AN249

KEELOQ® Transmitter Shell Using PIC12F6XX

TABLE 1: TRANSMITTER SHELL PIN
DESCRIPTIONS
Author: Mike Rylee
Microchip Technology Inc. Name Pin # Description
VDD 1 Positive supply voltage
INTRODUCTION S0 2 Switch input 0
RFOUT 6 Pulse Width Modulation (PWM)
This application note describes the KEELOQ® transmit-
output pin
ter shell using the PIC12F6XX. The KEELOQ transmitter
shell is designed to give the developer a modular VSS 8 Ground reference
coding environment to design a custom KEELOQ
encoder. The transmitter shell is useful for designers FIGURE 2: TRANSMITTER SHELL
that want a low-cost and low-power capable solution OPERATION
that can utilize the resources on board the PIC12F6XX
microcontroller. The Transmitter Shell comes with a START
Hopping Code lookup table for generating hopping
code transmissions during development. The KEELOQ
encryption algorithm can be licensed from Microchip by
contacting your local Microchip sales office. You can Is Button
view the Microchip sales office contact information at: Pressed? No
www.microchip.com.
Yes
Transmitter Shell Overview
This transmitter shell example uses two pins on the Update Sync
PIC12F6XX (See Figure 1 and Table 1). The input pin Counter
is the push button input S0. The PIC12F6XX is
configured to have an internal pull-up enabled on this
pin for reducing external circuitry. The RFOUT output Look up Encrypted
pin outputs the KEELOQ hopping code transmission Data from Table(1)
when a button is pushed. For more details on the
operation of the transmitter shell, please see the
flowchart in Figure 2. Load Transmit
Register
FIGURE 1: TRANSMITTER SHELL
PINOUT
PDIP, SOIC Transmit

VDD 1 8 VSS
PIC12F6XX

S0 2 7 NC Is Button No
Released?
S1(1) 3 6 RFOUT
Yes
S2(1) 4 5 NC
Note 1: This implementation uses a Hopping Code
lookup table instead of the KEELOQ®
Note 1: Only S0 is implemented in this encryption algorithm for producing a KEELOQ
application note. hopping code transmission. Please contact
your local Microchip sales office for details on
licensing the KEELOQ encryption algorithm.

 2003-2011 Microchip Technology Inc. Confidential DS00249B_C-page 1

AN249
TRANSMISSION FORMAT Code Word Organization
The transmitter shell transmits a 66-bit code word when
Code Word Format
a button is pressed. The 66-bit word is constructed
The transmitter shell code word is made up of several from a fixed code portion and an encrypted code
parts (see Figure 3). Each code word contains a 50% portion (Figure 4).
duty cycle preamble, a header, 32 bits of encrypted The 32 bits of encrypted data are generated from 4
data and 34 bits of fixed data followed by a guard button bits, 12 discrimination bits and the 16-bit sync
period before another code word can begin. value. The encrypted portion alone provides up to four
billion changing code combinations.
The 34 bits of fixed code data are made up of 2 status
bits, 4 button bits and the 28-bit serial number. The
fixed and encrypted sections combined increase the
number of code combinations to 7.38 x 1019.

FIGURE 3: CODE WORD FORMAT

TE TE TE
LOGIC ‘0’

LOGIC ‘1’

Bit
Period

50% Duty Cycle Encrypted Portion Fixed Portion of Guard

Preamble Header of Transmission Transmission Time
TP TH THOP TFIX TG

FIGURE 4: CODE WORD ORGANIZATION

34 bits of Fixed Portion 32 bits of Encrypted Portion

Repeat VLOW Button Serial Number Button OVR DISC Sync Counter
(1-bit) (1-bit) Status (28 bits) Status (2 bits) (10 bits) (16 bits)
S2 S1 S0 S3 S2 S1 S0 S3
MSb LSb
66 Data bits
Transmitted
LSb first.

Repeat VLOW Button Serial Number SEED

(1-bit) (1-bit) Status (28 bits) (32 bits)
1 1 1 1
MSb LSb

DS00249B_C-page 2 Confidential  2003-2011 Microchip Technology Inc.

 AN249
TRANSMITTER SHELL EEPROM Read
IMPLEMENTATION The EEPROM read routine is called EEREAD.

Implementation Overview Before the function is called, the address of the data in
the EEPROM should be stored in EEADR. The byte
The transmitter shell implementation shows the device read from the EEPROM is returned in the W register
resources, device configuration setup, useful function after the call and EEADR is incremented.
calls, and memory maps. The device resources (see Reading 2 consecutive bytes from the EEPROM
Table 2) show the available program memory, RAM (address 8h and 9h) would be done as follows:
and EEPROM. As shown in Table 2, there are
adequate resources for the designer to implement
MOVLW 08H ;SETUP THE ADDRESS
additional features. For a more detailed description of
MOVWF EEADR
the RAM and EEPROM memory maps, see Table 5 CALL EEREAD ;READ THE FIRST BYTE
and Table 6. The recommended configuration setup for MOVWF BYTE1 ;STORE THE DATA IN BYTE1 IN
the PIC12F6XX is depicted in Table 4. For more details ;SRAM
on the configuration word of the PIC12F6XX, please CALL EEREAD ;READ THE SECOND BYTE
see the PIC12F6XX data sheet available on the MOVWF BYTE2 ;STORE THE DATA IN BYTE2 IN
Microchip website at:  ;SRAM
www.microchip.com
EEPROM Write
The transmitter shell contains a 16-bit configuration
word similar to a HCS300. The two bits of the configu- Writing a byte to the EEPROM of the PIC® can be done
ration word that will be useful to the designer are bits 13 by calling EEWRITE. Before the call, the address to
and 14 that control the baud rate of the code hopping write to should be setup in EEADR, and the byte to
transmission output on the RFOUT pin (See Table 3). write to the EEPROM placed into the W register.
For a further explanation of the configuration word and EEADR is incremented after the byte has been written.
baud rates in KEELOQ-based encoders, please see the
Writing 01h and ABh to addresses 29h and 2Ah would
HCS300 data sheet available on the Microchip website
be done as follows:
at: www.microchip.com.
MOVLW 029H ; SETUP THE ADDRESS
Four functions will be useful to the user of the transmit- MOVWF EEADR
ter shell. Two of them are used to read data from and MOVLW 01H ; SETUP THE DATA TO WRITE
write data to the EEPROM on the PIC12F629. The CALL EEWRITE
other two are used to generate SEED and HOP MOVLW 0ABH ; SETUP THE DATA TO WRITE
transmissions and transmit them. CALL EEWRITE ; WRITE THE SECOND BYTE

 2003-2011 Microchip Technology Inc. Confidential DS00249B_C-page 3

AN249
TABLE 2: PIC12F6XX RESOURCES
Memory Type Size Used by Transmitter Free
FLASH (Program) 1024x14 words 00h to 243h 244h to 3FFh
DATA (SRAM) 64x8 Bytes See table below for details
EEPROM 128 Bytes 00h to 1Fh 20h to 3Fh

