Transponder Evaluation Kit User's Guideww1.microchip.com/downloads/en/devicedoc/51111b.pdf ·...

TRANSPONDER EVALUATION KITUSER’S GUIDE

Information contained in this publication regarding device applications and the like is intended by way of suggestiononly. No representation or warranty is given and no liability is assumed by Microchip Technology Incorporated withrespect to the accuracy or use of such information. Use of Microchip’s products as critical components in life supportsystems is not authorized except with express written approval by Microchip.

2000 Microchip Technology Incorporated. All rights reserved.

The Microchip name and logo, and KEELOQ are registered trademarks of Microchip Technology Incorporated in theU.S.A. and other countries.

All product/company trademarks mentioned herein are the property of their respective companies.

2000 Microchip Technology Inc. DS51111B

Transponder Evaluation Kit User’s Guide

DS51111B 2000 Microchip Technology Inc.


Table of Contents

Chapter 1. Setup1.1 Evaluation Kit Overview .................................................................. 1

1.2 Software Installation ....................................................................... 1

1.3 Hardware Setup .............................................................................. 2

1.4 Quick Start ...................................................................................... 2

Chapter 2. Base Station2.1 Base Station Overview ................................................................... 5

2.2 Base Station Outputs ...................................................................... 6

2.3 Base Station Polling Mode .............................................................. 7

2.4 Inductive Communication ............................................................... 8

2.5 RF Communication ......................................................................... 8

2.6 High Voltage – Danger ................................................................... 8

2.7 Stand-Alone Mode .......................................................................... 8

2.8 Base Station Programming ............................................................. 8

2.9 Learning a Transponder ................................................................. 9

2.10 Erasing Transponders .................................................................. 10

Chapter 3. HCS410

3.1 Selecting an HCS410 ................................................................... 11

3.2 Programming an HCS410 ............................................................. 11

3.3 Code Hopping Transmissions ....................................................... 16

3.4 SEED Transmissions .................................................................... 16

Chapter 4. HCS4124.1 Selecting an HCS412 ................................................................... 17

4.2 Programming an HCS412 ............................................................. 17

4.3 Code Hopping Transmissions ....................................................... 23

4.4 SEED Transmissions .................................................................... 23

2000 Microchip Technology Inc. DS51111B-page iii


Chapter 5. Other Dialog Boxes5.1 User EEPROM Dialog ...................................................................25

5.2 IFF Dialog ......................................................................................25

5.3 Monitor IFF Dialog .........................................................................26

Chapter 6. Configuration File6.1 Configuration File Overview ..........................................................27

6.2 New Setup .....................................................................................27

6.3 Load Setup ....................................................................................27

6.4 Save Setup ....................................................................................27

6.5 Save Setup As ..............................................................................27

Chapter 7. Key Generation

7.1 Key Generation Overview .............................................................29

7.2 Manufacturer’s Code .....................................................................29

7.3 Key Generation Algorithm .............................................................30

7.4 Key Generation Source .................................................................30

7.5 SEED/IFF2 ....................................................................................30

7.6 Simple Learn .................................................................................30

7.7 Normal Learn ................................................................................31

7.8 Secure Learn .................................................................................31

Chapter 8. Communication8.1 Serial Port Selection ......................................................................33

Chapter 9. Demonstrations

9.1 Overview .......................................................................................35

Chapter 10. Fault Finding10.1 Fault Finding .................................................................................39

DS51111B-page iv 2000 Microchip Technology Inc.

Table of Contents

Appendix A. Schematic DiagramsFigure A.1: Transponder Base Station (BASE_V3.0) ............................. 41Figure A.2: Transponder Base Station (GEN_5V) ................................. 42Figure A.3: Transponder Base Station (demod) ..................................... 43Figure A.4: Transponder Base Station (PIC16C66) ............................... 44Figure A.5: Transponder Base Station (coildrv) ..................................... 45Figure A.6: HCS410 DIP Socket Long Range RF Transponder ............ 46Figure A.7: HCS412 Credit Card Transmitter/Transponder ................... 47Figure A.8: HCS410 SOIC Short Range Transponder ........................... 48

Index .........................................................................................................49

Worldwide Sales and Service .................................................................50

2000 Microchip Technology Inc. DS51111B-page v


DS51111B-page vi 2000 Microchip Technology Inc.

TRANSPONDER EVALUATION KIT
USER’S GUIDE
Chapter 1. Setup

1.1 Evaluation Kit OverviewThe Transponder Evaluation kit enables the programming of HCS410s and HCS412s, as well as evaluating how the transponders are used in a system. The kit is made up of four principal items:

• Software• Base Station• Batteryless Transponders• Battery-powered Transponder/RF Transmitters.

The Base Station has the ability to program transponders inductively and act as a stand-alone decoder. When in stand-alone mode, the Base Station can learn transponders and do inductive Identify Friend or Foe (IFF) validation.

The Batteryless Transponders are powered through the magnetic field provided by the Base Station.

The Transponder/Transmitter combines the convenience of an RF transmitter with the security of a transponder. Typically, the RF transmitter will be used as a convenience item: i.e., unlocking the car door as the owner approaches the vehicle. Once in the car, a coil around the ignition electronically validates the key and disarms the immobilizer. This is completely transparent to the operator. Even if the battery in the key goes flat, the transponder will still be able to get power from the field generated by the car's coil.

1.2 Software Installation

1.2.1 Windows® 3.1Place the software into a disk drive. From Program Manager, choose File > Run. Type in a:install.exe.

Follow the installation instructions on the screen.

The first time you run the software, select the serial port you will be using for communicating to the Base Station from the Options > Serial Port menu.

1.2.2 Windows® 95/98 or Windows NT®

Place the software into a disk drive. From the Start menu, select the Run... option. Type in a:install.exe.

Follow the installation instructions on the screen.

The first time you run the software, select the serial port you will be using for communicating to the Base Station from the Options > Serial Port port menu.

2000 Microchip Technology Inc. DS51111B-page 1


1.3 Hardware SetupWhen programming either the Base Station or a transponder, the Base Station needs to be connected to a free serial port on the driving PC using the provided serial cable. After this, the Base Station should be powered up using the 12V power supply provided in the evaluation kit.

When programming a transponder inductively make sure the transponder is in the field when hitting the program button.

1.4 Quick StartFor those of you who don’t read the user manual when you open a new toy here is a quick start to using the Evaluation Kit.

1. Open the box and unpack the kit’s contents.2. Install the software.3. Connect the Base Station to a free serial port on your PC.4. Connect the Base Station to the provided power supply.5. Run the Evaluation Kit Software (Start > Programs > Transponder Eval-

uation Kit > Transponder Evaluation Kit).6. Select and test the serial port that the Base Station is connected to

(Setup > Serial Port).7. Select a demo and work your way through to program the Base Station

and transmitter. A suggested demo is the HCS412s Passive Entry Demo(Demos > HCS412 > Passive Entry Demo). See Chapter 9 for moreinformation.

8. Bring up the Monitor IFF dialog. This dialog displays any communicationbetween the Base Station and a transmitter.

9. Press the LEARN button on the Base Station. Notice how the LEARNand FIELD LEDs turn on as the Base Station searches for a transponder.

10. Bring the credit card-shaped HCS412 Transmitter/Transponder into thefield. The LEARN LED will start flashing, indicating that the Base Stationhas learned the HCS412.

11. Notice how the VALID_TOKEN LED lights up each time the Base Station'Polls' for a transmitter (the FIELD LED will turn on). This indicates thatthe transponder has been validated.

12. Look at the Monitor IFF dialog. Notice how the Base Station sends achallenge to the transponder, the response the transponder sends backto the Base Station, and the decrypted version of the transponder'sresponse.

13. Press a button on the Transmitter/Transponder twice. Notice how theLEARN LED flickers while the transmitter button is pressed. This indi-cates that the Base Station is receiving transmissions from the transmit-ter.

14. After two transmissions, the Base Station will have 'synchronized' withthe transmitter and will put an output on the S0:S1 LEDs, depending onwhich button is pressed.

DS51111B-page 2 2000 Microchip Technology Inc.

Setup

15. Look at the Monitor IFF dialog. Whenever you transmit, the counterincrements.

16. Remove JP3 on the Base Station to disable the RF receiver.17. Press a button on the transmitter 10 times.18. Replace JP3 and press S0 on the transmitter. The S0 LED on the Base

Station lights up and that the counter has increased by 10. 19. Remove JP3 again and press a button on the transmitter 20 times.20. Replace JP3. Press and hold S0 on the transmitter. The LEARN LED

flickers on and off indicating that transmissions are being received butthere is no other output on the Base Station LEDs.

21. Press S0 again. The LEARN LED flickers and the S0 LED on the BaseStation lights up indicating that the Base Station has resynchronized withthe transmitter.

22. To change the polling mode of the Base Station from continuous pollingto user-activated polling:

a) Press and hold the RESET push button on the Base Station.b) Press and hold the POLL push button.c) Release the RESET push button.d) After a second, release the POLL push button.

