00217a - Stand Alone - HCS Program

AN217
KEELOQ HCS30X, HCS200 Stand-Alone Programmer

KEELOQ SIMPLE LEARNING SCHEME
Author:
Maurizio Fiammeni
Microchip Technology Inc.
OVERVIEW
This application note describes how to implement a
KEELOQ stand-alone programmer using a Microchip
PIC16F84A microcontroller.
The PIC16F84A is a FLASH microcontroller with 64
bytes of internal EEPROM that, in this design, is used
to store the incremental serial number programmed
into HCS encoders every time. All the other HCS configuration parameters are defined as constants in the
FLASH program memory of the PIC16F84A.
(Fixed Key)
This learning scheme implements the lowest level of
security for a KEELOQ based security system. With this
method, every programmed encoder has a different
serial number, but the same fixed Encryption Key is
equal to the chosen Manufacturer's Code.
FIGURE 2:
SIMPLE LEARNING SCHEME
64-bit
Manufacturers Code
Encryption Key
Two learning schemes are implemented:

The simple learning scheme for which you can
find the complete software in this application note.
The normal learning scheme with the applicable
software included in the KEELOQ license agreement disks (this software includes the KEELOQ
decryption routine).
In the first scheme, the Encryption Key programmed in
the HCS encoders is always the same and equal to the
Manufacturer's Code.
In the second scheme, before starting to program the
encoder, the PIC16F84A calculates the Encryption Key
for that encoder using the 64-bit Manufacturer's Code
and the 28-bit serial number running the KEELOQ
decryption algorithm.
FIGURE 1:
PIC16F84A PIN OUT
PDIP, SOIC
1
2
3
4
5
6
7
8
9
PIC16F84A
RA2
RA3
RA4/T0CKI
MCLR
VSS
RB0/INT
RB1
RB2
RB3
18
17
16
15
14
13
12
11
10
RA1
RA0
OSC1/CLKIN
OSC2/CLKOUT
VDD
RB7
RB6
RB5
RB4
An explanation of the different security levels can be

found in the "Secure Data Products Handbook" (Comparison Chart, Section 1 [DS40168]).
The application note AN659 (KEELOQ Simple Code
Hopping Decode [DS00663]), implements a decoder
that can be used with an encoder using the simple
learning method.
KEELOQ NORMAL LEARNING

SCHEME
(Serial Number Derived System)
In this case, every transmitter is programmed with an
incremental unique serial number. This serial number is
used in conjunction with the 64-bit Manufacturer's
Code and the KEELOQ algorithm to generate the
Encryption Key. This Encryption Key is programmed
into the encoder, thus, every transmitter has a different
key that is used to encrypt the data.
A detailed explanation of this learning scheme can be
found in the Technical Brief TB001 [DS91000A], part of
the Microchip Secure Data Products Handbook.
The application note AN642 (KEELOQ Code Hopping
Decoder Using a PIC16C56, [DS00642]), implements a
decoder that can be used with the HCS programmed in
this normal method.
Notice:
This is a non-restricted version of Application Note AN218 which is available under the KEELOQ License
Agreement. The license agreement can be ordered from the Microchip Literature Center as DS40149.
2001 Microchip Technology Inc.
DS00217A-page 1
AN217
The key generation scheme is shown below:
FIGURE 3:
NORMAL (SERIAL NUMBER-DERIVED) LEARNING SCHEME
02H+SN
64-bit Manufacturers
Code
Transformation
(Decrypt or XOR)
06H+SN
Transformation
(Decrypt or XOR)
64-bit Manufacturers
Code
Upper 32 bits of key
OTHER POSSIBLE LEARNING

SCHEMES
Lower 32 bits of key
FIGURE 4:
HCS300 BLOCK DIAGRAM
Oscillator
Power
Latching
and
Switching
(Secure Seed-Derived System)

The two learning methods implemented in this application note are not the only schemes applicable. Refer to
Technical Brief TB001 for more information on Secure
Learning schemes.
Reset Circuit
LED Driver
Furthermore, custom learning scheme solutions can

also be implemented.
ENCODER EEPROM MEMORY

ORGANIZATION
Controller
LED
EEPROM
Encoder
PWM
32-bit Shift Register
The KEELOQ encoders are EEPROM based devices

with a built-in oscillator, wake-up on button press, reset
circuit and internal logic state machine (Figure 4).
VSS
Button Input Port
VDD
S3
S2
S1
S0
The HCS200, HCS300 and HCS301 contain 192 bits

(12 * 16-bit words) of EEPROM memory (Table 1). This
EEPROM array is used to store the Encryption Key, the
synchronization value, the serial number, etc.
A detailed description of the memory map is represented in Table 1.
DS00217A-page 2
AN217
TABLE 1:
HCS30X EEPROM MEMORY

MAP
WORD
ADDRESS
MNEMONIC
DESCRIPTION
TABLE 2:
HCS30X CONFIGURATION
WORD
BIT NUMBER
BIT DESCRIPTION
Discrimination Bit 0
KEY_0
64-bit Encryption Key

(word 0)
KEY_1

(word 1)
KEY_2

(word 2)

(word 3)
16-bit Synchronization
Value
3
4
KEY_3
SYNC
RESERVED
Set to 0000H
10
Overflow bit 0 (OVR0)
SER_0
Device Serial Number

(word 0)
11
Overflow bit 1 (OVR1)
SER_1
Device Serial Number

(word 1)
SEED_0
Seed Value (word 0)
14
Baud Rate Select Bit 1 (BSL1)
Seed Value (word 1)
15
Envelope Encryption Select (EENC)
SEED_1
10
EN_KEY
16-bit Envelope Key
11
CONFIG
Config Word
Note:
12
Low Voltage Trip Point Select
13
Baud Rate Select Bit 0 (BSL0)
Note:
Please refer to the HCS200 data sheet

[DS40138] for configuration details.
The MSb of the serial number contains a

bit used to select the auto shut-off timer.
In order to create the encrypted message transmitted

to the receiver, the encoder uses the 64-bit Encryption
Key and the 16-bit synchronous counter.
Certain configuration options can be selected for the
different encoders. Table 2 shows the configuration
word for the HCS300/1.
DS00217A-page 3
AN217
PROGRAMMING/VERIFY WAVEFORM
as the data in line. After each 16-bit word is loaded, a

programming delay is required for the internal program
cycle to complete. This delay can take up to TWC (see
Table 3).
The programming cycle allows programming of the

192-bits representing the serial number, the Encryption
Key, the configuration word, etc., in a serial data stream
into the encoder EEPROM.
At the end of the programming cycle, the device can be

verified (Figure 6) by reading back the EEPROM.
Clocking the S2 line reads back the data on the PWM
line. For security reasons, it is not possible to execute
a verify function without first programming the
EEPROM.
Programming is initiated by forcing the PWM line high,

after the S2 line has been held high for the appropriate
length of time (TPS).
After the program mode is entered, a delay must be
allowed during which the device erases the entire
memory. This writes all locations in the EEPROM to
zeros. The device can then be programmed by clocking
in 16 bits at a time, using S2 as the clock line and PWM
FIGURE 5:
A verify operation can only be done once, immediately

following the program cycle. This is important to prevent reading the internal memory of the encoder once
it has been programmed.
PROGRAMMING WAVEFORMS
Enter Program
Mode
TPBW
TCLKH
TDS
TWC
S3
(Clock)
TPS
TPH1
TCLKL
PWM
(Data)
Bit 0
Bit 1
TDH
Bit 2
Bit 3
Bit 14
Bit 15
Bit 16
Data for Word 0 (Key 0)
TPH2
Bit 17
Data for Word 1
Repeat 12 times for each word

Note 1: Unused button inputs to be held to ground during the entire programming sequence.
2: The VDD pin must be taken to ground after a program/verify cycle.
FIGURE 6:
VERIFY WAVEFORMS
End of
Programming Cycle
PWM
(Data)
Bit190 Bit191
Begin Verify Cycle Here

Data in Word 0
Bit 0
TWC
Bit 1
Bit 2
Bit 3
Bit 14
Bit 15
Bit 16 Bit 17
Bit190 Bit191
TDV
S3
(Clock)
Note: If a Verify operation is to be done, then it must immediately follow the Program cycle.
Note:
For the HCS300 and HCS301, both the S2 pin and the S3 pin can be used as programming clock lines, and
for the HCS200, only the S2 pin can be the clock line.
DS00217A-page 4
AN217
TABLE 3:
PROGRAMMING/VERIFY TIMING REQUIREMENTS
VDD = 5.0V 10%