TABLE 3: BAUD RATE SELECT Transmit Seed

Basic Pulse Code Words Calling the TRANSMIT_SEED function will cause an
BSL1 BSL0
Element Transmitted HCS300 compatible SEED transmission. The serial
0 0 400 s All number and seed are read from the EEPROM and
patched into the CSR before being transmitted on pin
0 1 200 s 1 out of 2
RFOUT on PORTA. The function code inserted at the
1 0 200 s 1 out of 4 head of the serial number is 1111 (S3:S0), to retain
1 1 100 s 1 out of 4 compatibility with the HCS300. The function code is
defined as SEED_FUNC near the beginning of the code.
TABLE 4: PIC12F6XX CNT0 should be setup to specify how many times the
CONFIGURATION SETUP entire CSR is transmitted. The transmission rate is
Fuses determined by bits 13 and 14 of the configuration word,
as in the HCS300.
Watch Dog Timer Enabled
To transmit the CSR six times, the following call can be
Internal RC Oscillator No Clockout made:
Code Protect On MOVLW 06H ;SETUP THE NUMBER OF
;TIMES TO TRANSMIT
Transmit HOP Code ;THE CSR
MOVWF CNT0
Calling the TRANSMIT_HOP function will cause an CALL TRANSMIT_SEED ;CALL THE ROUTINE
HCS300 compatible transmission to take place. The ;THAT TRANSMITS HOP
CSR (code shift register) is setup to contain the serial ;CODES
number, function code and HOP code, and pin RFOUT
on PORTA is used to transmit the CSR. The serial
number and counter are read from the EEPROM. The
counter is incremented and stored. The Least
Significant 4 bits of the counter determines which of the
16 HOP transmissions, as defined in ENCRYPT, are
used.
The function code that is mapped into the open portion
of the transmission is called HOP_FUNC and is defined
at the start of the code. This function code will also be
placed in the HOP code transmissions in the
production version of the transmitter. In the
transmission, REPT bit is always set and VLOW is
always cleared.
CNT0 should be setup to specify how many times the
entire CSR is transmitted before TRANSMIT_HOP is
called. The transmission rate is determined by bits 13
and 14 of the configuration word, as in the HCS300.
To transmit the CSR six times, the following call can be
made:
MOVLW 06H ;SETUP THE NUMBER OF
;TIMES TO TRANSMIT THE
;CSR
MOVWF CNT0
CALL TRANSMIT_HOP ;CALL THE ROUTINE THAT
;TRANSMITS HOP CODES

DS00249B_C-page 4 Confidential  2003-2011 Microchip Technology Inc.

 AN249
EEPROM Memory Map
The first half of the EEPROM is used by the transmitter
portion of the code. These bytes should only be written
to when the transmitter is first programmed with the
serial number, configuration word, encryption key, seed
value and counter value.

TABLE 5: EEPROM MEMORY MAP

Address Description Address Description
00h Config. Word LSB 10h Seed BYTE2
01h Config. Word MSB 11h Seed BYTE3
02h Encryption Key BYTE0 LSB 12h Counter 1 LSB
03h Encryption Key BYTE1 13h Counter 1 MSB
04h Encryption Key BYTE2 14h Counter 2 LSB
05h Encryption Key BYTE3 15h Counter 2 MSB
06h Encryption Key BYTE4 16h Counter 3 LSB
07h Encryption Key BYTE5 17h Counter 3 MSB
08h Encryption Key BYTE6 18h USER
09h Encryption Key BYTE7 MSB 19h USER
0Ah Serial Number BYTE0 1Ah USER
0Bh Serial Number BYTE1 1Bh USER
0Ch Serial Number BYTE2 1Ch USER
0Dh Serial Number BYTE3 1Dh USER
0Eh Seed BYTE0 1Eh USER
0Fh Seed BYTE1 1Fh USER
Legend: LSB - Least Significant Byte, MSB - Most Significant Byte
Note 1: The EEPROM data from addresses 20h to 3Fh can be used for anything else.

 2003-2011 Microchip Technology Inc. Confidential DS00249B_C-page 5

AN249
RAM Memory Map
The transmitter portion of the code uses the following
addresses.

TABLE 6: RAM MEMORY MAP

Address Description Address Description Address Description
20h USER 2Ch TMP5 38h CSR4*
21h USER 2Dh TMP6 39h CSR5*
22h USER 2Eh TMP7 3Ah CSR6*
23h CNT0* 2Fh TMP8 3Bh CSR7*
24h CNT1* 30h ETMP1* 3Ch KEY0*
25h CNT2* 31h ETMP2* 3Dh KEY1*
26h USER 32h ETMP3 3Eh KEY2*
27h USER 33h ETMP4 3Fh KEY3*
28h TMP1* 34h CSR0* 40h KEY4*
29h TMP2* 35h CSR1* 41h KEY5*
2Ah TMP3* 36h CSR2* 42h KEY6*
2Bh TMP4* 37h CSR3* 43h KEY7*
* These bytes are used during the transmitter part of the code and will be changed during the transmission
resulting in a possible loss of data. Addresses that are not marked will not be changed and data stored therein
will not be lost.
Note 1: Bytes that are marked “USER” are not used by the transmitter portion of the code.

Conclusion
This transmitter shell example shows a convenient way
to implement a low cost and low power capable custom
KEELOQ encoder. By utilizing the available code space
on board the PIC12F6XX, the developer has the
flexibility to add additional features.

ADDITIONAL INFORMATION
Microchip's Secure Data Products are covered by
some or all of the following: Code hopping encoder pat-
ents issued in European countries and U.S.A. Secure
learning patents issued in European countries, U.S.A.
and R.S.A.

DS00249B_C-page 6 Confidential  2003-2011 Microchip Technology Inc.

 AN249

Software License Agreement

The software supplied herewith by Microchip Technology Incorporated (the "Company") is intended and supplied to you, the Com-
pany's customer, for use solely and exclusively on Microchip prod-ucts manufactured by the company.
The software is owned by the Company and/or its supplier, and is protected under applicable copyright laws. All rights are reserved.
Any use in violation of the foregoing restrictions may subject the user to criminal sanctions under applicable laws, as well as to civil
liability for the breach of the terms and conditions of this license.
THIS SOFTWARE IS PROVIDED IN AN "AS IS" CONDITION. NO WARRANTIES, WHETHER EXPRESS, IMPLIED OR STATU-
TORY, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICU-
LAR PURPOSE APPLY TO THIS SOFTWARE. THE COMPANY SHALL NOT, IN ANY CIRCUMSTANCES, BE LIABLE FOR SPE-
CIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES, FOR ANY REASON WHATSOEVER.

APPENDIX A: MICROCHIP KEELOQ CODE HOPPING ENCODER SHELL

;------------------------------------------------------------------------------------------------
; MICROCHIP KEELOQ CODE HOPPING ENCODER SHELL
;
;------------------------------------------------------------------------------------------------
;
;PROGRAM INFORMATION:
; VERSION 6: Mike Rylee
; FILE: SHELLW~4.ASM
; DATE:SEPTEMBER 2002
; VER.: 6.0
; CKSM:
; FUSES: OSC=INTRC_OSC_NOCLKOUT, WDT=ON, CP=ON
; ASM.: MPLAB 5.70.00 USED.
; INCL: SENCRYPT.ASM
; NOTES:
; 1. Code Ported From 16C84 To 12F629
; 2. Default Manufacturer's Code - 0x0123456789ABCDEF
; 3. Default Serial Number - 0x1234567
; 4. Default Encryption Key - 0x0516FBE989074278
; 5. Transmissions Successfully Learned On HCS515 Decoder
;
; VERSION 5: S.G. DAWSON
; FILE: SHELLW~4.ASM
; DATE: SEPTEMBER 1998
; VER.: 5.0
; CKSM: ????H
; FUSES: RC, WDT=OFF, CP=ON
; ASM.: MPASM VERSION 02.13 USED.
; INCL: ENCRYPT.ASM
;
; CHANGES:
; 1) EEREAD FIXED.
; 2) CODE IS A RESERVED WORD IN THE NEW ASSEMBLERS, CODE CHANGED TO DISC.
;
; VERSION 4: S.G. DAWSON
; FILE: SHELLW~3.ASM
; DATE: JUNE 1997
; VER.: 3.0
; CKSM: ????H
; FUSES: RC, WDT=OFF, CP=ON
; ASM.: MPASM VERSION 01.40 USED.
; INCL: ENCRYPT.ASM
; CHANGES:
; 1) MADE ALL THE NUMBERS HEX VALUES.
; 2) MOVED THE FUNCTION ENCRYPT TO A SEPERATE INCLUDE FILE
;