23. The Base Station has now toggled to user-activated polling (repeat theprevious step to return to continuous polling mode).

24. When in user-activated polling mode, polling can be initiated by hittingthe POLL push button.



NOTES:


USER’S GUIDE
Chapter 2. Base Station

2.1 Base Station Overview

2.1.1 Warning: High VoltageFirst and foremost: THERE ARE HIGH VOLTAGE AREAS on the Base Station board. The voltage on the coil can reach over 400 VPP and has a peak current of 1A. The high voltage areas on the board are marked clearly. Don’t touch anything within those areas.

2.1.2 Base Station Features• Inductive authentication of transponders• Can receive and validate KEELOQ® code hopping transmissions• Can learn up to four KEELOQ encoders• Can be used to program HCS410 and HCS412 devices inductively or

through the PWM/S2 lines• Selectable polling mode

The Base Station has a number of push button inputs and LED outputs:

RESET push button – Resets the Base Station.

POLL push button – Forces the Base Station to poll continuously for 2 seconds before switching off.

LEARN push button – Places the Base Station in learn mode.

LEARN LED – Gives information about the status of a learn and general functioning of the Base Station. The LEARN LED will flicker on briefly each time a transponder's serial number is read when a transponder is brought into the field. This indicates that the Base Station has detected a transponder in the field. If the transponder has been learned, the Base Station will attempt to validate the transponder.

VALID TOKEN LED – Lights up for 500 ms each time the Base Station successfully validates a learned transponder inductively.

S0:S1:S2:S3 and PROX_RF LEDs – Indicates that a valid RF transmission has been received from a transmitter. The LEDs are lit for 500 ms depending on which button is pressed on the transmitter.

FIELD LED – Indicates when the Base Station is polling for a transponder and that the field is on.

Warning: Strong Magnetic FieldThe Base Stations generates a strong magnetic field. Avoid close proximity with devices influenced by magnetic fields: i.e., CRTs, pacemakers, computer disks, audio and video tapes, and magnetic strip cards.



2.2 Base Station Outputs

Figure 2.1: Base Station

The Base Station has a number of LEDs which display the results of authentication attempts.

The S0:S1:S2:S3, and PROX_RF LEDs are switched on for 500 ms whenever the Base Station receives a valid code hopping transmission from a learned transmitter. The PROX_RF will be illuminated if a transmission is initiated by a magnetic field.

The VALID TOKEN LED is switched on for 500 ms whenever the Base Station authenticates a learned transponder.

The LEARN LED flickers every time an RF transmission is received or if the serial number is read from a transponder. The LEARN LED will flicker before the Base Station attempts to check if the transmitter has been learned. This output is useful to a programmer giving feedback as to whether the Base Station detects a transponder or transmitter.

RF

Receiver

JP2

RESET POLL LEARN

93C46B

PIC

16C66

LEARNVALID

TOKEN

FIELDS0

S2

S3

PROX_RF

S1

12VDC

Connect RS-232 DB9 to hereConnect 12V Power Supply

High Voltage Area Transponder Evaluation Kit Base Station


Base Station

2.3 Base Station Polling ModeThe Base Station has two polling modes: Continuous and User-activated. In continuous polling mode, the Base Station automatically switches the field on and off. In user-activated polling mode, the Base Station only polls when activated by pressing the POLL push button on the Base Station.

There are two ways to switch from continuous polling mode to user-activated polling mode. The first uses the Transponder Evaluation Kit software. The polling mode can be found on the Base Config tab of the Program dialog (Transponder > Program). Once the correct polling mode is selected, use the PROGRAM BASE button to program the Base Station.

The second method is to toggle between the two modes without connecting the Base Station to the PC. To do this, connect the Base Station to the power supply. Next, press and hold the RESET push button on the Base Station. While still holding the RESET push button, press the POLL push button, and

Table 2.1: Base Station Jumpers

Jumper Name Description

JP1 B2T This is the line between the PICmicro® 8-bit micro-controller (MCU) and the circuitry controlling the Base Station coil. The jumper should be in place unless the user wants to disable the Base Station coil.

JP2 T2B This connects the Base Station to the inductive ana-log reception circuitry (pins 1 and 2) or to the 8x2 header (pins 2 and 3).

JP3 RF_OUT This is the output of the RF receiver. This jumper should be removed to disconnect the RF receiver from the PICmicro MCU.

J2 The pins on the 8x2 header are mapped as follows:Pin 1 – GroundPin 2 – Not usedPin 3 – PWM used during programmingPin 4 – Not usedPin 5 – 12V directly from the power supplyPin 6 – Not usedPin 7 – LC0Pin 8 – Not usedPin 9 – LC1/S3Pin 10 – Not usedPin 11 – S2Pin 12 – Not usedPin 13 – S1Pin 14 – 5VPin 15 – S0Pin 16 – Not used



then release the RESET push button. Wait a second and then release the POLL push button. The Base Station will continue to poll for a second or two and then switch to the newly-selected polling mode.

2.4 Inductive CommunicationThe inductive communication between the Base Station and a transponder takes place via the resonant capacitor/coil combination and analog reception circuitry on the Base Station. The capacitor/coil are resonated at 125 kHz.

2.5 RF CommunicationRF reception on the Base Station is done using the Telecontrolli receiver module on the Base Station. The transmitter transmits at 433 MHz.

2.6 High Voltage – DangerPlease note that the Base Station capacitor/coil has a peak-to-peak voltage of over 400V and a peak current of over 1A.

2.7 Stand-Alone ModeIn stand-alone mode, the Base Station acts as a stand-alone decoder. The Base Station can learn up to four transponders in stand-alone mode.

When in stand-alone mode, the IFF activity on the Base Station can be monitored by connecting the Base Station to the PC and selecting the Monitor IFF dialog.

Stand-alone mode is the default state of the Base Station, and the Base Station returns to stand-alone mode whenever a command from the PC is completed.

The Base Station does not need to be connected to the PC when in stand-alone mode.

2.8 Base Station ProgrammingTo program the Base Station, connect the Base Station to the appropriate COM port on the PC using the RS-232 cable included in the evaluation kit.

To program the Base Station with the correct Key Generation options and encoder type in the Base Station, select Transponder > Program from the main menu. This displays the Program dialog. Set the transponder options as if a transponder is being programmed, and press the Program Base push button to transfer the information to the Base Station. See Chapter 10 for more information.

Warning: HIGH VOLTAGE AREADO NOT touch any of the areas that are labeled HIGH VOLTAGE. You will get shocked.


Base Station

2.9 Learning a TransponderThe Base Station is able to “Learn” up to four transponders. During this process, the Base Station reads the transponder’s serial number, calculates the transponder’s key, and gets the transponders synchronization counter (if used as a transmitter). This information is then saved in EEPROM.

The next time the Base Station receives a transmission or reads the serial number from a transponder, the Base Station searches through its “data base” of serial numbers. If the Base Station finds the newly acquired serial number, the code hopping portion of a transmission (or response from the transponder) is decrypted. The resulting value is then compared to the expected value (synchronization counter or challenge). If the decrypted data is valid, the output LEDs lights up for 500 ms.

To learn a transponder onto a system inductively, perform the following steps:

1. Check that the Base Station is powered up and connected to the PC.2. Program the Base Station and transponder with the appropriate setup.3. Hit the LEARN push button – the LEARN LED will light up.4. Bring the transponder into the field.5. If the transponder is successfully learned, the LEARN LED will flash on

and off about 10 times.6. The Base Station can learn up to four transponders, after which the first

transmitter learned will be overwritten.7. If the learn operation fails, the learn LED will turn off and on for a second

before returning to stand-alone mode.

It is also possible to learn a transponder onto the Base Station using RF:

1. Check that the Base Station is powered up and connected to the PC.2. Program the Base Station and transponder with the appropriate setup.3. Hit the LEARN push button – the LEARN LED will light up.4. Press one of the buttons on the transmitter – the LEARN LED will switch

off.5. Press a button on the transmitter a second time. Note that when using

secure learn, the second transmission should be a SEED transmission.6. If the transponder is successfully learned, the LEARN LED will flash on

and off about 10 times.7. If the learn operation fails, the learn LED will turn off and on for a second

before returning to normal stand-alone mode.

If the learn operation fails, check that both the transponder and Base Station have been programmed correctly.



2.10 Erasing TranspondersIt is possible to erase all the transponders learned by the Base Station.

1. Press and hold the LEARN push button. The LEARN LED will switch on.2. After about eight seconds, the LEARN LED will switch off, indicating that

all the transponders have been erased.3. Release the LEARN push button.



Chapter 3. HCS410

3.1 Selecting an HCS410The HCS410 can be selected as the transponder being evaluated in the Transponder Select dialog (Setup > Xponder Select from the main menu).

3.2 Programming an HCS410The Program dialog can be reached via Transponder > Program from the main menu. The Program dialog allows the selection of the HCS410s options to be programmed into the HCS410. After programming the HCS410 the Base Station should be programmed so that it will be able to learn the HCS410. For a more detailed description of all the features, consult the latest data sheet. The following is a description of the options available in the Program dialog.

