AN659

Simple Code Hopping Decoder

Author: Steven Dawson KEY FEATURES

Microchip Technology Inc. • PIC16C54
OVERVIEW • Stand alone decoder
• Compatible with Microchip HCS200, HCS300,
This application note fully describes the working of a HCS301, HCS360, HCS361 and HCS410
code hopping decoder implemented on a Microchip encoders
PIC16C54 microcontroller. The PIC16C54 is smaller • Automatic bit rate detection
than the PIC16C56 used in the normal decoder • Automatic encoder type detection
(AN642) or the secure learn decoder (AN652). A sim- • Four function outputs
plified learning scheme with all encoders sharing a • Up to 15 learnable transmitters
common key and a simplified counter synchronization • RC Oscillator
scheme has been used to reduce the code space • Single press learn
requirements. The use of a common key reduces the
FIGURE 1: PIC16C54 KEELOQ DECODER
security of the system. The simple decoder can learn
up to 15 encoders. This application note describes the
various KEELOQ code hopping encoders that can be LEARN INIT 1 18 RFIN
used with the decoder, the decoder hardware, and the
LEARN IND 2 17 NC
various software modules comprising the system. The
software can be used to implement a stand alone Vcc 3 16 OSC OUT

PIC16C54 Secure
decoder or integrated with full function security sys-

Simple Decoder
tems. The decoder supports the Microchip HCS200, MCLR 4 15 OSC IN

HCS300, HCS301, HCS360, HCS361 and HCS410 GND 5 14 Vcc

KEELOQ code hopping encoders.
S0 6 13 NC

S1 7 12 EE CK

S2 8 11 EE CK

S3 9 10 EE DIO

THE INFORMATION CONTAINED IN THIS DOCUMENT IS PROPRIETARY AND

CONFIDENTIAL INFORMATION OF MICROCHIP TECHNOLOGY INC. THEREFORE,
ALL PARTIES ARE REQUIRED TO ENTER INTO A NONDISCLOSURE AGREEMENT
BEFORE RECEIVING THIS DOCUMENT.

KEELOQ is a registered trademark of Microchip Technology, Inc.

Microchip’s Secure Data Products are covered by some or all of the following patents:
Code hopping encoder patents issued in Europe, U.S.A., and R.S.A. — U.S.A.: 5,517,187; Europe: 0459781; R.S.A.: ZA93/4726
Secure learning patents issued in the U.S.A. and R.S.A. — U.S.A.: 5,686,904; R.S.A.: 95/5429
Microwire is a registered trademark of Motorola

 1998 Microchip Technology Inc. Confidential DS00659C_C-page 1

AN659
INTRODUCTION TO KEELOQ Synchronization Counters
ENCODERS The transmitted word contains a 16-bit synchronization
counter. The synchronization information is used at the
All KEELOQ encoders use the KEELOQ code hopping decoder to determine whether a transmission is valid or
technology to make each transmission by an encoder is a repetition of a previous transmission. Previous
unique. The encoder transmissions have two parts. The codes are rejected to safeguard against code grabbers.
first part changes each time the encoder is activated The HCS300 and HCS301 encoders transmit two over-
and is called the hopping code part and is encrypted. flow bits which may be used to extend the range of the
The second part is the unencrypted part of the trans- synchronization counter from 65,536 to 196,608 button
mission, principally containing the encoder’s serial operations. The HCS360 and HCS361 encoders trans-
number identifying it to a decoder. Refer to DS91002, mit one overflow bit which can be used to extend the
Introduction to KEELOQ. range of the synchronization counter from 65,536 to
Hopping Code 131,071 button operations.
The hopping code contains function information, a dis- Unencrypted Code
crimination value, and a synchronization counter. This Serial Number
information is encrypted by an encryption algorithm
before being transmitted. A 64-bit encryption key is The encoder’s serial number is transmitted every time
used by the encryption algorithm. If one bit in the data the button is pressed. The serial number is transmitted
that is encrypted changes, the result is that an average unencrypted as part of the transmission and serves to
of half the bits in the output will change. As a result, the identify the encoder to the decoder.
hopping code changes dramatically for each transmis- Other Status and Function Information
sion and can not be predicted.
The HCS200, HCS300, and HCS301 encoders include
Function Information provision for four bits of function information and two
The encoder transmits up to four bits of function infor- status bits in the fixed code portion of its transmission.
mation. Up to 15 different functions are available. The two status bits indicate whether a repeated trans-
mission is being sent, and whether the battery voltage
Discrimination Value is low. The HCS200 does not send repeated transmis-
Stored in the encoder EEPROM, this information can sion information, and the bit is permanently set to ‘0’.
be used to check integrity of decryption operation by a The HCS360/361 and HCS410 encoders transmit two
decoder. If known information is inserted into the trans- bits that are used as a Cyclic Redundancy check.
mitted string before encryption, the same information These bits can be used to check the integrity of the
can be used at the decoder to check whether the infor- reception. Additionally, the HCS360, HCS361 and
mation has been decrypted correctly. In the Microchip HCS410 encoders can extend the length of the serial
HCS encoders, up to 12 bits (including overflow bits) number from 28 bits to 32 bits, replacing the unen-
are available. crypted function code. The HCS410 also transmits 2
queing bits that can be used to detect multiple presses
of the same button combination.
Transmission Format Summary
Table 1 contains a summary of the information con-
tained in transmissions from each of the KEELOQ
encoders that can be learned by the Microchip
decoder.

DS00659C_C-page 2 Confidential  1998 Microchip Technology Inc.

