Code Hopping Encoder With UHF ASK-FSK Transmitter
Code Hopping Encoder With UHF ASK-FSK Transmitter
rfHCS362G
- <200 nA typical standby current S0 3 16 S3/RFENOUT
S1 4 15 S2
- 4.8 to 11.5 mA transmit current RFENIN 5 14 XTAL
CLKOUT 6 13 LF
- 2.2 to 5.5V operation PS/DATAASK 7 12 NC
VDDRF 8 11 VSSRF
• Integrated solution with minimum external parts ANT2 9 10 ANT1
• Separate pin-outs for KEELOQ encoder and RF
SSOP
transmitter provides for design flexibility
rfHCS362F
S1 4 17 S2
XTAL 5 16 FSKOUT
• Battery low signal transmitted to receiver with pro- RFENIN 6 15 DATAFSK
CLKOUT 7 14 LF
grammable threshold PS/DATAASK 8 13 NC
• Non-volatile EEPROM storage of synchronization VDDRF 9 12 VSSRF
ANT2 10 11 ANT1
data
• Easy to use EEPROM programming interface
• PWM or Manchester modulation Security
• Selectable encoder data rate 417 to 3334 bps
• Programmable 28/32-bit serial number
• On-chip tunable encoder oscillator
• Two programmable 64-bit encryption keys
• RF Enable output for transmitter control
• Programmable 60-bit seed
• Button inputs have internal pull-down resistors
• Each 69-bit transmission is unique with 32 bits of
• Elapsed time and button queuing options
hopping code
• Current limiting on LED output
• Encryption keys are read protected
• 2-bit CRC for error detection
Applications
UHF ASK/FSK Transmitter
• Automotive Remote Keyless Entry (RKE) systems
• Conforms to US FCC Part 15.231 regulations and
• Automotive alarm systems
European ERC 70-03E and EN 300 220-1
requirements • Automotive immobilizers
• VCO phase locked to quartz crystal reference; • Community gate and garage door openers
allows narrow receiver bandwidth to maximize • Identity tokens with usage counters
range and interference immunity • Burglar alarm systems
• Crystal frequency divide by 4 output (CLKOUT) • Building access
• Transmit frequency range (310 – 440 MHz) set by
Crystal frequency
• ASK Modulation Features
• FSK Modulation through crystal pulling Device Encrypt
(rfHCS362F) Encoding Transmitter
Keys
• Adjustable output power: -12 dBm to +2 dBm
rfHCS362AG 2 x 64 PWM/MAN ASK
• Differential output configurable for single or
double ended loop antenna rfHCS362AF 2 x 64 PWM/MAN ASK/FSK
• Automatic power amplifier inhibit until PLL lock
Production rfHCS362
Programmer Transmitter
Serial Number EEPROM Array
Serial Number
Encryption Key
Sync Counter
Key .
Manufacturer’s Generation Encryption .
Code Algorithm Key .
EEPROM Array
KEELOQ®
Encryption Key Encryption
Algorithm
Sync Counter
Serial Number
Transmitted Information
1 Received Information
EEPROM Array
Button Press Serial Number 32 Bits of Manufacturer Code
Information Encrypted Data
3
KEELOQ®
Decryption
Algorithm
Decrypted
Synchronization Check for
4 Match
Counter
Perform Function
5 Indicated by
button press
S3 S2 S1 S0
DATAFSK (1)
FSKOUT (1)
Mode
RFENIN Control FSK Switch
Logic
Divide Crystal
CLKOUT Oscillator XTAL
by 4
Phase
Detector
VDDRF and
Charge Pump
VSSRF
LF
Fixed
Divide Voltage
by 32 Controlled
Oscillator
(VCO)
Power
PS/DATAASK Amplifier
(PA)
ANT2 ANT1
PFET
DATA 2.1.2 INTERNAL RC OSCILLATOR
The rfHCS362G/362F has an onboard RC oscillator
NFET that controls all the logic output timing characteristics.
The oscillator frequency varies within ±10% of the
nominal value (once calibrated over a voltage range of
DATA I/O 2V – 3.5V or 3.5V – 6.3V). All the timing values
specified in this document are subject to the oscillator
RDATA variation.