25C 5C
Parameter
Symbol
Min.
Max.
Units
Program Mode Setup Time
TPS
3.5
4.5
ms
Hold Time 1
TPH1
3.5
ms
Hold Time 2
TPH2
50
Bulk Write Time
TPBW
2.2
ms
Program Delay Time
TPROG
2.2
ms
Program Cycle Time
TWC
36
ms
Clock Low Time
TCLKL
25
Clock High Time
TCLKH
25
Data Setup Time
TDS
Data Hold Time
TDH
18
Data Out Valid Time
TDV
10
24
DS00217A-page 5
AN217
SOFTWARE IMPLEMENTATION
The software that implements the encoder programmer
runs on the PIC16F84A.
The 64-bit Manufacturers Code is stored in the internal
PIC16F84A FLASH memory. This cannot be read if the
device is code protected.
All the other parameters in the configuration word of the
encoder are in the FLASH program memory of the
PIC16F84A, where they are defined as constants.
The serial number programmed every time into the

encoder is located instead, in the internal EEPROM
data memory of the PIC16F84A.
In order to change the Manufacturer Code (MKEY_X),
or some parameter of the configuration word, as the
voltage selection (VLOW), the baud rates transmission
(BSL0, BSL1), etc., a change in the firmware is
required. The following define can be modified in the
assembly code:
===========================================================================================
MODIFYABLE PROGRAMMING DEFINE
===========================================================================================
#DEFINE
KEY_METHOD 1
; MUST BE 1 IF NORMAL KEY GEN METHOD TO BE USED

; MUST BE 0 IF SIMPLE KEY GEN METHOD TO BE USED
; (ENCRYPTION KEY= MANUFACTURER KEY)
#DEFINE
HCS30X
; MUST BE 1 IF PROGRAMMING HCS300-301,

; MUST BE 0 IF PROGRAMMING HCS200
#DEFINE
#DEFINE
#DEFINE
#DEFINE
MCODE_0
MCODE_1
MCODE_2
MCODE_3
0xCDEF
0x89AB
0x4567
0x0123
; LSWORD
#DEFINE
SYNC
0X0000
; SYNCRONOUS COUNTER
#DEFINE
#DEFINE
SEED_0
SEED_1
0x0000
0x0000
; 2 WORD SEED VALUE
#DEFINE
ENV_KEY
0x0000
; ENVELOPE KEY (NOT USED FOR HCS200)
#DEFINE
AUTOFF
; AUTO SHUT OFF TIMER ( NOT USED FOR HCS200)
#DEFINE
#DEFINE
#DEFINE
#DEFINE
#DEFINE
#DEFINE
#DEFINE
#DEFINE
#DEFINE
DISC70
DISC8
DISC9
OVR0
OVR1
VLOW
BSL0
BSL1
EENC
0x00
0
0
0
0
1
0
0
0
;
;
;
;
;
;
;
;
;
;
#DEFINE
DISEQSN
; IF DISEQSN=1 SET DISCRIMINANT EQUAL TO

; SERNUM BIT10-0 IF DISEQSN=0 SET DISCRIMINANT
; AS DEFINED ABOVE
; MSWORD
DISCRIMINATION BIT7-BIT0
DISCRIMINATION BIT8
DISCRIMINATION BIT9
OVERFLOW BIT0 (DISC10 for HCS200)
OVERFLOW BIT1(DISC11 for HCS200)
LOW VOLTAGE TRIP POINT SELECT BIT (1=High voltage)
BAUD RATE SELECT BIT0
BAUD RATE SELECT BIT1(RESERVED for HCS200)
ENVELOPE ENCRYPTION SELECT(RESERVED for
HCS200)
===========================================================================================
Note:
The PIC16F84A program to build the HCS EEPROM memory map uses all these parameters.
DS00217A-page 6
AN217
The software given with this application note implements the Simple Key generation method, while the
software that implements the Normal Key method is
contained in the KEELOQ License agreement disks.
The software is composed of four main functions:
Main loop routines

Encryption Key generation routines
Programming HCS routines
Verify HCS routines
Verify HCS Routines (M_VERIFY)

At the end of the 12th word programmed, the
M_VERIFY routine continues to drive the clock line S2,
reading back the EEPROM memory and verifying what
was programmed before.
If the verify is right, it is indicated by 0.4 seconds LED
on (PROG_SUCCESS). If not, the LED will blink for 4 seconds (PROG_ERR) before going back to the M_LOOP.
For further analysis, consult the following literature:
Main Loop Routine (M_KEY_GEN:

SIMPLE_KEY_GEN, NORMAL_KEY_GEN,
MAP_SET)
KEELOQ Code Hopping

Decoder on a PIC16C56
AN642
DS00642
Converting NTQ105/106
Designs to HCS200/300s
AN644
DS00644
The program simply waits for a button press to proceed

to the programming routines.
Code Hopping Security

System on a PIC16C57
AN645
DS00645
Secure Learn Code Hopping

AN652
DS00652
KEELOQ Simple Code Hopping

Decoder
AN659
DS00659
KEELOQ Code Hopping

(public version)
AN661
DS00661
Secure Learn Code Hopping

(public version)
AN662
DS00662
KEELOQ Simple Code Hopping

Decoder (public version)
AN663
DS00663
Using KEELOQ to Generate

Hopping Passwords
AN665
DS00665
PICmicro Mid-Range MCU

Code Hopping Decoder
AN662
DS00672
HCS410 Transponder Decoder

using a PIC16C56
AN675
DS00675
Modular PICmicro Mid-Range

MCU Code Hopping Decoder
AN742
DS00742
Modular Mid-Range PICmicro

KEELOQ Decoder in C
AN744
DS00744
Secure Learning RKE Systems

Using KEELOQ Encoders
TB001
DS91000
An Introduction to KEELOQ
Code Hopping
TB003
DS91002
A Guide to Designing for

EuroHomelink Compatibility
TB021
DS91021
KEELOQ Decryption & IFF

Algorithms
TB030
DS91030
KEELOQ Decryption Routines in

C
TB041
DS91041
Interfacing a KEELOQ Encoder

to a PLL Circuit
TB042
DS91042
KEELOQ CRC Verification

Routines
TB043
DS91043
Encryption Routines (M_KEY_GEN:

SIMPLE_KEY_GEN, NORMAL_KEY_GEN,
MAP_SET)
The M_KEY_GEN routine can be different, by just
changing the parameter called KEY_METHOD from 0 to
1 in the modifiable table.
With the Simple Key generation method, the
SIMPLE_KEY_GEN routine sets the Encryption Key
equal
to
the
Manufacturer
Code.
The
NORMAL_KEY_GEN routine uses the KEELOQ decryption algorithm in order to create the Encryption Key,
starting from the Manufacturer Code and the current
serial number read from the PIC16F84A internal data
memory.
The MAP_SET routine prepares the 12 words (WORD0
- WORD11) to be programmed in the HCS EEPROM
map.
Programming HCS Routines

(M_PROGRAMMING)
This routine starts driving the PWM line high, after the
S2 line has been held high for the appropriate length of
time, in order to bulk erase the encoder after 2.2 ms
(TPBW).
Then, the M_NEW_WORD routine outputs the first word to
be programmed on the PWM line synchronously with
the clock S2 line and waits for the 36 ms of programming time (TWC).
This routine is repeated 12 times completing the entire
programming of the HCS EEPROM memory map.
The WAIT_uS and WAIT_WMSEC implements software
delay routines to wait micro or milliseconds.
DS00217A-page 7
AN217
FIGURE 7:
PROGRAMMING FLOW DIAGRAM

Reset
RESET_VECTOR
Initialize Ports,
Register and RAM
START
NO
Program button
pressed?
M_LOOP
YES
Read and increment
serial number from
EEPROM
READ_SN
Key generation:
KEY_GEN
(Simple or Normal
method)
Load words to be
programmed into HCS
memory map
MAP_SET
HCS programming
M_PROGRAMMING
YES
HCS verify ok?

M_VERIFY
LED on for 0,4 sec

Write SN programmed
into EEPROM
PROG_SUCCES
Programming error
4 sec LED blinking
PROG_ERR
YES
DS00217A-page 8
NO
NO
Button released?
M_END
AN217
CONCLUSION
Another improvement could be to introduce the possibility to modify the programming parameters by implementing a serial port that can interface to a PC. In this
way, we will no longer have a stand-alone programmer,
only because it will be possible to update the Manufacturer Key, the Seed, the configuration word, etc., with
simple PC software.
This application note describes a very low cost and

simple stand-alone KEELOQ encoder programmer,
which could be easily modified for additional features.
For example, a LCD display could be added showing
some parameters, such as the serial number and the
Seed programmed every time. Also, a RF or infrared
module receiver can be integrated to receive the
encoder transmission after every program operation
and test the transmitter hardware. One additional feature would be to add a manufacturer code verification
step before programming a device.
FIGURE 8:
These configuration parameters can also be stored in

