HCS473 - Electronic component Microchip - Free user manual and instructions

USER MANUAL HCS473 Microchip

HCS473 Programming Specification

1.0 PROGRAMMING THE HCS473

HCS473 devices are programmed using a serial method that differs from previous KEELoQ ^® encoders. This Serial mode will still allow the HCS473 to be programmed while in the users system (ICSP ^™ ). This allows for great design flexibility. This programming specification applies to HCS473 devices in all packages.

1.1 Hardware Requirements

The HCS473 requires one programmable power supply for VDD (4.5V to 5.5V) and a VPP of 9V to 14V. Both supplies should have a minimum resolution of 0.25V.

FIGURE 1-1: HCS473 DIAGRAM
PDIP, SOIC, TSSOP

S0 ← 1 S1 ← 2 S2 ← 3 S3 ← 4 VDD ← 5 LCX ← 6 LCY ← 7 HCS473 14 ← VDD 13 ← LED 12 ← OUTPUT 11 ← VSS 10 ← VSST 9 ← LCCOM 8 ← LCZ

TABLE 1-1: PROGRAMMING PIN DESCRIPTION

Pin Name	Function HCS473	Pin Type	Pin Description
S0 DATA	1	I/O	Data Input	Output
S1	CLOCK	2 I	Clock Input
LED	VPP	13	P(*)	Program mode select
Vss	Vss	11	P	Ground
VDD	VDD	14	P	Power supply

Legend: I = Input, O = Output, P = Power
Note: In the HCS473, the programming high voltage is internally generated. To activate the Programming mode, high voltage needs to be applied to LED input. This is used as a level source, meaning that LED does not draw any significant current.

1.2 Program Mode Entry

Program mode is entered by holding pins S1 and S0 low while raising V PP pin from VIL to VIHH. All other pins are don't care. Once in Program mode, the entire encoder memory can be accessed and programmed in a serial fashion. S1 and S0 are Schmitt Trigger inputs in this mode. It is important that VDD comes up first and V PP comes up less than 50 s later.

Programming of the device is obtained by writing to two separate memory areas: the encoder memory area and the configuration memory area.

The encoder memory consists of 64 bytes of EEPROM memory and contains the encoder specific data and user configuration options that determine the operation of the device as a KEELOQ encoder. Transmission baud rates, modulation formats and low voltage thresholds are examples of such encoder options.

The configuration memory contains important configuration bits affecting the basic functionality of the device, most of which are factory set and marked as Reserved. The only exception being the Encoder Protect Enable bit, that controls access to the encoder memory area.

In Program mode, all device memory is addressed by means of a single 10-bit Program Counter (PC) that upon entry is set to 3FFh.

FIGURE 1-2: PIN DIAGRAM

DATA CLOCK HCS473 1 14 VDD 2 13 VPP 3 12 4 11 VSS 5 10 6 9 7 8

1.3 Encoder Memory Map

The Encoder memory space is 8-bits wide and extends from address 00h to 7Fh (256 bytes) of which only the first block of 64 bytes is physically implemented from 00h to 3Fh.

In Program mode this memory is addressed by means of the 8 LSb of the Program Counter (PC), the upper 2 bits of it being ignored.

The non-implemented portion of the addressing space reads always as 0.

Immediately after Program mode entry PC=3FFh, therefore, the encoder memory address pointed to corresponds to location 0FFh, which is non-implemented.

Note: An Increment Address command is required to move the Program Counter to location 00h.

FIGURE 1-3: ENCODER MEMORY MAPPING

PC bit 9 bit 0bit 7 Encoder Configuration Memory 00h 3Fh Not Implemented 7Fh wrap around

The device configuration memory space is 12-bits wide and extends from 000h to 3FFh (1 Kbytes). Only the first part, containing 16 words from 000h to 00Fh, is physically implemented and available to the user. The remaining non-implemented portion of the addressing space reads always as 0.

Immediately after Program mode entry PC=3FFh, therefore, the configuration memory address pointed to corresponds to a non-implemented location.

Note: A Load Configuration Memory command followed by an Increment Address command is required to move the Program Counter to location 000h.

FIGURE 1-4: CONFIGURATION MEMORY MAPPING

PC bit 9 bit 0 000h Reserved (1) 001h Reserved 002h Reserved 003h Reserved 004h Reserved 005h Reserved 006h Reserved 007h Reserved 008h Configuration Word (2) 009h Configuration Word 00Ah Configuration Word 00Bh Configuration Word 00Ch Configuration Word 00Dh Configuration Word 00Eh Configuration Word 00Fh Configuration Word Not Implemented 3FFh wrap around

Note 1: Reserved locations content should not be modified as it contains important factory calibration values.
2: Configuration Word is mapped to 8 locations in memory. Writing to any of these locations, modifies all the other locations.

1.5 Programming Method

Programming of the device consists of three basic steps:

• The Configuration Word must be accessed to unprotect the encoder memory, turning the Encoder Protect bit from 0 to 1.
• As a side effect, turning the Encoder Protect bit from 0 back to 1, the encoder memory will be bulk erased (all locations set to 0FFh).
• The encoder memory can now be written with the new encoder data.
• Finally, the Configuration Word is accessed again to protect the encoder memory array.