V DATAFSK input 5 pF
VDDRF VDDRF
V 20 μA
CLKOUT PFET
output
PS/DATAASK PS
NFET
PLL Lock
VDD (V)
4.5
001 - 2.1V 101 - 4.2V 4.3
4.1
010 - 2.2V 110 - 4.4V 3.9
011 - 2.3V 111 - 4.6V 3.7
3.5
-40 -25 -10 5 20 35 50 65 80
FIGURE 2-4: rfHCS362 VLOW DETECTOR
(TYPICAL) Temperature (°C)
VLOW Option
2.7
◆ = 100
2.5 ■ = 101
▲ = 110
2.3 ✖ = 111
VDD (V)
2.1
Temperature (°C)
VLOW Option
◆ = 000
■ = 001
▲ = 010
✖ = 011
No No
No New
Buttons
Yes
1 CODE WORD
LOGIC "0"
LOGIC "1"
TBP
1 16
31 TE Preamble 3/10
TE Encrypted Fixed Code Guard
Header Portion Portion Time
LOGIC "0"
LOGIC "1"
TBP
START bit
bit 0 bit 1 bit 2 STOP bit
1 2 16
S[3210]
Time bits = 00 Time bits set internally to 01 Time bits set internally to 10
DATA
Time
0s 0.8 s 1.6 s 2.4 s
with
CRC [ 1, 0 ] 0 = 0
Status Information Fixed Code Portion (32 bits) Encrypted Portion (32 bits)
(5 bits)
Synchronization
Counter
Counter
QUE CRC VLOW BUT SERIAL NUMBER BUT Overflow DISC 16 bits
2 bits 2 bits 1-bit 4 bits (28 bits) 4 bits 2 bits 10 bits 15 0
Q1 Q0 C1 C0 S2 S1 S0 S3 S2 S1 S0 S3 OVR1 OVR0
Status Information Fixed Portion (32 bits) Encrypted Portion (32 bits)
(5 bits)
Synchronization
Counter
Counter
QUE CRC VLOW SERIAL NUMBER BUT Overflow DISC 16 bits
2 bits 2 bits 1-bit (32 bits) 4 bits 2 bits 10 bits 15 0
Q1 Q0 C1 C0 S2 S1 S0 S3 OVR1 OVR0
Status Information Fixed Portion (32 bits) Encrypted Portion (32 bits)
(5 bits)
Synchronization
Counter
Counter
QUE TIME VLOW BUT SERIAL NUMBER BUT Overflow DISC 16 bits
2 bits 2 bits 1-bit 4 bits (28 bits) 4 bits 2 bits 10 bits 15 0
Q1 Q0 T1 T0 S2 S1 S0 S3 S2 S1 S0 S3 OVR1 OVR0
Status Information Fixed Portion (32 bits) Encrypted Portion (32 bits)
(5 bits)
Synchronization
Counter
Counter
QUE TIME VLOW SERIAL NUMBER BUT Overflow DISC 16 bits
2 bits 2 bits 1-bit (32 bits) 4 bits 2 bits 10 bits 15 0
Q1 Q0 T1 T0 S2 S1 S0 S3 OVR1 OVR0
LED DATA
LED
Q1 Q0 C1 C0 1 1 1 1
Transmission Direction LSB First
3.4 Seed Code Word Data Format TABLE 3-1: SEED OPTIONS (SEEDC = 0)
A seed transmission transmits a unencrypted code Seed 1.6 s Delayed Seed
word that consists of 60 bits of fixed data that is stored
in the EEPROM. This can be used for secure learning SEED S[3210] S[3210]
of encoders or whenever a fixed code transmission is
00 - -
required. The seed code word further contains the
function code and the status information (VLOW, CRC 01 0101* 0001*
and QUEUE) as configured for normal code hopping 10 0101 0001
code words. The seed code word format is shown in
11 0101 -
Figure 3-10. The function code for seed code words is
always ‘1111b’. Note: *Limited Seed
Seed code words can be configured as follows:
TABLE 3-2: SEED OPTIONS (SEEDC = 1)
• Enabled permanently.
• Disabled permanently. Seed 3.2 s Delayed Seed
• Enabled until the synchronization counter is
SEED S[3210] S[3210]
greater than 7Fh, this configuration is often
referred to as Limited Seed. 00 - -
• The time before the seed code word is transmitted 01 1001* 0011*
can be set to 1.6 s or 3.2 s, this configuration is
often referred to as Delayed Seed. When this 10 1001 0011
option is selected, the rfHCS362 will transmit a 11 1001 -
code hopping code word for 1.6 s or 3.2 s, before Note: *Limited Seed
the seed code word is transmitted.
Example A): Selecting SEEDC = 1 and SEED = 11:
3.4.1 SEED OPTIONS makes SEED transmission available every time the
combination of buttons S3 and S0 is pressed simulta-
The button combination (S[3210]) for transmitting a
neously, but Delayed Seed mode is not available.
Seed code word can be selected with the Seed and
SeedC (SEED[0..1] and SEEDC) configuration Example B): Selecting SEEDC = 0 and SEED = 01:
options as shown in Table 3-1 and Table 3-2: makes SEED transmission available only for a limited
time (only up to 128 times). The combination of buttons
S2 and S0 produces an immediate transmission of the
SEED code. Pressing and holding for more than 1.6
seconds the S0 button alone produces the SEED code
word transmission (Delayed Seed).