• Anticollision/XPRF – Sets anticollision and RF transmission options in transponder mode.

• Code Word Blanking – Blanks out alternate code words enabling more power to be transmitted in each transmission (FCC).

• Counter – 16-bit counter transmitted as part of a code hopping trans-mission.

• Delayed Increment – Increments the synchronization counter by 12, 20 seconds after the last button is pressed. This can be used by the decoder to defeat the latest attack on code hopping systems.

• Discrimination Value – 12-bit value transmitted as part of a code hop-ping transmission.

• Extended Serial Number – The full 32-bit serial number is transmitted in a code hopping transmission when the extended serial number is enabled. If not enabled the S0:S1:S2 status replaces the most signifi-cant nibble of the serial number in a transmission.

• IFF Baud Rate – Selects the communication speed used in inductive communication.

• Intelligent Damping – Used in circuits with a high Q to enable faster data communication rates.

• LED Output – S2 can double as a LED output if this option is enabled.

• Low-Voltage Trip Point – Can be set to low (3V lithium battery) or high (6V battery).

• Min 3 Tx – At least three complete RF transmissions are sent each time the transponder is activated using the S0, S1 or S2 inputs.

• Overflow – Extends the range of the synchronization counter.



• RF Baud Rate – Selects the communication speed used in code hop-ping mode.

• Serial Number – 32-bit serial number.

• Transmission Format – The transmission format is selectable between PWM and Manchester Modulation

• Transport Code – 32-bit transport code.

• User EEPROM – 64-bit user EEPROM.

Figure 3.1: Wire Programming a Transmitter/Transponder

• OK push button – Accepts the settings selected but does not program the HCS410 or Base Station.

• CANCEL push button – Discards the changes made and closes the dialog.

• HELP push button – Brings up the online help.

• PRGM BASE push button – Programs the Base Station with the appro-priate manufacturer's code, key generation source and algorithm, trans-mission format, and speed so that it is able to communicate with an HCS410 programmed with the settings as given.

• WIRE PRGM push button – Programs the HCS410 with the selected data using the S2 and PWM lines. This can be done when the transmit-ter is connected to the Base Station at J2.

• INDUCT PRGM push button – Programs the HCS410 with the data selected inductively.

For more information about communication problems, see Chapter 10.

RF

Receiver

JP2

RESET POLL LEARN

93C46B

PIC

16C66

LEARNVALID

TOKEN

FIELD

S0

S2

S3

Prox_RF

S1

S1

12VDC

Connect RS-232 DB9 to hereConnect 12V Power Supply

High Voltage Area Transponder Evaluation Kit Base Station

ET

HC

S410


HCS410

3.2.1 Advanced OptionsCertain options should not be changed to ensure that the transponder can be learned by the Base Station.These are:

• The code hopping transmission modulation format defaults to PWM and can be changed on the Advanced Opts tab of the Program dialog.

• The oscillator tuning bits are set by the Base Station.

• The Key/SEED options are set on the Key Generation tab of the Pro-gram dialog.

• The synchronization counter is incremented and transmitted each time the HCS410 transmits a code hopping transmission. The synchro-nization counter is automatically set to 0000 by default.

• The discrimination values defaults to the least significant bit of the serial number.

3.2.2 Anticollision/XP RFThese two bits in the HCS410 are used to enable or disable anticollision mode, and enable or disable RF transmissions when in transponder mode.

• None – Disables both anticollision and inductively activated RF trans-missions to allow the HCS410 to work as a pure transponder in IFF mode.

• Proximity Activated – When selected, the HCS410 sends out ACK pulses when placed in a magnetic field. If the Base Station does not send a command within 50 ms, the HCS410 transmits a code hopping transmission for 2 seconds before returning to transponder mode.

• Anticollision – Places the Base Statin into anticollision mode. This allows multiple transponders to be brought into the same field.

• RF Echo – When selected, all of the HCS410 transponder responses are echoed on the PWM output.

3.2.3 Code Word BlankingWhen code word blanking is enabled, alternate code words are blanked. The FCC limits the amount of power that can be transmitted in a 100 ms window. Code word blanking is useful when trying to transmit the maximum power to a receiver.

3.2.4 Delayed IncrementWhen delayed increment is enabled, the HCS410 increases the synchronization counter by 12, 20 seconds after pressing the last push button. This can be used to foil jam and scan techniques.



3.2.5 Discrimination ValueThe HCS410 has a 10-bit discrimination value. The discrimination value forms part of the encrypted portion of a code hopping transmission. A KEELOQ decoder uses the discrimination value to validate the decrypted code.

3.2.6 Extended Serial NumberThe serial number is 32-bits long. To transmit the full 32 bits of the serial number, this option must be enabled. If this option is disabled, a copy of the function code (buttons pressed) is transmitted instead of the most significant nibble of the serial number.

3.2.7 IFF Baud RateThe HCS410 can communicate inductively at two speeds. The slow baud rate has a nominal elemental period of 200 µs and a fast baud rate of 100 µs. The demodulator circuitry has been optimized to work with the slow communication rate (200 µs) and will not work at the fast communication rate.

3.2.8 Intelligent DampingWhen intelligent damping is active, the HCS410 will briefly load the coil when the HCS410 expects a command from the Base Station. This allows LC circuits with a high Q to be used with the HCS410 and allows higher communication rates.

3.2.9 LED OutputS2 is used as a LED output when this option is enabled.

3.2.10 Low Voltage Trip PointThe HCS410 can be used with either a 3V or a 6V battery. The low-voltage trip point selects between the initial battery voltages. If the supply voltage drops below approximately 4V (6V battery) and 2V (3V battery), the HCS410 sets the VLOW bit in a code hopping transmission. This gives the Base Station the ability to warn the user if the bit is used. In addition to the VLOW bit being set, the LED output is disabled when a low-voltage condition occurs, warning the user to replace the battery.

3.2.11 Minimum 3 TransmissionsWhen a button is pressed on a transmitter, the HCS410 will normally complete a single transmission. When a minimum of three transmissions are enabled, at least three complete code words are transmitted, even if the button is released.


HCS410

3.2.12 OverflowThere are two overflow bits available in the HCS410. An overflow bit is cleared every time the 16-bit synchronization counter wraps from FFFF to 0000 (hex). This extends the counter range from 64k transmissions to 192k transmissions. The overflow bits cannot be reset unless the device is re-programmed.

3.2.13 RF Baud RateThe HCS410 can communicate at four speeds in RF mode. The baud rate bits select the nominal communication rate. These run from 00 being the slowest (TE = 400 µs) to 11 being the fastest (TE = 100 µs) communication rate. The RF receiver module on the Base Station works best at the slow communication value (400 µs) and may not work at all at the fastest transmission rate.

3.2.14 Serial NumberThe HCS410 has a 32-bit (8 hex digit) serial number that the user can select. When checked, the auto-increment option increments the serial number if the HCS410 is successfully programmed.

3.2.15 Transport CodeTo program the HCS410, change the serial number, or the configuration word inductively, the Base Station needs to send a 32-bit transport code after the appropriate op-code has been sent. After the transport code has been presented, the Base Station can send the data to be programmed into the device. If the transport code presented to the HCS410 does not match the transport code in the HCS410, the op-code is ignored.

This feature was added to prevent accidentally reprogramming the HCS410 inductively. The transport code is the 32 most significant bits of the SEED/Key2.

During wire programming, the transport code being programmed into the HCS410 is set in the Key Generation tab of the Program dialog and does not need to match the transport code currently in the HCS410. To inductively program the HCS410 or change the serial number, the enter the transport code currently in the transponder in the Transport Code tab of the Program dialog.

3.2.16 Transmission FormatThe HCS410 has two transmission formats available namely PWM and Manchester.

Note: The Base Station only receives PWM transmissions.



3.2.17 User EEPROMThe HCS410 has 64 bits of user EEPROM. A 64-bit number can be entered (16 hex digits) when programming the device.

When entering a 64-bit number, the data is mapped so that the last 8 bits are programmed into USR0 and the first 8 bits are programmed to USR3. For example: If entering a number such as 0123456789ABCDEF, the data is mapped so that CDEF is programmed into USR0 and 0123 is programmed into USR3.

3.3 Code Hopping TransmissionsThe transponder can be used as an RF transmitter. To force a KEELOQ code hopping transmission, activate any of the S inputs, S0, S1, S2 or a combination of the S inputs (Note: certain button combinations cause a SEED transmission, if enabled). A code hopping transmission has two portions – a fixed portion and a code hopping portion.

The fixed portion contains the 2 QUE bits, 2 CRC bits, a VLOW bit, 4/0 button status bits and 28/32-bit serial number. The encrypted information contains 4 button status bits, 12 discrimination bits and a 16-bit synchronization counter.