 2003-2011 Microchip Technology Inc. Confidential DS00249B_C-page 7

AN249
; VERSION 3: S.G. DAWSON
; FILE: SHELLW~2.ASM
; DATE: JUNE 1996
; VER.: 3.0
; CKSM: ????H
; FUSES: RC, WDT=OFF, CP=ON
; ASM.: MPASM VERSION 01.40 USED.
; INCL: NONE
;
; CHANGES:
; 1) THE TRANSMISSIONS FROM THE SHELL WILL LEARN ON A MCDEC14 DECODER
; - MANUFACTURER'S CODE = 01234567-89ABCDEF
; - SERIAL NUMBER = 01234567
; 2 REPLACED MANCHESTER TRANSMISSION FORMAT WITH PWM TRANSMISSION FORMAT
;
; VERSION 2: S.G. DAWSON
; FILE: FINAL_TX.ASM
; DATE: JUNE 1996
; VER.: 1.0
; CKSM: ????H
; FUSES: RC, WDT=ON, CP=ON
; ASM.: MPASM VERSION 01.30.01 USED.
; INCL: NONE
;
; CHANGES:
; 1 ADD ENCRYPTION ROUTINE.
; 2 SERIAL NUMBER, SEED, DISCRIMINATION BITS, COUNTERS, TRANSMISSION
; SPEED ALL NOW STORED IN EEPROM AND NEED TO BE READ FROM THERE.
;
; VERSION 1:V.N. DELPORT
; FILE: SHELLTX1.ASM
; DATE: 06/04/1996.
; VER.: 1.0a
; CKSM: ????H - FUSES:RC,WDT=ON,CP=ON.
; ASM.: MPASM VERSION 1.30.01 USED.
; INCL: NONE
;
;------------------------------------------------------------------------------------------------

LIST P=12F629,F=INHX8M,R=DEC
#include <p12f629.inc>
; ERRORLEVEL 0,-224,-305,-306
;Messages, Warnings and Errors Printed
;Ignore [224] => Use Of This Instruction is not recommended
;Ignore [305] => Using default dest of 1 file
;Ignore [306] => Crossing Page Boundary

__CONFIG _CP_ON & _CPD_OFF & _BODEN_OFF & _MCLRE_OFF & _WDT_ON & _PWRTE_ON &
_INTRC_OSC_NOCLKOUT

; USER DEFINE REGISERS

FLAGS EQU 20H ; USER FLAG REGISTER

TXNUM EQU 21H ; CURRENT TX
OLD_BUT EQU 22H ; OLD BUTTON CODE REGISTER

; COUNTER REGISTERS

CNT0 EQU 23H ; LOOP COUNTERS

CNT1 EQU 24H
CNT2 EQU 25H

CNT_HI EQU 26H ; 16 BIT CLOCK COUNTER

CNT_LW EQU 27H

DS00249B_C-page 8 Confidential  2003-2011 Microchip Technology Inc.

 AN249
; TEMP REGISTERS

TMP1 EQU 28H ; TEMP REGISTERS

TMP2 EQU 29H
TMP3 EQU 2AH
TMP4 EQU 2BH
TMP5 EQU 2CH
TMP6 EQU 2DH
TMP7 EQU 2EH
TMP8 EQU 2FH

ETMP1 EQU 30H ; TEMP REGISTERS

ETMP2 EQU 31H
ETMP3 EQU 32H
ETMP4 EQU 33H

; CIRCULAR BUFFER REGISTER

CSR0 EQU 34H

CSR1 EQU 35H
CSR2 EQU 36H
CSR3 EQU 37H
CSR4 EQU 38H ; 64 BIT RECEIVE SHIFT REGISTER
CSR5 EQU 39H
CSR6 EQU 3AH
CSR7 EQU 3BH
CSR8 EQU TMP1

KEY0 EQU 3CH ; 64 BIT SHIFT REGISTER WITH DECRYPTION KEY

KEY1 EQU 3DH
KEY2 EQU 3EH
KEY3 EQU 3FH
KEY4 EQU 40H
KEY5 EQU 41H
KEY6 EQU 42H
KEY7 EQU 43H

; **** WORK REGISTERS ********

MASK EQU EEDATA

TX_CNT EQU TMP6 ; TX COUNTER
RAM_HI EQU TMP7 ; 16 BIT RAM COUNTER ( USED IN RESYNC )
RAM_LW EQU TMP8
OUTBYT EQU EEDATA ; TEMP REGISTER FOR SERIAL EEPROM ROUTINES

; ************** DECRYPTION REGISTER RE-MAPPINGS **************

;
; NOTE : INDIRECT ADDRESSING USED, DO NOT CHANGE REGISTER ASSIGNMENT
;
; ***************************************************************
HOP1 EQU CSR0 ; 32 BIT HOPCODE REGISTER
HOP2 EQU CSR1
HOP3 EQU CSR2
HOP4 EQU CSR3

; ***** USER REGISTER RE-MAPPINGS ****************************************************************

DAT1 EQU CSR3 ; 32 BIT DATA REGISTER

DAT2 EQU CSR2
DAT3 EQU CSR1
DAT4 EQU CSR0

; RECEIVED TRANSMISSION OPEN 32 BITS

SER_0 EQU CSR7 ; 28 BIT SERIAL NUMBER

 2003-2011 Microchip Technology Inc. Confidential DS00249B_C-page 9

AN249
SER_1 EQU CSR6
SER_2 EQU CSR5
SER_3 EQU CSR4

; RECEIVED TRANSMISSION ENCRYPTED 32 BITS

FUNC EQU ETMP4 ; BUTTON CODE & USER BIT FUNCTION BYTE
DISC EQU ETMP3 ; DISCRIMINATION VALUE
CNTR_HI EQU ETMP2 ; 16 BIT RX COUNTER
CNTR_LW EQU ETMP1

HOP_FUNC EQU 010H ; FUNCTION CODE TRANSMITTED DURING HOP CODE TRANSMSSIONS
SEED_FUNC EQU 0F0H ; FUNCTION CODE TRANSMITTED DURING SEED TRANSMISSIONS

DS00249B_C-page 10 Confidential  2003-2011 Microchip Technology Inc.

 AN249

;------------------------------------------------------------------------------------------------
; REGISTER BIT DEFINITIONS:
;------------------------------------------------------------------------------------------------

; ********* GPIO BIT DEFINITIONS ****************************************************************

RFOUT EQU 01H ; PWM OUTPUT TO RF CIRCUIT

; ********* COMPILER DEFINES ********************************************************************

NBITS EQU 040H ; MAXIMUM TRANSMISSION BIT LENGTH

MIN EQU 540 ; TRANSMISSION HEADER MINIMUM LENGTH [æS]
MAX EQU 10800 ; TRANSMISSION HEADER MAXIMUM LENGTH [æS]

;******* CONFIGURATION BYTE OPTION MASKS *********************************************************

;
; NOTE : THESE MASK DEFINITIONS MUST BE CHANGED IF BIT
; LISTED ABOVE CHANGES
;**************************************************

LRN_MASK EQU 3H ; MASK FOR LEARN BITS

SC_MASK EQU 8H ; MASK SC_LRN BIT FROM EEPROM CONFIG BYTE

; ******* SUBROUTINE ERROR RETURN CODES ******

E_OK EQU 000H ; 0 VALID RESPONSE
E_DISCR EQU 0FFH ; -1 DISCRIMINATION FAILURE
E_CNT EQU 0FEH ; -2 INVALID COUNTER
E_WRITE EQU 0FCH ; -3 EEPROM WRITE FAILURE

; ******* EEPROM MEMORY MAP *******************

CFG_ADR EQU 000H ; CONFIG BYTE ADDRESS IN EEPROM, WITH x,BSL1,BSL0,x
; : xxD9,D8 : D7,D6,D5,D4 : D3,D2,D1,D0
KEY_ADR EQU 002H ; BASE ADDRESS FOR KEY
SER_ADR EQU 00AH ; BASE ADDRESS FOR SERIAL NUMBER
SEED_ADR EQU 00EH ; BASE ADDRESS FOR SEED
CNT_1 EQU 012H ; COUNTER 1, MSB IN 013H, LSB IN 012H
CNT_2 EQU 014H ; COUNTER 2
CNT_3 EQU 016H ; COUNTER 3

ORG 000H
CALL 0x3FF ; RETRIEVE FACTORY CALIBRATION VALUE
BANKSEL OSCCAL ; BANK 1
MOVWF OSCCAL ;
GOTO RESET ;

ORG 04H
GOTO MAIN

;---------------------------------------------------------------------------
;
; FUNCTION : GET_SEED ()
;
; DESCRIPTION : GET THE SEED FROM THE EEPROM AND PLACE IT IN CSR[0:3]
;---------------------------------------------------------------------------
GET_SEED
MOVLW SEED_ADR ; INITIALIZE EEADR WITH THE BASE ADDRESS OF THE SEED
BANKSEL EEADR ; BANK1
MOVWF EEADR
CALL EEREAD ; READ THE SEED
MOVWF CSR0
CALL EEREAD