S[3210]
RFENOUT
DATA
TPU TPLL TG
1st CODE WORD 2nd CODE WORD
Guard Time
Bit
Field Description Values
Address
0 OSC_0 Oscillator adjust 0000 - nominal
1 OSC_1 1000 - fastest
0111 - slowest
2 OSC_2
3 OSC_3
4 VLOW_0 VLOW select nominal values
5 VLOW_1 000 - 2.0V 100 - 4.0V
6 VLOW_2 001 - 2.1V 101 - 4.2V
010 - 2.2V 110 - 4.4V
011 - 2.3V 111 - 4.6V
7 BSEL_0 Bit rate select 00 - TE = 100 μs
8 BSEL_1 01 - TE = 200 μs
10 - TE = 400 μs
11 - TE = 800 μs
9 MTX_0 Minimum number of code 00 - 1
10 words 01 - 2
MTX_1
10 - 4
11 - 8
11 GUARD_0 Guard time select 00 - 0 ms (1 TE)
12 GUARD_1 01 - 6.4 ms + 2 TE
10 - 25.6 ms + 2 TE
11 - 76.8 ms + 2 TE
13 TIMOUT_0 Time-out select 00 - No Time-out
14 TIMOUT_1 01 - 0.8 s to 0.8 s + 1 code word
10 - 3.2 s to 3.2 s + 1 code word
11 - 25.6 s to 25.6 s + 1 code word
15 CTSEL CTSEL 0 = TIME bits
1 = CRC bits
Bit
Field Description Values
Address
0 DISC_0 Discrimination bits DISC[9:0]
1 DISC_1
2 DISC_2
... ...
8 DISC_8
9 DISC_9
10 OVR_0 Overflow OVR[1:0]
11 OVR_1
12 XSER Extended Serial Number 0 - Disable
1 - Enable
13 SEEDC Seed Control 0 = Seed transmission on:
S[3210] = 0001 (delay 1.6 s)
S[3210] = 0101 (immediate)
4.5.5 GUARD logical “1” the two overflow bits OVL0 and OVL1. The
overflow bits form part of the encrypted transmission,
The Guard time between code words can be set to 0 and therefore can be examined by receiver firmware.
ms, 6.4 ms, 25.6 ms and 76.8 ms. If during a series of Table 4-4 shows how the overflow bits act when they
code words, the output changes from Hopping Code to are set to one during initial device configuration.
Seed the Guard time will increase by 3 x TE.
The transmission time-out can be set to 0.8 s, 3.2 s, Sync. Counter OVL0 OVL1
25.6 s or no time-out. After the time-out period, the
No overflow 1 1
encoder will stop transmission and enter a low power
0-FFFFH
Shutdown mode.
First overflow 0 1
4.5.7 DISC[0..9] 2nd 0-FFFFH
Second overflow 0 0
The discrimination bits are used to validate the
Third 0-FFFFH
decrypted code word. The discrimination value is typi-
cally programmed with the 10 Least Significant bits of Subsequent overflows 0 0
the serial number or a fixed value.
As can be seen from the table, the counter is effectively
extended by one bit, that is OVL0. In addition, OVL1
4.5.8 OVR[0..1]
provides indication of the second counter overflow.
The automatically incrementing synchronization coun- After the second overflow, OVL0 and OVL1 remain
ter is at the core of generating the varying code. Since zero, providing permanent evidence of the first and
the counter is limited to 16 bits, it overflows after 65536 second overflow events.
increments, after which the code hopping sequence
repeats. In practice, this allows 20+ operations per day
for ten years before repeating the sequence. In addi-
tion, two overflow bits allow the sequence to be
extended further. The feature is enabled by setting to
Bit
Field Description Values
Address
0 SEED_48 Seed Most Significant word —
1 SEED_49
2 SEED_50
... ...
9 SEED_57
10 SEED_58
11 SEED_59
12 LED LED output timing 0 = VBOT>VLOW
LED blink 200/800 ms
VBOT<VLOW
LED not blinking
1 = VBOT>VLOW
LED blink 25/500 ms
VBOT<VLOW
LED blink once
13 MOD Modulation Format 0 = PWM
1 = MANCHESTER
14 RFEN RF Enable/S3 multiplexing 0 - Enabled
(S3 only sensed 2 seconds after the last but-
ton is released)
1 - Disabled
(S3 same as other S inputs)
15 HEADER PWM Header Length 0 = short Header, TH = 3 x TE
1 = standard Header, TH = 10 x TE
DATA
S2
S0 or S1 “01,10,11”
TRFON
RFEN
QUEUE CRC Vlow Button Serial Number Button DISC+ OVR Sync Counter
(2 bits) (2 bits) (1-bit) Status (28 bits) Status (12 bits) (16 bits)
S2 S1 S0 S3 S2 S1 S0 S3
69 Data bits LSb
MSb Transmitted
LSb first.