3.4 SEED TransmissionsIf SEED transmissions are enabled in the Key Generation tab of the program dialog, the transponder can be forced to transmit a SEED transmission in place of a code hopping transmission. A SEED transmission takes 60 least significant bits of the SEED from EEPROM and transmits them, followed by the 4-bit button status information, VLOW bit, 2 CRC bits, and the 2 QUE bits.

SEED transmissions are activated by pulling S0, S1, and S2 high at the same time. A delayed SEED transmission can be activated by pulling S0 and S1 high at the same time. A delayed SEED transmission transmits a normal code hopping transmission for 2 seconds and then switches over to SEED transmissions.

It is possible to erase all the transponders learned by the Base Station.

1. Press and hold the LEARN push button. The LEARN LED will switch on.2. After about 8 seconds the LEARN LED will switch off indicating that all

of the transponders have been erased.


USER’S GUIDE
Chapter 4. HCS412

4.1 Selecting an HCS412The HCS412 can be selected as the transponder being evaluated in the Transponder Select dialog (Setup > Xponder Select from the main menu).

4.2 Programming an HCS412The Program dialog can be reached via Transponder > Program in the main menu. The Program dialog allows the selections of the HCS412 options to be programmed into the HCS412. After programming the HCS412, the Base Station should be programmed so that it will be able to learn the HCS412. For a more detailed description of all the features please consult the latest data sheet. The following is a description of the options available in the Program dialog.

• Anticollision/XPRF – Sets anticollision and RF transmission options in transponder mode.

• ASK / FSK Control – An ASK and FSK control sequence has been implemented.

• Code Word Blanking – Blanks out alternate code words enabling more power to be transmitted in each transmission (FCC).

• Counter – 16-bit counter transmitted as part of a code hopping trans-mission.

• Delayed Increment – Increments the synchronization counter by 12, 20 seconds after the last button is pressed. This can be used by the decoder to defeat the latest attack on code hopping systems.

• Discrimination Value – 12-bit value transmitted as part of a code hop-ping transmission.

• Extended Serial Number – The full 32-bit serial number is transmitted in a code hopping transmission when the extended serial number is enabled. If not enabled the S0:S1:S2 status replaces the most signifi-cant nibble of the serial number in a transmission.

• IFF Baud Rate – Selects the communication speed used in inductive communication.

• Intelligent Damping – Used in circuits with a high Q to enable faster data communication rates.

• LC Demodulator – In this mode, data detected on the LCD line will be output on the DATA line.

• Low Voltage Trip Point – Can be set to low (3V lithium battery) or high (6V battery).



• Min 4 Tx – At least four complete RF transmissions are sent each time the transponder is activated using the S0, S1 or S2 inputs.

• Overflow – Extends the range of the synchronization counter.

• RF Baud Rate – Selects the communication speed used in code hop-ping mode.

• RF Enable – This option allows S2 to be to enable the RF circuitry dur-ing RF transmissions.

• S2/LC Pin – This option allows the S2 line to be used as a button input or as a transponder input.

• Serial Number – 32-bit serial number.

• Transmission Format – The transmission format is selectable between PWM and Manchester Modulation.

• Transport Code – 28-bit transport code.

• User EEPROM – 64-bit user EEPROM.

• CANCEL push button – Discards the changes made and closes the dialog.

• HELP push button – Brings up the online help.

• INDUCT PRGM push button – Programs the HCS412 with the data selected inductively.

• OK push button – Accepts the settings selected but does not program the HCS412 or Base Station.

• PRGM BASE push button – Programs the base with the appropriate manufacturer's code, key generation source and algorithm, transmis-sion format and speed so that it is able to communicate with an HCS412 programmed with the settings as given.

• WIRE PRGM push button – Programs the HCS412 with the selected data using the S2 and PWM lines. This can be done when the transmit-ter is connected to the Base Station at J2.



HCS412

4.2.1 Advanced OptionsCertain options should not be changed to ensure that the transponder can be learned by the Base Station.These are:

• The code hopping transmission modulation format defaults to PWM and can be changed on the Advanced Opts tab of the Program dialog.

• The oscillator tuning bits are set by the Base Station.

• The key/SEED options are set on the Key Generation tab of the Pro-gram dialog.

• The synchronization counter is incremented and transmitted each time the HCS412 transmits a code hopping transmission. The synchro-nization counter is automatically set to 0000 by default.

• The discrimination values defaults to the least significant bit of the serial number.

4.2.2 ASK/FSK ControlThe HCS412 has the ability to send ASK/FSK control signals on S2 when transmitting data.

4.2.3 Anticollision/XP RFThese two bits in the HCS412 are used to enable or disable anticollision mode and enable or disable RF transmissions when in Transponder mode.

• None – Disables both anticollision and inductively activated RF trans-missions to allow the HCS412 to work as a pure transponder in IFF mode.

• Proximity Activated – When selected, the HCS412 sends out ACK pulses when placed in a magnetic field. If the Base Station does not received a response within 50 ms, the HCS412 transmits a code hop-ping transmission for 2 seconds before returning to transponder mode.

• Anticollision – Places the Base Statin into anticollision mode. This allows multiple transponders to be brought into the same field.

• RF Echo – When selected, all of the HCS412 transponder responses are echoed on the PWM output.

Note: The HCS412 can only be inductively validated by the evaluationkit’s Base Station mode in RF Echo mode. This is because theinductive demodulation circuitry on the base is too slow for theHCS412.



4.2.4 Code Word BlankingWhen code word blanking is enabled, alternate code words are blanked. The FCC limits the amount of power that can be transmitted in a 100 ms window. Code word blanking is useful when trying to transmit the maximum power to a receiver.

4.2.5 Delayed IncrementWhen delayed increment is enabled, the HCS410 increases the synchronization counter by 12, 20 seconds after pressing the last push button. This can be used to foil jam and scan techniques.

4.2.6 Discrimination ValueThe HCS412 has a 10-bit discrimination value. The discrimination value forms part of the encrypted portion of a code hopping transmission. A KEELOQ decoder uses the discrimination value to validate the decrypted code.

4.2.7 Extended Serial NumberThe serial number is 32 bits long. To transmit the full 32 bits of the serial number this option must be enabled. If this option is disabled, a copy of the function code (buttons pressed) are transmitted instead of the most significant nibble of the serial number.

4.2.8 IFF Baud RateThe HCS412 can communicate inductively at two speeds. The slow baud rate has a nominal elemental period of 200 µs and a fast baud rate of 100 µs. The demodulator circuitry has been optimized to work with the slow communication rate (200 µs) and will not work at the fast communication rate.

4.2.9 Intelligent DampingWhen intelligent damping is active the, HCS412 will briefly load the coil when the HCS412 expects a command from the Base Station. This allows LC circuits with high Q to be used with the HCS412 and allows higher communication rates.

4.2.10 LC DemodulatorThe HCS412 can be used as a low cost LC demodulator. A capacitor/coil is connected across the LC0 and LC1 (LC1 is optional and is used for high sensitivity applications) pins. The HCS412 will output the field that is being received on the DATA pin.


HCS412

4.2.11 Low Voltage Trip PointThe HCS412 can be used with either a 3V or a 6V battery. The low-voltage trip point selects between the initial battery voltages. If the supply voltage drops below approximately 4V (6V battery) and 2V (3V battery), the HCS412 sets the VLOW bit in a code hopping transmission. This gives the Base Station the ability to warn the user if the bit is used. In addition to the VLOW bit being set, the LED output is disabled after a single flash when a low-voltage condition occurs, warning the user to replace the battery.

4.2.12 Minimum 4 TransmissionsWhen a button is pressed on a transmitter the HCS412 will normally complete a single transmission. When minimum of four transmissions are enabled, at least four complete code words are transmitted, even if the button pressed is released.

4.2.13 OverflowThere are two overflow bits available in the HCS412. An overflow bit is cleared every time the 16-bit synchronization counter wraps from FFFF to 0000 (hex). This extends the counter range from 64k transmissions to 192k transmissions. The overflow bits cannot be reset unless the device is re-programmed.

4.2.14 RF Baud RateThe HCS412 can communicate at four speeds in RF mode. The baud rate bits select the nominal communication rate. These run from 00 being the slowest (TE = 400 µs) to 11 being the fastest (TE = 100 µs) communication rate. The RF receiver module on the Base Station works best at the slow communication value (400 µs) and may not work at all at the fastest transmission rate.

4.2.15 RF EnableWhen this bit is enabled, the S2/LC1 pin of the HCS412 doubles as the RF enable control line for an ASK or FSK transmitter.

4.2.16 S2/LC PinPin 3 on the HCS412 can be configured as a button input or as a transponder input. When in transponder input mode, the resonant capacitor/coil is connected across LC0 and LC1. This is the transponder's high sensitivity mode.



4.2.17 Serial NumberThe HCS412 has a 32-bit (8 hex digit) serial number that the user can select. When checked, the auto-increment option increments the serial number if the HCS412 is successfully programmed.

4.2.18 Transport CodeTo program the HCS412, change the serial number, or the configuration word inductively, the Base Station needs to send a 28-bit transport code after the appropriate op-code has been sent. After the transport code has been presented, the Base Station can send the data to be programmed into the device. If the transport code presented to the HCS412 does not match the transport code in the HCS412, the op-code will be ignored.