 2003-2011 Microchip Technology Inc. Confidential DS00249B_C-page 11

AN249
MOVWF CSR1
CALL EEREAD
MOVWF CSR2
CALL EEREAD
MOVWF CSR3
RETURN

;---------------------------------------------------------------------------
;
; FUNCTION: GET_KEY ()
;
; DESCRIPTION: GET THE ENCRYPTION FROM THE EEPROM AND PLACE IT IN KEY[0:3]
;---------------------------------------------------------------------------
GET_KEY
MOVLW KEY_ADR ; INITIALIZE EEADR WITH THE BASE ADDRESS OF THE SEED
BANKSEL EEADR ; BANK1
MOVWF EEADR
MOVLW (KEY0-1) ; INITIALIZE THE RAM POINTER
MOVWF FSR

GET_KEYLOOP
INCF FSR,F ; INCREMENT THE RAM POINTER
CALL EEREAD ; READ THE BYTE OF THE KEY
MOVWF INDF ; WRITE TO KEY POSITION IN RAM

MOVLW KEY7 ; CHECK IF WE HAVE READ ALL 8 BYTES

SUBWF FSR,W ;
BTFSS STATUS,Z
GOTO GET_KEYLOOP ; LOOP BACK TO GET_KEYLOOP IF NOT ALL BYTES READ
RETURN ; RETURN IF WE HAVE THE KEY IN RAM

;---------------------------------------------------------------------------
;
; FUNCTION: GET_SERIAL ()
;
; DESCRIPTION: GET THE 28 BIT SERIAL NUMBER FROM THE EEPROM AND PLACE IT
; IN CSR[4:7]
;
;---------------------------------------------------------------------------
GET_SERIAL
MOVLW SER_ADR ; INITIALIZE EEADR WITH THE SERIAL NUMBER BASE ADDRESS
BANKSEL EEADR ; BANK1
MOVWF EEADR
CALL EEREAD ; READ THE SERIAL NUMBER
MOVWF CSR4
CALL EEREAD
MOVWF CSR5
CALL EEREAD
MOVWF CSR6
CALL EEREAD
MOVWF CSR7
RETURN

;---------------------------------------------------------------------------
;
; FUNCTION: GET_COUNTER ()
;
; DESCRIPTION: GET, CHECK FOR ERRORS, UPDATE THE COUNTERS AND RETURN WITH
; : THE COUNTER IN CSR1:CSR0
;
;---------------------------------------------------------------------------
GET_COUNTER
MOVLW CNT_2 ; INITIALIZE EEADR WITH CNT_2'S BASE ADDRESS

DS00249B_C-page 12 Confidential  2003-2011 Microchip Technology Inc.

 AN249
BANKSEL EEADR ; BANK1
MOVWF EEADR

CALL EEREAD ; STORE CNT_2 IN ETMP2:1

MOVWF ETMP1
CALL EEREAD
MOVWF ETMP2

CALL EEREAD ; READ THE LSB OF CNT_3

SUBWF ETMP1,W ; CHECK IF THE LSB'S OF CNT_2 AND CNT_3 ARE EQUAL
BTFSS STATUS,Z ;
GOTO CHECK_1_2 ; IF NOT GOTO THE CHECK WHERE CNT_1 AND CNT_2 ARE COMPARED

CALL EEREAD ; READ THE MSB OF CNT_3

SUBWF ETMP2,W ; CHECK IF THE MSB'S OF CNT_2 AND CNT_3 ARE EQUAL
BTFSS STATUS,Z ;
GOTO CHECK_1_2 ; IF NOT GOTO THE CHECK WEHRE CNT_1 AND CNT_2 ARE COMPARED
GOTO UPDATE_CNTRS ; IF BOTH ARE EQUAL UPDATE THE COUNTERS AS IN ETMP2 AND ETMP2

CHECK_1_2
MOVLW CNT_1 ; UNITIALIZE EEADR WITH CNT_1'S BASE ADDRESS
BANKSEL EEADR ; BANK1
MOVWF EEADR

CALL EEREAD ; READ THE LSB OF CNT_3

SUBWF ETMP1,W ; CHECK IF THE LSB'S OF CNT_2 AND CNT_3 ARE EQUAL
BTFSS STATUS,Z ;
GOTO CNT2_FAULTY ; IF NOT GOTO THE CHECK WHERE CNT_1 AND CNT_2 ARE COMPARED

CALL EEREAD ; READ THE MSB OF CNT_3

SUBWF ETMP2,W ; CHECK IF THE MSB'S OF CNT_2 AND CNT_3 ARE EQUAL
BTFSS STATUS,Z ;
GOTO CNT2_FAULTY ; IF NOT GOTO THE CHECK WEHRE CNT_1 AND CNT_2 ARE COMPARED
GOTO UPDATE_CNTRS ; IF BOTH ARE EQUAL UPDATE THE COUNTERS AS IN ETMP2 AND ETMP2

CNT2_FAULTY
MOVLW CNT_1 ; INITIALIZE EEADR WITH CNT_3'S ADDRESS, CNT_1 HAS ALREADY
BEEN UPDATED
; BUT WAS NEVER TRANSMITTED
BANKSEL EEADR ; BANK1
MOVWF EEADR

CALL EEREAD ; STORE THE LSB OF CNT_3 IN ETMP2

MOVWF ETMP1
CALL EEREAD ; STORE THE MSB OF CNT_3 IN ETMP2
MOVWF ETMP2

UPDATE_CNTRS
INCF ETMP1,F ; INCREMENT THE COUNTER
BTFSC STATUS,Z ; CHECK IF COUNTER HAS WRAPPED
INCF ETMP2,F ; INCREMENT IF COUNTER HAS WRAPPED

MOVLW CNT_1 ; LOAD CNT_1'S BASE ADDRESS

BANKSEL EEADR ; BANK1
MOVWF EEADR
MOVF ETMP1,W ; LOAD CNT_1'S LSB AND WRITE
CALL EEWRITE
MOVF ETMP2,W ; LOAD CNT_1'S MSB AND WRITE
CALL EEWRITE
MOVF ETMP1,W ; LOAD CNT_2'S LSB AND WRITE
CALL EEWRITE
MOVF ETMP2,W ; LOAD CNT_2'S MSB AND WRITE
CALL EEWRITE
MOVF ETMP1,W ; LOAD CNT_3'S LSB AND WRITE

 2003-2011 Microchip Technology Inc. Confidential DS00249B_C-page 13

AN249
CALL EEWRITE
MOVF ETMP2,W ; LOAD CNT_3'S MSB AND WRITE
CALL EEWRITE

MOVF ETMP2,W ; MOVE THE MSB OF THE COUTNER TO W

MOVWF CSR1 ; STORE THE MSB OF THE COUNTER TO CSR1
MOVF ETMP1,W ; MOVE THE LSB OF THE COUNTER TO CSR0
MOVWF CSR0 ; MOVE THE LSB OF THE COUNTER TO CSR0
RETURN

;---------------------------------------------------------------------------
;
; FUNCTION : GET_DISCR ()
;
; DESCRIPTION : GETS THE DISCRIMINATION VALUE FROM THE CONFIG BYTES AND
; : STORES THEM IN CSR3:2.
; : GETS NUMBER OF LOOPS FOR TE_DEL2 AND STORES IT IN TMP2
; : GETS THE NUMBER OF BLANK WORDS AND STORES THEM IN TMP3
;
;---------------------------------------------------------------------------
GET_DISCR
MOVLW CFG_ADR ; GET THE CONFIG WORDS ADDRESS...
BANKSEL EEADR ; BANK1
MOVWF EEADR
CALL EEREAD ; AND READ THE LSB OF THE CONFIG WORD
MOVWF CSR2

CALL EEREAD ; READ THE MSB OF THE CONFIG WORD

ANDLW 03H ; MASK OUT THE BAUD RATE SELECT BITS
MOVWF CSR3

GET_TXSPEED
MOVLW (CFG_ADR+1) ; READ THE MSB OF THE CONFIG WORD
BANKSEL EEADR ; BANK1
MOVWF EEADR
CALL EEREAD
ANDLW 060H ; MASK OUT BSL[1:0]
BCF STATUS,C
MOVWF TMP2
RLF TMP2,F
RLF TMP2,F
RLF TMP2,F
RLF TMP2,W

ADDWF PCL,F ; LOOKUP TIME

GOTO TE_400US_ALL
GOTO TE_200US_HALF
GOTO TE_200US_QRTR

TE_100US_QRTR
NOP ; BSL 2 AND 3 HAVE TE OF 100us
MOVLW 014H
MOVWF TMP2
MOVLW 03H ; TRANSMIT1, BLANK3
MOVWF TMP3
RETURN

TE_200US_QRTR
MOVLW 028H
MOVWF TMP2
MOVLW 03H
MOVWF TMP3 ; TRANSMIT 1, BLANK1
RETURN

DS00249B_C-page 14 Confidential  2003-2011 Microchip Technology Inc.

