2002 Microchip Technology Inc.
Preliminary
DS41189A-page 1
rfHCS362G/362F
General:
Combination K
EE
L
OQ
encoder and synthesized
UHF ASK/FSK transmitter in a single package
Operates on a single lithium coin cell
- <200 nA typical standby current
- 4.8 to 11.5 mA transmit current
- 2.2 to 5.5V operation
Integrated solution with minimum external parts
Separate pin-outs for K
EE
L
OQ
encoder and RF
transmitter provides for design flexibility
Code Hopping Encoder:
Programmable minimum code word completion
Battery low signal transmitted to receiver with pro-
grammable threshold
Non-volatile EEPROM storage of synchronization
data
Easy to use EEPROM programming interface
PWM or Manchester modulation
Selectable encoder data rate 417 to 3334 bps
On-chip tunable encoder oscillator
RF Enable output for transmitter control
Button inputs have internal pull-down resistors
Elapsed time and button queuing options
Current limiting on LED output
2-bit CRC for error detection
UHF ASK/FSK Transmitter:
Conforms to US FCC Part 15.231 regulations and
European ERC 70-03E and EN 300 220-1
requirements
VCO phase locked to quartz crystal reference;
allows narrow receiver bandwidth to maximize
range and interference immunity
Crystal frequency divide by 4 output (CLKOUT)
Transmit frequency range (310 440 MHz) set by
Crystal frequency
ASK Modulation
FSK Modulation through crystal pulling
(rfHCS362F)
Adjustable output power: -12 dBm to +2 dBm
Differential output configurable for single or
double ended loop antenna
Automatic power amplifier inhibit until PLL lock
Pin Diagrams
Security:
Programmable 28/32-bit serial number
Two programmable 64-bit encryption keys
Programmable 60-bit seed
Each 69-bit transmission is unique with 32 bits of
hopping code
Encryption keys are read protected
Applications:
Automotive Remote Keyless Entry (RKE) systems
Automotive alarm systems
Automotive immobilizers
Community gate and garage door openers
Identity tokens with usage counters
Burglar alarm systems
Building access
Device
Features
Encrypt
Keys
Encoding
Transmitter
rfHCS362AG
2 x 64
PWM/MAN
ASK
rfHCS362AF
2 x 64
PWM/MAN
ASK/FSK
SOIC
V
SS
S2
XTAL
S3/RFEN
OUT
V
DD
LED/SHIFT
S1
RFEN
IN
CLKOUT
PS/DATA
ASK
V
DDRF
S0
LF
2
3
4
5
6
7
8
9
1
17
16
14
13
12
11
10
15
18
r
f
H
C
S
36
2G
DATA
ANT2
NC
V
SSRF
ANT1
SSOP
V
SS
S2
DATA
FSK
S3/RFEN
OUT
V
DD
LED/SHIFT
S1
RFEN
IN
CLKOUT
PS/DATA
ASK
V
DDRF
S0
LF
2
3
4
5
6
7
8
9
1
19
18
16
15
14
13
12
17
20
r
f
HCS
36
2F
DATA
NC
V
SSRF
ANT2
ANT1
10
11
FSK
OUT
XTAL
K
EE
L
OQ
Code Hopping Encoder with
UHF ASK/FSK Transmitter
rfHCS362G/362F
DS41189A-page 2
Preliminary
2002 Microchip Technology Inc.
1.0 General Description ....................................................................................................................................................................... 3
2.0 Device Description ......................................................................................................................................................................... 9
3.0 Encoder Operation ....................................................................................................................................................................... 13
4.0 EEPROM Memory Organization .................................................................................................................................................. 21
5.0 Programming the rfHCS362G/362F............................................................................................................................................. 27
6.0 UHF ASK/FSK Transmitter .......................................................................................................................................................... 29
7.0 Integrating the rfHCS362G/362F into the System ....................................................................................................................... 37
8.0 Development Support .................................................................................................................................................................. 41
9.0 Electrical Characteristics.............................................................................................................................................................. 43
10.0 DC Characteristics ....................................................................................................................................................................... 45
11.0 Packaging Information ................................................................................................................................................................. 51
Appendix A: Data Sheet Revision History............................................................................................................................................ 54
On-Line Support................................................................................................................................................................................... 55
Reader Response ................................................................................................................................................................................ 56
rfHCS362G/362F Product Identification System.................................................................................................................................. 57
TO OUR VALUED CUSTOMERS
It is our intention to provide our valued customers with the best documentation possible to ensure successful use of your Microchip
products. To this end, we will continue to improve our publications to better suit your needs. Our publications will be refined and
enhanced as new volumes and updates are introduced.
If you have any questions or comments regarding this publication, please contact the Marketing Communications Department via
E-mail at docerrors@mail.microchip.com or fax the Reader Response Form in the back of this data sheet to (480) 792-4150.
We welcome your feedback.
Most Current Data Sheet
To obtain the most up-to-date version of this data sheet, please register at our Worldwide Web site at:
http://www.microchip.com
You can determine the version of a data sheet by examining its literature number found on the bottom outside corner of any page.
The last character of the literature number is the version number, (e.g., DS30000A is version A of document DS30000).
Errata
An errata sheet, describing minor operational differences from the data sheet and recommended workarounds, may exist for current
devices. As device/documentation issues become known to us, we will publish an errata sheet. The errata will specify the revision
of silicon and revision of document to which it applies.
To determine if an errata sheet exists for a particular device, please check with one of the following:
Microchip's Worldwide Web site; http://www.microchip.com
Your local Microchip sales office (see last page)
The Microchip Corporate Literature Center; U.S. FAX: (480) 792-7277
When contacting a sales office or the literature center, please specify which device, revision of silicon and data sheet (include liter-
ature number) you are using.
Customer Notification System
Register on our web site at www.microchip.com/cn to receive the most current information on all of our products.
2002 Microchip Technology Inc.
Preliminary
DS41189A-page 3
rfHCS362G/362F
1.0
GENERAL DESCRIPTION
The rfHCS362G/362F is a code hopping encoder plus
UHF transmitter designed for secure wireless com-
mand and control systems. The rfHCS362G/362F uti-
lizes the K
EE
L
OQ
code hopping technology which
incorporates high security in a small package outline at
a low cost to make this device well suited for unidirec-
tional remote keyless entry systems and access control
systems.
The rfHCS362G/362F combines a 32-bit hopping code
generated by a nonlinear encryption algorithm with a
28/32-bit serial number and 9/5 status bits to create a
69-bit transmission stream. The length of the transmis-
sion strongly resists the threat of code scanning. The
code hopping mechanism makes each transmission
unique, thus rendering code capture and resend (code
grabbing) schemes virtually useless.
The encryption key, serial number and configuration
data are stored in an EEPROM array which is not
accessible via any external connection. The EEPROM
data is programmable but read protected. The data can
be verified only after an automatic erase and program-
ming operation. This protects against attempts to gain
access to keys or manipulate synchronization values.
The rfHCS362G/362F provides an easy to use serial
interface for programming the necessary keys, system
parameters and configuration data.
The transmitter is a fully integrated UHF ASK/FSK
transmitter consisting of crystal oscillator, Phase-
Locked Loop (PLL), open-collector differential-output
Power Amplifier (PA), and mode control logic. External
components consist of bypass capacitors, crystal, and
PLL loop filter. There are no internal electrical connec-
tions between the encoder and the transmitter. The
encoder oscillator is independent from the transmitter
crystal oscillator.
The rfHCS362G is capable of Amplitude Shift Keying
(ASK) modulation by turning the PA on and off. The
rfHCS362F is capable of ASK or Frequency Shift Key-
ing (FSK) modulation by employing an internal FSK
switch to pull the transmitter crystal via a second load
capacitor.