 AN659
FIGURE 2: DECODER BLOCK DIAGRAM

RF S0
Receiver RFIN S1
S2
S3

PIC16C54
Learn
CS Indication
EEPROM CLK
DIO
Learn
Init

TABLE 1: KEELOQ ENCODER TRANSMISSION SUMMARY

HCS200/201 HCS300/301 HCS360/361 HCS410
# of bits # of bits # of bits # of bits
Total Transmission Length 66 66 67 69
Code Hopping Portion 32 32 32 32
Sync Counter 16 16 16 16
Discrimination bits 12 10 8 10
User Bits 0 0 2 0
Overflow Bits 0 2 1 2
Independent Mode 0 0 1 0
Function Code 4 4 4 4
Fixed Portion 34 34 35 37
Serial number 28 28 28/32 28/32
Function Code 4 4 4/0 4/0
Low Voltage Indicator 1 1 1 1
Repeat Bit 1 1 0 0
CRC 0 0 2 2
Queue Bits 0 0 0 2
TABLE 2: HCS200/201 AND HCS300/301 CODE HOPPING TRANSMISSION FORMAT
Code Hopping Portion Fixed Portion
Sync Counter Discrimination Func Serial Number Func VLOW
REPT
TABLE 3: HCS200/201 AND HCS300/301 SEED TRANSMISSION FORMAT
Seed Portion Fixed Portion
Seed Serial Number Func VLOW
REPT

 1998 Microchip Technology Inc. Confidential DS00659C_C-page 3

AN659
TABLE 4: HCS360/361 CODE HOPPING TRANSMISSION FORMAT
Code Hopping Portion Fixed Portion
Sync Counter Discrimination Func Serial Number Func VLOW
OVR, IND (28/32 bits) (4/0 REPT
bits)
TABLE 5: HCS360/361 SEED TRANSMISSION FORMAT
Seed Portion Fixed Portion
Seed Serial Number Func VLOW
(48 bits) (12/16 MS bits) (4/0 REPT
bits)
TABLE 6: HCS410 CODE HOPPING TRANSMISSION FORMAT
Code Hopping Portion Fixed Portion
Sync Counter Discrimination Func Serial Number Func VLOW
OVR (28/32 bits) (4/0 CRC
bits) QUE
TABLE 7: HCS410 SEED TRANSMISSION FORMAT
Seed Portion Fixed Portion
Seed Func VLOW
(60 bits) (4/0 CRC
bits) QUE

DS00659C_C-page 4 Confidential  1998 Microchip Technology Inc.

 AN659
PWM Format Figure 3 shows the sampling points when sampling the
data bits. The first and last elements are used exclu-
In general, all KEELOQ encoders share a common
sively to verify the integrity of the received symbol. The
transmission format:
first element (sample point A) is always high, the sec-
A preamble to improve biasing of decision thresholds ond (sample point B) is the complement of the data bit
in super-regenerative receivers. The preamble consists being sent, and the final element (sample point C) is
of alternate on and off periods, each lasting as long as always low. Because the period between the low por-
a single elemental period. tion of a bit (sample point C) and the rising edge of the
A calibration header consisting of a low period of 10 following bit (sample point X) can vary, the rising edge
elemental periods. Calibration actions should be per- of the first element (sample point X) is used to resyn-
formed on the low period of the header to ensure cor- chronize the receiving routine to each incoming bit.
rect operation with header chopping. If random noise is being received, the probability of a
A string of pulse-width modulated bits, each consisting set of three samples producing a valid combination is
of three elements. The first element is high, the second only 2-2 = 1/4. For a string of 66 bits, the corresponding
contains the data transmitted and is either high or low, figure is 2-134.
the third element is always low. Integrity checking on incoming signals is important.
A guard period is usually left between the transmis- Code hopping signals require significant processing,
sions. During this period nothing is transmitted by the as well as EEPROM access, to decrypt. Unnecessary
encoder. processing can be avoided by not attempting to decrypt
incoming codes that have bit errors.

FIGURE 3: KEELOQ PWM TRANSMISSION FORMAT

Data Bit Format I Bit Format II Sampling Points

2 te te 2 te 4 te

1 X A B C

1 te 2 te te 5 te

Microwire is registered trademark of Motorola.

 1998 Microchip Technology Inc. Confidential DS00659C_C-page 5

AN659
DECODER IMPLEMENTATION As the serial number information follows after the code
hopping portion of the transmission, any number of
The decoder is implemented on a PIC16C54 RISC serial number bits can be received and processed. In
microcontroller and a 93LC46B EEPROM as shown in the Microchip decoder described, the complete serial
the decoder schematic in Figure 14. However, this number (28 bits) is stored.
solution can be implemented in any PIC16/17 micro-
After matching the received and stored serial number,
controller with at least 500 words of program memory.
validation of a received transmission consists of two
The operating frequency of the controller is 4 MHz. The
steps. The first includes checking the integrity of the
microcontroller is used to capture transmissions from
decryption operation. Here the decoder compares the
the various encoders, decrypt transmissions captured,
least significat 8-bits of the discrimination value
and check the validity of the transmission based on the
received with the least significat 8-bits of the serial
information in the decrypted transmission and informa-
number. The discrimination value stored with the
tion stored in the EEPROM. If a transmission from a
HCS300/301/360/361/410 includes overflow bits and
valid encoder is received, the decoder activates the
user bits.
outputs dictated by the transmission.
The second portion of validation involves checking syn-
Encoder information, such as serial number and syn-
chronization information for that particular encoder.
chronization information is stored externally in an
The synchronization counter transmitted by all encod-
EEPROM. The EEPROM used is a Microchip 93LC46B
ers is 16 bits long. Two copies of the full synchroniza-
Microwire® Serial EEPROM. The information stored in
tion counter are stored for all valid encoders. The
the EEPROM is encrypted to protect the contents. The
storing of two copies of the synchronization information
EEPROM encryption is less secure than the KEELOQ
protects the decoder from loosing synchronization with
code hopping algorithm.
an encoder if one of the counters is corrupted.
As can be seen from the section on encoder transmis-
sions there are differences in the transmission formats
of the different encoders that can be used with the
decoder. The following section summarizes how the dif-
ferences in transmitted data are dealt with by the
decoder.

TABLE 8: MICROCHIP DECODER FUNCTIONAL INPUTS AND OUTPUTS

Mnemonic Pin Number Input / Output Function

RF IN 18 I Demodulated PWM signal from RF receiver. The
decoder uses this input to receive encoder transmis-
sions.
LEARN INIT 1 I Input to initiate learning.
LEARN IND 2 O Output to show the status of the learn process (in an
integrated system this will be combined with the system
status indicator).
S0, S1, S2, S3 6, 7, 8, 9 O Function outputs—corresponds to encoder input pins.

DS00659C_C-page 6 Confidential  1998 Microchip Technology Inc.