FIGURE 1-1: PROGRAMMING METHOD

graph TD
    A["Start"] --> B["Unprotect Encoder Memory"]
    B --> C["Program Encoder"]
    C --> D["Protect Encoder Memory"]
    D --> E["Stop"]
    style A fill:#f9f,stroke:#333
    style B fill:#ccf,stroke:#333
    style C fill:#cfc,stroke:#333
    style D fill:#fcc,stroke:#333
    style E fill:#cff,stroke:#333

It must be noted that if at the beginning the Encoder Protect bit is not RESET (1), later it will not be possible to modify the contents of the encoder memory.

Failing to set the Encoder Protect bit (0), after writing the new encoder data, on the contrary, will expose the encoder memory contents, including the crypto keys assigned to the device with an extremely severe impact on the security of the customer application.

1.6 The programming sequence

Both when accessing the configuration memory and the encoder memory, a simple basic sequence of four commands is used:

1. Load Data command, transfers the data to the write latch ready for the following command
2. Begin Programming Cycle command, initiates the self timed memory write sequence
3. Read command, verifies the outcome of the previous command
4. Increment Address command, so the Program Counter points to the next memory location

This sequence is repeated for the required number of consecutive locations.

In the following sections we will analyze in detail the implementation of such sequence for access to the two memory areas.

1.6.1 CONFIGURATION MEMORY ACCESS

Use the "Load Data For Configuration Memory" command followed by an Increment Address command, immediately after the Program Mode Entry sequence (see Section 1.4). This will set the PC to 000h, eight subsequent "Increment Address" commands will advance into the Configuration Word memory area (008h to 00Fh).

Continue using the "Load Data For Configuration Memory" command in step 1 of the programming sequence.

Use the "Read Data From Configuration Memory" command in step 3 of the programming sequence.

Use the "Increment Address" command immediately after the Program mode entry sequence. This will set the Program Counter to 00h where the actual Encoder programming sequence can start. (see Section 1.3)

Use the "Load Data For Encoder Memory" command in step 1 of the programming sequence.

Use the "Read Data From Encoder Memory" command in step 3 of the programming sequence.

1.6.3 RESERVED LOCATIONS

It is important that the programmer does not modify the content of any of the reserved locations as this might affect some of the factory programmed calibration parameters of the device such as the brown-out threshold levels or the internal RC oscillator frequency.

1.7 Serial Programming Operation

The S1 pin is used as a clock input pin and the S0 pin is used for entering command bits and data input/output during serial operation. To input a command, the clock pin (S1) is cycled 6 times. Each command bit is latched on the falling edge of the clock with the Least Significant bit (LSb) of the command being input first. The data on pin S0 is required to have a minimum setup and hold time of 100 ns, with respect to the falling edge of the clock. Commands that have data associated with them (read and load) are specified to have a minimum delay of 1 s, between the command and the data. After this delay, the clock pin is cycled 16 times,

with the first cycle being a START bit, followed by 12 data bits, two zeros and the last cycle being a STOP bit. START and STOP bits are also set to zero.

Data is input and output LSb first. Data is set on the rising edge of the clock and latched on the falling edge of the clock. Therefore, during a read operation, the LSb will be transmitted onto pin S0 on the rising edge of the second cycle, and during a load operation, the LSb will be latched on the falling edge of the second cycle. To allow for decoding of commands and reversal of data pin configuration, a time separation, of at least 1 s, is required between a command and a data word (or another command).

FIGURE 1-5: SERIAL COMMAND EXAMPLE

VDD LED S1 (CLOCK) S0 (DATA) RESET Program Mode 1 µs min. 15 26 3 4 5 16 15 X X strt_bit stp_bit

TABLE 1-2: SERIAL PROGRAMMING COMMAND SET

Command (MSb ... LSb)	Data (order of input/output)START bit, data LSb ... data MSb, padding, STOP bit
Load Data For Configuration Memory	0 0 0 0 0 00 d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 d10 d11 0 0 0
Load Data For Encoder Memory	0 0 0 0 1 10 d0 d1 d2 d3 d4 d5 d6 d7 0 0 0 0 0 0 0
Read Data From Configuration Memory	0 0 0 1 0 0d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 d10 d11 0 0 0
Read Data From Encoder Memory	0 0 0 1 0 10 d0 d1 d2 d3 d4 d5 d6 d7 0 0 0 0 0 0 0
Increment Address	0 0 0 1 1 0
Begin Erase / Programming Cycle	0 0 1 0 0 0
Begin Programming Only Cycle	0 0 1 0 1 0
Bulk Erase Encoder Memory	0 0 1 0 1 1

Note: All other 6-bit combinations are Reserved.

1.7.1 LOAD DATA FOR CONFIGURATION MEMORY

After receiving this command, the program counter (PC) will be set to 3FFh. An "Increment Address" command will then advance the PC to 000h pointing to the Configuration Word memory. By then applying 16 cycles to the clock pin, the chip will load 12 bits in, as the "data word".

1.7.2 LOAD DATA FOR ENCODER MEMORY

After receiving this command, the chip will load in 12 bits as a "data word" when 16 cycles are applied. However, the encoder memory is only 8-bits wide, and thus, only the first 8 bits of data after the START bit will be programmed into the data memory. It is still necessary to cycle the clock the full 16 cycles in order to allow the internal circuitry to RESET properly.

The PC is used to address the encoder memory. Only the lower 8 bits of the PC are decoded by the encoder memory. Locations 0h-3Fh are physically implemented, while locations 40h-FFh are not implemented and read as zeroes (low). If the PC is greater than FFh, it will wrap around and address a location from 0h-FFh.