the internal EEPROM data memory, resulting in a
stand-alone programmer.
PROGRAMMER SCHEMATIC CIRCUIT
VCC
10
1
2
3
4
S0
VDD
S1
LED
S2
S3
0.1F
8
7
PWM
17
GND
18
1
HCS 2XX/
3XX Socket
2
1K
GND
RA0
14
VDD
PROG BUTTON
RB7
RB6
12
RA2
RB5
11
RA3
RB4
10
RA4/TOCKI RB3
RA1
RB2
4
13
MCLR
1k
1K
GND
RB1
RB0
PROG OK/PROG FAIL
22pF
16
4MHz
15
CLKIN
GND
CLKOUT
PIC16F84A
VSS
GND
22pF
GND
MEMORY USAGE
Program Memory Words Used: 471
File Registers Used: 50
KEY WORDS
Programmer, KEELOQ, HCS200, HCS201, HCS300,
HCS301, HCS320 and PIC16F84A
DS00217A-page 9
AN217
Software License Agreement
The software supplied herewith by Microchip Technology Incorporated (the Company) for its PICmicro Microcontroller is intended
and supplied to you, the Companys customer, for use solely and exclusively on Microchip PICmicro Microcontroller products.
The software is owned by the Company and/or its supplier, and is protected under applicable copyright laws. All rights are reserved.
Any use in violation of the foregoing restrictions may subject the user to criminal sanctions under applicable laws, as well as to civil
liability for the breach of the terms and conditions of this license.
THIS SOFTWARE IS PROVIDED IN AN AS IS CONDITION. NO WARRANTIES, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE APPLY TO THIS SOFTWARE. THE COMPANY SHALL NOT, IN ANY CIRCUMSTANCES, BE LIABLE FOR
SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES, FOR ANY REASON WHATSOEVER.
APPENDIX A:
PROGHCS SOURCE CODE
MPASM 02.40 Released
LOC OBJECT CODE

VALUE
2007
3FF5
DS00217A-page 10
PROGHCS.ASM
8-1-2000
9:55:22
PAGE
LINE SOURCE TEXT
00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021
00001
00002
00134
00022
00023
00024
00025
00026
00027
00028
00029
00030
00031
00032
00033
00034
00035
00036
00037
00038
00039
00040
00041
00042
00043
00044
00045
00046
00047
00048
00049
00050
00051
00052
00053
00054
00055
LIST n=0,c=132
;========================================================================================
; MICROCHIP KEELOQ HCS200 - HCS300 - HCS301 STANDALONE PROGRAMMER
;========================================================================================
;
;
;
;
;
;
;
THIS STANDALONE PROGRAMMER APPLY THE SIMPLE LEARN SCHEME TO PROGRAM

THE HCS ENCODERS.
THE SERIAL NUMBER IS INCREMENTED EVERY TIME A HCS PROGRAMMING HAPPEN
AND IS STORED IN THE INTERNAL DATA EEPROM OF THE PIC16F84A
THE HCS MANUFACTURER CODE AND THE CONFIGURATION WORD CAN BE CHANGED
IN THE SECTION BELOW NAMED "MODIFYABLE PROGRAMMING DEFINE"
;========================================================================================
;
VERSION 1.0,
09/03/99
;========================================================================================
PROCESSOR
RADIX
PIC16F84A
DEC
INCLUDE
"P16F84A.INC"
LIST
; P16F84A.INC Standard Header File, Version 2.00
LIST
__CONFIG
Microchip Technology, Inc.
_XT_OSC & _CP_OFF & _WDT_ON & _PWRTE_ON
;========================================================================================
;
;
PIC16F84A
;
-------_-------;
HCSVDD | 1 RA2
RA1 18| CLK
(to HCS slave: S2)
;
| 2 RA3TC RA0 17| DATA
(to HCS slave: PWM)
;
| 3 RA4
OSC1 16| OSCin
;
reset | 4 MCLR OSC2 15| OSCtest
;
Vss | 5 Vss
Vdd 14| Vdd
;
| 6 RB0
RB7 13| PROG
;
| 7 RB1
RB6 12| LED
;
| 8 RB2
RB5 11|
;
| 9 RB3
RB4 10|
;
---------------;
;========================================================================================
; MACROS
#DEFINE BANK0
#DEFINE BANK1
bcf
bsf
STATUS,RP0
STATUS,RP0
;========================================================================================
; I/O PORT ASSIGNEMENT
; PORTA
#DEFINE
#DEFINE
#DEFINE
BIT DEFINITIONS
DATA
PORTA,0
CLK
PORTA,1
HCSVDD PORTA,2
; PORTB BIT DEFINITIONS

#DEFINE LED
PORTB,6
; (IN/OUT) Data (PWM) for Programming HCS

; (OUT) Clock (S2) for Programming HCS
; (OUT) HCS Vdd line
; (OUT) Program/failure led indicator
AN217
0000000C
0000000E
00000016
0000001E
00000026
00000027
00000028
00000029
0000002B
0000002F
00000033
00000037
0000003B
0000003D
0000003E
00000036
00000035
00000034
00000033
00056
00057
00058
00059
00060
00061
00062
00063
00064
00065
00066
00067
00068
00069
00070
00071
00072
00073
00074
00075
00076
00077
00078
00079
00080
00081
00082
00083
00084
00085
00086
00087
00088
00089
00090
00091
00092
00093
00094
00095
00096
00097
00098
00099
00100
00101
00102
00103
00104
00105
00106
00107
00108
00109
00110
00111
00112
00113
00114
00115
00116
00117
00118
00119
00120
00121
00122
00123
00124
00125
00126
00127
00128
00129
00130
00131
00132
00133
00134
00135
00136
00137
00138
00139
00140
00141
00142
#DEFINE PROG
#DEFINE SWRES
PORTB,7
PORTB,7
;--------------; PORT DIRECTION DEFINE

#DEFINE K_MASKPA
#DEFINE K_MASKPB
#DEFINE K_MASKPA_PROG
#DEFINE K_MASKPA_VERI
#DEFINE K_OPTION
; (IN)
; (IN)
REG
B11111000
B10111111
B11111000
B11111001
;
;
;
;
Programming Key
Sw reset Key on programming failure
PORTA:
PORTB:
PORTB:
PORTB:
TRI-STATE
TRI-STATE
TRI-STATE
TRI-STATE
VALUE
VALUE
FOR PROGRAMMING HCS
FOR VERIFY HCS
B00000111
; OPTION REGISTER SETTING
; PORTB PULL-UP ON, TMR0 associated to Tcy, Prescaler=1:256
;========================================================================================
; GENERAL PURPOSE RAM REGISTERS
CBLOCK
0x0C
; Word clocked into HCS

WRD_HI, WRD_LO
; Words to be programmed into HCS (HCS MEMORY MAPPING)
WORD0:2, WORD1:2, WORD2:2, WORD3:2
; Other Variable for programming HCS
TXNUM
TMP_CNT
MYCONT
COUNT_HI, COUNT_LO
; Number of bit clocked

; Temporary Counter
;
"
; Counter for Timing
; Generated Encryption KEY

KEY7, KEY6, KEY5, KEY4
KEY3, KEY2, KEY1, KEY0
; Circular Buffer used in decryption routine
CSR4, CSR5, CSR6, CSR7
CSR0, CSR1, CSR2, CSR3
; Counter used in decryption routine
CNT0, CNT1
; Mask register used in decryption routine
MASK
; Temporary Register
TMP0, TMP1, TMP2, TMP3
; Temp register
ENDC
; End of define general purpose RAM register
;========================================================================================
; ************** DECRYPTION REGISTER RE-MAPPINGS *******************
; NOTE : INDIRECT ADDRESSING USED, DO NOT CHANGE REGISTER ASSIGNMENT
; ******************************************************************
; 32 BIT HOPCODE BUFFER
#DEFINE
#DEFINE
#DEFINE
#DEFINE
HOP1
HOP2
HOP3
HOP4
CSR0
CSR1
CSR2
CSR3
; 28 BIT SERIAL NUMBER

SER_3
SER_2
SER_1
SER_0
EQU
EQU
EQU
EQU
CSR7
CSR6
CSR5
CSR4
; LSB
; MSB
;========================================================================================
; MODIFYABLE PROGRAMMING DEFINE
;========================================================================================
#DEFINE KEY_METHOD 0
; MUST BE 1 IF NORMAL KEY GENERATION METHOD TO BE USED

; MUST BE 0 IF SIMPLE KEY GENERATION METHOD TO BE USED
; (ENCRYPTION KEY= MANUFACTURER KEY)
#DEFINE HCS30X
; MUST BE 1 IF PROGRAMMING HCS300-301,

; MUST BE 0 IF PROGRAMMING HCS200
#DEFINE
#DEFINE
#DEFINE
#DEFINE
0xCDEF
0x89AB
0x4567
0x0123
; MANUFACTURER CODE, LSWORD
0X0000
; SYNCRONOUS COUNTER
MCODE_0
MCODE_1
MCODE_2
MCODE_3
#DEFINE SYNC
#DEFINE SEED_0 0x0000

