HCS365-KeeLoq® Code Hopping Encoder

/var/www/html/datasheet/sites/default/files/pdfhtml_dummy/41109E-html.html
background image

© 2011 Microchip Technology Inc.

DS41109E-page 1

K

EE

L

OQ®

 Code Hopping Encoder

FEATURES

Security

• Two programmable 32-bit serial numbers
• Two programmable 64-bit crypt keys
• Two programmable 60-bit seed values
• Each transmission is unique
• 67/69-bit transmission code length
• 32-bit hopping code
• Crypt keys are read protected

Operating

• 2.05-5.5V operation
• Four button inputs
• 15 functions available 
• Four selectable baud rates
• Selectable minimum code word completion
• Battery low signal transmitted to receiver
• Nonvolatile synchronization data
• PWM, VPWM, PPM, and Manchester modulation
• Button queue information transmitted
• Dual Encoder functionality

Other

• On-chip EEPROM
• On-chip tuned oscillator (±10% over voltage and 

temperature)

• Button inputs have internal pull-down resistors
• LED output
• PLL control for ASK and FSK
• Low external component count

Typical Applications

The HCS365 is ideal for Remote Keyless Entry (RKE)
applications. These applications include:
• Automotive RKE systems
• Automotive alarm systems
• Automotive immobilizers
• Gate and garage door openers 
• Identity tokens
• Burglar alarm systems

PACKAGE TYPES

HCS365 BLOCK DIAGRAM

GENERAL DESCRIPTION

The HCS365 is a code hopping encoder designed for
secure Remote Keyless Entry (RKE) and secure
remote control systems. The HCS365 utilizes the
K

EE

L

OQ®

 code hopping technology, which incorpo-

rates high security, a small package outline, and low
cost to make this device a perfect solution for unidirec-
tional authentication systems and access control sys-
tems.
The HCS365 combines a hopping code generated by a
nonlinear encryption algorithm, a serial number, and
status bits to create a secure transmission code. The
length of the transmission eliminates the threat of code
scanning and code grabbing access techniques. 

1

2

3

4

8

7

6

5

S0

S1

S2

S3/SHIFT/

V

DD

LED

DATA

Vss

PDIP, SOIC

HCS365

RFEN

V

SS

V

DD

Oscillator

RESET circuit

LED driver

Controller

Power

latching

and

switching

Button input port

32-bit SHIFT register

Encoder

EEPROM

DATA

 

LED

   

S3/SHIFT S2 S

1

S

0

RFEN

HCS365

/var/www/html/datasheet/sites/default/files/pdfhtml_dummy/41109E-html.html
background image

HCS365

DS41109E-page 2

© 2011 Microchip Technology Inc.

The crypt key, serial number, and configuration data
are stored in an EEPROM array which is not accessible
via any external connection. The EEPROM data is pro-
grammable but read protected. The data can be veri-
fied only after an automatic erase and programming
operation. This protects against attempts to gain
access to keys or manipulate synchronization values.
In addition, the HCS365 supports a dual encoder. This
allows two manufacturers to use the same device with-
out having to use the same manufacturer’s code in
each of the encoders. The HCS365 provides an easy
to use serial interface for programming the necessary
keys, system parameters, and configuration data.

1.0

SYSTEM OVERVIEW

Key Terms
The following is a list of key terms used throughout this
data sheet. For additional information on K

EE

L

OQ

 and

code hopping, refer to Technical Brief (TB003).
• RKE - Remote Keyless Entry
• Button Status - Indicates what button input(s) 

activated the transmission. Encompasses the 4 
button status bits S3, S2, S1 and S0 (Figure 3-2).

• Code Hopping - A method by which a code, 

viewed externally to the system, appears to 
change unpredictably each time it is transmitted.

• Code Word - A block of data that is repeatedly 

transmitted upon button activation (Figure 3-2).

• Transmission - A data stream consisting of 

repeating code words (Figure 4-1).