 AN249
TE_200US_HALF
MOVLW 028H
MOVWF TMP2
MOVLW 01H
MOVWF TMP3 ; TRANSMIT 1, BLANK1
RETURN

TE_400US_ALL
MOVLW 050H
MOVWF TMP2
CLRF TMP3 ; TRANSMIT 1, BLANK0
RETURN

RESET
MOVLW 07H ; SETUP TMR0 PRESCALER
MOVWF OPTION_REG
BSF WPU,5 ; GP5 WEAK PULL UP ENABLED
BANKSEL GPIO ; BANK0

CLRF GPIO
MOVLW .7 ; COMPARATOR OFF
MOVWF CMCON

BANKSEL TRISIO ; BANK1

BCF VRCON,7 ; TURN OFF VREF
MOVLW 0FFH
MOVWF TRISIO ; TRISTAT GPIO
BCF TRISIO,RFOUT ; RFOUT IS AN OUTPUT - GP1

CLRF PCLATH ; CLEAR PAGE HI BYTE

GOTO MAIN ; GOTO MAIN PROGRAM LOOP

;---------------------------------------------------------------------------
; THIS IS WHERE THE ENCRYPTION ROUTINES ARE ADDED
;---------------------------------------------------------------------------
#INCLUDE "SENCRYPT.ASM" ; SHELL ENCRYPTION ROUTINE - TRANSMISSION LOOK UP TABLE
;; #INCLUDE "ENCRYPT.ASM" ; REAL ENCRYPTION ROUTINE

;---------------------------------------------------------------------------
;
; FUNCTION : EEWRITE ()
;
; DESCRIPTION : WRITE 8 BIT VALUE TO EEPROM
;
;---------------------------------------------------------------------------
EEWRITE
CLRWDT ; RESET WATCHDOG TIMER
BANKSEL EEDATA ; BANK1
MOVWF EEDATA ; STORE DATA
BSF EECON1,WREN ; EEPROM WRITE ENABLE
BCF INTCON,GIE ; DISABLE INT'S
MOVLW 055H ; WRITE 55H
MOVWF EECON2
MOVLW 0AAH ; WRITE AAH
MOVWF EECON2
BSF EECON1,WR ; BEGIN WRITE BY SETTING WR BIT

EEWRITE2
BTFSC EECON1,WR ; WAIT FOR EEPROM WRITE COMPLETE
GOTO EEWRITE2
BSF INTCON,GIE ; ENABLE INT'S

 2003-2011 Microchip Technology Inc. Confidential DS00249B_C-page 15

AN249
BCF EECON1,WREN ; EEPROM WRITE DISABLE
INCF EEADR,F ; POINT TO NEXT ADDRESS IN EEPROM
BANKSEL GPIO ; BANK 0
RETLW E_OK

;---------------------------------------------------------------------------
;
; FUNCTION : EEREAD ()
;
; DESCRIPTION : READ 8 BIT VALUE FROM EEPROM
;
;---------------------------------------------------------------------------
EEREAD
BANKSEL EEADR ; BANK1
BSF EECON1,RD ; EE READ
INCF EEADR,F ; POINT TO NEXT ENTRY IN EEPROM
MOVF EEDATA,W ; GET UPPER 8 BITS
BANKSEL GPIO ; BANK 0
RETURN ; RETURN WITHOUT CHANGING W REGISTER

;---------------------------------------------------------------------------
;
; FUNCTION : ROT_SHIFT()
;
; DESCRIPTION : RIGHT ROTATE 64 BIT RECEIVE SHIFT REGISTER
;
;---------------------------------------------------------------------------
ROT_SHIFT
RRF CSR8,1 ; RIGHT ROTATE RECEIVE SHIFT REGISTER
RRF CSR7,1 ; RIGHT ROTATE RECEIVE SHIFT REGISTER
RRF CSR6,1 ; RIGHT ROTATE RECEIVE SHIFT REGISTER
RRF CSR5,1 ; RIGHT ROTATE RECEIVE SHIFT REGISTER
RRF CSR4,1 ; RIGHT ROTATE RECEIVE SHIFT REGISTER
RRF CSR3,1 ; RIGHT ROTATE RECEIVE SHIFT REGISTER
RRF CSR2,1 ; RIGHT ROTATE RECEIVE SHIFT REGISTER
RRF CSR1,1 ; RIGHT ROTATE RECEIVE SHIFT REGISTER
RRF CSR0,1 ; RIGHT ROTATE RECEIVE SHIFT REGISTER
RETLW E_OK

;---------------------------------------------------------------------------
;
; FUNCTION : TE_DEL ()
;
; DESCRIPTION : WAIT FOR 1 TE CYCLE. TE_DEL2 = 5us. DELAYING 20 TE_DEL2
; : TAKES DELAY UP TO 100us
;
;---------------------------------------------------------------------------
TE_DELAY
MOVF TMP2,W ; MOV THE SELECTED BAUD RATE TO W
MOVWF CNT2
MOVF TMP2,W ; TMP2 CONTAINS THE TX RATE SELECTED

TE_DEL2
NOP ; [1] WASTE TIME
CLRWDT ; [1]
DECFSZ CNT2,1 ; [1]
GOTO TE_DEL2 ; [2]
RETLW 0

;---------------------------------------------------------------------------
;
; FUNCTION : TRANSMIT_HOP ()
;
; DESCRIPTION : SET UP CSR[8:0] TO TRANSMIT A NORMAL HOP CODE
; : TRANSMISSION AND TRANSMIT.

DS00249B_C-page 16 Confidential  2003-2011 Microchip Technology Inc.

 AN249
;
;---------------------------------------------------------------------------
TRANSMIT_HOP
CALL GET_COUNTER ; GET AND UPDATE THE COUNTERS IN EEPROM
CALL GET_DISCR ; GET THE DISC. VALUE FROM THE CONFIG WORD

MOVLW HOP_FUNC ; ADD THE FUNCTION CODE TO THE WORD TO BE ENCRYPTED

IORWF CSR3,F ;
CALL GET_KEY ; GET THE ENCRYPTION KEY INTO RAM
CALL ENCRYPT

CALL GET_SERIAL ; GET THE SERIAL NUMBER FROM EE TO CSR[8:4]

MOVLW HOP_FUNC ; PREPARE TO MASK THE FUNCTION CODE IN THE OPEN PORTION
IORWF CSR7,F

MOVLW 2H ; SET THE LAST BITS TO HAVE RPT SET AND VLOW CLEAR
MOVWF CSR8
GOTO TRANSMIT_CSR

;---------------------------------------------------------------------------
;
; FUNCTION : TRANSMIT_SEED ()
;
; DESCRIPTION : SET UP CSR[8:0] TO TRANSMIT A SEED TRANSMISSION AND
; : TRANSMIT.
;
;---------------------------------------------------------------------------
TRANSMIT_SEED
CALL GET_TXSPEED
CALL GET_SEED ; GET THE SEED FROM EE TO CSR[3:0]
CALL GET_SERIAL ; GET THE SERIAL NUMBER FROM EE TO CSR[8:4]