 AN659
PROGRAM FLOW FIGURE 4: MICROCHIP DECODER MAIN
PROGRAM FLOW
The software for the Microchip decoder has been writ-
ten for the PIC16C54 microcontroller. The compiler
used is MPASM version 01.30.01. The operating fre-
quency of the PIC16C54 is 4 MHz. The clock speed Reset
should be kept as close as possible to 4 MHz as the RESET
reception routine (RECEIVE) is dependent on the
4 MHz clock for correct functioning. Other decoder
functions that rely on a 4 MHz clock speed are the hold
times of the various outputs and time-outs. The main
Initialize Ports
program flow is described here. Detailed descriptions and
of individual functions can be found further in the appli- Variables
cation note.
After startup, the encoder enters the main loop where
it spends most of its time. The main loop checks to see
if the learn button is being activated. If so, the decoder
enters the learn mode described in the “Learn” section. Entry to Main
Loop
If learn has not been initiated, the microcontroller M_LOOP
checks for transmissions from encoders (RECEIVE). If
a transmission from an encoder has successfully been
received, the microcontroller validates the transmission
received as described in the “Transmission Validation”
section. If the transmission received is a valid transmis- Clear
the LED
sion from an encoder learned into the system, the sys-
tem sets the appropriate outputs (M_OUTPUT).

Learn
button Learn Routine
pressed? YES LEARN

NO

Update Timer
TST_RTCC

Handle Timer
TST_TIMER

NO Received
Transmission?
RECEIVE

YES

Transmission
Validation

 1998 Microchip Technology Inc. Confidential DS00659C_C-page 7

AN659
FUNCTIONAL MODULES FIGURE 5: SAMPLING POINTS USED IN
RECEIVE ALGORITHM
Reception
Preamble Header Data
The reception routine (called RECEIVE) is based on a
reliable algorithm which has successfully been used in
previous implementations of KEELOQ decoders. Auto-
matic bit rate detection is used to compensate for vari-
12 3 4 5 6 74 5
ations in bit rate of different encoders of a specific type,
as well as the differences in bit rate between different
encoders (HCS200, HCS300, and HCS360). The
reception routine is able to receive 64-bit transmis- In systems where the reception routine is called to
sions. This is easily extended to receive more bits. The check if there is activity on the receiver input, the rou-
decoder only uses the first 60 bits received. The tine should poll the input for a valid transmission for at
remaining bits are ingnored. least the time taken to complete one transmission if
The reception algorithm performs a number of func- activity is detected on the input line. This makes provi-
tions when an output is detected from the receiver. sion for the reception routine being called while a trans-
Figure 5 gives all the major sampling points in the mission is in progress. Having missed the first header,
reception algorithm. the first transmission will be invalid and be discarded.
The decoder should continue sampling the input
The reception algorithm calibrates on the low period of through the guard time in order to catch the next
the header to determine the actual elemental period for header and transmission (i.e., for a decoder designed
the transmission being received. The required elemen- to capture HCS300 transmissions the time spent poll-
tal period is 10% of the low header period. In Figure 5 ing for a valid transmission should be at least 100 ms if
the header calibration sample points are marked 1 activity is detected in the input line).
through 3. The calibration flow chart (Figure 6) shows
at what points in the program samples 1, 2, and 3 are Reception Algorithm Flow Chart
taken. The flow chart in Figure 6 describes the calibration rou-
Elemental periods outside the capture range of the tine which is used to determine the actual transmission
algorithm (either too long or too short) are rejected, rate of the encoder so that the decoder can compen-
since they are due either to noise or to reception of an sate for deviations from nominal timing. There are four
incomplete signal. different exit points, each of which should branch to a
point in the program where housekeeping and input
Using the determined elemental period, three samples
monitoring can be resumed. There is only one exit point
after the first rising edge (sample 3) following the
for a valid calibration operation (RCV7). At this point, it
header are taken. The first sample is taken half an ele-
is assumed that a valid header has been received and
mental period after the rising edge (sample 4); the sec-
that a string of data bits will follow.
ond, one elemental period later (sample 5), and the
third, another one elemental period later (sample 6). The second flow chart (Figure 7) handles the reception
The first sample must be high, the second could be of bits once the calibration routine has been success-
either high or low, and the third sample must be low. If fully completed. The data bits are all sampled three
either the first or the third sample is not as expected, times each to ensure that a noise free transmission has
the attempt at capturing a transmission is abandoned. been received. The reception routine uses the cali-
In Figure 5, the data sample points are points 4 through brated elemental period, determined in the calibration
6. The flow chart describing data reception (Figure 7) routine, to ensure that the samples are correctly
shows where in the code the samples are taken. spaced. The routine resynchronizes itself on the rising
flank of each bit. Only 60 bits of the data received are
If all 64 bits have been captured, each with the correct
used by the decoder described, the decoder ignores
first and third elements, the transmission can be
the unencrypted function code and the status bits.
assumed to be correct, and decryption can commence.
The receiving routine should be called often enough to If the control samples in a given bit are sampled cor-
ensure that the high portion in the header is not missed rectly (i.e., the first element is high and the last element
(Sample 1, Figure 5). is low), the routine checks whether 66 bits have been
received correctly. If not, the routine returns to the call-
ing procedure.

DS00659C_C-page 8 Confidential  1998 Microchip Technology Inc.

 AN659
FIGURE 6: CALIBRATION FLOW CHART

Calibrate
RECEIVE

LOW Invalid Header

Input? RMT_0

1
HIGH

Reset Time-out
Counter

NO

Input? HIGH
RCV1 Time-Out?

2 YES
LOW

Clear Calibration
Counter
RCV2

NO

Input? LOW Too Long?

RCV3 RCV4

HIGH 3

YES
Calibration
Counter/10
RCV6

Too Short? YES Invalid Header

RCV6 RMT_0

NO

Load Cal
Counter
RCV7

Receive Data
DL1

 1998 Microchip Technology Inc. Confidential DS00659C_C-page 9

AN659
FIGURE 7: DATA RECEPTION FLOW CHART

Receive Data
RCV7

Wait Half Bit

Period
DL1

Input LOW
SAMPLE1

HIGH 4

Wait Full Bit

Period
DL2

Input HIGH
SAMPLE2

LOW

Data = 0
Data = 1

Set Up DL1 Wait Full Bit

Timer Period
RCV11 DL3

HIGH 7

Input HIGH
RCV8/RCV9/ Input
RVC10 SAMPLE3

LOW NO LOW 6

NO
Time-out? Last Bit?