• Crypt Key - A unique and secret 64-bit number 

used to encrypt and decrypt data. In a symmetri-
cal block cipher such as the K

EE

L

OQ

 algorithm, 

the encryption and decryption keys are equal and 
will therefore be referred to generally as the crypt 
key.

• Encoder - A device that generates and encodes 

data.

• Encryption Algorithm - A recipe whereby data is 

scrambled using a crypt key. The data can only be 
interpreted by the respective decryption algorithm 
using the same crypt key.

• Decoder - A device that decodes data received 

from an encoder (i.e., HCS5XX).

• Decryption Algorithm - A recipe whereby data 

scrambled by an encryption algorithm can be 
unscrambled using the same crypt key.

• Learn – Learning involves the receiver calculating 

the transmitter’s appropriate crypt key, decrypting 
the received hopping code and storing the serial 
number, synchronization counter value, and crypt 
key in EEPROM. The K

EE

L

OQ

 product family facil-

itates several learning strategies to be imple-
mented on the decoder. The following are 
examples of what can be done. 

Simple Learning

The receiver uses a fixed crypt key. The crypt 
key is common to every component used by 
the same manufacturer.

Normal Learning

The receiver derives a crypt key from the 
encoder serial number. Every transmitter has 
a unique crypt key.

Secure Learning

The receiver derives a crypt key from the 
encoder seed value. Every encoder has a 
unique seed value that is only transmitted by 
a special button combination.

• Manufacturer’s Code – A unique and secret 64-

bit number used to derive crypt keys. Each 
encoder is programmed with a crypt key that is a 
function of the manufacturer’s code. Each 
decoder is programmed with the manufacturer 
code itself.

The HCS365 code hopping encoder is designed specif-
ically for keyless entry systems. In particular, typical
applications include vehicles and home garage door
openers. The encoder portion of a keyless entry sys-
tem is integrated into a transmitter carried by the user.
The transmitter is operated to gain access to a vehicle
or restricted area. The HCS365 is meant to be a cost-
effective yet secure solution to such systems requiring
very few external components (Figure 2-1).
Most low end keyless entry transmitters are given a
fixed identification code that is transmitted every time a
button is pushed. The number of unique identification
codes in a low end system is usually a relatively small
number. These shortcomings provide an opportunity
for a sophisticated thief to create a device that ‘grabs’
a transmission and retransmits it later or a device that
quickly ‘scans’ all possible identification codes until the
correct one is found.
The HCS365, on the other hand, employs the K

EE

L

OQ

code hopping technology coupled with a transmission
length of 67 bits to virtually eliminate the use of code
‘grabbing’ or code ‘scanning’. The high security level of
the HCS365 is based on the patented K

EE

L

OQ 

technol-

ogy. A block cipher based on a block length of 32 bits
and a key length of 64 bits is used. The algorithm
obscures the information in such a way that if a single
hopping code data bit changes (before encryption), sta-
tistically more than 50% of the encrypted data bits will
change.

/var/www/html/datasheet/sites/default/files/pdfhtml_dummy/41109E-html.html
background image

© 2011 Microchip Technology Inc.

DS41109E-page 3

HCS365

As indicated in the block diagram on page one, the
HCS365 has a small EEPROM array which must be
loaded with several parameters before use; most often
programmed by the manufacturer at the time of produc-
tion. The most important of these are:
• A serial number, typically unique for every 

encoder

• A crypt key
• An initial synchronization value

The crypt key generation typically inputs the transmitter
serial number and 64-bit manufacturer’s code into the
key generation algorithm (Figure 1-1). The manufac-
turer’s code is chosen by the system manufacturer and
must be carefully controlled as it is a pivotal part of the
overall system security. 