MOVLW SEED_FUNC ; PREPARE TO MASK THE FUNCTION CODE IN THE OPEN PORTION
IORWF CSR7,F

MOVLW 2H ; SET THE LAST BITS TO HAVE RPT SET AND VLOW CLEAR
MOVWF CSR8
GOTO TRANSMIT_CSR

;---------------------------------------------------------------------------
;
; FUNCTION : TRANSMIT_BLANK ()
;
; DESCRIPTION : TRANSMITS AS MANY BLANK TRANSMISSIONS AS SPECIFIED BY TMP3
;
;---------------------------------------------------------------------------
TRANSMIT_BLANK
MOVF TMP3,W
MOVWF TMP4 ; TMP4 IS DECREMENTED EACH TIME TX IS BLANKED

BLANK_LOOP
BTFSC STATUS,Z ; CHECK IF TMP4 IS ZERO
RETURN ; RETURN IF TMP4 IS ZERO

MOVLW 010H ; PREAMBLE

MOVWF CNT1
BLANKLOOP_PREAMBLE
CALL TE_DELAY ; PREAMBLE HIGH
CALL TE_DELAY ; PREAMBLE LOW
DECFSZ CNT1,F
GOTO BLANKLOOP_PREAMBLE

 2003-2011 Microchip Technology Inc. Confidential DS00249B_C-page 17

AN249
MOVLW 08H ; SYNC PULSE
MOVWF CNT1
BLANKLOOP_SYNC
CALL TE_DELAY
DECFSZ CNT1,F
GOTO BLANKLOOP_SYNC

MOVLW 042H ; 66 BITS

MOVWF CNT1
BLANKLOOP_DATA
CALL TE_DELAY ; LEADING HIGH
CALL TE_DELAY ; DATA BITS
CALL TE_DELAY ; TRAILING LOW
DECFSZ CNT1,F
GOTO BLANKLOOP_DATA

MOVLW 038H ; 56 TE GUARD TIME

MOVWF CNT1
BLANKLOOP_GUARD
CALL TE_DELAY
DECFSZ CNT1,F
GOTO BLANKLOOP_GUARD

DECF TMP4,F ; DECREMENT LOOP COUNTER

GOTO BLANK_LOOP

;---------------------------------------------------------------------------
;
; FUNCTION : TRANSMIT_CSR ()
;
; DESCRIPTION : TRANSMITS THE CONTENTS OF CSR[8:0] (66 BITS) USING A
; : PWM FORMAT, LSB OF CSR0 FIRST, ENDING WITH BIT 1 OF CSR8
;
;---------------------------------------------------------------------------
TRANSMIT_CSR

; ****** TRANSMIT PREAMBLE *********

TX00 MOVLW 010H ; 16 PREAMBLE BITS
MOVWF CNT1
TX0
BCF GPIO,RFOUT ; SET RF OUTPUT HIGH
CALL TE_DELAY ; WAIT FOR HIGH CYCLE
BSF GPIO,RFOUT ; SET RF OUTPUT LOW
CALL TE_DELAY ;
DECFSZ CNT1,1 ; ALL PREAMLES ???
GOTO TX0 ; ... NO, THEN DO NEXT

; ****** WAIT FOR HEADER TIME *******

MOVLW 0AH ; ANOTHER 7 TE CYCLES

MOVWF CNT1
BCF GPIO,RFOUT
TX1
CALL TE_DELAY ; WAIT FOR ONE TE CYCLE
DECFSZ CNT1,1 ; ALL TE CYCLES
GOTO TX1 ; ... NO,THEN DO NEXT

; ******* TX DATA ( 32 BIT HOP + 36 FIX ) ****

TX_DTA
MOVLW 042H ; TOTAL OF 66 BITS TO TRANSMIT
MOVWF CNT1

DS00249B_C-page 18 Confidential  2003-2011 Microchip Technology Inc.

 AN249
TX_DTA2
BSF GPIO,RFOUT ; SET RF OUTPUT HIGH
CALL TE_DELAY ; WAIT FOR ONE TE CYCLE
BTFSC CSR0,0 ; TEST FOR BIT = 0
GOTO TX_MARK ; ... NO, THEN BIT = 1

; ******* SEND BIT = 0 ************************

TX_SPACE
BSF GPIO,RFOUT ; SET RF OUTPUT LOW
CALL TE_DELAY ; WAIT FOR ONE TE CYCLE
BCF GPIO,RFOUT ; SET RF OUTPUT LOW
CALL TE_DELAY ; WAIT FOR ONE TE CYCLE
GOTO TX_NEXT

; ******** SEND BIT = 1 ************************

TX_MARK
BCF GPIO,RFOUT ; SET RF OUTPUT HIGH
CALL TE_DELAY ; WAIT FOR ONE TE CYCLE
BCF GPIO,RFOUT ; SET RF OUTPUT LOW
CALL TE_DELAY ; WAIT FOR ONE TE CYCLE
GOTO TX_NEXT

TX_NEXT
CALL ROT_SHIFT ; GET NEXT BIT IN CARRY
DECFSZ CNT1,1 ; ALL BITS TRANSMITTED
GOTO TX_DTA2 ; ... NO, THEN DO NEXT BIT

; ******** SEND ONE STOP BIT ********************

TX_STOP
BCF GPIO,RFOUT ; SET RF OUTPUT LOW
CALL TE_DELAY ; WAIT FOR ONE TE CYCLE
BSF GPIO,RFOUT ; SET RF OUTPUT HIGH
CALL TE_DELAY ; WAIT FOR ONE TE CYCLE

; ******** RESTORE CSR TO ORIGIN ****************

MOVLW (72-65)
MOVWF CNT1
RESTORE_CSR
CALL ROT_SHIFT
DECFSZ CNT1,F
GOTO RESTORE_CSR

; ******** WAIT FOR GARD TIME *******************

TX_GUARD
MOVLW 038H ; GUARD TIME = 56xTE
MOVWF CNT1
BCF GPIO,RFOUT ; SET RF OUTPUT LOW

TX_GUARD2
CALL TE_DELAY ; WAIT ONE TE_DELAY TIME
DECFSZ CNT1,1
GOTO TX_GUARD2

CALL TRANSMIT_BLANK

DECFSZ CNT0,1
GOTO TX00

RETLW 0H

;---------------------------------------------------------------------------
;

 2003-2011 Microchip Technology Inc. Confidential DS00249B_C-page 19

AN249
; FUNCTION : RD_MAP1 ()
;
; DESCRIPTION : READ CODE MAP FROM ROM TABLE
;
;---------------------------------------------------------------------------

RD_MAP1
MOVLW 8H ; NUMBER OF BYTE TO READ FROM ROM
MOVWF CNT1

MOVLW CSR7 ; POINT TO TRANSMISSION REGISTER

MOVWF FSR

MOVLW 001H ; INCREMENT POINTER

BANKSEL EEADR ; BANK 1
MOVWF EEADR
CALL EEREAD
MOVWF CNT2
ADDLW 1
MOVLW 001H
BANKSEL EEADR ; BANK 1
MOVWF EEADR
CALL EEWRITE
MOVLW 007H
ANDWF CNT2,F
CLRC
RLF CNT2,1
RLF CNT2,1
RLF CNT2,1

CLRFCSR8

RD_MAP12
CLRWDT
MOVFW CNT2 ; GET INDEX POINTER
MOVWF INDF ; STORE IN BUFFER

DECF FSR,1 ; POINT TO NEXT ENTRY IN BUFFER

INCF CNT2,1 ; POINT TO NEXT ENTRY IN ROM TABLE

DECFSZ CNT1,1
GOTO RD_MAP12
RETLW 0

;---------------------------------------------------------------------------
;
; FUNCTION : RD_MAP2 ()
;
; DESCRIPTION : READ SEED MAP FROM ROM TABLE
;
;---------------------------------------------------------------------------
RD_MAP2
MOVLW 8H ; NUMBER OF BYTE TO READ FROM ROM
MOVWF CNT1

MOVLW CSR7 ; POINT TO TRANSMISSION REGISTER

MOVWF FSR

CLRF CNT2
CLRF CSR8

RD_MAP22
CLRWDT
MOVFW CNT2 ; GET INDEX POINTER
CALL GET_SEED ; READ BYTE FROM MAP

DS00249B_C-page 20 Confidential  2003-2011 Microchip Technology Inc.