YES YES

NO Received
Invalid 56 Bits?
RMT01

YES

Cleanup Reception Complete

RMT2 RMT1

DS00659C_C-page 10 Confidential  1998 Microchip Technology Inc.

 AN659
Transmission Validation Discrimination Values
Once a complete transmission has been received from After decryption, the Code Shift Register (CSR) used
an encoder, the transmission needs to be validated by the KEELOQ decryption algorithm contains the same
before any further action is taken. Validation consists of 32 bits of information originally encrypted in the
the following steps and is shown in Figure 8: encoder before transmission. Twelve of these bits are
1. Check the serial number (28 bits) received discrimination bits.
against the stored encoder serial numbers The decryption operation can be checked by compar-
(M_SERIAL). ing parts of the decrypted 32-bit word (the discrimina-
2. Decrypt the transmission received using the tion values) with known values.
system key (M_HOP).
3. Compare the eight least significant bits of the
serial number to the 8 least significat bits of the
discrimination value in the decrypted hopping
portion of the transmission (M_DIS).
4. Get the first counter from the EEPROM
(M_CNT) and check if the counter falls within the
512 count open window (M_CHECK0). If not get
the second counter from EEPROM (M_CNT)
and check whether the counter falls within the
open window.
5. Check whether the received counter is the same
as the stored counter (M_CHECK2). If so reset
the output timer (M_TZERO)
6. If the transmission is a new one update the
counters in EEPROM (M_UPDATE).
7. Set the appropriate function code on the outputs
(M_OUTPUT) and reset the output timer
(M_TZERO).
8. Return to the main routine (M_LOOP) and con-
tinue with normal housekeeping chores.

TABLE 9: HCS200 AND HCS300/301 DECRYPTED HOPPING CODE TRANSMISSION FORMAT

Function1 MSB Encoder disc. bits LSB MSB Synchronization counter LSB
(4 bits) (12 bits) (16 bits)
1The HCS200 has padding in S3 button position since no S3 button is present.

TABLE 10: HCS360/361 DECRYPTED HOPPING CODE TRANSMISSION FORMAT

Function MSB Encoder disc. bits LSB MSB Synchronization counter LSB
(4 bits) (12 bits) (16 bits)

 1998 Microchip Technology Inc. Confidential DS00659C_C-page 11

AN659
FIGURE 8: TRANSMISSION VALIDATION FLOWCHART

Transmission Return To
Main Loop
Validation M_LOOP

Get Serial #
From EEPROM
M_SERIAL

Same As
Serial # NO Checked all? NO Point to Next
Received? M_NEXT Transmitter

YES YES

Decrypt Transmission
M_HOP

Discrim Value NO
equal lower byte of
Serial #?
M_DIS
YES

Get first Counter

From EEPROM
M_CNT

Counter Get second Counter Counter NO

within 512 window? NO
From EEPROM within 512 window?
M_CHECK0 M_CNT M_CHECK0

YES YES

Counter Update Stored

same? NO Set Appropriate Outputs Reset Timer
Counters
M_CHECK2 M_UPDATE M_OUTPUT M_TZERO

YES

DS00659C_C-page 12 Confidential  1998 Microchip Technology Inc.

 AN659
Synchronization Checking The decoder stores two copies of the synchronization
counter. If the power supply is interrupted during a
The synchronization information is used in the decoder
counter update the synchronization counter can be cor-
to determine whether the transmission is valid or
rupted. The decoder first checks received synchroniza-
whether it is a repetition of a previous transmission.
tion counter with the first counter. If the counter
Repeated codes are rejected to safeguard the system
received is outside the open window the second
against code grabbers.
counter is read and compared with the received
The transmitting encoder has a 16-bit synchronization counter. When the counters are updated in EEPROM
counter, stored in EEPROM, which is incremented they are written singly and both counters should never
every time the encoder is activated. The synchroniza- be corrupted at the same time.
tion counter value received is stored in the decoder’s
The simplified synchronization scheme used in the
EEPROM every time a valid transmission is received
decoder uses less code space than the conventional
from a particular encoder. When a following transmis-
synchronization scheme at the expense of a lower level
sion is received from the same transmitter it is possible
of security.
to quickly verify whether the transmission is valid. For
example, a grabbed code from the legitimate user’s FIGURE 9: DECODER WINDOW
previous transmission will result in a synchronization OPERATION
counter value that is less than the current count value.
The simple decoder described in the application note
has a single synchronization window. The window is
512 counts big. If the synchronization counter received Blocked 64K
is less than 512 counts above the last counter received Window
the decoder updates the counters in EEPROM and
activates the appropriate outputs. If the counter is Open
greater that 512 above the stored counter the transmit- Window 512 Values
in Open
ter will have to be relearned. Modification to the syn- Window
chronization window can be made in M_SUB.