The rfHCS362G/362F is a single channel device. The
transmit frequency is fixed and set by an external refer-
ence crystal. Transmit frequencies in the range of 310
to 440 MHz can be selected. Output drive is an open-
collector differential amplifier. The differential output is
well suited for loop antennas. Output power is adjust-
able from +2 dBm to -12 dBm in six discrete steps.
The rfHCS362G/362F are radio frequency (RF) emit-
ting devices. Wireless RF devices are governed by a
country's regulating agency. For example, in the United
States it is the Federal Communications Committee
(FCC) and in Europe it is the European Conference of
Postal and Telecommunications Administrations
(CEPT). It is the responsibility of the designer to ensure
that their end product conforms to rules and regulations
of the country of use and/or sale.
RF devices require correct board level implementation
in order to meet regulatory requirements. Layout con-
siderations are given in Section 6.0 UHF ASK/FSK
Transmitter.
1.1
Important Terms
The following is a list of key terms used throughout this
data sheet. For additional information on K
EE
L
OQ
and
Code Hopping refer to Technical Brief 3 (TB003).
RKE - Remote Keyless Entry
Button Status - Indicates what button input(s)
activated the transmission. Encompasses the 4
button status bits S3, S2, S1 and S0 (Figure 3-6).
Code Hopping - A method by which a code,
viewed externally to the system, appears to
change unpredictably each time it is transmitted.
Code word - A block of data that is repeatedly
transmitted upon button activation (Figure 3-6).
Transmission - A data stream consisting of
repeating code words (Figure 10-1).
Encryption key - A unique and secret 64-bit
number used to encrypt and decrypt data. In a
symmetrical block cipher such as the K
EE
L
OQ
algorithm, the encryption and decryption keys are
equal and will be referred to generally as the
encryption key.
Encoder - A device that generates and encodes
data.
Encryption Algorithm - A recipe whereby data is
scrambled using a encryption key. The data can
only be interpreted by the respective decryption
algorithm using the same encryption key.
Decoder - A device that decodes data received
from an encoder.
Decryption algorithm - A recipe whereby data
scrambled by an encryption algorithm can be
unscrambled using the same encryption key.
Learn Learning involves the receiver calculating
the transmitter's appropriate encryption key,
decrypting the received hopping code and storing
the serial number, synchronization counter value
and encryption key in EEPROM. The K
EE
L
OQ
product family facilitates several learning strate-
gies to be implemented on the decoder. The fol-
lowing are examples of what can be done.
- Simple Learning
The receiver uses a fixed encryption key,
common to all components of all systems by
the same manufacturer, to decrypt the
received code word's encrypted portion.
rfHCS362G/362F
DS41189A-page 4
Preliminary
2002 Microchip Technology Inc.
- Normal Learning
The receiver uses information transmitted
during normal operation to derive the encryp-
tion key and decrypt the received code
word's encrypted portion.
- Secure Learn
The transmitter is activated through a special
button combination to transmit a stored 60-bit
seed value used to generate the transmitter's
encryption key. The receiver uses this seed
value to derive the same encryption key and
decrypt the received code word's encrypted
portion.
Manufacturer's code A unique and secret 64-
bit number used to generate unique encoder
encryption keys. Each encoder is programmed
with a encryption key that is a function of the man-
ufacturer's code. Each decoder is programmed
with the manufacturer code itself.
1.2
Applications
The rfHCS362G/362F is suited for secure wireless
remote control applications. The EEPROM technology
makes customizing application programs (transmitter
codes, appliance settings, etc.) extremely fast and con-
venient. The small footprint packages are suitable for
applications with space limitations. Low-cost, low-
power, high performance, ease of use and I/O flexibility
make the rfHCS362G/362F very versatile. Typical
application circuits are shown in Figure 1-5 and
Figure 1-6.
