next generation high-speed emulator for

Microchip Flash DSC and MCU devices. It debugs and

programs PIC® Flash MCUs and dsPIC® Flash DSCs

with the easy-to-use, powerful graphical user interface of

the MPLAB Integrated Development Environment (IDE),

included with each kit.

The emulator is connected to the design engineer’s PC

using a high-speed USB 2.0 interface and is connected

to the target with either a connector compatible with in-

circuit debugger systems (RJ11) or with the new high-

speed, noise tolerant, Low-Voltage Differential Signal

(LVDS) interconnection (CAT5).

The emulator is field upgradable through future firmware

downloads in MPLAB IDE. In upcoming releases of

MPLAB IDE, new devices will be supported, and new

features will be added. MPLAB REAL ICE offers

significant advantages over competitive emulators

including low-cost, full-speed emulation, run-time

variable watches, trace analysis, complex breakpoints, a

ruggedized probe interface and long (up to three meters)

interconnection cables.

5.9 MPLAB ICD 3 In-Circuit Debugger

System

MPLAB ICD 3 In-Circuit Debugger System is Micro-

chip's most cost effective high-speed hardware

debugger/programmer for Microchip Flash Digital Sig-

nal Controller (DSC) and microcontroller (MCU)

devices. It debugs and programs PIC® Flash microcon-

trollers and dsPIC® DSCs with the powerful, yet easy-

to-use graphical user interface of MPLAB Integrated

Development Environment (IDE).

The MPLAB ICD 3 In-Circuit Debugger probe is con-

nected to the design engineer's PC using a high-speed

USB 2.0 interface and is connected to the target with a

connector compatible with the MPLAB ICD 2 or MPLAB

REAL ICE systems (RJ-11). MPLAB ICD 3 supports all

MPLAB ICD 2 headers.

5.10 PICkit 3 In-Circuit Debugger/

Programmer and

PICkit 3 Debug Express

The MPLAB PICkit 3 allows debugging and program-

ming of PIC® and dsPIC® Flash microcontrollers at a

most affordable price point using the powerful graphical

user interface of the MPLAB Integrated Development

Environment (IDE). The MPLAB PICkit 3 is connected

to the design engineer's PC using a full speed USB

interface and can be connected to the target via an

Microchip debug (RJ-11) connector (compatible with

MPLAB ICD 3 and MPLAB REAL ICE). The connector

uses two device I/O pins and the reset line to imple-

ment in-circuit debugging and In-Circuit Serial Pro-

gramming™.

The PICkit 3 Debug Express include the PICkit 3, demo

board and microcontroller, hookup cables and CDROM

with user’s guide, lessons, tutorial, compiler and

MPLAB IDE software.

40158F.book Page 29 Wednesday, June 1, 2011 10:36 AM

HCS410

5.11 PICkit 2 Development

Programmer/Debugger and

PICkit 2 Debug Express

The PICkit™ 2 Development Programmer/Debugger is

a low-cost development tool with an easy to use inter-

face for programming and debugging Microchip’s Flash

families of microcontrollers. The full featured

Windows® programming interface supports baseline

(PIC10F, PIC12F5xx, PIC16F5xx), midrange

(PIC12F6xx, PIC16F), PIC18F, PIC24, dsPIC30,

dsPIC33, and PIC32 families of 8-bit, 16-bit, and 32-bit

microcontrollers, and many Microchip Serial EEPROM

products. With Microchip’s powerful MPLAB Integrated

Development Environment (IDE) the PICkit™ 2

enables in-circuit debugging on most PIC® microcon-

trollers. In-Circuit-Debugging runs, halts and single

steps the program while the PIC microcontroller is

embedded in the application. When halted at a break-

point, the file registers can be examined and modified.

The PICkit 2 Debug Express include the PICkit 2, demo

board and microcontroller, hookup cables and CDROM

with user’s guide, lessons, tutorial, compiler and

MPLAB IDE software.