FIGURE 1-1:

CREATION AND STORAGE OF CRYPT KEY DURING PRODUCTION

The valid synchronization counter is the basis behind
the transmitted code word changing for each transmis-
sion; it increments each time a button is pressed. Each
increment of the synchronization value results in more
than 50% of the hopping code bits changing.
Figure 1-2 shows how the key values in EEPROM are
used in the encoder. Once the encoder detects a button
press, it reads the button inputs and updates the syn-
chronization counter. The synchronization counter and
crypt key are input to the encryption algorithm and the
output is 32 bits of encrypted information. This data will
change with every button press while its value will
appear to ‘randomly hop around’. Hence, this data is
referred to as the hopping portion of the code word.
The 32-bit hopping code is combined with the button
information and serial number to form the code word
transmitted to the receiver. The code word format is
explained in greater detail in Section 4.1. 
A receiver may use any type of controller as a decoder.
Typically, it is a microcontroller with compatible firm-
ware that allows the decoder to operate in conjunction
with an HCS365 based transmitter. 
A transmitter must first be ‘learned’ by the receiver
before its use is allowed in the system. Learning
includes calculating the transmitter’s appropriate crypt
key, decrypting the received hopping code, storing the
serial number, storing the synchronization counter
value, and storing crypt key in EEPROM.

In normal operation, each received message of valid
format is evaluated. The serial number is used to deter-
mine if it is from a learned transmitter. If the serial num-
ber is from a learned transmitter, the message is
decrypted and the synchronization counter is verified.
Finally, the button status is checked to see what opera-
tion is requested. Figure 1-3 shows the relationship
between some of the values stored by the receiver and
the values received from the transmitter. 
For detailed decoder operation, see Section 7.0. 

Transmitter 

Manufacturer’s 

Serial Number

Code

Crypt

 Key

Key

Generation

Algorithm

Serial Number

Crypt Key
Sync Counter

.

.

.

HCS365

Production

Programmer

EEPROM Array

/var/www/html/datasheet/sites/default/files/pdfhtml_dummy/41109E-html.html
background image

HCS365

DS41109E-page 4

© 2011 Microchip Technology Inc.

FIGURE 1-2:

BUILDING THE TRANSMITTED CODE WORD (ENCODER)

FIGURE 1-3:

BASIC OPERATION OF RECEIVER (DECODER) 

NOTE: Circled numbers indicate the order of execution.

Button Press

Information

EEPROM Array

32 Bits  

Encrypted Data

Serial Number

Transmitted Information

Crypt Key

Sync Counter

Serial Number

K

EE

L

OQ®

Encryption

Algorithm

Button Press

 Information

EEPROM Array

Manufacturer Code 

32 Bits of 

Encrypted Data

Serial Number

Received Information

 

  Decrypted

Synchronization

        

Counter

     Verify

     Counter

Sync Counter

Serial Number

K

EE

L

OQ®

Decryption

Algorithm

1

3

4

     Check for

    Match

2

    Perform Function

        Indicated by

        button press 

5

Crypt Key

/var/www/html/datasheet/sites/default/files/pdfhtml_dummy/41109E-html.html
background image

© 2011 Microchip Technology Inc.

DS41109E-page 5

HCS365

2.0

DEVICE DESCRIPTION

As shown in the typical application circuits (Figure 2-1),
the HCS365 is an easy device to use. It requires only
the addition of buttons and RF circuitry for use as the
encoder in your security application. A description of
each pin is described in Table 2-1. Refer to Figure 2-2
for information on the I/O pins.

TABLE 2-1:

PIN DESCRIPTIONS

The HCS365 will normally be in a low power SLEEP
mode. When a button input is taken high, the device will
wake up, start the step-up regulator, and go through the
button debounce delay of T

DB

 before the button code is

latched. In addition, the device will then read the con-
figuration options. Depending on the configuration
options and the button code, the device will determine
what the data and modulation format will be for the
transmission. The transmission will consist of a stream
of code words and will be transmitted T