Most low-end keyless entry transmitters are given a
fixed identification code that is transmitted every time a
button is pushed. The number of unique identification
codes in a low-end system is usually a relatively small
number. These shortcomings provide an opportunity
for a sophisticated thief to create a device that `grabs'
a transmission and retransmits it later, or a device that
quickly `scans' all possible identification codes until the
correct one is found.
The rfHCS362G/362F, on the other hand, employs the
K
EE
L
OQ
code hopping technology coupled with a trans-
mission length of 66 bits to virtually eliminate the use of
code `grabbing' or code `scanning'. The high security
level of the rfHCS362G/362F is based on patented
technology. A block cipher based on a block length of
32 bits and a key length of 64 bits is used. The algo-
rithm obscures the information in such a way that even
if the transmission information (before coding) differs
by only one bit from that of the previous transmission,
the next coded transmission will be completely differ-
ent. Statistically, if only one bit in the 32-bit string of
information changes, approximately 50 percent of the
coded transmission bits will change.
FIGURE 1-1:
ADDITIONAL BUTTON INPUTS
Up to 7 button inputs can be implemented making them
look like a binary value to the 3 Sx inputs. This is done
with switching diodes as shown in Figure 1-1. The dis-
advantage is that simultaneously pressed buttons now
appear as if a single button is pressed.
The rfHCS362G/362F has a small EEPROM array
which must be loaded with several parameters before
use. These are most often programmed by the manu-
facturer at the time of production. The most important
of these are:
A 28-bit serial number, typically unique for every
encoder
An encryption key
An initial 16-bit synchronization value
A 16-bit configuration value
The encryption key generation typically inputs the
transmitter serial number and 64-bit manufacturer's
code into the key generation algorithm (Figure 1-2).
The manufacturer's code is chosen by the system
manufacturer and must be carefully controlled as it is a
pivotal part of the overall system security.
The 16-bit synchronization counter is the basis behind
the transmitted code word changing for each transmis-
sion; it increments each time a button is pressed. Due
to the code hopping algorithm's complexity, each incre-
ment of the synchronization value results in about 50%
of the bits changing in the transmitted code word.
V
DD
S0
S1
S2
RFEN
B4 B3 B2 B1 B0
2002 Microchip Technology Inc.
Preliminary
DS41189A-page 5
rfHCS362G/362F
Figure 1-3 shows how the key values in EEPROM are
used in the encoder. Once the encoder detects a button
press, it reads the button inputs and updates the syn-
chronization counter. The synchronization counter and
encryption key are input to the encryption algorithm
and the output is 32 bits of encrypted information. This
data will change with every button press, its value
appearing externally to `randomly hop around', hence it
is referred to as the hopping portion of the code word.
The 32-bit hopping code is combined with the button
information and serial number to form the code word
transmitted to the receiver. The code word format is
explained in greater detail in Section 3.1.
A receiver may use any type of controller as a decoder,
but it is typically a microcontroller with compatible firm-
ware that allows the decoder to operate in conjunction
with an rfHCS362G/362F based transmitter.
Section 7.0 provides detail on integrating the
rfHCS362G/362F into a system.
A transmitter must first be `learned' by the receiver
before its use is allowed in the system. Learning
includes calculating the transmitter's appropriate
encryption key, decrypting the received hopping code
and storing the serial number, synchronization counter
value and encryption key in EEPROM.
In normal operation, each received message of valid
format is evaluated. The serial number is used to deter-
mine if it is from a learned transmitter. If from a learned
transmitter, the message is decrypted and the synchro-
nization counter is verified. Finally, the button status is
checked to see what operation is requested. Figure 1-4
shows the relationship between some of the values
stored by the receiver and the values received from
the transmitter.
FIGURE 1-2:
CREATION AND STORAGE OF ENCRYPTION KEY DURING PRODUCTION
Transmitter
Manufacturer's
Serial Number
Code
Encryption
Key
Key
Generation
Algorithm
Serial Number
Encryption Key
Sync Counter
.
.
.
rfHCS362
Production
Programmer
EEPROM Array
PDF 
ZIP