#DEFINE SEED_1 0x0000
#DEFINE ENV_KEY 0x0000
; MSWORD
; 2 WORD SEED VALUE

; ENVELOPE KEY
( NOT USED FOR HCS200)
DS00217A-page 11
AN217
0000
0000
0000
28DB
0004
0004
0004
0009
0005
0006
0007
0008
0009
000A
000B
000C
000D
000E
000F
0010
0011
0012
0183
018B
0185
0186
1683
3007
0081
30F8
0085
30BF
0086
1283
0181
0008
DS00217A-page 12
00143
00144 #DEFINE AUTOFF 1
; AUTO SHUT OFF TIMER
( NOT USED FOR HCS200)
00145
00146 #DEFINE DISC70 0x00
; DISCRIMINATION BIT7-BIT0
00147 #DEFINE DISC8
0
; DISCRIMINATION BIT8
00148 #DEFINE DISC9
0
; DISCRIMINATION BIT9
00149 #DEFINE OVR0
0
; OVERFLOW BIT0
(DISC10 for HCS200)
00150 #DEFINE OVR1
0
; OVERFLOW BIT1
(DISC11 for HCS200)
00151 #DEFINE VLOW
1
; LOW VOLTAGE TRIP POINT SELECT BIT (1=High voltage)
00152 #DEFINE BSL0
0
; BAUD RATE SELECT BIT0
00153 #DEFINE BSL1
0
; BAUD RATE SELECT BIT1
(RESERVED for HCS200)
00154 #DEFINE EENC
0
; ENVELOPE ENCRYPTION SELECT
(RESERVED for HCS200)
00155
00156 #DEFINE DISEQSN 1
; IF DISEQSN=1 SET DISCRIMINANT EQUAL TO SERNUM BIT10-0
00157
; IF DISEQSN=0 SET DISCRIMINANT AS DEFINED ABOVE
00158
00159 ;========================================================================================
00160 ; OTHER EQUATE
00161 ;========================================================================================
00162
00163 #DEFINE NUM_WRD .12
; NUMBER OF WORD TO PROGRAM INTO HCS
00164 #DEFINE RES
0X0000
; RESERVED WORD
00165
00166 #DEFINE CONF_HI ((EENC<<7)|(BSL1<<6)|(BSL1<<5)|(VLOW<<4)|(OVR1<<3)|(OVR0<<2)|(DISC9<<1)|DISC8)
00167
00168 ; ****** HCS TIME PROGRAMMING EQUATE ********
00169 #DEFINE Tps
.4
; PROGRAM MODE SETUP TIME 4mS
(3,5mS min, 4,5 max)
00170 #DEFINE Tph1
.4
; HOLD TIME 1
4mS
(3,5mS min)
00171 #DEFINE Tph2
.19
; HOLD TIME 2
62uS (50uS min)
00172 #DEFINE Tpbw
.3
; BULK WRITE TIME
3mS
(2,2mS min)
00173 #DEFINE Tclkh
.10
; CLOCK HIGH TIME
35uS (25uS min)
00174 #DEFINE Tclkl
.10
; CLOCK LOW TIME
35uS (25uS min)
00175 #DEFINE Twc
.40
; PROGRAM CYCLE TIME
40mS (36mS min)
00176
00177
00178 ; NOTE: FOR mS TIME DELAY USE WAIT_WMSEC SUBROUTINE ( W * 1mSec )
00179 ;
FOR uS TIME DELAY USE WAIT_uS SUBROUTINE ( 5 + Txxx*3 uS )
00180
00181
00182 ;========================================================================================
00183 ;========================================================================================
00184
00185 ;========================================================================================
00186 ; FUNCTION
: RESET ()
00187 ; DESCRIPTION : PROGRAM RESET ROUTINE
00188 ;========================================================================================
00189
00190
ORG
0x00
00191 RESET_VECTOR
00192
goto
START
00193
00194 ;========================================================================================
00195 ; FUNCTION
: ISR_VECTOR ()
00196 ; DESCRIPTION : INTERRUPT SERVICE ROUTINE VECTOR
00197 ;========================================================================================
00198
00199
ORG
0x04
00200 ISR_VECTOR
00201
retfie
00202
00203 ;========================================================================================
00204
00205 ;========================================================================================
00206 ;========================================================================================
00207 ; SUBROUTINES
SUBROUTINES
SUBROUTINES
SUBROUTINES
SUBROUTINES
00208 ;========================================================================================
00209 ;========================================================================================
00210
00211 ;========================================================================================
00212 ; FUNCTION
: INITREG
00213 ; DESCRIPTION : REGISTER INIZIALIZATION
00214 ;========================================================================================
00215
00216 INITREG
clrf
STATUS
00217
clrf
INTCON
; INTERRUPT DISABLED
00218
clrf
PORTA
; RESET PORTA
00219
clrf
PORTB
; RESET PORTB
00220
BANK1
00221
movlw
K_OPTION
; INT CLK, PRESCALER TO TMR0, ON PULL-UP
00222
movwf
OPTION_REG
00223
movlw
K_MASKPA
; SETUP PORTA
00224
movwf
TRISA
00225
movlw
K_MASKPB
; SETUP PORTB
00226
movwf
TRISB
00227
BANK0
00228
clrf
TMR0
00229
return
AN217
0013
0014
0015
0016
0017
0018
0019
001A
001B
001C
001D
001E
001F
0020
0020
0021
0022
0023
0024
0025
0026
0027
0028
0029
002A
002B
002C
002D
002E
300C
0084
0180
0A84
3050
0604
1D03
2815
0008
00AA
0BAA
281D
0008
3010
00A9
30FA
00AA
0064
0BAA
2824
0BA9
2822
0008
0064
1F86
282A
2020
0008
002F
0030
0031
3036
0084
01A8
0032
0033
0034
0035
0036
0037
0038
0039
003A
003B
003C
003D
003E
003F
0040
0042
0043
0064
0828
0089
1683
1408
0064
1808
2837
1283
0808
0080
0AA8
3004
0628
1903 2844
0384
2832
0044
0045
0046
0047
0048
0FB6
284B
0FB5
284B
0FB4
00230
00231
00232
00233
00234
00235
00236
00237
00238
00239
00240
00241
00242
00243
00244
00245
00246
00247
00248
00249
00250
00251
00252
00253
00254
00255
00256
00257
00258
00259
00260
00261
00262
00263
00264
00265
00266
00267
00268
00269
00270
00271
00272
00273
00274
00275
00276
00277
00278
00279
00280
00281
00282
00283
00284
00285
00286
00287
00288
00289
00290
00291
00292
00293
00294
00295
00296
00297
00298
00299
00300
00301
00302
00303
00304
00305
00306
00307
00308
00309
00310
00311
00312
00313
00314
00315
00316
;========================================================================================
; FUNCTION
: INITREG
; DESCRIPTION : REGISTER INIZIALIZATION
;========================================================================================
CLEAR_RAM
CLEAR_RAM_LOOP
movlw
movwf
clrf
incf
movlw
xorwf
skpz
goto
return
0x0C
FSR
INDF
FSR,F
0x50
FSR,W
CLEAR_RAM_LOOP
;========================================================================================
; FUNCTION
: WAIT_uS ()
; DESCRIPTION
: WAIT 5+W*3 MICROSECOND SUBROUTINE
;========================================================================================
WAIT_uS
WAIT_uS_A
movwf
decfsz
goto
return
COUNT_LO
COUNT_LO, F
WAIT_uS_A
;========================================================================================
; FUNCTION
: DEBOUNCE - WAIT_16MSEC - WAIT_WMSEC ()
; DESCRIPTION
: WAIT 16mSec or W mSec SUBROUTINE
;========================================================================================
DEBOUNCE
WAIT_16MSEC
WAIT_WMSEC