 1998 Microchip Technology Inc. Confidential DS00659C_C-page 13

AN659
Function Interpretation Decryption
In a single-chip system, where the code hopping After receiving a complete transmission the decoder
decoder and the control program are combined into decrypts the code hopping portion of the transmitted
one device, the function code is interpreted to deter- code. All of the encoders have the same encryption
mine what the system must do. One function can be key.
used to arm the system and lock the vehicle, a second The KEELOQ decryption algorithm is used to decrypt
to disarm the system and unlock the vehicle, and a third the 32-bit code hopping portion of KEELOQ transmis-
to open the trunk. sions. The decryption routine is called DECRYPT. A
The four function bits in the encrypted portion of a 32–bit Code Shift Register (CSR) contains the received
transmission can be used to determine the button(s) code, and a 64-bit register contains the decryption key.
pressed on the transmitter. Up to 15 functions can be In the simple decoder, all encoders have a common
implemented in this way, 0000 being related to a reset decryption key which is securely stored in the program
state on the current encoders. memory.
The four function bits transmitted by the KEELOQ The block diagram (Figure 10) explains the operation
encoders correspond to the S2, S1, S0, and S3 inputs during each iteration of the decryption algorithm. A
on the HCS300/301/360/361 encoders and S2, S1, S0, nonlinear function (NLF – Table 11) is used to produce
and S2 inputs on the HCS200. a single bit from five bits in the CSR. This output is com-
In the Microchip decoder the function code received bined, via an exclusive-OR function, with two CSR bits
from the encoder is put onto the function outputs (S0 to and a single bit from the key register to form an output.
S3) if a valid transmission is received (M_OUTPUT). At the end of each cycle, the key register is rotated left,
and the CSR is rotated left. The output from the exclu-
Output Activation sive-OR function is inserted into the LSB (bit 0,0) of the
The Microchip decoder has four momentary outputs CSR.
namely S0, S1, S2, and S3. As described in the sec- The decryption operation requires 528 iterations. In
tion on “Function Interpretation” these outputs are a other words, the operation in the block diagram should
function of the inputs activated on the encoder. The be executed 528 times before the decrypted data will
momentary outputs are activated for 524 ms and appear in the CSR.
extended for 524 ms if a repeated transmission is
The NLF is intended to obscure any linear relationships
received. If a new valid transmission with a different
that might otherwise exist in the encrypted output. The
function code is received during output activation, the
NLF is listed in the form of a 5-bit lookup table, in which
outputs are switched off for 131 ms and the new func-
the five input bits are:
tion output is activated.
• I4 = CSR3,6
• I3 = CSR3,1
• I2 = CSR2,3
• I1 = CSR1,0
• I0 = CSR0,0.

DS00659C_C-page 14 Confidential  1998 Microchip Technology Inc.

 AN659
FIGURE 10: THE KEELOQ DECRYPTION ALGORITHM
1,7
MSB Code Shift Register LSB
3,7 3 2 1 0
3,6 3,1 2,3 1,0 0,0

NLF

XOR

1,7
7 6 5 4 3 2 1 0
MSB Key Register LSB

TABLE 11: NON-LINEAR FUNCTION OUTPUT

I4 I3 I2 I1 I0 NLF
0 0 0 0 0 0
0 0 0 0 1 1
0 0 0 1 0 1
0 0 0 1 1 1
0 0 1 0 0 0
0 0 1 0 1 1
0 0 1 1 0 0
0 0 1 1 1 0
0 1 0 0 0 0
0 1 0 0 1 0
0 1 0 1 0 1
0 1 0 1 1 0
0 1 1 0 0 1
0 1 1 0 1 1
0 1 1 1 0 1
0 1 1 1 1 0
1 0 0 0 0 0
1 0 0 0 1 0
1 0 0 1 0 1
1 0 0 1 1 1
1 0 1 0 0 1
1 0 1 0 1 0
1 0 1 1 0 1
1 0 1 1 1 0
1 1 0 0 0 0
1 1 0 0 1 1
1 1 0 1 0 0
1 1 0 1 1 1
1 1 1 0 0 1
1 1 1 0 1 1
1 1 1 1 0 0
1 1 1 1 1 0

 1998 Microchip Technology Inc. Confidential DS00659C_C-page 15

AN659
Learn Learn Program Flow
The decoder is able to learn up to 15 encoders. Inter- The simple decoder has a single transmission learn.
nally a learn indicator is used by the decoder to keep This is because there is no need to generate a decryp-
track of the next internal memory position where a tion key. On receiving a transmission from an encoder
learn is to take place. The 15 encoder positions in the decoder validates the encoder simply by checking
EEPROM form a rotating buffer where the next trans- that the discrimination value is what is expected (iden-
mitter to be written over is the transmitter at the tail of tical to the serial number). The program flow during
the buffer. The LEARN INIT input on the decoder is learn is shown in Figure 11 below. Learn in the simple
active low and the LEARN IND output active high. decoder takes place as follows.
Learn is initiated by momentarily pressing the LEARN 1. The decoder detects that the learn button has
button. The decoder uses the current learn position as been pressed (M_LOOP) and enters learn
a scratch pad area. This means that an unsuccessful mode.
learn deletes the information stored at that learn posi-
2. The time-out counter is cleared (LEARN)and the
tion. The learn indicator is not incremented if the learn
LED is switched on until the button is released
was unsuccessful.
(LEARN1). If the learn button is activated for 8
seconds, all of the transmitters are erased and
the LED is switched off (ERASE_ALL).
3. The transmitter waits till it receives a valid trans-
mission (LEARN3). If no transmission is
received within 30 seconds the decoder times
out and exits learn (TST_TIMER).
4. Once the decoder has received a transmission it
checks whether the transmitter has already
been learnt (M_SEARCH). If so the user posi-
tion is overwritten, otherwise the learn indicator
is used as the learn position (LEARN_NF) and
the serial number written to EEPROM.
5. The HOP code is decrypted (LEARN_DEC) and
the least significant 8 bits of the serial number
compared to the least significant 8 bits of the
discrimination value (LRN_CHK).
6. If the discrimination bytes match those of the
serial number the counter is written to the
EEPROM (LEARN_UP) otherwise the decoder
exits the learn routine (CANCEL_LEARN).
7. If the transmitter was being learnt to the position
pointed to by the learn indicator the learn indica-
tor is updated (LEARN_UP).
8. The LED is switched on for 500ms to show that
the learn was successfully completed and the
decoder returns to normal program flow (SUC-
CESS).

DS00659C_C-page 16 Confidential  1998 Microchip Technology Inc.

 AN659
FIGURE 11: PROGRAM FLOW DURING LEARN

Learn Routine Received NO

LEARN Transmission?
RECEIVE

YES

Clear
Timer Transmitter NO Read Learn
LEARN Already Learnt? indicator
M_SEARCH LEARN_NF

YES

Write Serial
LED On Number
in EEPROM
LEARN_F

Update Timer Decrypt

TST_RTCC Hop Code
LEARN_DEC

NO Time > NO Disc.