 AN249
MOVWF INDF ; STORE IN BUFFER

DECF FSR,1 ; POINT TO NEXT ENTRY IN BUFFER

INCF CNT2,1 ; POINT TO NEXT ENTRY IN ROM TABLE

DECFSZ CNT1,1
GOTO RD_MAP22
RETLW 0

;---------------------------------------------------------------------------
;
; FUNCTION : MAIN ()
;
; DESCRIPTION : MAIN PROGRAM LOOP
;
;---------------------------------------------------------------------------
MAIN
BANKSEL INTCON ; BANK 1
BCF INTCON,GIE ; DISABLE GLOBAL INTERUPTS
CALL INITIALIZE_EEPROM

M_LOOP
BANKSEL GPIO ; BANK 0
CLRWDT
BTFSC GPIO,5 ; TEST IF S0 PRESSED - GP5
GOTO M_LOOP ; LOOP BACK
MOVLW 1
MOVWF CNT0
CALL TRANSMIT_HOP ; TRANSMIT HOP CODE TRANSMISSION
M_LOOP2
BTFSC GPIO,5 ; LOOP WHILE BUTTON IS STILL PRESSED
GOTO M_LOOP ; LOOP BACK IF BUTTON IS RELEASED
MOVLW 1
MOVWF CNT0
CALL TRANSMIT_CSR ; OTHERWISE RETRANSMIT BUFFER
GOTO M_LOOP2 ; LOOP BACK TO M_LOOP2

;---------------------------------------------------------------------------
;
; FUNCTION : INITIALIZE EEPROM
;
; DESCRIPTION : EEPROM INITIALIZATION
;
;---------------------------------------------------------------------------
INITIALIZE_EEPROM
MOVLW KEY_ADR ; WRITE KEY0 (LSB)
MOVWF EEADR
MOVLW 078H
CALL EEWRITE
MOVLW 042H ; WRITE KEY1
CALL EEWRITE
MOVLW 007H ; WRITE KEY2
CALL EEWRITE
MOVLW 089H ; WRITE KEY3
CALL EEWRITE
MOVLW 0E9H ; WRITE KEY4
CALL EEWRITE
MOVLW 0FBH ; WRITE KEY5
CALL EEWRITE
MOVLW 016H ; WRITE KEY6
CALL EEWRITE
MOVLW 05H ; WRITE KEY7
CALL EEWRITE

MOVLW CNT_1 ; WRITE COUNTERS TO 0

 2003-2011 Microchip Technology Inc. Confidential DS00249B_C-page 21

AN249
BANKSEL EEADR ; BANK 1
MOVWF EEADR

MOVLW 000H ; CLEAR THE COUNTERS

CALL EEWRITE ; CNT_1
CALL EEWRITE
CALL EEWRITE ; CNT_2
CALL EEWRITE
CALL EEWRITE ; CNT_3
CALL EEWRITE

MOVLW SER_ADR ; WRITE THE SERIAL_NUMBER

BANKSEL EEADR ; BANK 1
MOVWF EEADR
MOVLW 067H ; WRITE SER0
CALL EEWRITE
MOVLW 045H ; WRITE SER1
CALL EEWRITE
MOVLW 023H ; WRITE SER2
CALL EEWRITE
MOVLW 001H ; WRITE SER3
CALL EEWRITE

MOVLW SEED_ADR ; WRITE THE SEED

BANKSEL EEADR ; BANK 1
MOVWF EEADR
MOVLW 04DH ; WRITE SEED0
CALL EEWRITE
MOVLW 03CH ; WRITE SEED1
CALL EEWRITE
MOVLW 02BH ; WRITE SEED2
CALL EEWRITE
MOVLW 01AH ; WRITE SEED3
CALL EEWRITE

MOVLW CFG_ADR ; WRITE THE CONFIG WORD

BANKSEL EEADR ; BANK 1
MOVWF EEADR
MOVLW 067H ; WRITE THE LSBYTE OF THE SERIAL NUMBER TO CFG0
CALL EEWRITE
MOVLW 61H ; WRITE BITS 8 AND 9 OF THE SERIAL NUMBER TO CFG0, BSL1:0 ARE
BOTH 0
CALL EEWRITE
RETURN

END

DS00249B_C-page 22 Confidential  2003-2011 Microchip Technology Inc.

 AN249

Software License Agreement

The software supplied herewith by Microchip Technology Incorporated (the "Company") is intended and supplied to you, the Com-
pany's customer, for use solely and exclusively on Microchip prod-ucts manufactured by the company.
The software is owned by the Company and/or its supplier, and is protected under applicable copyright laws. All rights are reserved.
Any use in violation of the foregoing restrictions may subject the user to criminal sanctions under applicable laws, as well as to civil
liability for the breach of the terms and conditions of this license.
THIS SOFTWARE IS PROVIDED IN AN "AS IS" CONDITION. NO WARRANTIES, WHETHER EXPRESS, IMPLIED OR STATU-
TORY, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICU-
LAR PURPOSE APPLY TO THIS SOFTWARE. THE COMPANY SHALL NOT, IN ANY CIRCUMSTANCES, BE LIABLE FOR SPE-
CIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES, FOR ANY REASON WHATSOEVER.

APPENDIX B: HOPPING CODE LOOKUP TABLE

;*************************************************************************************
;
;FUNCTION : ENCRYPT ()
;
; DESCRIPTION : LOOKS UP THE WORD TO TRANSMIT BASED ON THE LS4 BITS OF THE
; : COUNTER (CSR0)
;
;*************************************************************************************
ENCRYPT
MOVLW 0FH ; MASK OUT THE LS4 BITS OF THE COUNTER
ANDWF CSR0,W
ADDWF PCL,F ; LOOK UP CORRECT HOP ENCRYPTED PORTION OF 
; THE WORD

GOTO TRANSMISSION_0
GOTO TRANSMISSION_1
GOTO TRANSMISSION_2
GOTO TRANSMISSION_3
GOTO TRANSMISSION_4
GOTO TRANSMISSION_5
GOTO TRANSMISSION_6
GOTO TRANSMISSION_7
GOTO TRANSMISSION_8
GOTO TRANSMISSION_9
GOTO TRANSMISSION_10
GOTO TRANSMISSION_11
GOTO TRANSMISSION_12
GOTO TRANSMISSION_13
GOTO TRANSMISSION_14
GOTO TRANSMISSION_15

 2003-2011 Microchip Technology Inc. Confidential DS00249B_C-page 23

AN249
TRANSMISSION_0 ; 21670000 IS ENCRYPTED TO 697B8411
MOVLW011H
MOVWF CSR0
MOVLW 084H
MOVWF CSR1
MOVLW 07BH
MOVWF CSR2
MOVLW 069H
MOVWF CSR3
RETLW 0 ; RETURN

TRANSMISSION_1 ; 21670001 IS ENCRYPTED TO 61C8D00B

MOVLW 00BH
MOVWF CSR0
MOVLW 0D0H
MOVWF CSR1
MOVLW 0C8H
MOVWF CSR2
MOVLW 061H
MOVWF CSR3
RETLW 0 ; RETURN

TRANSMISSION_2 ; 21670002 IS ENCRYPTED TO D7B81824

MOVLW 024H
MOVWF CSR0
MOVLW 018H
MOVWF CSR1
MOVLW 0B8H
MOVWF CSR2
MOVLW 0D7H
MOVWF CSR3
RETLW 0 ; RETURN

TRANSMISSION_3 ; 21670003 IS ENCRYPTED TO 3D4B96D1

MOVLW 0D1H
MOVWF CSR0
MOVLW 096H
MOVWF CSR1
MOVLW 04BH
MOVWF CSR2
MOVLW 03DH
MOVWF CSR3
RETLW 0 ; RETURN

DS00249B_C-page 24 Confidential  2003-2011 Microchip Technology Inc.