PU

 after the but-

ton is pressed for as long as the buttons are held down
or until a time-out occurs. The code word format can be
either a code hopping format or a seed format. 
The time-out time can be selected with the Time-out
Select (TSEL) configuration option. This option allows
the time-out to be set to 0.8s, 3.2s, 12.8s, or 25.6s.
When a time-out occurs, the device will go into SLEEP
mode to protect the battery from draining when a button
gets stuck.
If the device is in the transmit process and detects that
a new button is pressed, the current code word will be
aborted, a new code word will be transmitted and the
time-out counter will RESET. If all the buttons are
released, a minimum number of code words will still be
completed. The minimum code words can be set to 1,
2, 4, or 8 using the Minimum Code Words (MTX) con-
figuration option. If the time for transmitting the mini-
mum code words is longer than the time-out time, the
device will not complete the minimum code words.

Note:

S0-S3 inputs have pull-down resistors. V

IN

should be tied high if the step-up regulator
is not used.

Name

Pin 

Number

Description

S0

1

Switch input 0

S1

2

Switch input 1

S2

3

Switch input 2

S3/

SHIFT/

RFEN

4

Switch input 3, 
SHIFT button or 
RF Enable output

V

SS

5

Ground reference

DATA

6

Data output pin/

LED

7

Open drain output for LED 

V

DD

8

Positive supply voltage

/var/www/html/datasheet/sites/default/files/pdfhtml_dummy/41109E-html.html
background image

HCS365

DS41109E-page 6

© 2011 Microchip Technology Inc.

The HCS365 has an onboard nonvolatile EEPROM.
This EEPROM is used to store user programmable
data and the synchronization counter. The data is pro-
grammed at the time of production and includes the
security related information such as encoder keys,
serial numbers, discrimination values, and seed val-
ues. All the security related options are read protected.
The initial counter value is also programmed at the time
of production. From then on the device maintains the
counter itself. The HCS365 has built in redundancy for
protection and can recover from counter corruption.
The counter will not increment if the previous write was
corrupted by low voltage RESET or power failure dur-
ing T

PLL

. Instead, the counter will revert back to the

previous count and the HCS370 will attempt to correct
the bad bits. This will continue on every button press
until the voltage increases and the counter is success-
fully corrected.

FIGURE 2-1:

TYPICAL CIRCUITS

V

DD

B0

S0

S1

S2

RFEN

LED

V

DD

DATA

V

SS

Three buttons remote with PLL control

B1

V

DD

Tx out

S0

S1

S2

S3

LED

V

DD

DATA

V

SS

Five buttons remote control (Note)

B4  B3 B2 B1 B0

Note:

Up to 15 functions can be implemented by
pressing more than one button simultane-
ously or by using a suitable diode array.

V

DD

Tx out

S0

S1

S2

SHIFT

LED

V

DD

DATA

V

SS

B1  B0

Tx1

Tx2

DUAL Transmitter remote control 

RF PLL

D

ATA

 I

N

E

NABLE

B2

/var/www/html/datasheet/sites/default/files/pdfhtml_dummy/41109E-html.html
background image

© 2011 Microchip Technology Inc.

DS41109E-page 7

HCS365

FIGURE 2-2:

I/O CIRCUITS 

FIGURE 2-3:

BASIC FLOW DIAGRAM OF 
THE DEVICE OPERATION

Z

IN

S0, S1, S2
Inputs

V

DD

DATA I/O

NFET

PFET

DATA OUT

Figure 2-2(A)

Figure 2-2(B)

Figure 2-2(C)

DATA, RFEN

N

P

STEP
Outputs

V

DD

 

START

Sample Buttons

Increment

Seed

Time-

Out

 Encrypt 

No

No

Yes

Get Config

TX?

Counter 

 Transmit 

MTX

No

Buttons

Seed

Time

Read

Seed 

STOP

Yes

Yes

No

Yes

No

No

Yes

Yes

Yes

Seed

Button

No

New

Buttons

No

/var/www/html/datasheet/sites/default/files/pdfhtml_dummy/41109E-html.html
background image

HCS365

DS41109E-page 8

© 2011 Microchip Technology Inc.