5.12 MPLAB PM3 Device Programmer

The MPLAB PM3 Device Programmer is a universal,

CE compliant device programmer with programmable

voltage verification at VDDMIN and VDDMAX for

maximum reliability. It features a large LCD display

(128 x 64) for menus and error messages and a modu-

lar, detachable socket assembly to support various

package types. The ICSP™ cable assembly is included

as a standard item. In Stand-Alone mode, the MPLAB

PM3 Device Programmer can read, verify and program

PIC devices without a PC connection. It can also set

code protection in this mode. The MPLAB PM3

connects to the host PC via an RS-232 or USB cable.

The MPLAB PM3 has high-speed communications and

optimized algorithms for quick programming of large

memory devices and incorporates an MMC card for file

storage and data applications.

5.13 Demonstration/Development

Boards, Evaluation Kits, and

Starter Kits

A wide variety of demonstration, development and

evaluation boards for various PIC MCUs and dsPIC

DSCs allows quick application development on fully func-

tional systems. Most boards include prototyping areas for

adding custom circuitry and provide application firmware

and source code for examination and modification.

The boards support a variety of features, including LEDs,

temperature sensors, switches, speakers, RS-232

interfaces, LCD displays, potentiometers and additional

EEPROM memory.

The demonstration and development boards can be

used in teaching environments, for prototyping custom

circuits and for learning about various microcontroller

applications.

In addition to the PICDEM™ and dsPICDEM™ demon-

stration/development board series of circuits, Microchip

has a line of evaluation kits and demonstration software

for analog filter design, KEELOQ® security ICs, CAN,

IrDA®, PowerSmart battery management, SEEVAL®

evaluation system, Sigma-Delta ADC, flow rate

sensing, plus many more.

Also available are starter kits that contain everything

needed to experience the specified device. This usually

includes a single application and debug capability, all

on one board.

Check the Microchip web page (www.microchip.com)

for the complete list of demonstration, development

and evaluation kits.

40158F.book Page 30 Wednesday, June 1, 2011 10:36 AM

HCS410

6.0 ELECTRICAL CHARACTERISTICS

TABLE 6-1: ABSOLUTE MAXIMUM RATING

Symbol Item Rating Units

VDD Supply voltage -0.3 to 6.6 V

VIN*Input voltage -0.3 to VDD + 0.3 V

VOUT Output voltage -0.3 to VDD + 0.3 V

IOUT Max output current 50 mA

TSTG Storage temperature -55 to +125 C (Note)

TLSOL Lead soldering temp 300 C (Note)

VESD ESD rating (Human Body Model) 4000 V

Note: Stresses above those listed under “ABSOLUTE MAXIMUM RATINGS” may cause permanent damage to

the device.

*If a battery is inserted in reverse, the protection circuitry switches on, protecting the device and draining the

battery.