8.4 s? Button Lift?
LEARN1 Value = Lower NO Learn Fail
LEARN1 CANCEL_LEARN
Byte of Ser #
LEARN_CHK
YES YES YES

LED Off LED Off Write Counter

LEARN2 to EEPROM
LEARN_UP

Wait for button lift Update Timer

ERASE_ALL Was NO Upate Learn
TST_RTCC
TX in map? indicator

YES

Erase all 30 s Timeout? NO LED On

EEPROM Data TST_TIMER for 500 ms
SUCCESS
YES

Reset
RESET Return to
Main Loop
M_LOOP

 1998 Microchip Technology Inc. Confidential DS00659C_C-page 17

AN659
Operation of Learn FIGURE 12: LEARN OPERATION
The following steps need to be followed by a user to
learn an encoder onto the simple decoder. The steps
are shown in Figure 21.
1. Press and release the learn button. The LEARN
LED will be on while the button is pressed.
Learn Operation
2. Activate the transmitter. The LED will turn on for
500 ms to indicate that the transmitter was suc-
cessfully learnt.
3. To learn up to 15 transmitters, repeat steps 1-2.
The 16th transmitter will overwrite the first trans-
mitter that was learned. Press Learn Button
Learn will be terminated if the eight least significant
bits of the serial number do not match the eight least
significant bits of the discrimination value. NO

Erasing all the transmitters is accomplished by press-

ing and holding the LEARN button for more than 8.4
seconds. The LED will turn off at this time indicating Decoder NO 30 sec
that the decoder is in erase all mode. The transmitters Received TX? Time-out?
are erased when the learn button is released.
YES YES
TIMER0 (RTCC) Multiplexing
A time keeping scheme is needed to ensure that the
system timing is not abandoned while receiving an
incoming signal, during learn cycles, key generation Decoder Stores
and decryption. The system timing is used to allow peri- Serial Number
odic monitoring of sensors and pulsing outputs with a
specific period.
TIMER0 is used to keep track of system time. TIMER0
is an 8-bit timer on the PIC16C54. On the decoder
described, TIMER0 is prescaled to increment every
256 instruction cycles. This makes TIMER0 very useful Decoder Decrypts
for keeping track of real time. While various routines are Transmission
being run, including reception routines and decryption,
TIMER0 is periodically checked for a time-out value
calculated at the beginning of a certain period (i.e.,
switch off time of a LED).
The routine checking TIMER0 is called TST_RTCC. Dec.
checks Disc. NO
The most significant bit (MSB) of TIMER0 changes & Serial No. Exit Learn
every 32 ms. In order to extend the range of TIMER0, Match?
two additional 8-bit counters are used, CNT_LW and
CNT_HI, which extend the range of TIMER0 to 134 YES
seconds. If the MSB of TIMER0 is set, the extended
counter (CNT_LW and CNT_HI) is incremented and
the function returns to the calling program. LED of for 500 ms
Indicating
The TST_TIMER routine checks appropriate time-out Successful Learn
values based on the system status bits in SREG (i.e. to
check for the 30-second time-out in the learn routine
TST_TIMER checks to see if bit three of CNT_HI is
set).
End

DS00659C_C-page 18 Confidential  1998 Microchip Technology Inc.

 AN659
EEPROM MEMORY MAP (16-BIT BYTES)
TABLE 12: EEPROM MEMORY MAP (16-BIT WORDS)

Address Mnemonic Address Mnemonic

00 USER0 20 CNT7_0
01 Learn Indicator 21 CNT7_1
02 USER1 22 SER7_0
03 USER2 23 SER7_1
04 CNT0_0 24 CNT8_0
05 CNT0_1 25 CNT8_1
06 SER0_0 26 SER8_0
07 SER0_1 27 SER8_1
08 CNT1_0 28 CNT9_0
09 CNT1_1 29 CNT9_1
0A SER1_0 2A SER9_0
0B SER1_1 2B SER9_1
0C CNT2_0 2C CNT10_0
0D CNT2_1 2D CNT10_1
0E SER2_0 2E SER10_0
0F SER2_1 2F SER10_1
10 CNT3_0 30 CNT11_0
11 CNT3_1 33 CNT11_1
12 SER3_0 32 SER11_0
13 SER3_1 33 SER11_1
14 CNT4_0 34 CNT12_0
15 CNT4_1 35 CNT12_1
16 SER4_0 36 SER12_0
17 SER4_1 37 SER12_1
18 CNT5_0 38 CNT13_0
19 CNT5_1 39 CNT13_1
1A SER5_0 3A SER13_0
1B SER5_1 3B SER13_1
1C CNT6_0 3C CNT14_0
1D CNT6_1 3D CNT14_1
1E SER6_0 3E SER14_0
1F SER6_1 3F SER14_1
Note: The number of users can be limited by changing ‘MAX_USERS’ defined at the top of the code.

 1998 Microchip Technology Inc. Confidential DS00659C_C-page 19

AN659
RAM MEMORY MAP
TABLE 13: RAM MEMORY MAP

Address Mnemonic Description

07 FLAGS Decoder flags.
08 ADDRESS Address register—points to address in EEPROM.
09 TXNUM Current transmitter.
0A OUTBYT General data register.
0B CNT0
0C CNT1 Loop counters.
OD CNT2
OE CNT_HI
16-bit clock counter.
OF CNT_LO
10 CSR0
11 CSR1
12 CSR2
13 CSR3
64-bit shift register
14 CSR4
15 CSR5
16 CSR6
17 CSR7
18 TMP1
19 TMP2
1A REG0 Not Used
1B REG1 Not Used
1C KEY0 Least significant 32 bits of the key shift registor.
1D KEY1
1E KEY2
1F KEY3

DS00659C_C-page 20 Confidential  1998 Microchip Technology Inc.

 AN659
ALTERNATE NAMES AND FUNCTIONS
Many of the memory locations in RAM are used by multiple routines. A list of alternate names and functions are given
in Table 14 below.
TABLE 14: ALTERNATE NAMES AND FUNCTIONS

Address Mnemonic Also known as Description

0A MASK OUTBYT Mask used in decryption.
0A TMP_CNT TMP1 Counter used in the reception routine.
10 HOP1 CSR0
11 HOP2 CSR1
32-bit hop code register.
12 HOP3 CSR2
13 HOP4 CSR3
17 SER_0 CSR7
16 SER_1 CSR6 28-bit serial number is stored here by the
15 SER_2 CSR5 reception routine.
14 SER_3 CSR4
13 FUNC CSR3 Function code and user nibble of discrim-
ination value.
12 DISC CSR2 Discrimination value.
11 CNTR_HI CSR1
16-bit received counter.
10 CNTR_LW CSR0
11 CSR8 TMP2 Most significant byte of the code shift reg-
ister.
0D KEY4 CNT2
15 KEY5 CSR5 Most significant 32 bits of the key shift
16 KEY6 CSR6 register.
17 KEY7 CSR7