3.0

EEPROM ORGANIZATION

A summary of the HCS370 EEPROM organization is
shown in the three tables below. The address column
shows the starting address of the option and its length
or bit position. Options larger than 8 bits are stored
with the Most Significant bits at the given address.

Enough consecutive 8-bit blocks are reserved for the
entire option size. Options such as SEED1, which
have a length that is not an exact multiple of 8 bits, is
stored right justified in the reserved space. Additional
smaller options such as SDBT1 may be stored in the
same address as the Most Significant bits. 

TABLE 3-1:

ENCODER1 OPTIONS (SHIFT=0)

Note 1: All Timing values vary ±10%.

Symbol

Address

16

:Bits

Description

(1)

Reference 

Section

KEY1

1E: 64 bits

Encoder Key 

3.2.2

SEED1

14: 60 bits

Encoder Seed Value

3.3

SYNC1

00: 20 bits
00: 18 bits

Encoder Synchronization Counter (CNTSEL=1)
Encoder Synchronization Counter (CNTSEL=0) plus overflow

3.2, 3.2.1

SER1

10: 32 bits

Encoder Serial Number

3.2.2

DISC1

1C: 10 bits

Encoder Discrimination value

3.2,  3.2.1

MSEL1

1C: ---- 32--

Transmission Modulation 
Format

Value

2

Format

4.1

00

PWM

01

Manchester

10

VPWM

11

PPM

HSEL1

1C: ---4 ----

Header Select

T

E

 = 0

10 

T

E

 = 1

4.1

XSER1

1C: --5- ----

Extended Serial Number 

28 bits = 0

32 bits = 1

3.2

QUEN1

1C: -6-- ----

Queue counter Enable

Disable = 0

Enable = 1

5.5

STEN1

1C: 7--- ----

START/STOP Pulse 
Enable

Disable = 0

Enable = 1

4.1

LEDBL1

3F: -6-- ----

Low Voltage LED Blink

Never = 0

Once = 1

5.3

LEDOS1

3F: 7--- ----

LED On Time Select

(1)

50 ms = 0

100 ms = 1

5.3

SDLM1

3C: ---- ---0

Limited Seed

Disable = 0

Enable = 1

3.3

SDMD1

3C: ---- --1-

Seed Mode

User = 0

Production = 1

3.3

SDBT1

14: 7654 ----

Seed Button Code

3.3

SDTM1

3C: ---- 32--

Time Before Seed Code 
Word

(1)

Value

2

Time (s)

3.3

00

0.0

01

0.8

10

1.6

11

3.2

BSEL1

3C: --54 ----

Transmission Baud Rate 
Select

(1)

Value

2

T

E

 (

μ

s)

4.1

00

100

01

200

10

400

11

800

GSEL1

3C: 76-- ----

Guard Time Select

(1)

Value

2

Time (ms)

4.1,  5.2

00

00

01

6.4

10

51.2

11

102.4

/var/www/html/datasheet/sites/default/files/pdfhtml_dummy/41109E-html.html
background image

© 2011 Microchip Technology Inc.

DS41109E-page 9

HCS365

TABLE 3-2:

ENCODER2 OPTIONS (SHIFT=1)

Symbol

Address

16

:Bits

Description

(1)

Reference 

Section

KEY2

34: 64 bits

Encoder Key 

3.2.1

SEED2

2A: 60 bits

Encoder Seed Value

3.3

SYNC2

08: 20 bits
08: 18 bits

Encoder Synchronization Counter (CNTSEL=1)
Encoder Synchronization Counter (CNTSEL=0) plus overflow