WAITSET
WAITLOOP
movlw
movwf
movlw
movwf
clrwdt
decfsz
goto
decfsz
goto
return
.16
COUNT_HI
.250
COUNT_LO
COUNT_LO,F
WAITLOOP
COUNT_HI,F
WAITSET
;========================================================================================
; FUNCTION
: BUTTON RELEASE ()
; DESCRIPTION
: WAIT FOR BUTTON RELEASE
;========================================================================================
BUTTON_RELEASE
clrwdt
btfss
goto
call
return
PROG
BUTTON_RELEASE
DEBOUNCE
;========================================================================================
; FUNCTION
: READ_SN ()
; DESCRIPTION
: READ LAST SERIAL NUMBER STORED IN THE PIC16F84A EEPROM DATA,
;
AND INCREMENT IT INTO NEW SER_x
;========================================================================================
READ_SN
READ_SN_A
movlw
movwf
clrf
SER_3
FSR
MYCONT
clrwdt
movf
movwf
MYCONT,W
EEADR
; COUNTER OF BYTE
; READ FROM DATA EEPROM
BANK1
bsf
clrwdt
btfsc
goto
EECON1, RD
; do a read
EECON1, RD
$-2
; Read done ?
movf
movwf
incf
movlw
xorwf
bz
decf
goto
EEDATA,W
INDF
MYCONT, F
.4
MYCONT, W
READ_SN_INC
FSR, F
READ_SN_A
incfsz
goto
incfsz
goto
incfsz
SER_3, F
READ_SN_X
SER_2, F
READ_SN_X
SER_1, F
BANK0
READ_SN_INC
; TEST IF 4 BYTE READ
; LOW BYTE: INCREMENT SN
DS00217A-page 13
AN217
0049
004A
284B
0AB3
004B
0008
004C
004D
004E
004F
0064
3036
0084
01A8
0050
0051
0052
0053
0054
0055
0056
0057
0058
0059
005A
005B
005C
005D
005E
005F
0060
0061
0061
0062
0063
0064
0065
0066
0067
0068
0069
006A
0064
0828
0089
0800
0088
1683
1208
1508
3055
0089
30AA
0089
1488
0064
1888
285D
1108
006C
006D
006E
006F
0071
0072
0073
0AA8
3004
0628
1903 2873
0384
2850
0008
0074
0075
0076
0076
0077
0078
0079
007A
007B
007C
007C
007D
007E
007F
0080
0081
0082
0082
0083
0084
0085
0086
0087
0088
0088
0089
008A
008B
008C
1283
0808
1683
1408
0064
1808
2865
1283
0608
1D03 2961
300E
0084
0832
0080
0A84
0831
0080
0A84
0830
0080
0A84
082F
0080
0A84
082E
0080
0A84
082D
0080
0A84
082C
0080
0A84
082B
0080
DS00217A-page 14
00317
00318
00319
00320
00321
00322
00323
00324
00325
00326
00327
00328
00329
00330
00331
00332
00333
00334
00335
00336
00337
00338
00339
00340
00341
00342
00343
00344
00345
00346
00347
00348
00349
00350
00351
00352
00353
00354
00355
00356
00357
00358
00359
00360
00361
00362
00363
00364
00365
00366
00367
00368
00369
00370
00371
00372
00373
00374
00375
00376
00377
00378
00379
00380
00381
00382
00383
00384
00385
00386
00387
00388
00389
00390
00391
00392
00393
00394
00395
00396
00397
00398
00399
00400
00401
00402
00403
goto
incf
READ_SN_X
READ_SN_X
SER_0, F
return
;========================================================================================
; FUNCTION
: WRITE_SN ()
; DESCRIPTION
: SAVE INTO PIC16F84A EEPROM DATA THE LAST PROGRAMMED SERIAL
;
: NUMBER
;========================================================================================
WRITE_SN
WRITE_SN_BYTE
clrwdt
movlw
movwf
clrf
SER_3
FSR
MYCONT
clrwdt
movf
movwf
movf
movwf
MYCONT, W
EEADR
INDF, W
EEDATA
; COUNTER OF BYTE
; WRITTEN TO DATA EEPROM
BANK1
WRITE_SN_A
bcf
bsf
movlw
movwf
movlw
movwf
bsf
clrwdt
btfsc
goto
bcf
EECON1, EEIF
EECON1, WREN
0x55
EECON2
0xAA
EECON2
EECON1, WR
movf
EEDATA, W
bsf
clrwdt
btfsc
goto
EECON1, RD
; do a read
EECON1, RD
$-2
; Read done ?
xorwf
BNZ
EEDATA, W
EE_ERR
incf
movlw
xorwf
BZ
decf
goto
return
MYCONT, F
.4
MYCONT, W
WRITE_SN_X
FSR, F
WRITE_SN_BYTE
EECON1, WR
WRITE_SN_A
EECON1, WREN
; enable Write
; Write complete ?
; disable Write
VERIFY_WRITE
BANK0
BANK1
BANK0
WRITE_SN_X
; EEPROM WRITE ERROR
; TEST IF WRITTEN ALL THE 4 BYTES
;========================================================================================
; FUNCTION
: MEM_MAP ()
; DESCRIPTION
: PREPARE THE WORDS TO BE PROGRAMMED INTO HCS
;========================================================================================
MAP_SET
WORD_0
WORD_0_LO
WORD_0_HI
WORD_1
WORD_1_LO
WORD_1_HI
WORD_2
WORD_2_LO
WORD_2_HI
WORD_3
WORD_3_LO
WORD_3_HI
movlw
movwf
WORD0
FSR
movf
movwf
incf
movf
movwf
incf
KEY0,W
INDF
FSR, F
KEY1,W
INDF
FSR, F
movf
movwf
incf
movf
movwf
incf
KEY2,W
INDF
FSR, F
KEY3,W
INDF
FSR, F
movf
movwf
incf
movf
movwf
incf
KEY4,W
INDF
FSR, F
KEY5,W
INDF
FSR, F
movf
movwf
incf
movf
movwf
KEY6,W
INDF
FSR, F
KEY7,W
INDF
; ENCRYPTION KEY (4 WORD)
AN217
008D
008E
008E
008F
0090
0091
0092
0093
0094
0094
0095
0096
0097
0098
0099
009A
009A
009B
009C
009D
009E
009F
00A0
00A0
00A1
00A2
00A3
00A4
00A5
00A6
00A7
00A8
00A8
00A9
00AA
00AB
00AC
00AD
00AE
00AE
00AF
00B0
00B1
00B2
00B3
00B4
0A84
00B4
00B5
00B6
00B7
00B8
00B9
00BA
00BA
00BB
00BC
00BD
00BE
00BF
00C0
00C1
00C2
3000
0080
0A84
3000
0080
0A84
00C3
00C4
00C5
00C6
00C7
00C8
00C9
3000
0080
0A84
3000
0080
0A84
3000
0080
0A84
3000
0080
0A84
0836
0080
0A84
0835
0080
0A84
0834
0080
0A84
0833
390F
3880
0080
0A84
3000
0080
0A84
3000
0080
0A84
3000
0080
0A84
3000
0080
0A84
0836
0080
0A84
0835
3903
3810
0080
0A84
0008
0800
008D
0A84
0800
008C
0A84
0008
00404
00405
00406
00407
00408
00409
00410
00411
00412
00413
00414
00415
00416
00417
00418
00419
00420
00421
00422
00423
00424
00425
00426
00427
00428
00429
00430
00431
00432
00433
00434
00435
00436
00437
00438
00439
00440
00441
00442
00443
00444
00445
00446
00447
00448
00449
00450
00451
00452
00453
00454
00455
00456
00457
00458
00459
00460
00461
00462
00463
00464
00465
00466
00467
00468
00469
00470
00471
00472
00473
00474
00475
00476
00477
00478
00479
00480
00481
00482
00483
00484
00485
00486
00487
00488
00489
00490
WORD_4
WORD_4_LO
WORD_4_HI
WORD_5
WORD_5_LO
WORD_5_HI
WORD_6
WORD_6_LO
WORD_6_HI
WORD_7
WORD_7_LO
WORD_7_HI
WORD_8
WORD_8_LO
WORD_8_HI
WORD_9
WORD_9_LO
WORD_9_HI
incf
FSR, F
movlw
movwf
incf
movlw
movwf
incf
LOW(SYNC)
INDF
FSR, F
HIGH(SYNC)
INDF
FSR, F
movlw
movwf
incf
movlw
movwf
incf
LOW(RES)
INDF
FSR, F
HIGH(RES)
INDF
FSR, F
movf
movwf
incf
movf
movwf
incf
SER_3, W
INDF
FSR, F
SER_2, W
INDF
FSR, F
movf
movwf
incf
movf
andlw
iorlw
movwf
incf
SER_1, W
INDF
FSR, F
SER_0, W
B00001111
(AUTOFF<<7)
INDF
FSR, F
movlw
movwf
incf
movlw
movwf
incf
LOW(SEED_0)
INDF
FSR, F
HIGH(SEED_0)
INDF
FSR, F
movlw
movwf
incf
movlw
movwf
incf
LOW(SEED_1)
INDF
FSR, F
HIGH(SEED_1)
INDF
FSR, F
; SYNC COUNTER (1 WORD)
; RESERVED (1 WORD)
WORD_10_HI
WORD_11
WORD_11_LO
WORD_11_HI
; MSByte
; SET THE AUTO SHUT-OFF TIMER
; SEED VALUE ( 2 WORD)
WORD_10
WORD_10_LO
; SERIAL NUMBER (2 WORD)