TABLE 6-2: DC AND TRANSPONDER CHARACTERISTICS

Commercial (C): TAMB = 0°C to 70°C

Industrial (I): TAMB = -40°C to 85°C

2.0V < VDD < 6.3V

Parameter Symbol Min Typ(1) Max Unit Conditions

Average operating current(2) IDD (avg) — 50

160

100

300 µA VDD = 3.0V

VDD = 6.3V

Programming current IDDP —1.0

2.2

1.8

3.5 mA VDD = 3.0V

VDD = 6.3V

Standby current IDDS — 0.1 100 nA

High level input voltage VIH 0.55 VDD —VDD + 0.3 V

Low level input voltage VIL -0.3 — 0.15 VDD V

High level output voltage VOH 0.8 VDD

0.8 VDD

—— VVDD = 2V, IOH =- .45 mA

VDD = 6.3V, IOH,= -2 mA

Low level output voltage VOL —

—

0.08 VDD

0.08 VDD VVDD = 2V, IOH = 0.5 mA

VDD = 6.3V,IOH = 5mA

LED output current ILED 3.0 4.0 7.0 mA VDD = 3.0V, VLED = 1.5V

Switch input resistor RS 40 60 80 kΩ

PWM input resistor RPWM 80 120 160 kΩ

LC input current ILC — — 10.0 mA VLCC=15 VP-P

LC input clamp voltage VLCC —15— VILC <10 mA

LC induced output current VDDI —5.0mAVLCC > 10V

LC induced output voltage VDDV 5.0

4.5

6.3

5.6

6.8

6.8 V10 V < VLCC, IDD = 0 mA

10 V < VLCC, IDD = -1 mA

Carrier frequency fc — 125 — kHz

External LC Inductor value L — 900 — µH

External LC Capacitor value C — 1.8 — nF

Note 1: Typical values at 25°C.

2: No load connected.

3: LC inputs are clamped at 15 volts.

40158F.book Page 31 Wednesday, June 1, 2011 10:36 AM

HCS410

FIGURE 6-1: POWER UP AND TRANSMIT TIMING

TABLE 6-3: POWER UP AND TRANSMIT TIMING REQUIREMENTS

VDD = +2.0V to 6.3V

Commercial (C):TAMB = 0°C to +70°C

Industrial (I): TAMB = -40°C to +85°C

Parameter Symbol Min Typ. Max Unit Remarks

Time to second button press TBP 44 + Code

Word Time

58 + Code

Word Time

63 + Code

Word Time

ms (Note 1)

Transmit delay from button detect TTD 39 44 48 ms (Note 2)

Debounce delay TDB 31 35 39 ms

Auto-shutoff time-out period TTO 18 20 22 s (Note 3)

Note 1: TBP is the time in which a second button can be pressed without completion of the first code word and the

intention was to press the combination of buttons.

2: Transmit delay maximum value if the previous transmission was successfully transmitted.

3: The auto-shutoff timeout period is not tested.

Button Press

Detect

TDB

PWM

TTD

Code Word Transmission

TTO

Code

Word

Code

Word

Code

Word

Code

Word

TBP

40158F.book Page 32 Wednesday, June 1, 2011 10:36 AM

HCS410

FIGURE 6-2: HCS410 NORMALIZED TE VS. TEMP

TABLE 6-4: CODE WORD TRANSMISSION TIMING PARAMETERS—PWM MODEÞ

VDD = +2.0V to 6.3V

Commercial (C): TAMB = 0°C to +70°C

Industrial (I): TAMB = -40°C to +85°C

Code Words Transmitted

BSL1 = 0,

BSL0 = 0

BSL1 = 0,

BSL0 = 1

Symbol Characteristic Number

of TEMin. Typ. Max. Number

of TEMin. Typ. Max. Units

TEBasic pulse element 1 360 400 440 1 180.0 200.0 220.0 μs

TBP PWM bit pulse width 3 1080 1200 1320 3 540.0 600.0 660.0 μs

TPPreamble duration 32 12 12.8 14 32 5.76 6.0 7.04 ms

THHeader duration 10 3.6 4.0 4.4 10 1.80 2.0 2.20 ms

THOP Code hopping duration 96 35 38.4 42 96 17.28 19.20 21.12 ms

TFIX Fixed code duration 111 39.96 44.4 48.84 111 19.98 22.20 24.42 ms

TGGuard time 46 16.6 18.4 20.2 46 8.3 9.6 10.1 ms

—Total transmit time 295 106.2 118.0 129.8 295 53.1 59.0 64.9 ms

Note: The timing parameters are not tested but derived from the oscillator clock.