1.7.3 READ DATA FROM CONFIGURATION MEMORY

After receiving this command, the chip will transmit data bits out of the configuration memory currently accessed, starting with the second rising edge of the clock input. The S0 pin will go into Output mode on the second rising clock edge, and it will revert back to Input mode (hi-impedance) after the 16th rising edge.

Configuration Word memory will read irrespective of the Encoder Protect enable bit status.

1.7.4 READ DATA FROM ENCODER MEMORY

After receiving this command, the chip will transmit data bits out of the data memory starting with the second rising edge of the clock input. The S0 pin will go into Output mode on the second rising clock edge, and it will revert back to Input mode (hi-impedance) after the 16th rising edge. As previously stated, the data memory is 8-bits wide, and therefore, only the first 8 bits that are output are actual data. A timing diagram for this read command is shown in Figure 5-2.

If the Encoder Protect mechanism is enabled, all the encoder configuration data will read as zeros. Writing to the encoder memory will also be disabled.

1.7.5 INCREMENT ADDRESS

The PC is incremented when this command is received. A timing diagram of this command is shown in Figure 5-3.

1.7.6 BEGIN ERASE/PROGRAMMING CYCLE

A Load command must be given before every Begin Programming command. Word erasure and programming of Configuration Word and encoder memory will begin, after this command is received and decoded. An internal timing mechanism executes an erase before write. The user must allow the combined time for erase and programming, as specified in the electrical specs, for programming to complete. No "End Programming" command is required.

1.7.7 BEGIN PROGRAMMING ONLY CYCLE

This command is similar to the Erase/Programming Cycle command, except that a word erase is not done. Programming Configuration Word and encoder memory will begin after this command is received and decoded. The user must allow the time for programming, as specified in the electrical specs, for programming to complete. No "End Programming" command is required.

It is recommended that the user do a bulk erase before starting a series of programming only cycles.

1.7.8 BULK ERASE ENCODER MEMORY

After this command is performed, the "Next Program" command will erase the entire encoder memory. The erase time is specified to be 10 ms.

All bulk erase operations must take place at 4.5 to 5.5V VDD range.

FIGURE 1-6: PROGRAM/VERIFY FLOW CHART - ENCODER MEMORY

graph TD
    A["Program"] --> B["Program Mode Entry"]
    B --> C["Increment Address Command"]
    C --> D["Load Data for Encoder Memory"]
    D --> E["Begin Programming Command"]
    E --> F["Wait 10 ms"]
    F --> G["Read Data from Encoder Memory"]
    G --> H{Data Correct?}
    H -->|No| I["Report Programming Failure"]
    H -->|Yes| J{All Locations Done?}
    J --> K["RESET (Exit Serial Program Mode)"]
    K --> L["Done"]
    M["Verify"] --> N["Program Mode Entry"]
    N --> O["Increment Address Command"]
    O --> P["Read Data from Encoder Memory"]
    P --> Q{Data Correct?}
    Q -->|No| R["Report Verification Failure"]
    Q -->|Yes| S["Reset (Exit Serial Program Mode)"]
    S --> T["Done"]
    U["Increment Address Command"] --> V["End"]
    style A fill:#f9f,stroke:#333
    style M fill:#f9f,stroke:#333
    style N fill:#f9f,stroke:#333
    style O fill:#f9f,stroke:#333
    style P fill:#f9f,stroke:#333
    style Q fill:#f9f,stroke:#333
    style R fill:#f9f,stroke:#333
    style S fill:#f9f,stroke:#333
    style T fill:#f9f,stroke:#333

2.0 CONFIGURATION WORD

Special care must be taken when modifying the Configuration Word contents of the HCS473. In fact, in addition to the Encoder Protection enable bits, it contains several "factory calibration" parameters that are vital to the proper working of the device (marked Reserved).

Care must be taken not to lose these bits contents when manipulating the Configuration Word.

Writing the Configuration Word requires further consideration of the following constraints:

• writing will be performed only if the Encoder Protect bit differs from the current Configuration Word contents
• changing from 0 to 1, the Encoder Protect bit will produce a bulk erase of the encoder memory contents

Refer to Figure 2-1 (PROGRAM FLOW CHART CONFIGURATION WORD) to learn how to access and program the Configuration Word of an HCS473 device.

TABLE 2-1: CONFIGURATION WORD BIT MAP

Res Res Res Res

Res EP

Res Res

Res Res

Res Res

bit 11 bit 6 bit 0

Res: Reserved, preserve value of these bits when writing to the Configuration Word

bit 6: EP: Encoder Protection enable bit

Setting the bit from 0 to 1 removes read protection and bulk erases the Encoder EEPROM

1 = Not protected

0 = Protected - Can not read or write

2.1 Encoder Protection

The HCS473 features an Encoder Protection mechanism to control access to the encoder memory array. When Encoder Protection is enabled, the encoder memory locations read all '0's. Further programming is disabled for the entire array.

Once Encoder Protection have been enabled, disabling it will produce a bulk erase of the entire encoder memory array.

Configuration memory is not affected by the Encoder Protect bits and is always available to read.

Note: Failing to set the Encoder Protect bit (0), after writing new encoder data will expose the encoder memory contents, including the crypto keys assigned to the device, with an extremely severe impact on the security of the customer application.

TABLE 2-2: CODE PROTECTION

Memory Segment	R/W Protected (EP = 0)	R/W Unprotected (EP = 1)
Configuration Memory [000h:00Fh]	Read Enabled, Write Enabled*	Read Enabled, Write Enabled*
Encoder memory [000h:03Fh]	Read Disabled(all 0's), Write Disabled	Read Enabled, Write Enabled

Note*: The Configuration Word is not updated unless EP is changed from existing value.