; LSByte
; ENVELOPE KEY (1 WORD)

; (RESERVED FOR HCS200 SET TO 0x0000)
movlw
movwf
incf
movlw
movwf
incf
(LOW(ENV_KEY) * HCS30X)
INDF
FSR, F
(HIGH(ENV_KEY) * HCS30X)
INDF
FSR, F
movf
movwf
incf
movf
ANDLW
IORLW
movwf
incf
return
SER_3, W
INDF
FSR, F
SER_2, W
B00000011
CONF_HI
INDF
FSR, F
; CONFIGURATION WORD
; LOWER BYTE=LOWEST BYTE OF SERIAL NUMBER
; MASK BIT OF SER. NUM.

; MASK OTHER BIT OF CONFIG WORD
;========================================================================================
; FUNCTION
: PREPARE_WRD ()
; DESCRIPTION
: PUT IN WRD_LO & WRD_HI THE WORD TO BE CLOCKED OUT (PWM)
;========================================================================================
PREPARE_WRD
movf
movwf
incf
movf
movwf
incf
return
INDF, W
WRD_LO
FSR, F
INDF, W
WRD_HI
FSR, F
;========================================================================================
; This include File is provided with the Keeloq License disk in order to
; implement the NORMAL KEY GENERATION SCHEME METHOD
;
INCLUDE "DECRYPT.INC"
;========================================================================================
;========================================================================================
; FUNCTION
: GET KEY or SIMPLE_KEY_GEN ()
DS00217A-page 15
AN217
00CA
00CB
00CC
00CD
00CE
00CF
00D0
00D1
00D2
00D3
00D4
00D5
00D6
00D7
00D8
00D9
00DA
3001
00AB
3023
00AC
3045
00AD
3067
00AE
3089
00AF
30AB
00B0
30CD
00B1
30EF
00B2
0008
00DB
00DC
2005
2013
00DD
00DE
00DF
00E0
00E1
1706
30FA
2021
1306
28E2
00E2
00E3
00E4
00E5
00E6
00E7
00E8
00E9
0064
1B86
28E2
2020
202F
0064
20CA
2074
00EA
00EA
00EB
00EC
00ED
00EE
00EF
00F0
00F1
1005
1085
1505
1683
30F8
0085
1283
2020
00F2
00F3
00F4
1485
3004
2021
00F5
00F6
00F7
1405
3004
2021
DS00217A-page 16
00491
00492
00493
00494
00495
00496
00497
00498
00499
00500
00501
00502
00503
00504
00505
00506
00507
00508
00509
00510
00511
00512
00513
00514
00515
00516
00517
00518
00519
00520
00521
00522
00523
00524
00525
00526
00527
00528
00529
00530
00531
00532
00533
00534
00535
00536
00537
00538
00539
00540
00541
00542
00543
00544
00545
00546
00547
00548
00549
00550
00551
00552
00553
00554
00555
00556
00557
00558
00559
00560
00561
00562
00563
00564
00565
00566
00567
00568
00569
00570
00571
00572
00573
00574
00575
00576
00577
; DESCRIPTION
: ENCRYPTION KEY = MANUFACTURER CODE STORED IN ROM
;========================================================================================
SIMPLE_KEY_GEN
movlw
movwf
movlw
movwf
movlw
movwf
movlw
movwf
movlw
movwf
movlw
movwf
movlw
movwf
movlw
movwf
return
HIGH(MCODE_3)
KEY7
LOW(MCODE_3)
KEY6
HIGH(MCODE_2)
KEY5
LOW(MCODE_2)
KEY4
HIGH(MCODE_1)
KEY3
LOW(MCODE_1)
KEY2
HIGH(MCODE_0)
KEY1
LOW(MCODE_0)
KEY0
; COPY THE MANUFACTURER CODE INTO

; ENCRYPTION KEY (BYTE)
;========================================================================================
;========================================================================================
;========================================================================================
;
END SUBROUTINES
END SUBROUTINES
END SUBROUTINES
;========================================================================================
;========================================================================================
;========================================================================================
; FUNCTION
: START ()
; DESCRIPTION : PROGRAM START ROUTINE
;========================================================================================
START
call
call
INITREG
CLEAR_RAM
bsf
movlw
call
bcf
goto
LED
.250
WAIT_WMSEC
LED
M_LOOP
; LED ON PWUP
; WAIT 250Msec with LED ON
; LED OFF
;========================================================================================
; FUNCTION
: M_LOOP ()
; DESCRIPTION
: MAIN PROGRAM ROUTINE
;========================================================================================
M_LOOP
clrwdt
btfsc
goto
call
; WAIT FOR PROGRAMMING BUTTON PRESS

PROG
M_LOOP
DEBOUNCE
;---------------------------------------------------------------------------------------; PROGRAMMING ROUTINES

;---------------------------------------------------------------------------------------M_KEY_GEN
call
READ_SN
; READ FROM EE SN TO BE PROGRAMMED
clrwdt
if
KEY_METHOD==1
call
NORMAL_KEY_GEN
else
call
SIMPLE_KEY_GEN
call
MAP_SET
endif
;--------------M_PROGRAMMING
M_PROG_INIT
bcf
bcf
bsf
BANK1
movlw
movwf
BANK0
call
M_PROG_SETUP
; PREPARE EEPROM MEMORY MAP

; ENTER IN PROGRAMMING MODE AND BULK ERASE
DATA
CLK
HCSVDD
; DATA=0
; CLK=0
; HCS POWER ON
K_MASKPA_PROG
TRISA
WAIT_16MSEC
bsf
movlw
call
CLK
Tps
WAIT_WMSEC
; DATA=0, CLK=1
; WAIT Program mode Setup Time (Tps)
bsf
movlw
call
DATA
Tph1
WAIT_WMSEC
; DATA=1, CLK=1
; WAIT Program Hold Time 1 (Tph1)
AN217
00F8
00F9
00FA
1005
3013
201C
00FB
00FC
00FD
1085
3003
2021
00FE
00FF
0100
01A7
300E
0084
0101
20C3
0102
01A6
0103
0104
0105
0106
0107
0108
0109
010A
010B
010C
1485
1003
0C8C
0C8D
1803
290C
0000
1005
290D
1405
010D
010E
010F
0110
0111
300A
201C
1085
300A
201C
0112
0113
0114
0115
0116
0AA6
3010
0626
1D03
2903
0117
0118
0119
1005
3028
2021
011A
011B
011C
011D
011E
0AA7
300C
0627
1D03
2901
011F
011F
0120
0121
0122
0123
0124
0125
1683
30F9
0085
1283
0064
300E
0084
0126
0127
01A7
01A6
0128
0129
012A
012B
012C
012D
012E
012F
0130
0131
1003
1805
1403
0C8C
0C8D
0AA6
3010
0626
1D03
2942
0132
0133
0134
0135
0136
0137
0138
0139
080D
0600
1D03
2950
0A84
080C
0600
1D03
00578
00579
00580
00581
00582
00583
00584
00585
00586
00587
00588
00589
00590
00591
00592
00593
00594
00595
00596
00597
00598
00599
00600
00601
00602
00603
00604
00605
00606
00607
00608
00609
00610
00611
00612
00613
00614
00615
00616
00617
00618
00619
00620
00621
00622
00623
00624
00625
00626
00627
00628
00629
00630
00631
00632
00633
00634
00635
00636
00637
00638
00639
00640
00641
00642
00643
00644
00645
00646
00647
00648
00649
00650
00651
00652
00653
00654
00655
00656
00657
00658
00659
00660
00661
00662
00663
00664
M_PROG_BULK_ER
bcf
movlw
call
DATA
Tph2
WAIT_uS
; DATA=0, CLK=1
; WAIT Program Hold Time 2 (Tph2)
bcf
movlw
call
CLK
Tpbw
WAIT_WMSEC
; DATA=0, CLK=0
; WAIT Program Bulk Write Time (Tpbw)
clrf
movlw
movwf
TMP_CNT
WORD0
FSR
call
PREPARE_WRD
clrf
TXNUM
; OUTPUT WORD ROTATE

; NUMBER OF BIT TRASMITTED FOR EACH WORD
bsf
clrc
rrf
rrf
skpnc
goto
nop
bcf
goto
bsf
CLK
; CLK=1
WRD_HI, F
WRD_LO, F
; ROTATE BIT TO OUTPUT

; into CARRY FLAG
movlw
call
bcf
movlw
call
Tclkh
WAIT_uS
CLK
Tclkl
WAIT_uS
;---------------
M_NEW_WORD
;---------------
M_TX_BIT
M_PROG_DLO
M_PROG_DHI
M_PROG_BIT
;--------------M_PROG_CHK_WORD incf
movlw
xorwf
skpz
goto
;--------------M_END_WORD
bcf
movlw
call
;--------------M_CECHK_PRG_END incf
movlw
xorwf
skpz
goto
; CLOCK INTO HCS THE WORDS TO BE PROGRAMMED

; NUMBER OF WORD TRASMITTED
; SET INDIRECT PONTER TO INIT EE MAP
M_PROG_DHI
DATA
M_PROG_BIT
DATA
; DATA=0
; DATA=1
; DELAY
; CLK=0
; DELAY
TXNUM, F
.16
TXNUM, W
; INCREMENT NUMBER OF BIT TRASMITTED

; CHECK IF END OF WORD TRASMITTED (16 BITS)
M_TX_BIT
; TRASMIT NEXT BIT
DATA
Twc
WAIT_WMSEC
; END OUTPUT WORD

; DATA=0
; WAIT FOR WORD Write Cycle Time (Twc)
TMP_CNT, F
NUM_WRD
TMP_CNT, W
; INCREMENT NUMBER OF WORD PROGRAMMED

; CHECK NUMBER OF WORD TRASMITTED
M_NEW_WORD
; PROGRAM NEW WORD
;---------------------------------------------------------------------------------------; VERIFY ROUTINE