This feature was added to prevent accidentally reprogramming the HCS412 inductively. The transport code is the 28 most significant bits of the SEED/Key2.

During wire programming, the transport code being programmed into the HCS412 is set in the Key Generation tab of the Program dialog and does not need to match the transport code currently in the HCS412. To inductively program the HCS412 or change the serial number, the enter the transport code currently in the transponder in the Transport Code tab of the Program dialog.

4.2.19 Transmission FormatThe HCS412 has two transmission formats available namely PWM and Manchester.

4.2.20 User EEPROMThe HCS412 has 64 bits of user EEPROM. A 64-bit number can be entered (16 hex digits) when programming the device.

When entering a 64-bit number, the data is mapped so that the last 8 bits are programmed into USR0 and the first 8 bits are programmed to USR3. For example: If entering a number such as 0123456789ABCDEF, the data is mapped so that CDEF is programmed into USR0 and 0123 is programmed into USR3.

Note: The Base Station only receives PWM transmissions.


HCS412

4.3 Code Hopping TransmissionsThe transponder can be used as an RF transmitter. To force a KEELOQ code hopping transmission, activate any of the S inputs, S0, S1, S2 or a combination of the S inputs (Note: certain button combinations cause a SEED transmission, if enabled). A code hopping transmission has two portions – a fixed portion and a code hopping portion.

The fixed portion contains the 2 QUE bits, 2 CRC bits, a VLOW bit, 4/0 button status bits and 28/32-bit serial number. The encrypted information contains 4 button status bits, 12 discrimination bits and a 16-bit synchronization counter.

4.4 SEED TransmissionsIf SEED transmissions are enabled in the Key Generation tab of the Program dialog, the user can force the Transponder to transmit a SEED transmission in place of a code hopping transmission. A SEED transmission takes 60 least significant bits of the SEED from EEPROM and transmits the, followed by the 4-bit button status information, VLOW bit, 2 CRC bits, and the 2 QUE bits.

SEED transmissions are activated by pulling S0, S1, and S2 high at the same time. A delayed SEED transmission can be activated by pulling S0 and S1 high at the same time. A delayed SEED transmission transmits a normal code hopping transmission for 2 seconds and then switches over to SEED transmissions.

It is possible to erase all the transponders learned by the Base Station.

1. Press and hold the LEARN push button. The LEARN LED will switch on.2. After about 8 seconds the LEARN LED will switch off indicating that all

the transponders have been erased.



NOTES:



Chapter 5. Other Dialog Boxes

5.1 User EEPROM DialogThe 64-bit user EEPROM and 32-bit serial number on the HCS410 or HCS412 can be read and modified in IFF mode. The User EEPROM dialog allows you to read or write to the user EEPROM on the HCS410 and HCS412. The User EEPROM dialog can be opened through the Transponder > EEPROM in the main menu.

To read the user EEPROM press the READ push button. If there is a transponder in the field, this will read all of the user information.

The user EEPROM can be modified as needed and written by pressing the WRITE push button. To write to the transponder’s serial number, the Base Station needs to have the transport code that was originally programmed into the transponder.

The transport code should be entered to allow the serial number to be changed. If the transport code entered does not match the transport code in the transponder, the serial number will not be modified.

The command status line lets shows whether the read/write passed or failed. For more information about communication problems, see Chapter 10.

5.2 IFF DialogThe IFF dialog can be opened by selecting Transponder > IFF from the main menu. This option enables a manual operation of a challenge/response with a transponder in the field. To do this, select the key and algorithm to be used for the IFF and enter a 32-bit challenge.

It is important to note that unless the 2-Key IFF mode is selected in the Key Generation tab at the Program dialog, the Key2 for an IFF will be disabled.

After selecting an algorithm, selecting a key and entering the 32-bit challenge the hit the IFF push button. The Base Station will attempt to do an IFF with a transponder in the field. The IFF results text box gives information about the result of the IFF.

The HCS412 has an “IFF Hop” command. When the HCS412 receives this command from the Base Station, the HCS412 will build the 32-bit code hopping portion of a transmission. For example: The counter will be incremented and encrypted along with the discrimination value and function code.


Note: To use Key2 successfully, both manufacturers codes should be thesame in the Key Generation tab of the Program dialog.



5.3 Monitor IFF DialogWhen the Base Station is in stand-alone mode, the Base Station will dump the serial number, challenge sent, the HCS410s or HCS412s response, and the decrypted response to the serial port, even if the encoder is not learned.

RF transmissions received by the Base Station in stand-alone mode are also dumped to the serial port and can be seen in the Monitor IFF dialog.

This can be monitored by the user in the Monitor IFF dialog (Transponder > Monitor IFF).


USER’S GUIDE
Chapter 6. Configuration File

6.1 Configuration File OverviewThe evaluation kit uses a configuration file to save the user-selectable settings. The configuration file that was last used is loaded each time the program is started.

6.2 New SetupTo load the default setup, select File > New from the main menu.

6.3 Load SetupTo load a previously saved configuration file, select File > Load Setup from the main menu.

6.4 Save SetupTo save the current configuration, select File > Save Setup from the main menu.

6.5 Save Setup AsTo save the current configuration file under a different name and directory, select File > Save Setup from the main menu.



NOTES:


USER’S GUIDE
Chapter 7. Key Generation

7.1 Key Generation OverviewKey generation is used to generate keys for KEELOQ encoders. The encoder uses its key to generate responses to IFF challenges and to encrypt the code hopping portion of a transmission when used as a transmitter. The HCS410 and HCS412 both have two keys available. The first of the keys is used to encrypt the code hopping portion of the key and to do any of the IFF functions when an IFF is performed using Key1.

Key2 can be used either as a second IFF key or as a SEED in a SEED transmission. The keys are generated when the encoder is programmed. Key generation in KEELOQ systems has three parts: the key generation source, the key generation algorithm, and the manufacturer’s code.

The key generation source is either the encoder’s serial number or the encoder’s SEED. Normal key generation uses the encoder’s serial number as the source. Secure learn uses the encoder’s SEED as a source.

The manufacturer’s code is a 64-bit value used to create a unique relationship between the key generation source and the encoder key.

The key generation method used when programming the Base Station or a transponder is selected on the Key Generation tab in the Program dialog (Transponder > Program). Note that in order to use secure learn, the second key is used as a SEED,. Only one key is available for IFF functions. This also implies that if two keys are used for IFF, key generation must be either simple or normal key generation because enabling 2-key mode in the encoder disables SEED transmissions.

7.2 Manufacturer’s CodeThe 64-bit manufacturer’s code is used in key generation for one or both of the encoder’s keys. The manufacturer’s code creates a unique relationship between key generation source and the encoder key. If two manufacturers use the same source (e.g., serial number 1111) and algorithm (i.e., decryption), the key generation process will produce two completely different encoder keys for the two manufacturer's because of the different manufacturer’s code.

Encoders for the two different manufacturers are not interchangeable. This prevents cloning of transmitters. If two manufacturers decide to work together, they will have to share a manufacturer's code. The manufacturer's code is central to system security and should be kept as a closely guarded secret.

The manufacturer's code is entered in the Key Generation tab in the Program dialog (Transponder > Program).



7.3 Key Generation AlgorithmThere are two key generation algorithms currently supported by Microchip. The first of these is the decryption algorithm. The second is the XOR algorithm. Both algorithms use the manufacturer’s code to create a unique link between the key generation source and the encoder key. The Transponder Evaluation Kit only supports the Decryption algorithm.

7.4 Key Generation SourceThe source used in key generation is either the serial number of the encoder or the SEED of the encoder. Using the SEED (secure learn) as the source, requires a SEED transmission during the learn process.

7.5 SEED/IFF2The HCS410 and HCS412 encoders have a 64-bit space that can be used as either a SEED during a SEED transmission or as a second IFF key. The selection can be made in the Key Generation tab in the Program dialog (Transponder > Program).

This space is also used as the transport code which is used to protect the encoder from accidently being programmed in IFF mode. The Seed/Key2 is used as the transport code regardless of the setting of SEED/IFF2.

No SEED – 1 Key – This option disables the use of the area, completely disabling both SEED transmissions and the areas used as a second key.

Limited SEED – The SEED transmissions will be disabled when the synchronization counter goes over 256 when limited SEED transmissions are enabled. Only one key is available for IFF authentication.

SEED – SEED transmissions are always enabled in this mode. Only one key is available for IFF authentication.

2 Key IFF – SEED transmissions are disabled and the transponder has two keys for IFF authentication available.

7.6 Simple LearnSimple learn uses a single key for all the encoders in a system. This key is the manufacturer's code. This method of key generation is less secure than either normal learn or secure learn because once the encryption key for one encoder in the system is known, the encryption key for all encoders in the system is known. Simple learn is useful in applications where convenience is a high priority and security is nominal.