Enter Program
Mode TPBW
TCLKH TDS TWC
S2 (S3)
(Clock)
TPS TPH1
TCLKL TDH
DATA
Bit 0 Bit 1 Bit 2 Bit 3 Bit 14 Bit 15 Bit 16 Bit 17
(Data)
Note: If a Verify operation is to be done, then it must immediately follow the Program cycle.
X1
rfHCS362G/
362F
C1
TABLE 6-2: XTAL OSC APPROXIMATE FREQ. VS. CAPACITANCE (ASK MODE) (1)
C2 = 1000 pF C2 = 100 pF C2 = 47 pF
C1 (pF) Freq (MHz) / Dev (kHz) Freq (MHz) / Dev (kHz) Freq (MHz) / Dev (kHz)
22 433.612 / 34 433.619 / 27 433.625 / 21
33 433.604 / 25 433.610 / 19 433.614 / 14
39 433.598 / 20 433.604 / 14 433.608 / 10
47 433.596 / 17 433.601 / 11.5 433.604 / 8
68 433.593 / 13 433.598 / 9 433.600 / 5.5
100 433.587 / 8 — —
Note 1: Standard Operating Conditions (unless otherwise stated) TA = 25°C, RFEN = 1, VDDRF = 3V,
fXTAL = 13.55 MHz
XTAL
Fmax
X1
Frequency
C2 (MHz)
FSKOUT
Fmin
C1
rfHCS362F
C1 C1||C2
DATAFSK = 1 DATAFSK = 0
rfHCS362G/362F
LF
R1
C2 C1
TABLE 6-4: EXAMPLE LOOP FILTER VALUES FOR TRANSMIT FREQUENCY = 433.92 MHz (1)
TABLE 6-5: EXAMPLE LOOP FILTER VALUES FOR TRANSMIT FREQUENCY = 315 MHz (1)
Devices. R1 20μA
DATA IN
The transmit output power can be adjusted in six dis- PS/DATAASK To power
crete steps from +2 dBm to -12 dBm by varying the volt- select
circuitry
age (VPS) at the PS/DATAASK pin. Figure 6-5 shows an
example voltage divider network for ASK operation and R2
Table 6-6 lists typical values for R1 and R2 for both the
ASK and FSK modes.
RFEN Description
0 Transmitter and CLKOUT in Standby
1 Transmitter and CLKOUT enabled
LED
TLED
1 TE
RFEN
TPLL
TTD
TDB
SN Button Press
Detect
Bit 0 Bit 1 Bit 30 Bit 31 Bit 32 Bit 33 Bit 58 Bit 59 Bit 60 Bit 61 Bit 62 Bit 63 Bit 64 Bit 65 Bit 66 Bit 67 Bit 68
LOGIC "0"
LOGIC "1"
TBP
1 16
31 TE Preamble 3/10
TE Encrypted Fixed Code Guard
Header Portion Portion Time
LOGIC "0"
LOGIC "1"
TBP
START bit
bit 0 bit 1 bit 2 STOP bit
1 2 16
4 x TE Data Word
31 x TE Preamble Header Transmission
REVISION HISTORY
From: Name
Company
Address
City / State / ZIP / Country
Telephone: (_______) _________ - _________ FAX: (______) _________ - _________
Application (optional):
Would you like a reply? Y N
Questions:
2. How does this document meet your hardware and software development needs?
3. Do you find the organization of this document easy to follow? If not, why?
4. What additions to the document do you think would enhance the structure and subject?
5. What deletions from the document could be made without affecting the overall usefulness?
* JW Devices are UV erasable and can be programmed to any device configuration. JW Devices meet the electrical requirement of
each oscillator type.
• Microchip believes that its family of products is one of the most secure families of its kind on the market today, when used in the
intended manner and under normal conditions.
• There are dishonest and possibly illegal methods used to breach the code protection feature. All of these methods, to our
knowledge, require using the Microchip products in a manner outside the operating specifications contained in Microchip’s Data
Sheets. Most likely, the person doing so is engaged in theft of intellectual property.
• Microchip is willing to work with the customer who is concerned about the integrity of their code.
• Neither Microchip nor any other semiconductor manufacturer can guarantee the security of their code. Code protection does not
mean that we are guaranteeing the product as “unbreakable.”
Code protection is constantly evolving. We at Microchip are committed to continuously improving the code protection features of our
products. Attempts to break Microchip’s code protection feature may be a violation of the Digital Millennium Copyright Act. If such acts
allow unauthorized access to your software or other copyrighted work, you may have a right to sue for relief under that Act.
ISBN: 978-1-61341-234-3