VDD = +2.0V to 6.3V

Commercial (C): TAMB = 0°C to +70°C

Industrial (I): TAMB = -40°C to +85°C

Code Words Transmitted

BSL1 = 1,

BSL0 = 0

BSL1 = 0,

BSL0 = 1

Symbol Characteristic Number

of TEMin. Typ. Max. Number

of TEMin. Typ. Max. Units

TEBasic pulse element 1 180.0 200.0 220.0 1 90.0 100.0 110.0 μs

TBP PWM bit pulse width 3 540.0 600.0 660.0 3 270.0 300.0 330.0 μs

TPPreamble duration 32 5.76 6.0 7.04 32 2.88 3.0 3.52 ms

THHeader duration 10 1.80 2.0 2.20 10 0.90 1.0 1.10 ms

THOP Code hopping duration 96 17.28 19.20 21.12 96 8.64 9.60 10.56 ms

TFIX Fixed code duration 111 19.98 22.2 24.42 111 9.99 11.1 12.21 ms

TGGuard time 46 8.3 9.6 10.1 46 41 4.6 5.1 ms

— Total transmit time 295 53.1 59.0 64.9 295 26.6 29.5 32.5 ms

Note: The timing parameters are not tested but derived from the oscillator clock.

0.94

1.10

1.08

1.06

1.04

1.02

1.00

0.98

0.96

0.92

0.90

TE Min.

TE Max.

VDD LEGEND

= 2.0V

= 3.0V

= 6.0V

Ty p i c a l

Temperature °C

-50 -40 -30 -20 -10 0 10 20 30 40 50 60 70 80 90

Note: Values are for calibrated oscillator.

40158F.book Page 33 Wednesday, June 1, 2011 10:36 AM

HCS410

FIGURE 6-3: TYPICAL VOLTAGE TRIP POINTS

TABLE 6-5: CODE WORD TRANSMISSION TIMING PARAMETERS—MANCHESTER MODE

VDD = +2.0V to 6.3V

Commercial (C): TAMB = 0°C to +70°C

Industrial (I): TAMB = -40°C to +85°C

Code Words Transmitted

BSL1 = 0,

BSL0 = 0

BSL1 = 0,

BSL0 = 1

Symbol Characteristic Number

of TEMin. Typ. Max. Number

of TEMin. Typ. Max. Units

TEBasic pulse element 1 720.0 800.0 880.0 1 360.0 400.0 440.0 μs

TPPreamble duration 32 23.04 25.60 28.16 32 11.52 12.80 14.08 ms

THHeader duration 4 2.88 3.20 3.52 4 1.44 1.60 1.76 ms

TSTART Start bit 2 1.44 1.60 1.76 2 0.72 0.80 0.88 ms

THOP Code hopping duration 64 46.08 51.20 56.32 64 23.04 25.60 28.16 ms

TFIX Fixed code duration 74 53.28 59.20 65.12 74 26.64 29.60 32.56 ms

TSTOP Stop bit 2 1.44 1.60 1.76 2 0.72 0.80 0.88 ms

TGGuard time 32 23.0 25.6 28.2 32 11.5 12.8 14.1 ms

— Total transmit time 210 151.2 168 184.8 210 75.6 84.0 92.4 ms

Note: The timing parameters are not tested but derived from the oscillator clock.

VDD = +2.0V to 6.3V

Commercial (C): TAMB = 0°C to +70°C

Industrial (I): TAMB = -40°C to +85°C

Code Words Transmitted

BSL1 = 1,

BSL0 = 0

BSL1 = 1,

BSL0 = 1

Symbol Characteristic Number

of TEMin. Typ. Max. Number

of TEMin. Typ. Max. Units

TEBasic pulse element 1 360.0 400.0 440.0 1 180.0 200.0 220.0 μs

TPPreamble duration 32 11.52 12.80 14.08 32 5.76 6.40 7.04 ms

THHeader duration 4 1.44 1.60 1.76 4 0.72 0.80 0.88 ms

TSTART Start bit 2 0.72 0.80 0.88 2 0.36 0.40 0.44 ms

THOP Code hopping duration 64 23.04 25.60 28.16 64 11.52 12.80 14.08 ms

TFIX Fixed code duration 74 26.64 29.60 32.56 74 13.32 14.8 16.28 ms

TSTOP Stop bit 2 0.72 0.80 0.88 2 0.36 0.40 0.44 ms

TGGuard time 32 11.5 12.8 14.1 32 5.8 6.4 7.0 ms

— Total transmit time 210 75.6 84.0 92.4 210 37.8 42.0 46.2 ms

Note: The timing parameters are not tested but derived from the oscillator clock.