FIGURE 2-1: PROGRAM FLOW CHART - CONFIGURATION WORD

graph TD
    A["Start"] --> B["Enter Program Mode"]
    B --> C["Load Data for Configuration Word (1)"]
    C --> D["Increment Address Command"]
    D --> E{Address = 008h}
    E -->|No| D
    E -->|Yes| F["Read Data from Configuration Word"]
    F --> G["Toggle Encoder Protect"]
    G --> H["Load Data for Configuration Word"]
    H --> I["Begin Program Cycle"]
    I --> J["Read Data from Configuration Word"]
    J --> K{Data Correct?}
    K -->|No| L["Report Program Configuration Word Error"]
    K -->|Yes| M["RESET (Exit Serial Program Mode)"]
    M --> N["Done"]

2.2 HCS473 Counter Implementation

The HCS473 uses a different method of storing the counter in EEPROM when compared to previous KEELoQ encoders. This section explains how to implement this different counter storage method and provides some examples for testing purposes.

FIGURE 2-1: COUNTER IMPLEMENTATION FLOWCHART

graph TD
    A["Start"] --> B{Is 16-bit Counter Selected?}
    B -->|Yes| C["Use 16-bit Counter Storage Scheme"]
    B -->|No| D["Use 20-bit Counter Storage Scheme"]
    C --> E["Get Initial Counter Value(s)"]
    D --> E
    E --> F["Convert Initial Counter Values to Pseudo Gray Code"]
    F --> G["Calculate Checksums"]
    G --> H["Store Counter Values Store Checksums"]
    H --> I["Program Device"]
    I --> J["End"]

20-Bit Counter:

Reg Bits
A 23	22 21 20	19 18 17	16
	x	x	0	0	D	D	D	D

MSb

Reg Bits
B 15	14 13 12	11 10 9	8
	D	D	D	D	D	D	D	D

Reg Bits
C 7	6	5	4	3	2	1	0
	D	D	D	D	D	D	D	D

LSb

• D represents a counter bit
• x represents a don't care
• 0 represents a logic zero

16-Bit Counter:

Reg Bits
A 23	22 21 20	19 18 17	16
	x	x	0	0	0	0	F	F

MSb

Reg Bits
B 15	14 13 12	11	10 9 8
	D	D	D	D	D	D	D	D

Reg Bits
C 7	6	5	4	3	2	1	0
	D	D	D	D	D	D	D	D

LSb

• D represents a counter bit
• x represents a don't care
• 0 represents a logic zero
• FF represents overflow conditions. FF = 11 -> None

$$ F F = 0 1 \rightarrow \text { Once } $$

$$ F F = 0 0 \rightarrow T w i c e $$

Convert Initial Counter Values to Pseudo Gray Code (C Implementation):

Note: See previous page for references to A, B, and C.

If (B & 1)

C ^= 0xFF;

If (A & 1)

B ^^ = 0xFF;

Calculate Checksums (C implementation):

Checksum1 = B^C;

Checksum2 = A^C;

Checksum3 = A^B;

Store Counter Values And Checksums:

Note: Checksum 3 comes before Checksum 2

	Bits
Address	7	6	5	4	3	2	1	0
18 A
19 B
1A C
1B Checksum 1
1C Checksum 3
1D Checksum 2

Example 1:

Counter Scheme: 16-bit

Counter Value: 0x0000

Overflow Condition: None

Reg Bits
A 23	22 21 20	19 18 17	16
	0	0	0	0	0	0	1	1

MSb

Reg Bits
B	15	14	13	12	11	10	9	8
	0	0	0	0	0	0	0	0

Reg Bits
C 7	6	5	4	3	2	1	0
	0	0	0	0	0	0	0	0

LSb

Get Initial Counter Values:

$$ A = 0 \times 0 3 $$

$$ B = 0 \times 0 0 $$

$$ C = 0 \times 0 0 $$

Convert Initial Counter Values To Pseudo Gray Code (See page 12):

$$ A = 0 x 0 3 $$

$$ B = 0 x F F $$

$$ C = 0 x 0 0 $$

Calculate Checksums:

$$ \text { Checksum1 } = \mathrm{B} \oplus \mathrm{C} = 0 \mathrm{xFF} \oplus 0 \mathrm{x00} = 0 \mathrm{xFF} $$

$$ \text { Checksum2 } = A \oplus C = 0 x 0 3 \oplus 0 x 0 0 = 0 x 0 3 $$

$$ \text { Checksum3 } = A \oplus B = 0 x 0 3 \oplus 0 x F F = 0 x F C $$

Store Counter Values And Checksums:

	Bits
Address	7	6	5	4	3	2	1	0
18	A = 0x03
19	B = 0xFF
1A	C = 0x00
1B	Checksum 1 = 0xFF
1C	Checksum 3 = 0xFC
1D	Checksum 2 = 0x03

Example 2:

Counter Scheme: 16-bit

Counter Value: 0x1234

Overflow Condition: Once

Reg Bits
A 23	22 21 20	19 18 17	16
	0	0	0	0	0	0		0
MSb
Reg Bits
B	15	14	13	12	11	10	9	8
	0	0	0	1	0	0	1	0
Reg Bits
C 7	6	5	4	3	2	1	0
	0	0	1	1	1	0	0	0

Get Initial Counter Values:

A = 0x01

B = 0x12

C = 0x34

Convert Initial Counter Values To Pseudo Gray Code (See page 12):

A = 0x01

B = 0xED

C = 0x34

Calculate Checksums:

Checksum1 = B ⊕ C = 0xED ⊕ 0x34 = 0xD9

Checksum2= A ⊕ C = 0x01 ⊕ 0x34 = 0x35

Checksum3= A ⊕ B = 0x01 ⊕ 0xED = 0xEC

Store Counter Values And Checksums:

	Bits
Address	7	6	5	4	3	2	1	0
18	A = 0x01
19	B = 0xED
1A	C = 0x34
1B	Checksum 1 = 0xD9
1C	Checksum 3 = 0xEC
1D	Checksum 2 = 0x35

Example 3:

Counter Scheme: 16-bit

Counter Value: 0x789A

Overflow Condition: Twice

Reg Bits
A 23	22 21 20	19 18 17	16
	0	0	0	0	0	0	0	0

MSb

Reg Bits
B	15	14	13	12	11	10	9	8
	0	1	1	1	1	0	0	0

Reg Bits
C 7	6	5	4	3	2	1	0
	1	0	0	1	1	0	1	0

LSb

Get Initial Counter Values:

$$ A = 0 \times 0 0 $$

$$ B = 0 \times 7 8 $$

$$ C = 0 \times 9 A $$

Convert Initial Counter Values To Pseudo Gray Code (See page 12):

$$ A = 0 x 0 0 $$

$$ B = 0 x 7 8 $$

$$ C = 0 x 9 A $$

Calculate Checksums:

$$ \text { Checksum1 } = \mathrm{B} \oplus \mathrm{C} = 0 x 7 8 \oplus 0 x 9 \mathrm{A} = 0 x \mathrm{E2} $$

$$ \text { Checksum2 } = A \oplus C = 0 x 0 0 \oplus 0 x 9 A = 0 x 9 A $$

$$ \text { Checksum3 } = A \oplus B = 0 x 0 0 \oplus 0 x 7 8 = 0 x 7 8 $$

Store Counter Values And Checksums:

	Bits
Address	7	6	5	4	3	2	1	0
18	A = 0x00
19	B = 0x78
1A	C = 0x9A
1B	Checksum 1 = 0xE2
1C	Checksum 3 = 0x78
1D	Checksum 2 = 0x9A

Example 4:

Counter Scheme: 20-Bit

Counter Value: 0xFABCD

Reg Bits
A 23	22 21 20	19 18 17	16
	0	0	0	0	1	1	1	1

MSb

Reg Bits
B 15	14 13 12	11 10 9	8
	1	0	1	0	1	0	1	1

Reg Bits
C 7	6	5	4	3	2	1	0
	1	1	0	0	1	1	0	1

LSb

Get Initial Counter Values:

A = 0x0F

B = 0xAB

C = 0xCD

Convert Initial Counter Values To Pseudo Gray Code (See page 12):

A = 0x0F

B = 0x54

C = 0x32

Calculate Checksums:

Checksum1=B ⊕ C = 0x54 ⊕ 0x32 = 0x66

Checksum2=A ⊕ C=0x0F ⊕ 0x32=0x3D

Checksum3= A ⊕ B = 0x0F ⊕ 0x54 = 0x5B

Store Counter Values And Checksums:

	Bits
Address	7	6	5	4	3	2	1	0
18	A = 0x0F
19	B = 0x54
1A	C = 0x32
1B	Checksum 1 = 0x66
1C	Checksum 3 = 0x5B
1D	Checksum 2 = 0x3D

3.0 ENCODER MEMORY ORGANIZATION

A summary of the HCS473 EEPROM organization is shown in the table below. For large fields the Most Significant Byte is stored at the smallest address and the Least Significant Byte is stored at the highest address. Fields like SEED (60 bits) and DISC (10 bits) that are not an exact multiple of bytes are stored right justified such that the Most Significant bits of the lowest address are left as zeros.

TABLE 3-1: HCS473 MEMORY MAP

	Bits
Bytes 7	6		5		4		3
00 USER	0 EEPROM AREA MSB
01 USER	0 EEPROM AREA LSB
02 USER	1 EEPROM AREA MSB
03 USER	1 EEPROM AREA LSB
04 USER	2 EEPROM AREA MSB
05 USER	2 EEPROM AREA LSB
06 USER	3 EEPROM AREA MSB
07 USER	3 EEPROM AREA LSB
08 ENCODER SERIAL NUMBER MSB
09 ENCODER SERIAL NUMBER
0A	ENCODER SERIAL NUMBER
0B	ENCODER SERIAL NUMBER LSB
0C	VEHICLE ID #1 MSB
0D	VEHICLE ID #1 LSB			TOKEN #1ID
0E	VEHICLE ID #2 MSB
0F	VEHICLE ID #2 LSB			TOKEN #2ID
10	64-BIT IFF_KEY (MSB)
11	64-BIT IFF_KEY
12	64-BIT IFF_KEY
13	64-BIT IFF_KEY
14	64-BIT IFF_KEY
15	64-BIT IFF_KEY
16	64-BIT IFF_KEY
17	64-BIT IFF_KEY (LSB)
18	SYNCH COUNTER USB
19	SYNCH COUNTER MSB
1A	SYNCH COUNTER LSB
1B	SYNCH COUNTER CHKSUM 1
1C	SYNCH COUNTER CHKSUM 3
1D	SINCH COUNTER CHKSUM 2
1E	RESERVED (0x00)
1F	RESERVED (0x00)
20	64-BIT KEY_1 MSB
21	64-BIT KEY_1
22	64-BIT KEY_1
23	64-BIT KEY_1
24	64-BIT KEY_1
25	64-BIT KEY_1
26	64-BIT KEY_1
27	64-BIT KEY_1 (LSB)
28					60-BIT SEED VALUE (MS-NIBBLE)
29	60-BIT SEED VALUE
2A	60-BIT SEED VALUE
2B	60-BIT SEED VALUE
2C	60-BIT SEED VALUE
2D	60-BIT SEED VALUE
Bytes	7	6	5	4	3	2	1	0
2E 60-BIT	SEED VALUE
2F 60-BIT	SEED VALUE (LSB)
30 TRANSPORT CODE (MSB)
31 TRANSPORT CODE
32 TRANSPORT CODE
33 TRANSPORT CODE (LSB)
34							DISCRIMINATION BIT (MSB)
35 DISCRIMINATION BIT (LSB)
36 RFEN	PLL VLOWS CTSEL QUEN XSER HSEL MSEL
37	SDMD	SDLM	SDTM		SEED BUTTON CODE
38	TSEL		MTX		GSEL		RFBSL
39					TPLS	LPRD LPRL	LPRE
3A	SACK	RFRSP	LCRSP	DAMP	PXMA	ACOL	LFBSL
3B
3C
3D
3E
3F	RESERVED (0x5A)

