Interfacing and programming HCS300/HCS515 KEELOQ chips

You can read an introduction to KEELOQ here: http://ww1.microchip.com/downloads/en/AppNotes/91002a.pdf

The motivation for this work was the desire to have remote lock and unlock to my car. The car already had central door locking system.

After examining the the electric schematic of the central door locking system I was glad that only two signals were needed for opening and closing all doors. I needed two open drain outputs connected to two inputs of the central locking module on the car. When I wanted to close/open car I had to pull the corresponding input of the central locking module to ground and then release it. That's all, I tested and it worked well.

After this I needed a remote control, I decided to use RF and not IR. I found a small three button remote control from Aurel with Microchip HCS300 Keeloq encoder chip, RF 433.92MHz emitter and CR2032 battery holder rated at 0.5mW RF power.

The remote looks like this and actually is quite small:

A short presentation for this remote from its' manufacturer here: http://www.aurelwireless.com/wp-content/uploads/shortform/650200606G_sf.pdf

As I said, this remote contains a Keeloq code hopping encoder (HCS300).

This chip is manufactured by Microchip, here is its' datasheet: http://ww1.microchip.com/downloads/en/devicedoc/21137f.pdf

This chip has 4 button inputs and on this remote control only 3 inputs are used because we have 3 buttons.

A short description of the HCS300 taken from the datasheet:

The HCS300 from Microchip Technology Inc. is a code hopping encoder designed for secure Remote Keyless Entry (RKE) systems. The HCS300 utilizes the KEELOQ code hopping technology, incorporating high security, a small package outline and low cost. The HCS300 is a perfect solution for unidirectional remote keyless entry systems and access control systems.

The HCS300 combines a 32-bit hopping code, generated by a nonlinear encryption algorithm, with a 28-bit serial number and 6 information bits to create a 66-bit code word. The code word length eliminates the threat of code scanning and the code hopping mechanism makes each transmission unique, thus rendering code capture and resend schemes useless.

Having this remote with HCS300 Keeloq encoder you also need a RF receiver on the car with the ability to decode and validate the remote control transmission.

First I needed a compatible 433.92MHz RF receiver that had OOK modulation just like the emitter in the remote. I chose this receiver from Aurel: http://www.aurelwireless.com/wp-content/uploads/user-manual/650201133G_um.pdf which works at 5V and typically consumes 3mA according to its' datasheet.

The RF receiver looks like this:

Don't forget to connect the wire antenna otherwise the receive range will be severely shortened.

After setting up this receiver I have RF raw data that the emitter sent (the 66-bit code word which includes the 32bit hopping part).

Fortunately, there is also a Keeloq decoder chip, HCS515, which can decode and validate this transmission.

A short description of HCS515 taken from the datasheet

The Microchip Technology Inc. HCS515 is a code hopping decoder designed for secure Remote Keyless Entry (RKE) systems. The HCS515 utilizes the patented code hopping system and high security learning mechanisms to make this a canned solution when used with the HCS encoders to implement a unidirectional remote and access control systems. The HCS515 can be used as a stand-alone decoder or in conjunction with a microcontroller.

For this system to work the HCS300 encoder and HCS515 decoder have to be programmed with corresponding codes and the decoder has to learn the encoder by a specific procedure. Only after this the decoder is synchronized with the encoder and responds to button presses on the remote control.

As the datasheet says, the decoder can work in stand-alone mode or in conjunction with a microcontroller. In stand-alone mode, HCS515 has two outputs S0 and S1 which are activated(high for 500ms then low) when S0 and S1 buttons are pressed on the remote control (S0 and S1 inputs high on HCS300 encoder). On the car I mounted the stand-alone scenario with S0 and S1 outputs driving two NPN BC547 transistors with the collectors tied to the central door locking module inputs for open / closing doors with 47 ohm resistors in series. That's all and it worked very well.

The hardest part was programming correctly the encoder and decoder and then learning procedure. There were two problems here: I needed a programmer to program HCS300 and HCS515. Microchip PicKit2, if you have one, can program HCS300 but not HCS515 so I decided to make a programmer myself by implementing the programming protocol described in the encoder / decoder datasheets onto a ST STM8S Discovery platform. There were some problems to this because the datasheets are not 100% clear about the timing of the programming signals but finally got it working.

Programming HCS 515

The next challenge was to understand what codes should I program in HCS300 and what codes in HCS515.

First step is that you choose a secret Manufacturer Code (64bit - 8bytes), for example: 0x1122334455667788

This code you have to program to the decoder (HCS515) using function _Bool HCS515_Program(u8* data) data is a pointer to a u8 array which contains this manufacturer code. If the function returns 1, the HCS515 chip programming should have gone ok.

Note: The Repeat bit must be cleared in the configuration byte in Stand-alone mode. In the code provided below it the bit is enabled, to disable it clear bit 2 in cmd[1] in function _Bool HCS515_Program(u8* data).

Programming HCS 300

Choose a 32 bit serial number for your remote control and write it down.

Then, with the manufacturer key you chose in the previous step, you need the Microchip Keeloq code generation tool in which you put your chosen manufacturer code, that was programmed in HCS515 and then press generate button in the tool. What you need for next step is this generated 64bit code by the tool and your chosen 32 bit serial number.

Update the function _Bool HCS300_Program() with the generated code and your chosen 32 bit serial number for the remote and then call this function. After programming, this function verifies what was written and if everything was ok it returns 1, otherwise 0.

This remote control with HCS300 has pads on the PCB that connects the onboard HCS300 to the pins needed for programming. I soldered wires o these pads and connected the remote control to my STM8S board and programmed the remote. After this I desoldered the wires and closed the remote.

Learn procedure in stand-alone mode

After successfully programming HCS300 and HCS515 with THE RIGHT code in THE RIGHT byte order, the system still doesn't work yet because the receiver (decoder) has to learn the remote (which has it's own serial number).

Here is what the datasheet says about activating learn in stand alone mode:

The HCS515 decoder can also be used in stand-alone applications. The HCS515 will activate the data line for up to 500 ms if a valid transmission was received, and this output can be used to drive a relay circuit. To activate learn or erase all commands, a button must be connected to the CLK input. User feedback is indicated on an LED connected to the S_DAT output line. If the CLK line is pulled high, using the learn button, the LED will switch on. After the CLK line is kept high for longer than 2 seconds, the decoder will switch the LED line off, indicating that learn will be entered if the button is released. If the CLK line is kept high for another 6 seconds, the decoder will activate an ERASE_ALL command. Learn mode can be aborted by taking the clock line high until the data line goes high (LED switches on). During learn, the data line will give feedback to the user and, therefore, must not be connected to the relay drive circuitry.

• Note: The Repeat bit must be cleared in the configuration byte in Stand-alone mode.

After taking the clock low and before a transmitter is learned, any low-to-high change on the clock line may terminate learn. This has learn implications when a switch with contact bounce is used.

Only after this step the system will work and is synchronized. If you press a button on the remote the corresponding output on the HCS515 is activated for 500ms.

Note: if you press buttons on the remote control and you are not in the range of the receiver, the system can become desynchronized. If you press more than 16 times a button on the remote, when you get near the car and press the open button, the doors will not open the first time you press the button but will open the second time and the system will synchronize again. If you press a button on your remote more than 32000 times and yo are not in the range of the receiver the system you will need to do a learn procedure to get the system back synchronized.