VLOW

Volts (V)

-40 05085

2.0

1.6

1.8

2.2

2.4

2.6

Tem p ( C )

VLOW sel = 0

4.4

4.0

4.2

3.8

4.6

4.8

5.0 VLOW sel = 1

2.8

Nominal VLOW trip point

Legend

40158F.book Page 34 Wednesday, June 1, 2011 10:36 AM

HCS410

7.0 PACKAGING INFORMATION

7.1 Package Marking Information

8-Lead PDIP Example

8-Lead SOIC Example

XXXXXXXX

XXXXXNNN

YYWW

HCS301

XXXXXNNN

0025

XXXXXXX

XXXYYWW

NNN

HCS301

XXX0025

NNN

Legend: XX...X Customer specific information*

Y Year code (last digit of calendar year)

YY Year code (last 2 digits of calendar year)

WW Week code (week of January 1 is week ‘01’)

NNN Alphanumeric traceability code

Note: In the event the full Microchip part number cannot be marked on one line, it will

be carried over to the next line thus limiting the number of available characters

for customer specific information.

*Standard PIC® MCU device marking consists of Microchip part number, year code, week code, and

traceability code. For PIC device marking beyond this, certain price adders apply. Please check with your

Microchip Sales Office. For QTP devices, any special marking adders are included in QTP price.

40158F.book Page 35 Wednesday, June 1, 2011 10:36 AM

HCS410

7.2 Package Details





 

 

 

 



 



 

   

  

  

    

    

    

    

    

    

    

    

    

    

    

NOTE 1

   

40158F.book Page 36 Wednesday, June 1, 2011 10:36 AM

HCS410

Note: For the most current package drawings, please see the Microchip Packaging Specification located at

http://www.microchip.com/packaging

40158F.book Page 37 Wednesday, June 1, 2011 10:36 AM

HCS410

Note: For the most current package drawings, please see the Microchip Packaging Specification located at

http://www.microchip.com/packaging

40158F.book Page 38 Wednesday, June 1, 2011 10:36 AM

HCS410

 ! ""#$%& !'



40158F.book Page 39 Wednesday, June 1, 2011 10:36 AM

HCS410

APPENDIX A: ADDITIONAL

INFORMATION

Microchip’s Secure Data Products are covered by

some or all of the following:

Code hopping encoder patents issued in European

countries and U.S.A.

Secure learning patents issued in European countries,

U.S.A. and R.S.A.

REVISION HISTORY

Revision F (June 2011)

• Updated the following sections: Development Sup-

port, The Microchip Web Site, Reader Response

and HCS410 Product Identification System

• Added new section Appendix A

• Minor formatting and text changes were incorporated

throughout the document

40158F.book Page 40 Wednesday, June 1, 2011 10:36 AM

HCS410

THE MICROCHIP WEB SITE

Microchip provides online support via our WWW site at

www.microchip.com. This web site is used as a means

to make files and information easily available to

customers. Accessible by using your favorite Internet

browser, the web site contains the following

information:

•Product Support – Data sheets and errata,

application notes and sample programs, design

resources, user’s guides and hardware support

documents, latest software releases and archived

software

•General Technical Support – Frequently Asked

Questions (FAQ), technical support requests,

online discussion groups, Microchip consultant

program member listing

•Business of Microchip – Product selector and

ordering guides, latest Microchip press releases,

listing of seminars and events, listings of

Microchip sales offices, distributors and factory

representatives

CUSTOMER CHANGE NOTIFICATION

SERVICE

Microchip’s customer notification service helps keep

customers current on Microchip products. Subscribers

will receive e-mail notification whenever there are

changes, updates, revisions or errata related to a

specified product family or development tool of interest.