4.0 ENCODER CONFIGURATION OPTIONS SUMMARY

TABLE 4-1: EEPROM ORGANIZATION

Symbol	Address (Bits)	Class Description (Note 1)
USR 0 00:	16 bits T User E	EPROM Area
USR 1 02:	16 bits T User E	EPROM Area
USR 2 04:	16 bits T User E	EPROM Area
USR 3 06:	16 bits T User E	EPROM Area
SER 08:	32 bits B Encoder Serial Number
VID 1 0C:	16 bits	T	Vehicle/Token ID Number
VID 2 0E:	16 bits	T	Vehicle/Token ID Number
IFF KEY	10: 64 bits T		IFF Key
COUNT	18: 64 bits	E	Encoder Synchronization Counter and Overflow bits
KEY 20:	64 bits E		Encoder Key
SEED 28:	60 bits E Encoder Seed Value
TCODE	30: 32 bits T		Transport Code
DISC	34: 10 bits E		Encoder Discrimination Value
MSEL 36:	----0	E	Transmission Modulation Format	PWM=0	Manchester=1
HSEL	36:----1-	E	Header Select	4 TE = 0	10 TE = 1
XSER	36:----2--	E	Extended Serial Number	28 bits = 0	32 bits = 1
QUEN	36:----3---	E	Queue counter Enable	Disable = 0	Enable = 1
CNTSEL	36:----4----	E	Counter Select	16 bits = 0	20 bits = 1
VLOWSEL	36:----5----	E	Low Voltage Trip Point Select(2)	2.2 V = 0	3.3 V = 1
PLLSEL	36:-6----	B	PLL Interface Select	ASK = 0	FSK = 1
RFEN	36:7----	B	RF Enable Output	S3 = 0	RF Enable = 1
SDBT 37:	----3210	E	Seed Button Code
SDTM	37:----54----	E	Time Before Seed Code Word(1)	Value	Time (s)
				00b	0.0
				01b	0.8
				10b	1.6
				11b	3.2
SDLM	37:-6----	E	Limited Seed	Unlimited	Limited
SDMD	37:7----	E	Seed Mode	User = 0	Production = 1

Note 1: All Timing values vary ±10%.
2: Voltage thresholds are ±150mV .

Symbol	Address (Bits)	Class	Description (Note 1)
RFBSL 38:	----10 E RF Transmission	Baud Rate Select(1)		Value TE (μs)
				00b 100
				01b 200
				10b 400
				11b 800
GSEL 38:	----32-- E Guard	Time Select	(1)	Value Time (ms)
				00b 0.0
				01b 6.4
				10b	51.2
				11b	102.4
MTX	38:---54----	E	Minimum Code Words	Value	Value
				00b	1
				01b	2
				10b	4
				11b	8
TSEL	38:76---- E	Time-out Select	(1)	Value	Time (s)
				00b	4
				01b	8
				10b	16
				11b	32
LPRE	39:----0	E	Long Preamble Enable	Disable = 0	Enable = 1
LPRL	39:----1-	E	Long Preamble Length(1)	75 ms = 0	100 ms = 1
LPRD 39:	----2--	E	Long Preamble Duty Cycle (1)	33% = 0	50% = 1
TPLS	39:----3---	T	Transponder Preamble Length Select	Normal = 0	Short = 1
LFBSL	3A:----10	T	LF Transmission Baud Rate Select(1)	Value	TE (μs)
				00b 100
				01b 200
				10b 400
				11b	800
ACOL	3A:----2--	T	Anti-Collision	Disable = 0	Enable = 1
PXMA	3A:----3---	T	Proximity Activation	Disable = 0	Enable = 1
DAMP	3A:----4----	T	Intelligent LC Damping	Disable = 0	Enable = 1
LCRSP	3A:----5----	T	LC Response	Disable = 0	Enable = 1
RFRSP	3A:----6----	T	RF Response	Disable = 0	Enable = 1
SACK	3A:7----	T	Skip First Acknowledge	Disable = 0	Enable = 1
END	3F:01011010		Unused, always set to 5A

Note 1: All Timing values vary ±10%.
2: Voltage thresholds are ±150mV .