;---------------------------------------------------------------------------------------M_VERIFY
BANK1
movlw
K_MASKPA_VERI
; I/O TRISTATE FOR VERIFY
movwf
TRISA
BANK0
clrwdt
movlw
WORD0
; SET INDIRECT POINTER TO INIT EE MAP
movwf
FSR
clrf
clrf
;--------------M_VER_BITIN
clrc
btfsc
setc
rrf
rrf
incf
movlw
xorwf
skpz
goto
;--------------M_VERIFY_WORD
movf
xorwf
skpz
goto
incf
movf
xorwf
skpz
TMP_CNT
TXNUM
DATA
WRD_HI, F
WRD_LO, F
TXNUM, F
.16
TXNUM, W
; NUMBER OF WORDS RECIVED

; NUMBER OF BIT RECEIVED FOR EACH WORD
; RECIVE DATA BIT FROM HCS FOR VERIFY
; TEST and ROTATE RECEIVED BIT INTO WORD BUFFER
; TEST IF RECEIVED A COMPLETE WORD
M_VER_CLKHI
WRD_LO, W
INDF, W
; 16th BIT RECIVED (WORD) -> VERIFY WORD
PROG_ERR
FSR, F
WRD_HI, W
INDF, W
; WORD LOW VERIFY ERROR
DS00217A-page 17
AN217
013A
013B
013C
013D
013E
013F
0140
0141
2950
0A84
0AA7
300C
0627
1903
2949
01A6
0142
0143
0144
1485
300A
201C
0145
0146
0147
0148
1085
300A
201C
2928
0149
204C
014A
014B
014C
014D
014E
014F
1706
30C8
2021
30C8
2021
295D
0150
0151
0152
0153
0154
0155
0185
3014
00A7
1706
3064
2021
0156
0157
0158
0159
015A
1306
3064
2021
0BA7
2953
015B
015C
1306
295D
015D
015E
015F
0160
1306
1105
202A
28E2
0161
0162
0163
0164
0185
1706
0064
2963
2100
2100
2101
2102
2103
0000
0000
0000
0000
00665
00666
00667
00668
00669
00670
00671
00672
00673
00674
00675
00676
00677
00678
00679
00680
00681
00682
00683
00684
00685
00686
00687
00688
00689
00690
00691
00692
00693
00694
00695
00696
00697
00698
00699
00700
00701
00702
00703
00704
00705
00706
00707
00708
00709
00710
00711
00712
00713
00714
00715
00716
00717
00718
00719
00720
00721
00722
00723
00724
00725
00726
00727
00728
00729
00730
00731
00732
00733
00734
00735
00736
00737
00738
00739
00740
00741
00742
00743
goto
incf
incf
movlw
xorwf
skpnz
goto
clrf
;--------------M_VER_CLKHI
bsf
movlw
call
M_VER_CLKLO
X---XXXXXXXXXXXX
XXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXX
DS00217A-page 18
PROG_SUCCESS
TXNUM
; ALL 12 WORDS VERIFIED WITH SUCCESS
CLK
Tclkh
WAIT_uS
; CLK=1
; WAIT TIME CLOCK HIGH
CLK
Tclkl
WAIT_uS
M_VER_BITIN
; CLK=0
; WAIT TIME CLOCK LOW
; TEST IF RECEIVED ALL THE WORDS PROGRAMMED
;---------------------------------------------------------------------------------------; HCS PROGRAMMING ERROR

; WAIT FOR BUTTON PRESS
PROG_ERR
PROG_ERR_LEDON
clrf
movlw
movwf
bsf
movlw
call
PORTA
.20
TMP_CNT
LED
.100
WAIT_WMSEC
PROG_ERR_LEDOFF bcf
movlw
call
decfsz
goto
LED
.100
WAIT_WMSEC
TMP_CNT,F
PROG_ERR_LEDON
PROG_ERR_X
LED
PROG_END
bcf
goto
; 20 * 0,2SEC = 4SEC LED BLINKING

; LED ON FOR 0,1SEC
; DELAY
; LED OFF FOR 0,1SEC
; DELAY
;---------------------------------------------------------------------------------------PROG_END
bcf
LED
bcf
HCSVDD
call
BUTTON_RELEASE
goto
M_LOOP
;---------------------------------------------------------------------------------------; PIC16F84A DATA EEPROM WRITE ERROR; LED ON FOREVER
EE_ERR
clrf
bsf
clrwdt
goto
PORTA
LED
; LED ON
$-1
;---------------------------------------------------------------------------------------; INIZIALIZE THE SER NUM STORED IN THE FIRST 4 BYTES OF THE INTERNAL EE DATA MEMORY
;---------------------------------------------------------------------------------------ORG
0x2100
DE
0x00
DE
0x00
DE
0x00
DE
0x00
;---------------------------------------------------------------------------------------;========================================================================================
; END OF FILE
;========================================================================================
MEMORY USAGE MAP (X = Used,

:
:
:
:
; WORD HIGH VERIFY ERROR
;---------------------------------------------------------------------------------------PROG_SUCCESS
call
WRITE_SN
; WRITE LAST SN PROGRAMMED INTO
; PIC16F84A EEPROM DATA
bsf
LED
; LED ON FOR 0,4SEC
movlw
.200
call
WAIT_WMSEC
; DELAY
movlw
.200
call
WAIT_WMSEC
; DELAY
goto
PROG_END
MPASM 02.40 Released
0000
0040
0080
00C0
bcf
movlw
call
goto
PROG_ERR
FSR, F
TMP_CNT, F
NUM_WRD
TMP_CNT, W
END
PROGHCS.ASM
8-1-2000
9:55:22
PAGE
- = Unused)
XXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXX
AN217
0100
0140
2000
2100
:
:
:
:
XXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXX
-------X-------XXXX------------
XXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXX
-------------------------------
XXXXXXXXXXXXXXXX
XXXXX-----------------------------------------
XXXXXXXXXXXXXXXX
----------------------------------------------
All other memory blocks unused.

Program Memory Words Used:
Program Memory Words Free:
Errors
:
Warnings :
Messages :
0
0 reported,
16 reported,
354
670
0 suppressed
0 suppressed
DS00217A-page 19
AN217
NOTES:
DS00217A-page 20
AN217
NOTES:
DS00217A-page 21
AN217
NOTES:
DS00217A-page 22
AN217
All rights reserved. Copyright 2001, Microchip

Technology Incorporated, USA. Information contained
in this publication regarding device applications and the
like is intended through suggestion only and may be
superseded by updates. No representation or warranty
is given and no liability is assumed by Microchip
Technology Incorporated with respect to the accuracy
or use of such information, or infringement of patents or
other intellectual property rights arising from such use
or otherwise. Use of Microchips products as critical
components in life support systems is not authorized
except with express written approval by Microchip. No
licenses are conveyed, implicitly or otherwise, under
any intellectual property rights. The Microchip logo and
name are registered trademarks of Microchip
Technology Inc. in the U.S.A. and other countries. All
rights reserved. All other trademarks mentioned herein
are the property of their respective companies. No
licenses are conveyed, implicitly or otherwise, under
any intellectual property rights.
Trademarks
The Microchip name, logo, PIC, PICmicro,
PICMASTER, PICSTART, PRO MATE, KEELOQ,
SEEVAL, MPLAB and The Embedded Control
Solutions Company are registered trademarks of
Microchip Technology Incorporated in the U.S.A. and
other countries.
Total Endurance, ICSP, In-Circuit Serial Programming,
FilterLab, MXDEV, microID, FlexROM, fuzzyLAB,
MPASM, MPLINK, MPLIB, PICDEM, ICEPIC,
Migratable Memory, FanSense, ECONOMONITOR,
SelectMode and microPort are trademarks of
Microchip Technology Incorporated in the U.S.A.
Serialized Quick Term Programming (SQTP) is a
service mark of Microchip Technology Incorporated in
the U.S.A.
All other trademarks mentioned herein are property of
their respective companies.
2001, Microchip Technology Incorporated, Printed in
the U.S.A., All Rights Reserved.
Microchip received QS-9000 quality system

certification for its worldwide headquarters,
design and wafer fabrication facilities in
Chandler and Tempe, Arizona in July 1999. The
Companys quality system processes and
procedures are QS-9000 compliant for its
PICmicro 8-bit MCUs, KEELOQ code hopping
devices, Serial EEPROMs and microperipheral
products. In addition, Microchips quality
system for the design and manufacture of
development systems is ISO 9001 certified.
DS00217A-page 23
WORLDWIDE SALES AND SERVICE

AMERICAS
New York
Corporate Office
150 Motor Parkway, Suite 202

Hauppauge, NY 11788
Tel: 631-273-5305 Fax: 631-273-5335
2355 West Chandler Blvd.