Key Generation

7.7 Normal LearnNormal learn uses the serial number of the encoder during key generation to generate the key. When learning the encoder onto a receiver/Base Station, the receiver needs to either read the serial number (IFF mode) or receive a valid transmission (RF mode). Thereafter, a key can be generated using the decryption algorithm and the manufacturer’s code.

7.8 Secure LearnSecure learn uses a SEED transmission from an encoder to generate the encoder key. Only a single IFF key is used when Implementing key generation via secure learn. The location of the second IFF key is used to store the SEED.

Generating the encoder key can be accomplished between the decryption algorithm or the XOR algorithm.

Note: The Base Station only supports the decryption algorithm.



NOTES:


USER’S GUIDE
Chapter 8. Communication

8.1 Serial Port SelectionThe PC can be connected to the Base Station via serial ports COM1 through COM4. Serial port selection is established in the Select Serial Port dialog. Once the connection is established, test the communication between the Base Station and the PC by pressing the TEST COMS push button.

If the connection is working, click OK to accept the selection. Press Cancel to discard the changes and leave the dialog.




NOTES:


USER’S GUIDE
Chapter 9. Demonstrations

9.1 OverviewThe demonstrations are listed in the main menu. The demonstrations consist of five steps. The first step in the demonstration gives a brief introduction. If the setup (Low-Voltage Trip, IFF Baud Rate, etc.) that is being used has changed between the time the program was started and the demo is started, the software displays a prompt to save the setup before continuing.

The setup is changed during the demo in order to provide the opportunity to see what the settings used during the demo are by going to the Program dialog (Transponder > Program).

There are five control buttons in the Demonstration dialogs as described below:

The PREVIOUS button goes back one step during the demo. This allows for checking or repeating a previous step.

The SKIP button moves to the next step with out completing the programming necessary to successfully complete the current step. This can be used to step through the demo, without having the Base Station connected to a PC.

The NEXT button moves to the next step, performing the actions the step requires, typically programming of the Base Station or the transponder.

The CANCEL button aborts the demonstration.

The HELP button brings up the online help.

After the demonstration has been completed, the configuration will be changed. The transponder setup can be seen in the Program dialog. Additional transponders can be programmed at this point.

9.1.1 HCS410 Batteryless DemoThe HCS410 batteryless demonstration sets the Base Station up to work with the small, batteryless HCS410 transponder that is supplied with the evaluation kit. The small transponder is not programmed.

After the demonstration the user will be able to learn and validate the batteryless transponder. After the transponder has been learned the VALID_TOKEN LED will light up on the Base Station each time the transponder is brought into the field. The transponder is programmed with anti-collision off, but there is no reason why anti-collision cannot be used.

The battery powered transmitter / transponder can also be used during this demonstration – if the user chooses not to use the battery powered transmitter / transponder the user should skip over the programming stage.



9.1.2 HCS410 Proximity Activation DemoThe HCS410 proximity activation demonstration will set the Base Station and program the HCS410 transmitter / transponder to work in proximity activated mode. When used as a transmitter the HCS410 will send out a transmission when a button (S0, S1 or S2 is pressed).

When the HCS410 is programmed with proximity activation enabled the HCS410 will send out a single code hopping word when the HCS410 is brought into a magnetic field and no command is received within 50ms of the first acknowledge pulse being sent out by the HCS412.

After the HCS410 is learned onto the Base Station the proximity activation can be seen working whenever the PROX_RF LED illuminates. To force a proximity activated transmission remove JP2. This will prevent the Base Station from receiving data from the HCS410 transmitter / transponder inductively. The Base Station doesn’t receive the HCS410’s acknowledge pulses and the transponder is not detected. As a result the Base Station doesn’t send out a command, causing the HCS410 to send a proximity activated transmission.

9.1.3 HCS410 RF Echo DemoThe HCS410 RF echo demonstration sets the Base Station and HCS410 transmitter/transponder to work with RF echo mode enabled. When in RF Echo mode the HCS410 sends the response to any inductive command received out twice, first on the inductive lines and then on the RF output.

RF Echo mode is used when no inductive receiver is present or when the inductive receiver is out of range. This can be checked by removing either JP2 (disable the inductive path back to the microcontroller) or removing JP3 (disables the RF path back to the microcontroller).

When in RF Echo mode, anticollision mode is also active.

9.1.4 HCS412 Proximity Activation DemoThe HCS412 proximity activation demonstration sets the Base Station and programs the HCS412 Transmitter/Transponder to work in proximity activated mode. When used as a transmitter the HCS412 sends out a transmission when a button (S0, S1 or S2) is pressed.

When the HCS412 is programmed with proximity activation enabled, the HCS412 sends out a single code hopping word when the HCS412 is brought into a magnetic field and no command is received within 50 ms of the first acknowledge pulse being sent out by the HCS412.

After the HCS412 is learned onto the Base Station the proximity activation can be seen working whenever the PROX_RF LED illuminates. To force a proximity activated transmission, remove JP2. This will prevent the Base Station from receiving data from the HCS412 Transmitter/Transponder inductively. The Base Station doesn’t receive the HCS412s acknowledge


Demonstrations

pulses and the transponder is not detected. As a result, the Base Station doesn’t send out a command. This causes the HCS412 to send a proximity activated transmission.

9.1.5 HCS412 Passive Entry DemoThe HCS412 passive entry demonstration sets the Base Station and HCS412 transmitter/transponder to work in passive entry mode. When in passive entry mode, the HCS412 sends the response to any inductive command received out twice, first on the RF output and then on the LC output.

Passive entry mode can be used when no inductive receiver is present or when the inductive receiver is out of range. This can be checked by removing either JP2 (disable the inductive path back to the microcontroller) or removing JP3 (disables the RF path back to the microcontroller).

When in passive entry mode, anticollision mode is also active.

Note: The Base Station cannot inductively validate the HCS412 transponder in proximity activated mode.



NOTES:


USER’S GUIDE
Chapter 10. Fault Finding

10.1 Fault FindingIf, after giving a PC command (program, IFF, Read, Write, etc.) the command fails, check the following:

1. Check that the Base Station is powered up.2. Check that the serial cable is securely connected to the Base Station and

PC.3. Check that the correct serial port has been selected.4. Check that the Base Station has been programmed with the current

setup (communication speed and protocol).5. Check that the transponder is in the field.6. Check that the jumpers at JP1, JP2 (across pins 1 & 2), and JP3 are

inserted.

If, after programming a transponder, and the transponder fails to learn the transponder:

1. Check the settings above.2. Check that the Base Station has been programmed. Press the PRGM

BASE button in the Transponder > Program dialog after programmingthe transponder.

3. Check that the transponder was programmed correctly.4. Check that the IFF baud rate is set to the slowest setting.

Failed to program a long range transmitter/transponder when plugged into the board:

1. Check that jumper at JP2 is placed across pins 2 and 3.

Fails to receive RF transmissions:

1. Check that PWM transmission format is selected.2. Check that JP3 is inserted.3. Check that the transmitter is programmed with an RF transmission rate

of 400 µs or 200 µs.

Fails to validate a transponder inductively.

1. Check that the IFF baud rate is set to 200 µs.2. If using an HCS412, check that RF Echo mode is selected in the Options

> Anticollision/XPRF dialog. The Base Station’s reception circuitry is tooslow to validate an HCS412 inductively and relies on RF talk back for val-idation.



NOTES:


USER’S GUIDE
Appendix A. Schematic Diagrams

Figure A.1: Transponder Base Station (BASE_V3.0)

L1 CO

IL 5

00V

WB

1528

coild

rv

12V

DAT

A_B

2T

LC-C

OIL

LC-C

AP

OS

C

VC

CG

EN

_5V

12V

DG

_5V

AN

_5V

D1

1N58

20C

AS

E 2

67-0

3

dem

od

AN

_5V

BS

_RF

DAT

A_T

2B

PIC

16C

63

OS

C

DAT

A_B

2T

DAT

A_T

2B

12V

C3

10nF

500

V22

25

+ 4

+ 2

+3

+1

+ 5

J1 MD

C-0

3412

VV

OLT

AG

EH

IGH



Figure A.2: Transponder Base Station (GEN_5V)12

V

R1

22R

C4

1u 1

6VE

IA S

ize

A

VIN

3V

OU

T 1

G N D 2

U2

NJM

78L0

5UA

SO

T-89

C5

100n

16V

C41

68u

EIA

Siz

e D

R71

1k

DG

_5V

D14

PO

WE

RG

reen

LE

D

R2

22R

VIN

3V

OU

T 1

G N D 2

U1

NJM

78L0

5UA

SO

T-89

AN

_5V

C40

68u

EIA

Siz

e D

C7

100n

16V

JMP

1

JUM

PE

R

C6

1u 1

6VE

IA S

ize

A

JMP

1 IS

A "

VIR

TU

AL"

JU

MP

ER

US

ED

TO

SE

PAR

ATE

AN

ALO

G A

ND

DIG

ITA

L G

RO

UN

D N

ET

LIS

TS

ON

LY A

ND

IS T

O B

E S

HO

RT

ED

OU

T.