To register, access the Microchip web site at

www.microchip.com. Under “Support”, click on

“Customer Change Notification” and follow the

registration instructions.

CUSTOMER SUPPORT

Users of Microchip products can receive assistance

through several channels:

• Distributor or Representative

• Local Sales Office

• Field Application Engineer (FAE)

• Technical Support

• Development Systems Information Line

Customers should contact their distributor,

representative or field application engineer (FAE) for

support. Local sales offices are also available to help

customers. A listing of sales offices and locations is

included in the back of this document.

Technical support is available through the web site

at: http://microchip.com/support

40158F.book Page 41 Wednesday, June 1, 2011 10:36 AM

HCS410

READER RESPONSE

It is our intention to provide you with the best documentation possible to ensure successful use of your Microchip

product. If you wish to provide your comments on organization, clarity, subject matter, and ways in which our

documentation can better serve you, please FAX your comments to the Technical Publications Manager at

(480) 792-4150.

Please list the following information, and use this outline to provide us with your comments about this document.

TO: Technical Publications Manager

RE: Reader Response

Total Pages Sent ________

From: Name

Company

Address

City / State / ZIP / Country

Telephone: (_______) _________ - _________

Application (optional):

Would you like a reply? Y N

Device: Literature Number:

Questions:

FAX: (______) _________ - _________

DS40158FHCS410

1. What are the best features of this document?

2. How does this document meet your hardware and software development needs?

3. Do you find the organization of this document easy to follow? If not, why?

4. What additions to the document do you think would enhance the structure and subject?

5. What deletions from the document could be made without affecting the overall usefulness?

6. Is there any incorrect or misleading information (what and where)?

7. How would you improve this document?

40158F.book Page 42 Wednesday, June 1, 2011 10:36 AM

HCS410

HCS410 PRODUCT IDENTIFICATION SYSTEM

To order or obtain information, e.g., on pricing or delivery, refer to the factory or the listed sales office.

Package:

P = Plastic DIP (300 mil Body), 8-lead

SN = Plastic SOIC (150 mil Body), 8-lead

ST = TSSOP (4.4 mm Body), 8-lead

Temperature

Range:

Blank = 0°C to +70°C

I= –40°C to +85°C

Device: HCS410 Code Hopping Encoder

HCS410T Code Hopping Encoder (Tape and Reel)

HCS410 — /P

40158F.book Page 43 Wednesday, June 1, 2011 10:36 AM

HCS410

NOTES:

40158F.book Page 44 Wednesday, June 1, 2011 10:36 AM

Information contained in this publication regarding device

applications and the like is provided only for your convenience

and may be superseded by updates. It is your responsibility to

ensure that your application meets with your specifications.

MICROCHIP MAKES NO REPRESENTATIONS OR

WARRANTIES OF ANY KIND WHETHER EXPRESS OR

IMPLIED, WRITTEN OR ORAL, STATUTORY OR

OTHERWISE, RELATED TO THE INFORMATION,

INCLUDING BUT NOT LIMITED TO ITS CONDITION,

QUALITY, PERFORMANCE, MERCHANTABILITY OR

FITNESS FOR PURPOSE. Microchip disclaims all liability

arising from this information and its use. Use of Microchip

devices in life support and/or safety applications is entirely at

the buyer’s risk, and the buyer agrees to defend, indemnify and

hold harmless Microchip from any and all damages, claims,

suits, or expenses resulting from such use. No licenses are

conveyed, implicitly or otherwise, under any Microchip

intellectual property rights.

Trademarks

The Microchip name and logo, the Microchip logo, dsPIC,

KEELOQ, KEELOQ logo, MPLAB, PIC, PICmicro, PICSTART,

PIC32 logo, rfPIC and UNI/O are registered trademarks of

Microchip Technology Incorporated in the U.S.A. and other

countries.

FilterLab, Hampshire, HI-TECH C, Linear Active Thermistor,

MXDEV, MXLAB, SEEVAL and The Embedded Control

Solutions Company are registered trademarks of Microchip

Technology Incorporated in the U.S.A.