Chandler, AZ 85224-6199
Tel: 480-792-7200 Fax: 480-792-7277
Technical Support: 480-792-7627
Web Address: http://www.microchip.com
Rocky Mountain
2355 West Chandler Blvd.
Chandler, AZ 85224-6199
Tel: 480-792-7966 Fax: 480-792-7456
Atlanta
500 Sugar Mill Road, Suite 200B
Atlanta, GA 30350
Tel: 770-640-0034 Fax: 770-640-0307
Austin
Analog Product Sales
8303 MoPac Expressway North
Suite A-201
Austin, TX 78759
Tel: 512-345-2030 Fax: 512-345-6085
Boston
2 Lan Drive, Suite 120
Westford, MA 01886
Tel: 978-692-3848 Fax: 978-692-3821
Boston
Unit A-8-1 Millbrook Tarry Condominium
97 Lowell Road
Concord, MA 01742
Tel: 978-371-6400 Fax: 978-371-0050
Chicago
333 Pierce Road, Suite 180
Itasca, IL 60143
Tel: 630-285-0071 Fax: 630-285-0075
Dallas
4570 Westgrove Drive, Suite 160
Addison, TX 75001
Tel: 972-818-7423 Fax: 972-818-2924
Dayton
Two Prestige Place, Suite 130
Miamisburg, OH 45342
Tel: 937-291-1654 Fax: 937-291-9175
Detroit
Tri-Atria Office Building
32255 Northwestern Highway, Suite 190
Farmington Hills, MI 48334
Tel: 248-538-2250 Fax: 248-538-2260
Los Angeles
18201 Von Karman, Suite 1090
Irvine, CA 92612
Tel: 949-263-1888 Fax: 949-263-1338
Mountain View
1300 Terra Bella Avenue
Mountain View, CA 94043-1836
Tel: 650-968-9241 Fax: 650-967-1590
ASIA/PACIFIC (continued)
Korea
Microchip Technology Korea
168-1, Youngbo Bldg. 3 Floor
Samsung-Dong, Kangnam-Ku
Seoul, Korea
Tel: 82-2-554-7200 Fax: 82-2-558-5934
San Jose
2107 North First Street, Suite 590
San Jose, CA 95131
Tel: 408-436-7950 Fax: 408-436-7955
Singapore
Microchip Technology Singapore Pte Ltd.
200 Middle Road
#07-02 Prime Centre
Singapore, 188980
Tel: 65-334-8870 Fax: 65-334-8850
Toronto
6285 Northam Drive, Suite 108
Mississauga, Ontario L4V 1X5, Canada
Tel: 905-673-0699 Fax: 905-673-6509
Taiwan
Microchip Technology Taiwan
11F-3, No. 207
Tung Hua North Road
Taipei, 105, Taiwan
Tel: 886-2-2717-7175 Fax: 886-2-2545-0139
ASIA/PACIFIC
Australia
Microchip Technology Australia Pty Ltd
Suite 22, 41 Rawson Street
Epping 2121, NSW
Australia
Tel: 61-2-9868-6733 Fax: 61-2-9868-6755
EUROPE
China - Beijing
Denmark
Microchip Technology Beijing Office

Unit 915
New China Hong Kong Manhattan Bldg.
No. 6 Chaoyangmen Beidajie
Beijing, 100027, No. China
Tel: 86-10-85282100 Fax: 86-10-85282104
Microchip Technology Denmark ApS

Regus Business Centre
Lautrup hoj 1-3
Ballerup DK-2750 Denmark
Tel: 45 4420 9895 Fax: 45 4420 9910
France
China - Shanghai
Microchip Technology Shanghai Office
Room 701, Bldg. B
Far East International Plaza
No. 317 Xian Xia Road
Shanghai, 200051
Tel: 86-21-6275-5700 Fax: 86-21-6275-5060
Hong Kong
Microchip Asia Pacific
RM 2101, Tower 2, Metroplaza
223 Hing Fong Road
Kwai Fong, N.T., Hong Kong
Tel: 852-2401-1200 Fax: 852-2401-3431
India
India Liaison Office
Divyasree Chambers
1 Floor, Wing A (A3/A4)
No. 11, OShaugnessey Road
Bangalore, 560 025, India
Tel: 91-80-2290061 Fax: 91-80-2290062
Japan
Microchip Technology Intl. Inc.
Benex S-1 6F
3-18-20, Shinyokohama
Kohoku-Ku, Yokohama-shi
Kanagawa, 222-0033, Japan
Tel: 81-45-471- 6166 Fax: 81-45-471-6122
Arizona Microchip Technology SARL

Parc dActivite du Moulin de Massy
43 Rue du Saule Trapu
Batiment A - ler Etage
91300 Massy, France
Tel: 33-1-69-53-63-20 Fax: 33-1-69-30-90-79
Germany
Arizona Microchip Technology GmbH
Gustav-Heinemann Ring 125
D-81739 Munich, Germany
Tel: 49-89-627-144 0 Fax: 49-89-627-144-44
Germany
Lochhamer Strasse 13
D-82152 Martinsried, Germany
Tel: 49-89-895650-0 Fax: 49-89-895650-22
Italy
Arizona Microchip Technology SRL
Centro Direzionale Colleoni
Palazzo Taurus 1 V. Le Colleoni 1
20041 Agrate Brianza
Milan, Italy
Tel: 39-039-65791-1 Fax: 39-039-6899883
United Kingdom
Arizona Microchip Technology Ltd.
505 Eskdale Road
Winnersh Triangle
Wokingham
Berkshire, England RG41 5TU
Tel: 44 118 921 5869 Fax: 44-118 921-5820
01/30/01
All rights reserved. 2001 Microchip Technology Incorporated. Printed in the USA. 3/01
Printed on recycled paper.
Information contained in this publication regarding device applications and the like is intended through suggestion only and may be superseded by
updates. It is your responsibility to ensure that your application meets with your specifications. No representation or warranty is given and no liability is
assumed by Microchip Technology Incorporated with respect to the accuracy or use of such information, or infringement of patents or other intellectual
property rights arising from such use or otherwise. Use of Microchips products as critical components in life support systems is not authorized except with
express written approval by Microchip. No licenses are conveyed, implicitly or otherwise, except as maybe explicitly expressed herein, under any intellectual property rights. The Microchip logo and name are registered trademarks of Microchip Technology Inc. in the U.S.A. and other countries. All rights
reserved. All other trademarks mentioned herein are the property of their respective companies.
DS00217A-page 24

00217a - Stand Alone - HCS Program

Caricato da

Informazioni sul documento

Descrizione originale:

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

00217a - Stand Alone - HCS Program

Caricato da

Copyright:

Formati disponibili

AN217

KEELOQ HCS30X, HCS200 Stand-Alone Programmer

SIMPLE LEARNING SCHEME

Two learning schemes are implemented:

PIC16F84A PIN OUT

An explanation of the different security levels can be

KEELOQ NORMAL LEARNING

2001 Microchip Technology Inc.

NORMAL (SERIAL NUMBER-DERIVED) LEARNING SCHEME

Upper 32 bits of key

OTHER POSSIBLE LEARNING

Lower 32 bits of key

HCS300 BLOCK DIAGRAM

(Secure Seed-Derived System)

Furthermore, custom learning scheme solutions can

ENCODER EEPROM MEMORY

The KEELOQ encoders are EEPROM based devices

Button Input Port

The HCS200, HCS300 and HCS301 contain 192 bits

2001 Microchip Technology Inc.

HCS30X EEPROM MEMORY

64-bit Encryption Key

64-bit Encryption Key

64-bit Encryption Key

64-bit Encryption Key

Overflow bit 0 (OVR0)

Device Serial Number

Overflow bit 1 (OVR1)

Device Serial Number

Seed Value (word 0)

Baud Rate Select Bit 1 (BSL1)

Seed Value (word 1)

Envelope Encryption Select (EENC)

16-bit Envelope Key

Low Voltage Trip Point Select

Baud Rate Select Bit 0 (BSL0)

Please refer to the HCS200 data sheet

The MSb of the serial number contains a

In order to create the encrypted message transmitted

2001 Microchip Technology Inc.

as the data in line. After each 16-bit word is loaded, a

The programming cycle allows programming of the

At the end of the programming cycle, the device can be

Programming is initiated by forcing the PWM line high,

A verify operation can only be done once, immediately

Data for Word 0 (Key 0)

Data for Word 1

Repeat 12 times for each word

Begin Verify Cycle Here

2001 Microchip Technology Inc.

PROGRAMMING/VERIFY TIMING REQUIREMENTS

VDD = 5.0V 10%

Program Mode Setup Time

Bulk Write Time

Program Delay Time

Program Cycle Time

Clock Low Time

Clock High Time

Data Setup Time

Data Hold Time

Data Out Valid Time

2001 Microchip Technology Inc.

The serial number programmed every time into the