5.0 PROGRAM MODE ELECTRICAL CHARACTERISTICS

TABLE 5-1: AC/DC TIMING REQUIREMENTS FOR PROGRAM MODE

AC/DC CHARACTERISTICS,POWER SUPPLY PINS
Characteristics Sym Min	Typ Max	Units Conditions/Comments
General
Supply voltage during programming	Vbatt 4.5 5.0	5.5	V
Supply voltage during verify	Vbatt	V_DD min.		V_DD max.	V
High voltage on Test mode entry	Vihh	V_BATT + 4.5		14.0	V	Always use minimum on VIHH
Power-up Reset time before entering Test mode	tvdd		50		μs
rise time ( V_ss to V_HH ) for Test mode entry	tvhhr			1.0	ms
(S1, S0) input high level	Vih1	0.8V_BATT			V Schmitt Trigger input
(S1, S0) input low level	Vil1	0.2V_BATT			V Schmitt Trigger input
S<3:0> setup time before (Test mode selection pattern setup time)	tset0 100			ns
S<3:0> hold time after (Test mode selection pattern setup time)	thld0	5			ms
Serial Program/Verify
Data in setup time before clock	tset1 100			ns
Data in hold time after clock	thld1 100			ns
Data input not driven to next clock input (delay required between command/data or command/command)	tdly1 1.0			μs
Delay between clock to clock of next command or data	tdly2 1.0			μs
Clock to data out valid (during read data)	tdly3	80			ns
Serial Clock Period		1			μs
Erase Cycle Time				10	ms
Program Cycle Time				10	ms

FIGURE 5-1: LOAD DATA FOR CONFIG MEMORY COMMAND

graph TD
    A["VvATT tvdd"] --> B["ViHH"]
    C["MCLR"] --> D["tset0"]
    D --> E["S1 (CLOCK)"]
    E --> F["thld0"]
    F --> G["0"]
    G --> H["tset1"]
    H --> I["thld1"]
    I --> J["0"]
    J --> K["X"]
    K --> L["strt_bit"]
    L --> M["tset1"]
    M --> N["thld1"]
    N --> O["100 ns min."]
    P["1 μs min."] --> Q["tdly2"]
    Q --> R["15"]
    R --> S["26"]
    S --> T["3"]
    T --> U["4"]
    U --> V["165"]
    W["100 ns min."] --> X["1 μs min."]
    X --> Y["100 ns min."]
    Z["STP_bit"] --> AA["stp_bit"]

FIGURE 5-2: READ DATA FROM ENCODER MEMORY COMMAND

MCLR VIIH tset0 thld0 tdly2 1 μs min S1 (CLOCK) 1 2 3 4 15 26 3 4 16 5 s0 (DATA) 1 0 1 0 X X strt_bit stdy3 stp_bit tset1 thld1 tdly1 1 μs min. 100 ns min. RC0 = input RC0 = output RC0 input RESET Program Mode

FIGURE 5-3: INCREMENT ADDRESS COMMAND

MCLR VIHH S1 (CLOCK) s0 (DATA) RESET Program Mode 1 2 3 4 0 1 0 0 tset1 thld1 100 ns min. tdly2 1 µs min. Next Command 15 26 X X tdly1 1 µs min.

6.0 ADDITIONAL INFORMATION

Microchip's Secure Data Products are covered by some or all of the following: Code hopping encoder patents issued in European countries and U.S.A. Secure learning patents issued in European countries, U.S.A. and R.S.A.

NOTES:

Note the following details of the code protection feature on Microchip devices:

• Microchip products meet the specification contained in their particular Microchip Data Sheet.
- Microchip believes that its family of products is one of the most secure families of its kind on the market today, when used in the intended manner and under normal conditions.
- There are dishonest and possibly illegal methods used to breach the code protection feature. All of these methods, to our knowledge, require using the Microchip products in a manner outside the operating specifications contained in Microchip's Data Sheets. Most likely, the person doing so is engaged in theft of intellectual property.
- Microchip is willing to work with the customer who is concerned about the integrity of their code.
- Neither Microchip nor any other semiconductor manufacturer can guarantee the security of their code. Code protection does not mean that we are guaranteeing the product as "unbreakable."

Code protection is constantly evolving. We at Microchip are committed to continuously improving the code protection features of our products. Attempts to break Microchip's code protection feature may be a violation of the Digital Millennium Copyright Act. If such acts allow unauthorized access to your software or other copyrighted work, you may have a right to sue for relief under that Act.

Information contained in this publication regarding device applications and the like is provided only for your convenience and may be superseded by updates. It is your responsibility to ensure that your application meets with your specifications. MICROCHIP MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND WHETHER EXPRESS OR IMPLIED, WRITTEN OR ORAL, STATUTORY OR OTHERWISE, RELATED TO THE INFORMATION, INCLUDING BUT NOT LIMITED TO ITS CONDITION, QUALITY, PERFORMANCE, MERCHANTABILITY OR FITNESS FOR PURPOSE. Microchip disclaims all liability arising from this information and its use. Use of Microchip devices in life support and/or safety applications is entirely at the buyer's risk, and the buyer agrees to defend, indemnify and hold harmless Microchip from any and all damages, claims, suits, or expenses resulting from such use. No licenses are conveyed, implicitly or otherwise, under any Microchip intellectual property rights.