12

3

1

SO

T-89


Schematic Diagrams

Figure A.3: Transponder Base Station (demod)

R41

270R

AN

_5V

R23

100R

D6

UF

1007

BS

_RF

2.5V R

2747

0kD

4LL

4148

D5

LL41

48

R28

1k

3 2 1

4 1

U7A

LM60

36M

SO

IC-1

4

R20

10k

R19

22k

5 6 7

4 1 1

U7B

LM60

36M

SO

IC-1

4

R33

10k

10

9 8

4 1 1

U7C

LM60

36M

SO

IC-1

4

R32

680R

R36

47k

R37

47k

C24

18p

12

13

14

4 1 1

U7D

LM60

36M

SO

IC-1

4

R39

15k

C25

100p

R38

1k8

C22

1n

R35

270R

R31

6k8

C23

100n

16V

R18

220k

C18

1n

C43 10

n

R22

10k

C19

100n

16V

R29

1k

D7

LM38

5-2.

5TO

-92

R24

100R

C21

1n5

500V

R25

1M R26

1M

C42

10n

R58

N/C

R54 68

k

R50

N/C

5 6 7

84U

8B

LM35

8MS

OIC

-8

R49

1k

R52

1k

HIG

HV

OLT

AG

EC

2010

n 50

0V

3 2 1

84U

8A

LM35

8MS

OIC

-8

C28

1nC27

2n7

R55

68k

R48 1k

R47

4k7

R42

100k

D9

LL41

48

DAT

A_T

2BR

45

1k

R44

1k Q8

2N70

02A

SO

T-23

C29

100n

16V

C30

100n

16V

1+ -

+ -+ -

+ -

+-+-

Env

elop

e D

etec

tor

Buf

fer

Ban

d P

ass

Filt

erB

and

Pas

s F

ilter

Low

Pas

s F

ilter

Sch

mid

t Tri

gger



Figure A.4: Transponder Base Station (PIC16C66)

C38

100n

16VV

CC

VC

C1 2 3 4 5 6 7 8 9 10 11 12 13 14 15J3 R

F-M

OD

ULE

VC

C

1J9 AN

TE

NN

A-L

EA

D

Pro

vide

Str

ain

Rel

ief

VC

C VC

CC

3910

0n 1

6VR

6610

kR

6710

kVC

C

SW

1LE

AR

N P

B

RA

0 2

RA

1 3

RA

2 4

RA

3 5

RA

4/T

0CK

I 6

RA

5/S

S 7

RC

0/T

1OS

O/T

1CK

I 1

1R

C1/

T1O

SI/C

CP

2 1

2R

C2/

CC

P1

13

RC

3/S

CK

/SC

L 1

4

OS

C1/

CLK

IN 9

OS

C2/

CLK

OU

T 1

0

VS

S 8

VS

S 1

9

VD

D20

MC

LR/V

PP 1

RB

0/IN

T21

RB

122

RB

223

RB

324

RB

425

RB

526

RB

627

RB

728

RC

7/R

X/D

T18R

C6/

TX

/CK17

RC

5/S

DO16

RC

4/S

DI/S

DA15

U12

PIC

16C

6628

LE

AD

SK

INN

Y D

IP

S0

S1

S3

S2

R70

10k

SW

2

RE

SE

T P

BC

S 1

CLK

2D

I 3

NC

6N

C 7

DO

4

V C C8 V S S 5

U11

93C

46B

8 LE

AD

DIP

R69

10k

1J6 TP

JP3

RF

OU

T

R80

1kR

FIN

PW

MR

59 1kR

61 1kR

60 1kR

62 1k

D10

S0

D12

S1

D11

S2

D13

S3

SW

3P

OL

PB

C31

27pY

1

4 M

Hz

C32

27p

1J4 TP

R82

10k

C35

1u 1

6V

C36

1u 1

6V

VC

C

JP1

B2T

OS

CD

ATA

_B2T

5 9 4 8 3 7 2 6 1

P1

DB

9 F

EM

ALE

V+

2

DIN

1 1

1D

IN2

10

RO

UT

1 1

2R

OU

T2

9

C1+

1

C1-

3V

- 6

DO

UT

114

DO

UT

2 7

RIN

113

RIN

2 8

C2+

4

C2-

5

V C C1 6 G N D 1 5

U10

DS

14C

232T

MS

OIC

-16

TX

1

1J7 TP

JP2

T2B

1J5 TP

DAT

A_T

2B

R79

1k

1J8 TP

C34

1u 1

6V

RX

1

C37

1u 1

6V

R78

1k D17

PR

OX

_RFC

331u

16V

R77

1k D15

VA

LID

TO

KE

ND

16LE

AR

N

R81

1k

D18

FIE

LD

R83

1kV

CC

1 3 5 7 9 11 13 15

2 4 6 8 10 12 14 16

J2 CO

N16

A

12V

S3

S2

S1

S0

PW

M12

VLC

0

1

1

1


Schematic Diagrams

Figure A.5: Transponder Base Station (coildrv)

Q6

MM

BT

3904

SO

T-32

3C

1610

0n 1

6VR

1368

0RC

1733

00u

25V

R17

0.47

R 1

Wat

t12

V

R14

150R

Q1

MT

P23

P06

VT

O-2

20A

BR

16

1R 1

WAT

TLC

-CO

IL

HIG

HV

OLT

AG

E

R76

N/C

LC-C

AP

Q2

MT

P50

N06

VTO

-220

AB

Q7

MM

BT

3906

SO

T-32

3

Q5

2N70

02A

SO

T-23

R75

N/C

EN

HA

NC

ED

FR

EQ

UE

NC

Y C

IRC

UIT

R11

10k

VC

C 9 1

0 8

U4C

MC

74H

C00

AD

SO

IC-1

4

12

13

11U

4D

MC

74H

C00

AD

SO

IC-1

4

VC

CR

1568

0RD

3M

UR

860

TO-2

20A

C

Q4

MT

W14

N50

ETO

-247

AE

Q3

2N70

02A

SO

T-23

D 1

2

CLK

11

Q 9

Q 8

P R

1 0

C L 1 3

U5B

MC

74H

C74

AD

SO

IC-1

4R84

100R

D 2

CLK

3Q

5

Q 6

P R

4

C L 1

U5A

MC

74H

C74

AD

SO

IC-1

4

4 5 6

U4B

MC

74H

C00

AD

SO

IC-1

4

LOG

IC H

IGH

= F

IELD

LOG

IC L

OW

= N

O F

IELD

DAT

A_B

2T

VC

C

EN

HA

NC

ED

FR

EQ

UE

NC

Y C

IRC

UIT

INS

IDE

TH

IS B

OX

RE

SIS

TOR

S R

74, R

75 A

ND

R76

SO

LDE

R IN

0 O

HM

RE

SIS

TOR

S IF

NO

T U

S

C15

100n

16V

C13

100n

16V

C14

100n

16V

VC

CR

73

N/C

R72

0R6

MH

z16

MH

zP

I 1

1R

ST

12

Q4

7Q

5 5

Q6

4Q

7 6

Q8

14Q

913

Q10

15Q

12 1

Q13

2Q

14 3

PO

9P

O10

U6

74H

C40

60S

OIC

-16

1 2 3

U4A

MC

74H

C00

AD

SO

IC-1

4

R12

10k

R74

N/C

OS

C

SO

LDE

R O

NLY

ON

E: R

72 O

R R

73



Figure A.6: HCS410 DIP Socket Long Range RF Transponder

1 3 5 7 9 11 13 15

2 4 6 8 10 12 14 16C

ON

16A

BT

16V

C4

100n

F08

05

VC

C

R6

10R

0805

PW

M

D2

LL41

48M

iniM

ELF

VC

C

SW

1

S0

SW

2

S1

S0

1

S1

2S

2/LE

D 3

LC1

4

VD

D 8

LC0

7

PW

M 6

VS

S 5

U2

HC

S41

0D

IP-8

LC0

PW

MJP

1

JUM

PE

R

R2

47k

0805

Q1

BF

R92

AS

OT

23

C2

2.2p

F08

05

L1 20m

m P

CB

TR

AC

E

C1

470p

F08

05

R1

47R

0805

VC

C

R3

220R

0805

C3

12pF

0805

2

3

1

4U1

SA

W42

527

L2 TR

AN

SP

ON

DE

R C

OIL

1206

C6

N/C

1206

C5

1.5n

F12

06

R7

220k

0805

R4

220R

0805

R5

220R

0805

C7

2.2u

F08

05

SW

3

S2

D1

HS

MH

-TX

0035

28

1

NC

NC

T

T

J1


Schematic Diagrams

Figure A.7: HCS412 Credit Card Transmitter/Transponder

270

Vcc

12

34

Vcc



Figure A.8: HCS410 SOIC Short Range Transponder

12

34

J1 CO

N4

Sur

face

mou

nt p

ads

with

.1"

spac

ing C3

2.2u

F08

05

S0

1

S1

2

S2/

LED

3

LC1

4

VD

D 8

LC0

7

PW

M 6

VS

S 5

U1

HC

S41

0S

OIC

-8

R1

N/C

0805

C1

1.5n

F12

06

C2

N/C

1206

L1 TR

AN

SP

ON

DE

R C

OIL

* S

EE

NO

TE

BE

LOW

* N

OT

E

B)