 1998 Microchip Technology Inc. Confidential DS00659C_C-page 21

AN659
DEVICE PINOUTS
The device used in the application note is a PIC16C54 PDIP or SOIC.
TABLE 15: DEVICE PINOUTS

PIN PIC16C54 Function Decoder Function PIN PIC16C54 Function Decoder Function
1 Port A Bit 2 LEARN Input Act Low 18 Port A Bit 1 RF Input
2 Port A Bit 3 LRN IND Output High 17 Port A Bit 0 Not used
3 TIMER0 Connect to VDD 16 Osc In RC osc (4 MHz)
4 MCLR Brown out detect 15 Osc Out
5 GND Ground 14 VDD +5V supply
6 Port B Bit 0 S0 13 Port B Bit 7 Not Used
7 Port B Bit 1 S1 12 Port B Bit 6 CS (93LC46B,
pin 1))
8 Port B Bit 2 S2 11 Port B Bit 5 CLK (93LC46B,
pin 2)
9 Port B Bit 3 S3 10 Port B Bit 4 DIO (93LC46B,
pin 3 & 4)

TIMING PARAMETERS
TABLE 16: TIMING PARAMETERS

Parameter Typical Unit

Output activation duration 524 ms
Output pause if new function code received 131 ms
Erase all duration 8.4 s
Learn mode time-out 33.6 s
Learn failure LED on duration 1 s

SOURCE CODE LISTING

A diskette is supplied containing source code for the Microchip decoder in the file simdec**.asm. The code has been
compiled using MPASM v01.30.01. Certain functions are dependent on the oscillator speed for correct functioning.
Examples of time dependent functions include RECEIVE and TST_TIMER. The PIC16C54 Microcontroller should run
at 4 MHz.
TABLE 17: LIST OF IMPORTANT FUNCTIONS

Function Name Description

DECRYPT Decryption routine for Hop Code.
EEREAD The data in the EEPROM at ADDRESS is read to TMP1 and TMP2 (Note).
EEWRITE The data in TMP1, and TMP2 is written to the EEPROM at ADDRESS (Note).
M_DIS Check discrimination value.
M_CNT Check synchronization (counter) values.
RECEIVE Start of the RF reception routine.
LEARN Learn mode.
TST_RTCC Check Timer0 and update CNT_LW and CNT_HI.
TST_TIMER Check CNT_LW and CNT_HI and do whatever real-time tasks that are required.
Note: TMP1, TMP2 and ADDRESS are user defined registers.

DS00659C_C-page 22 Confidential  1998 Microchip Technology Inc.

 Vcc
U2
J1 D5 LM7805
12V VI VO
FIGURE 13:

1 G
2 1N4004/7
3 N
GND C2 D C3
APPENDIX A:

CON3 100uF 100uF

POWER SUPPLY

 1998 Microchip Technology Inc.

Vcc
U4
LOW VOLTAGE DETECTOR
J2
VI G VO
N 1
D R3 RF INPUT
100R
VCC R8 D6 LEARN

R4 D1 S0
R1 1 U5 R5 D2 S1
10K 4
SCHEMATIC DIAGRAMS

4 17 R6 D3 S2
MCLR V RA0 18
3 C RA1 1 R7 D4 S3
RTCC C RA2
RA3 2
16

Confidential
OSC1
RB0 6
15 7
CLKOUT RB1 8
RB2 9
RB3 10
RB4 11
C1 G RB5 12
10pF N RB6 13
D RB7
PIC16C54
5 VCC
U1
SCHEMATIC DIAGRAM OF MICROCHIP KEELOQ DECODER

VCC 1 CS VCC 8
2 SK NC 7
R2 3 6
DI NC
4 DO GND 5
1K 93LC46B
47K

2 SERIAL EEPROM
S1
LEARN INIT
1

DS00659C_C-page 23
AN659
 VCC
FIGURE 14:

12V U2 12V
J1 D5 LM7805 J2
AN659

12V MOTOR CONTROL OUT

1 VI G VO 1
2 K2

DS00659C_C-page 24
C2 N C3 D8 CON1
GND 3 1N4004/7 100uF D 100uF
CON3
1N4004/7

RELAY SPST
Power Supply
S0 Q1
NPN

Door Motor
VCC
U4
LOW VOLTAGE DETECTOR Vcc
ANTENNA
VI G VO J3
N 1
D R3 2
100R 3
Vcc 4 L1
5 GARAGE LIGHT
6
7
8
9
R1 1 U5 10
10K 4 11
4 17 12
MCLR V RA0 13

Confidential
RA1 18 RF INPUT 14 12V V1
3 RTCC CC RA2 1 15 110V AC
RA3 2
16 OSC1
6 S0 RF RECEIVER MODULE K1
15 CLKOUT RB0 7 S1 D9
TYPICAL GARAGE DOOR OPENER SCHEMATIC

RB1 8
RB2 9
RB3 10 1N4004/7
C1 G RB4
RB5 11 RELAY SPST
10pF VCC R6
N RB6 12 U1 R7
D RB7 13 1 CS VCC 8 D6 100R 1M Q2
PIC16C54 2 SK NC 7 S1 NPN
5 3 DI NC 6
4 DO GND 5 1N4004/7
VCC
1K 93LC46B C5
R4 R2 10µF
47K
1K SERIAL EEPROM Garage light

D10
LEARN 2
S1
LEARN INIT
1

 1998 Microchip Technology Inc.

 FIGURE 15:

 1998 Microchip Technology Inc.

Vcc

RF CIRCUITRY (433MHz)
S1 D1
1 2 LED
S2 U2
1 2 S0 1 S0 VCC 8
S1 2 S1 LED 7 LED R2
S2 3 S2 PWM 6 PWM Q1 L1
BT1 C1 S3 4 S3 GND 5 BFR92A C3 20mm PCB TRACK
6V 100nF 47k SOT23 2.2pF
HCS300 1206 0805 VCC
NP0
R1
PGM CLK PGM DATA 1
VCC U1 47R
2 SAW 1206

Confidential
42527 R3
R02101 220R C4 C2
12pF 100 pF
1234 0805 0805
3
J1 NP0
HCS200/300/301/360/361 TRANSMITTER DESIGN

PROGRAMMING PADS

DS00659C_C-page 25
AN659
AN659
NOTES:

DS00659C_C-page 26 Confidential  1998 Microchip Technology Inc.