QUALITY MANAGEMENT SYSTEM CERTIFIED BY DNV

=ISO/TS 16949:2009=

Trademarks

The Microchip name and logo, the Microchip logo, dsPIC, KEELOQ, KEELOQ logo, MPLAB, PIC, PICmicro, PICSTART, PIC ^32 logo, rfPIC and UNI/O are registered trademarks of Microchip Technology Incorporated in the U.S.A. and other countries.

FilterLab, Hampshire, HI-TECH C, Linear Active Thermistor, MXDEV, MXLAB, SEEVAL and The Embedded Control Solutions Company are registered trademarks of Microchip Technology Incorporated in the U.S.A.

Analog-for-the-Digital Age, Application Maestro, chipKIT, chipKIT logo, CodeGuard, dsPICDEM, dsPICDEM.net, dsPICWorks, dsSPEAK, ECAN, ECONOMONITOR, FanSense, HI-TIDE, In-Circuit Serial Programming, ICSP, Mindi, MiWi, MPASM, MPLAB Certified logo, MPLIB, MPLINK, mTouch, Omniscient Code Generation, PICC, PICC-18, PICDEM, PICDEM.net, PICkit, PICtail, REAL ICE, rfLAB, Select Mode, Total Endurance, TSHARC, UniWinDriver, WiperLock and ZENA are trademarks of Microchip Technology Incorporated in the U.S.A. and other countries.

SQTP is a service mark of Microchip Technology Incorporated in the U.S.A.

All other trademarks mentioned herein are property of their respective companies.

© 2011, Microchip Technology Incorporated, Printed in the U.S.A., All Rights Reserved.

Printed on recycled paper.

ISBN: 978-1-61341-211-4

Microchip received ISO/TS-16949:2002 certification for its worldwide headquarters, design and wafer fabrication facilities in Chandler and Tempe, Arizona; Gresham, Oregon and design centers in California and India. The Company's quality system processes and procedures are for its PIC® MCUs and dsPIC® DSCs, KEELoo® code hopping devices, Serial EEPROMs, microperipherals, nonvolatile memory and analog products. In addition, Microchip's quality system for the design and manufacture of development systems is ISO 9001:2000 certified.

Worldwide Sales and Service

AMERICAS

Corporate Office

2355 West Chandler Blvd.

Chandler, AZ 85224-6199

Tel: [phone]

Fax: [phone]

Technical Support:

http://www.microchip.com/

support

Web Address:

www.microchip.com

Atlanta

Duluth, GA

Tel: [phone]

Fax: [phone]

Boston

Westborough, MA

Tel: [phone]

Fax: [phone]

Chicago

Itasca,

Tel: [phone]

Fax: [phone]

Cleveland

Independence, OH

Tel: [phone]

Fax: [phone]

Dallas

Addison, TX

Tel: [phone]

Fax: [phone]

Detroit

Farmington Hills, MI

Tel: [phone]

Fax: [phone]

Indianapolis

Noblesville, IN

Tel: [phone]

Fax: [phone]

Los Angeles

Mission Viejo, CA

Tel: [phone]

Fax: [phone]

Santa Clara

Santa Clara, CA

Tel: [phone]

Fax: [phone]

Toronto

Mississauga, Ontario,

Canada

Tel: [phone]

Fax: [phone]

ASIA/PACIFIC

Asia Pacific Office

Suites 3707-14, 37th Floor

Tower 6, The Gateway

Harbour City, Kowloon

Hong Kong

Tel: [phone]

Fax: [phone]

Australia - Sydney

Tel: [phone]

Fax: [phone]

China - Beijing

Tel: [phone]

Fax: [phone]

China - Chengdu

Tel: [phone]

Fax: [phone]

China - Chongqing

Tel: [phone]

Fax: [phone]

China - Hangzhou

Tel: [phone]

Fax: [phone]

China - Hong Kong SAR

Tel: [phone]

Fax: [phone]

China - Nanjing

Tel: [phone]

Fax: [phone]

China - Qingdao

Tel: [phone]

Fax: [phone]

China - Shanghai

Tel: [phone]

Fax: [phone]

China - Shenyang

Tel: [phone]

Fax: [phone]

China - Shenzhen

Tel: [phone]

Fax: [phone]

China - Wuhan

Tel: [phone]

Fax: [phone]

China - Xian

Tel: [phone]

Fax: [phone]

China - Xiamen

Tel: [phone]

Fax: [phone]

China - Zhuhai

Tel: [phone]

Fax: [phone]

ASIA/PACIFIC

India - Bangalore

Tel: [phone]

Fax: [phone]

India - New Delhi

Tel: [phone]

Fax: [phone]

India - Pune

Tel: [phone]

Fax: [phone]

Japan - Yokohama

Tel: [phone]

Fax: [phone]

Korea - Daegu

Tel: [phone]

Fax: [phone]

Korea - Seoul

Tel: [phone]

Fax: [phone] or

82-2-558-5934

Malaysia - Kuala Lumpur

Tel: [phone]

Fax: [phone]

Malaysia - Penang

Tel: [phone]

Fax: [phone]

Philippines - Manila

Tel: [phone]

Fax: [phone]

Singapore

Tel: [phone]

Fax: [phone]

Taiwan - Hsin Chu

Tel: [phone]

Fax: [phone]

Taiwan - Kaohsiung

Tel: [phone]

Fax: [phone]

Taiwan - Taipei

Tel: [phone]

Fax: [phone]

Thailand - Bangkok

Tel: [phone]

Fax: [phone]

05/02/11