Analog-for-the-Digital Age, Application Maestro, CodeGuard,

dsPICDEM, dsPICDEM.net, dsPICworks, dsSPEAK, ECAN,

ECONOMONITOR, FanSense, HI-TIDE, In-Circuit Serial

Programming, ICSP, Mindi, MiWi, MPASM, MPLAB Certified

logo, MPLIB, MPLINK, mTouch, Omniscient Code

Generation, PICC, PICC-18, PICDEM, PICDEM.net, PICkit,

PICtail, REAL ICE, rfLAB, Select Mode, Total Endurance,

TSHARC, UniWinDriver, WiperLock and ZENA are

trademarks of Microchip Technology Incorporated in the

U.S.A. and other countries.

SQTP is a service mark of Microchip Technology Incorporated

in the U.S.A.

All other trademarks mentioned herein are property of their

respective companies.

Printed on recycled paper.

ISBN: 978-1-61341-226-8

Note the following details of the code protection feature on Microchip devices:

• Microchip products meet the specification contained in their particular Microchip Data Sheet.

• Microchip believes that its family of products is one of the most secure families of its kind on the market today, when used in the

intended manner and under normal conditions.

• There are dishonest and possibly illegal methods used to breach the code protection feature. All of these methods, to our

knowledge, require using the Microchip products in a manner outside the operating specifications contained in Microchip’s Data

Sheets. Most likely, the person doing so is engaged in theft of intellectual property.

• Microchip is willing to work with the customer who is concerned about the integrity of their code.

• Neither Microchip nor any other semiconductor manufacturer can guarantee the security of their code. Code protection does not

mean that we are guaranteeing the product as “unbreakable.”

Code protection is constantly evolving. We at Microchip are committed to continuously improving the code protection features of our

products. Attempts to break Microchip’s code protection feature may be a violation of the Digital Millennium Copyright Act. If such acts

allow unauthorized access to your software or other copyrighted work, you may have a right to sue for relief under that Act.

Microchip received ISO/TS-16949:2002 certification for its worldwide

headquarters, design and wafer fabrication facilities in Chandler and

Tempe, Arizona; Gresham, Oregon and design centers in California

and India. The Company’s quality system processes and procedures

are for its PIC® MCUs and dsPIC® DSCs, KEELOQ® code hopping

devices, Serial EEPROMs, microperipherals, nonvolatile memory and

analog products. In addition, Microchip’s quality system for the design

and manufacture of development systems is ISO 9001:2000 certified.

40158F.book Page 45 Wednesday, June 1, 2011 10:36 AM

AMERICAS

Corporate Office

2355 West Chandler Blvd.

Chandler, AZ 85224-6199

Tel: 480-792-7200

Fax: 480-792-7277

Technical Support:

http://www.microchip.com/

support

Web Address:

www.microchip.com

Atlanta

Duluth, GA

Tel: 678-957-9614

Fax: 678-957-1455

Boston

Westborough, MA

Tel: 774-760-0087

Fax: 774-760-0088

Chicago

Itasca, IL

Tel: 630-285-0071

Fax: 630-285-0075

Cleveland

Independence, OH

Tel: 216-447-0464

Fax: 216-447-0643

Dallas

Addison, TX

Tel: 972-818-7423

Fax: 972-818-2924

Detroit

Farmington Hills, MI

Tel: 248-538-2250

Fax: 248-538-2260

Indianapolis

Noblesville, IN

Tel: 317-773-8323

Fax: 317-773-5453

Los Angeles

Mission Viejo, CA

Tel: 949-462-9523

Fax: 949-462-9608

Santa Clara

Santa Clara, CA

Tel: 408-961-6444

Fax: 408-961-6445

Toronto

Mississauga, Ontario,

Canada

Tel: 905-673-0699

Fax: 905-673-6509

ASIA/PACIFIC

Asia Pacific Office

Suites 3707-14, 37th Floor

Tower 6, The Gateway

Harbour City, Kowloon

Hong Kong

Tel: 852-2401-1200

Fax: 852-2401-3431

Australia - Sydney

Tel: 61-2-9868-6733

Fax: 61-2-9868-6755

China - Beijing

Tel: 86-10-8569-7000

Fax: 86-10-8528-2104

China - Chengdu

Tel: 86-28-8665-5511

Fax: 86-28-8665-7889

China - Chongqing

Tel: 86-23-8980-9588

Fax: 86-23-8980-9500

China - Hangzhou

Tel: 86-571-2819-3180

Fax: 86-571-2819-3189

China - Hong Kong SAR

Tel: 852-2401-1200

Fax: 852-2401-3431

China - Nanjing

Tel: 86-25-8473-2460

Fax: 86-25-8473-2470

China - Qingdao

Tel: 86-532-8502-7355

Fax: 86-532-8502-7205

China - Shanghai

Tel: 86-21-5407-5533

Fax: 86-21-5407-5066

China - Shenyang

Tel: 86-24-2334-2829

Fax: 86-24-2334-2393

China - Shenzhen

Tel: 86-755-8203-2660

Fax: 86-755-8203-1760

China - Wuhan

Tel: 86-27-5980-5300

Fax: 86-27-5980-5118

China - Xian

Tel: 86-29-8833-7252

Fax: 86-29-8833-7256

China - Xiamen

Tel: 86-592-2388138

Fax: 86-592-2388130

China - Zhuhai

Tel: 86-756-3210040

Fax: 86-756-3210049

ASIA/PACIFIC

India - Bangalore

Tel: 91-80-3090-4444

Fax: 91-80-3090-4123

India - New Delhi

Tel: 91-11-4160-8631

Fax: 91-11-4160-8632

India - Pune

Tel: 91-20-2566-1512

Fax: 91-20-2566-1513

Japan - Yokohama

Tel: 81-45-471- 6166

Fax: 81-45-471-6122

Korea - Daegu

Tel: 82-53-744-4301

Fax: 82-53-744-4302

Korea - Seoul

Tel: 82-2-554-7200

Fax: 82-2-558-5932 or

82-2-558-5934

Malaysia - Kuala Lumpur

Tel: 60-3-6201-9857

Fax: 60-3-6201-9859

Malaysia - Penang

Tel: 60-4-227-8870

Fax: 60-4-227-4068

Philippines - Manila

Tel: 63-2-634-9065

Fax: 63-2-634-9069

Singapore

Tel: 65-6334-8870

Fax: 65-6334-8850

Taiwan - Hsin Chu

Tel: 886-3-6578-300

Fax: 886-3-6578-370

Taiwan - Kaohsiung

Tel: 886-7-213-7830

Fax: 886-7-330-9305

Taiwan - Taipei

Tel: 886-2-2500-6610

Fax: 886-2-2508-0102

Thailand - Bangkok

Tel: 66-2-694-1351

Fax: 66-2-694-1350

EUROPE

Austria - Wels

Tel: 43-7242-2244-39

Fax: 43-7242-2244-393

Denmark - Copenhagen

Tel: 45-4450-2828

Fax: 45-4485-2829

France - Paris

Tel: 33-1-69-53-63-20

Fax: 33-1-69-30-90-79

Germany - Munich

Tel: 49-89-627-144-0

Fax: 49-89-627-144-44

Italy - Milan

Tel: 39-0331-742611

Fax: 39-0331-466781

Netherlands - Drunen

Tel: 31-416-690399

Fax: 31-416-690340

Spain - Madrid

Tel: 34-91-708-08-90

Fax: 34-91-708-08-91

UK - Wokingham

Tel: 44-118-921-5869

Fax: 44-118-921-5820

Worldwide Sales and Service

05/02/11

40158F.book Page 46 Wednesday, June 1, 2011 10:36 AM