CO

ILC

RA

FT

SU

RFA

CE

MO

UN

T 1

812L

S-1

05 X

KB

C IN

DU

CT

OR

C)

DA

LE IM

-4 A

XIA

L LE

AD

IND

UC

TOR

TR

AN

SP

ON

DE

R C

OIL

FO

OT

PR

INT

S F

OR

A)

CU

STO

M F

AIR

RIT

E /

EM

2 F

ER

RIT

E C

OR

E IN

DU

CT

OR




Aalgorithm ................................................... 12, 18Anti Collision ............................................. 11, 17

Bbattery .............................................................. 1

CCode Word Blanking ................................ 11, 17

DDamping ................................................... 11, 17Delayed Increment ................................... 11, 17

Eerase .................................................. 10, 16, 23extended serial number ............................ 11, 17

HHigh Voltage ................................................. 5, 8

IIFF .................................................. 1, 13, 19, 29IFF2 ................................................................ 30

Kkey generation .......................................... 29, 30

LLEARN ............................................... 10, 16, 23learn ............................................................. 1, 9Low Voltage Trip Point ................. 11, 14, 17, 21

Mmanufacturer’s code ........................... 12, 18, 29Monitor ............................................................. 8

NNormal learn ................................................... 31

Ooutputs .............................................................. 5Overflow ................................................... 11, 18

PPC ................................................................ 2, 8poll .................................................................... 5power ................................................................ 1PWM ................................................................. 5

RRESET .............................................................. 5RF ......................................................... 1, 11, 18RF Baud Rate ........................................... 12, 18

SS0 ..................................................... 5, 6, 11, 18S1 ......................................................... 5, 11, 18S2 ......................................................... 5, 11, 18Secure learn ................................................... 31SEED ........................................................ 29, 30serial number ........................................ 6, 12, 18serial port .......................................................... 1Simple learn .................................................... 30Software Installation ......................................... 1source ............................................................. 29stand alone ................................................... 1, 8

Ttransmission ........................................ 5, 6, 9, 30transmitter ................................................. 5, 6, 9Transport Code ......................................... 12, 18

Uuser EEPROM .......................................... 12, 18

VVALID TOKEN .............................................. 5, 6

Index

Information contained in this publication regarding device applications and the like is intended through suggestion only and may be superseded by updates.It is your responsibility to ensure that your application meets with your specifications. No representation or warranty is given and no liability is assumed byMicrochip Technology Incorporated with respect to the accuracy or use of such information, or infringement of patents or other intellectual property rightsarising from such use or otherwise. Use of Microchip’s products as critical components in life support systems is not authorized except with express writtenapproval by Microchip. No licenses are conveyed, implicitly or otherwise, except as maybe explicitly expressed herein, under any intellectual propertyrights. The Microchip logo and name are registered trademarks of Microchip Technology Inc. in the U.S.A. and other countries. All rights reserved. All othertrademarks mentioned herein are the property of their respective companies.


All rights reserved. © 2000 Microchip Technology Incorporated. Printed in the USA. 3/00 Printed on recycled paper.

AMERICASCorporate OfficeMicrochip Technology Inc.2355 West Chandler Blvd.Chandler, AZ 85224-6199Tel: 480-786-7200 Fax: 480-786-7277Technical Support: 480-786-7627Web Address: http://www.microchip.com

AtlantaMicrochip Technology Inc.500 Sugar Mill Road, Suite 200BAtlanta, GA 30350Tel: 770-640-0034 Fax: 770-640-0307BostonMicrochip Technology Inc.5 Mount Royal AvenueMarlborough, MA 01752Tel: 508-480-9990 Fax: 508-480-8575ChicagoMicrochip Technology Inc.333 Pierce Road, Suite 180Itasca, IL 60143Tel: 630-285-0071 Fax: 630-285-0075DallasMicrochip Technology Inc.4570 Westgrove Drive, Suite 160Addison, TX 75248Tel: 972-818-7423 Fax: 972-818-2924DaytonMicrochip Technology Inc.Two Prestige Place, Suite 150Miamisburg, OH 45342Tel: 937-291-1654 Fax: 937-291-9175DetroitMicrochip Technology Inc.Tri-Atria Office Building 32255 Northwestern Highway, Suite 190Farmington Hills, MI 48334Tel: 248-538-2250 Fax: 248-538-2260Los AngelesMicrochip Technology Inc.18201 Von Karman, Suite 1090Irvine, CA 92612Tel: 949-263-1888 Fax: 949-263-1338New YorkMicrochip Technology Inc.150 Motor Parkway, Suite 202Hauppauge, NY 11788Tel: 631-273-5305 Fax: 631-273-5335San JoseMicrochip Technology Inc.2107 North First Street, Suite 590San Jose, CA 95131Tel: 408-436-7950 Fax: 408-436-7955

AMERICAS (continued)TorontoMicrochip Technology Inc.5925 Airport Road, Suite 200Mississauga, Ontario L4V 1W1, Canada Tel: 905-405-6279 Fax: 905-405-6253

ASIA/PACIFICChina - BeijingMicrochip Technology, Beijing Unit 915, 6 Chaoyangmen Bei Dajie Dong Erhuan Road, Dongcheng District New China Hong Kong Manhattan BuildingBeijing, 100027, P.R.C. Tel: 86-10-85282100 Fax: 86-10-85282104China - ShanghaiMicrochip Technology Unit B701, Far East International Plaza,No. 317, Xianxia RoadShanghai, 200051, P.R.C.Tel: 86-21-6275-5700 Fax: 86-21-6275-5060Hong KongMicrochip Asia PacificUnit 2101, Tower 2Metroplaza223 Hing Fong RoadKwai Fong, N.T., Hong KongTel: 852-2-401-1200 Fax: 852-2-401-3431IndiaMicrochip Technology Inc.India Liaison OfficeNo. 6, Legacy, Convent RoadBangalore, 560 025, IndiaTel: 91-80-229-0061 Fax: 91-80-229-0062JapanMicrochip Technology Intl. Inc.Benex S-1 6F3-18-20, ShinyokohamaKohoku-Ku, Yokohama-shiKanagawa, 222-0033, JapanTel: 81-45-471- 6166 Fax: 81-45-471-6122KoreaMicrochip Technology Korea168-1, Youngbo Bldg. 3 FloorSamsung-Dong, Kangnam-KuSeoul, KoreaTel: 82-2-554-7200 Fax: 82-2-558-5934

ASIA/PACIFIC (continued)SingaporeMicrochip Technology Singapore Pte Ltd.200 Middle Road#07-02 Prime CentreSingapore, 188980Tel: 65-334-8870 Fax: 65-334-8850TaiwanMicrochip Technology Taiwan10F-1C 207Tung Hua North RoadTaipei, TaiwanTel: 886-2-2717-7175 Fax: 886-2-2545-0139

EUROPEDenmarkMicrochip Technology Denmark ApSRegus Business CentreLautrup hoj 1-3Ballerup DK-2750 DenmarkTel: 45 4420 9895 Fax: 45 4420 9910FranceArizona Microchip Technology SARLParc d’Activite du Moulin de Massy43 Rue du Saule TrapuBatiment A - ler Etage91300 Massy, FranceTel: 33-1-69-53-63-20 Fax: 33-1-69-30-90-79GermanyArizona Microchip Technology GmbHGustav-Heinemann-Ring 125D-81739 München, GermanyTel: 49-89-627-144 0 Fax: 49-89-627-144-44ItalyArizona Microchip Technology SRLCentro Direzionale Colleoni Palazzo Taurus 1 V. Le Colleoni 120041 Agrate BrianzaMilan, Italy Tel: 39-039-65791-1 Fax: 39-039-6899883United KingdomArizona Microchip Technology Ltd.505 Eskdale RoadWinnersh TriangleWokingham Berkshire, England RG41 5TUTel: 44 118 921 5858 Fax: 44-118 921-5835

03/23/00

WORLDWIDE SALES AND SERVICE

Microchip received QS-9000 quality system certification for its worldwide headquarters, design and wafer fabrication facilities in Chandler and Tempe, Arizona in July 1999. The Company’s quality system processes and procedures are QS-9000 compliant for its PICmicro® 8-bit MCUs, KEELOQ® code hopping devices, Serial EEPROMs and microperipheral products. In addition, Microchip’s quality system for the design and manufacture of development systems is ISO 9001 certified.

Transponder Evaluation Kit User's Guideww1.microchip.com/downloads/en/devicedoc/51111b.pdf ·...

Documents

Transcript of Transponder Evaluation Kit User's Guideww1.microchip.com/downloads/en/devicedoc/51111b.pdf ·...