 AN659
NOTES:

 1998 Microchip Technology Inc. Confidential DS00659C_C-page 27

M
WORLDWIDE SALES AND SERVICE
AMERICAS AMERICAS (continued) ASIA/PACIFIC (continued)
Corporate Office Toronto Singapore
Microchip Technology Inc. Microchip Technology Inc. Microchip Technology Singapore Pte Ltd.
2355 West Chandler Blvd. 5925 Airport Road, Suite 200 200 Middle Road
Chandler, AZ 85224-6199 Mississauga, Ontario L4V 1W1, Canada #07-02 Prime Centre
Tel: 602-786-7200 Fax: 602-786-7277 Tel: 905-405-6279 Fax: 905-405-6253 Singapore 188980
Technical Support: 602 786-7627 Tel: 65-334-8870 Fax: 65-334-8850
Web: http://www.microchip.com ASIA/PACIFIC Taiwan, R.O.C
Atlanta Hong Kong Microchip Technology Taiwan
Microchip Technology Inc. Microchip Asia Pacific 10F-1C 207
500 Sugar Mill Road, Suite 200B RM 3801B, Tower Two Tung Hua North Road
Atlanta, GA 30350 Metroplaza Taipei, Taiwan, ROC
Tel: 770-640-0034 Fax: 770-640-0307 223 Hing Fong Road Tel: 886-2-2717-7175 Fax: 886-2-2545-0139
Boston Kwai Fong, N.T., Hong Kong
Microchip Technology Inc. Tel: 852-2-401-1200 Fax: 852-2-401-3431 EUROPE
5 Mount Royal Avenue India United Kingdom
Marlborough, MA 01752 Microchip Technology Inc. Arizona Microchip Technology Ltd.
Tel: 508-480-9990 Fax: 508-480-8575 India Liaison Office 505 Eskdale Road
Chicago No. 6, Legacy, Convent Road Winnersh Triangle
Microchip Technology Inc. Bangalore 560 025, India Wokingham
333 Pierce Road, Suite 180 Tel: 91-80-229-0061 Fax: 91-80-229-0062 Berkshire, England RG41 5TU
Itasca, IL 60143 Japan Tel: 44-1189-21-5858 Fax: 44-1189-21-5835
Tel: 630-285-0071 Fax: 630-285-0075 Microchip Technology Intl. Inc. France
Dallas Benex S-1 6F Arizona Microchip Technology SARL
Microchip Technology Inc. 3-18-20, Shinyokohama Zone Industrielle de la Bonde
14651 Dallas Parkway, Suite 816 Kohoku-Ku, Yokohama-shi 2 Rue du Buisson aux Fraises
Dallas, TX 75240-8809 Kanagawa 222-0033 Japan 91300 Massy, France
Tel: 972-991-7177 Fax: 972-991-8588 Tel: 81-45-471- 6166 Fax: 81-45-471-6122 Tel: 33-1-69-53-63-20 Fax: 33-1-69-30-90-79

Dayton Korea Germany

Microchip Technology Korea Arizona Microchip Technology GmbH
Microchip Technology Inc.
168-1, Youngbo Bldg. 3 Floor Gustav-Heinemann-Ring 125
Two Prestige Place, Suite 150
Samsung-Dong, Kangnam-Ku D-81739 München, Germany
Miamisburg, OH 45342
Seoul, Korea Tel: 49-89-627-144 0 Fax: 49-89-627-144-44
Tel: 937-291-1654 Fax: 937-291-9175
Tel: 82-2-554-7200 Fax: 82-2-558-5934 Italy
Detroit
Shanghai Arizona Microchip Technology SRL
Microchip Technology Inc.
Microchip Technology Centro Direzionale Colleoni
42705 Grand River, Suite 201
RM 406 Shanghai Golden Bridge Bldg. Palazzo Taurus 1 V. Le Colleoni 1
Novi, MI 48375-1727
2077 Yan’an Road West, Hong Qiao District 20041 Agrate Brianza
Tel: 248-374-1888 Fax: 248-374-2874
Shanghai, PRC 200335 Milan, Italy
Los Angeles Tel: 86-21-6275-5700 Fax: 86 21-6275-5060 Tel: 39-39-6899939 Fax: 39-39-6899883
Microchip Technology Inc.
18201 Von Karman, Suite 1090 9/29/98
Irvine, CA 92612
Tel: 714-263-1888 Fax: 714-263-1338
Microchip received ISO 9001 Quality
New York System certification for its worldwide
Microchip Technology Inc. headquarters, design, and wafer
150 Motor Parkway, Suite 202
fabrication facilities in January, 1997.
Hauppauge, NY 11788
Tel: 516-273-5305 Fax: 516-273-5335 Our field-programmable PICmicro®
8-bit MCUs, KEELOQ® code hopping
San Jose devices, Serial EEPROMs, related
Microchip Technology Inc.
specialty memory products and
2107 North First Street, Suite 590
San Jose, CA 95131
development systems conform to the
Tel: 408-436-7950 Fax: 408-436-7955 stringent quality standards of the
International Standard Organization
(ISO).

All rights reserved. © 1998 Microchip Technology Incorporated. Printed in the USA. 10/98 Printed on recycled paper.

Information contained in this publication regarding device applications and the like is intended for suggestion only and may be superseded by updates. No representation or warranty is given and no
liability is assumed by Microchip Technology Incorporated with respect to the accuracy or use of such information, or infringement of patents or other intellectual property rights arising from such use
or otherwise. Use of Microchip’s products as critical components in life support systems is not authorized except with express written approval by Microchip. No licenses are conveyed, implicitly or
otherwise, under any intellectual property rights. The Microchip logo and name are registered trademarks of Microchip Technology Inc. in the U.S.A. and other countries. All rights reserved. All other
trademarks mentioned herein are the property of their respective companies.

DS00652C_C-page 16  1998 Microchip Technology Inc.