3.2,
3.2.1

SER2

26: 32 bits

Encoder Serial Number

3.2,  3.2.2

DISC2

32: 10 bits

Encoder Discrimination value

3.2,

 3.2.1

MSEL2

32: ---- 32--

Transmission Modulation 
Format

Value

2

Format

4.1

00

PWM

01

Manchester

10

VPWM

11

PPM

HSEL2

32: ---4 ----

Header Select

4 T

E

 = 0

10 T

E

 = 1

4.1

XSER2

32: --5- ----

Extended Serial Number 

28 bits = 0

32 bits = 1

3.2

QUEN2

32: -6-- ----

Queue counter Enable

Disable = 0

Enable = 1

5.5

STEN2

32: 7--- ----

START/STOP Pulse 
Enable

Disable = 0

Enable = 1

4.1

LEDBL2

3D: -6-- ----

Low Voltage LED Blink

Never = 0

Once = 1

5.3

LEDOS2

3D: 7--- ----

LED On Time Select

(1)

50 ms = 0

100 ms = 1

5.3

SDLM2

3E: ---- ---0

Limited Seed

Disable = 0

Enable = 1

3.3

SDMD2

3E: ---- --1-

Seed Mode

User = 0

Production = 1

3.3

SDBT2

2A: 7654 ----

Seed Button Code

3.3

SDTM2

3E: ---- 32--

Time Before Seed Code 
word

(1)

Value

2

Time (s)

3.3

00

0.0

01

0.8

10

1.6

11

3.2

BSEL2

3E: --54 ----

Transmission Baud Rate 
Select

(1)

Value

2

T

E

 (

μs)

4.1

00

100

01

200

10

400

11

800

GSEL2

3E: 76-- ----

Guard Time Select

(1)

Value

2

Time (ms)

4.1,  5.2

00

2 T

E

01

6.4

10

51.2

11

102.4

Note 1: All Timing values vary ±10%.

2: Voltage thresholds are ±150 mV.

/var/www/html/datasheet/sites/default/files/pdfhtml_dummy/41109E-html.html
background image

HCS365

DS41109E-page 10

© 2011 Microchip Technology Inc.

TABLE 3-3:

DEVICE OPTIONS 

 

3.1

Dual Encoder Operation

The HCS365 contains two transmitter configurations
with separate serial numbers, encoder keys, discrimi-
nation values, counters, and seed values. This means
that the HCS365 can be used as two independent
encoders. The code word is calculated using one of two
possible encoder configurations. Most options for code
word and modulation formats can be different from
Encoder 1 and Encoder 2. However, LED and RF
transmitter options have to be the same. The SHIFT
input pin is used to select between the encoder config-
urations. A low on the SHIFT pin will select Encoder 1
and a high will select Encoder 2.

Symbol

Address

16

:Bits

Description

(1)

Reference 

Section

WAKE

3F: ---- --10

Wake-up

(1)

Value

2

Value

4.1

00

No Wake-up

01

75 ms 50%

10

50 ms 33.3%

11

100 ms 16.7%

CNTSEL

3F: ---- -2--

Counter Select

16 bits = 0

20 bits = 1

3.2.1

VLOWL

3F: ---- 3---

Low Voltage Latch Enable

Disable = 0

Enable = 1

3.2.3.1

VLOWSEL

3F: ---4 ----

Low Voltage Trip Point Select

(2)

2.2 V = 0

3.2V = 1

3.2.3.1

PLLSEL

3F: --5- ----

PLL Interface Select

ASK = 0

FSK = 1

5.2

MTX

3D: ---- --10

Minimum Code Words

Value

2

Value

2.0

00

1

01

2

10

4

11

8

TSEL

3D: --54 ----

Time-out Select

(1)

Value

2

Time(s)

2.0

00

0.8

01

3.2

10

12.8

11

25.6

DUAL

3D:-----2--

Dual Encoder Enable

Disable = 0

Enable = 1

RFENO

3D: ----3---

RF Enable Output Select

Disable = 0

Enable = 1

Note 1: All Timing values vary ±10%.

2: Voltage thresholds are ±150 mV.

Maker
Microchip Technology Inc.