 AN249
TRANSMISSION_4 ; 21670004 IS ENCRYPTED TO 7AD24DE2
MOVLW 0E2H
MOVWF CSR0
MOVLW 04DH
MOVWF CSR1
MOVLW 0D2H
MOVWF CSR2
MOVLW 07AH
MOVWF CSR3
RETLW 0 ; RETURN

TRANSMISSION_5 ; 21670005 IS ENCRYPTED TO B4E77FA0

MOVLW 0A0H
MOVWF CSR0
MOVLW 07FH
MOVWF CSR1
MOVLW 0E7H
MOVWF CSR2
MOVLW 0B4H
MOVWF CSR3
RETLW 0 ; RETURN

TRANSMISSION_6 ; 21670006 IS ENCRYPTED TO A69A3DBB

MOVLW 0BBH
MOVWF CSR0
MOVLW 03DH
MOVWF CSR1
MOVLW 09AH
MOVWF CSR2
MOVLW 0A6H
MOVWF CSR3
RETLW 0 ; RETURN

TRANSMISSION_7 ; 21670007 IS ENCRYPTED TO BA5E2B7B

MOVLW 07BH
MOVWF CSR0
MOVLW 02BH
MOVWF CSR1
MOVLW 05EH
MOVWF CSR2
MOVLW 0BAH
MOVWF CSR3
RETLW 0 ; RETURN

 2003-2011 Microchip Technology Inc. Confidential DS00249B_C-page 25

AN249
TRANSMISSION_8 ; 21670008 IS ENCRYPTED TO 83052194
MOVLW 094H
MOVWF CSR0
MOVLW 021H
MOVWF CSR1
MOVLW 005H
MOVWF CSR2
MOVLW 083H
MOVWF CSR3
RETLW 0 ; RETURN

TRANSMISSION_9 ; 21670009 IS ENCRYPTED TO 9CAEC2D6

MOVLW 0D6H
MOVWF CSR0
MOVLW 0C2H
MOVWF CSR1
MOVLW 0AEH
MOVWF CSR2
MOVLW 09CH
MOVWF CSR3
RETLW 0 ; RETURN

TRANSMISSION_10 ; 2167000A IS ENCRYPTED TO 70707115

MOVLW 015H
MOVWF CSR0
MOVLW 071H
MOVWF CSR1
MOVLW 070H
MOVWF CSR2
MOVLW 070H
MOVWF CSR3
RETLW 0 ; RETURN

TRANSMISSION_11 ; 2167000B IS ENCRYPTED TO 32698325

MOVLW 025H
MOVWF CSR0
MOVLW 083H
MOVWF CSR1
MOVLW 069H
MOVWF CSR2
MOVLW 032H
MOVWF CSR3
RETLW 0 ; RETURN

DS00249B_C-page 26 Confidential  2003-2011 Microchip Technology Inc.

 AN249
TRANSMISSION_12 ; 2167000C IS ENCRYPTED TO DDB0FF0D
MOVLW 00DH
MOVWF CSR0
MOVLW 0FFH
MOVWF CSR1
MOVLW 0B0H
MOVWF CSR2
MOVLW 0DDH
MOVWF CSR3
RETLW 0 ; RETURN

TRANSMISSION_13 ; 2167000D IS ENCRYPTED TO 5926D1CB

MOVLW 0CBH
MOVWF CSR0
MOVLW 0D1H
MOVWF CSR1
MOVLW 026H
MOVWF CSR2
MOVLW 059H
MOVWF CSR3
RETLW 0 ; RETURN

TRANSMISSION_14 ; 2167000E IS ENCRYPTED TO F4D7A869

MOVLW 069H
MOVWF CSR0
MOVLW 0A8H
MOVWF CSR1
MOVLW 0D7H
MOVWF CSR2
MOVLW 0F4H
MOVWF CSR3
RETLW 0 ; RETURN

TRANSMISSION_15 ; 2167000F IS ENCRYPTED TO B8C01782

MOVLW 082H
MOVWF CSR0
MOVLW 017H
MOVWF CSR1
MOVLW 0C0H
MOVWF CSR2
MOVLW 0B8H
MOVWF CSR3
RETLW 0 ; RETURN

 2003-2011 Microchip Technology Inc. Confidential DS00249B_C-page 27

AN249
NOTES:

DS00249B_C-page 28 Confidential  2003-2011 Microchip Technology Inc.

Note the following details of the code protection feature on Microchip devices:
• Microchip products meet the specification contained in their particular Microchip Data Sheet.

• Microchip believes that its family of products is one of the most secure families of its kind on the market today, when used in the
intended manner and under normal conditions.

• There are dishonest and possibly illegal methods used to breach the code protection feature. All of these methods, to our
knowledge, require using the Microchip products in a manner outside the operating specifications contained in Microchip’s Data
Sheets. Most likely, the person doing so is engaged in theft of intellectual property.

• Microchip is willing to work with the customer who is concerned about the integrity of their code.

• Neither Microchip nor any other semiconductor manufacturer can guarantee the security of their code. Code protection does not
mean that we are guaranteeing the product as “unbreakable.”

Code protection is constantly evolving. We at Microchip are committed to continuously improving the code protection features of our
products. Attempts to break Microchip’s code protection feature may be a violation of the Digital Millennium Copyright Act. If such acts
allow unauthorized access to your software or other copyrighted work, you may have a right to sue for relief under that Act.

Information contained in this publication regarding device Trademarks

applications and the like is provided only for your convenience
The Microchip name and logo, the Microchip logo, dsPIC,
and may be superseded by updates. It is your responsibility to
KEELOQ, KEELOQ logo, MPLAB, PIC, PICmicro, PICSTART,
ensure that your application meets with your specifications.
PIC32 logo, rfPIC and UNI/O are registered trademarks of
MICROCHIP MAKES NO REPRESENTATIONS OR
Microchip Technology Incorporated in the U.S.A. and other
WARRANTIES OF ANY KIND WHETHER EXPRESS OR countries.
IMPLIED, WRITTEN OR ORAL, STATUTORY OR
OTHERWISE, RELATED TO THE INFORMATION, FilterLab, Hampshire, HI-TECH C, Linear Active Thermistor,
INCLUDING BUT NOT LIMITED TO ITS CONDITION, MXDEV, MXLAB, SEEVAL and The Embedded Control
QUALITY, PERFORMANCE, MERCHANTABILITY OR Solutions Company are registered trademarks of Microchip
FITNESS FOR PURPOSE. Microchip disclaims all liability Technology Incorporated in the U.S.A.
arising from this information and its use. Use of Microchip Analog-for-the-Digital Age, Application Maestro, chipKIT,
devices in life support and/or safety applications is entirely at chipKIT logo, CodeGuard, dsPICDEM, dsPICDEM.net,
the buyer’s risk, and the buyer agrees to defend, indemnify and dsPICworks, dsSPEAK, ECAN, ECONOMONITOR,
hold harmless Microchip from any and all damages, claims, FanSense, HI-TIDE, In-Circuit Serial Programming, ICSP,
suits, or expenses resulting from such use. No licenses are Mindi, MiWi, MPASM, MPLAB Certified logo, MPLIB,
conveyed, implicitly or otherwise, under any Microchip MPLINK, mTouch, Omniscient Code Generation, PICC,
intellectual property rights. PICC-18, PICDEM, PICDEM.net, PICkit, PICtail, REAL ICE,
rfLAB, Select Mode, Total Endurance, TSHARC,
UniWinDriver, WiperLock and ZENA are trademarks of
Microchip Technology Incorporated in the U.S.A. and other
countries.
SQTP is a service mark of Microchip Technology Incorporated
in the U.S.A.
All other trademarks mentioned herein are property of their
respective companies.
© 2003-2011, Microchip Technology Incorporated, Printed in
the U.S.A., All Rights Reserved.
Printed on recycled paper.

ISBN: 978-1-61341-276-3

Microchip received ISO/TS-16949:2002 certification for its worldwide

headquarters, design and wafer fabrication facilities in Chandler and
Tempe, Arizona; Gresham, Oregon and design centers in California
and India. The Company’s quality system processes and procedures
are for its PIC® MCUs and dsPIC® DSCs, KEELOQ® code hopping
devices, Serial EEPROMs, microperipherals, nonvolatile memory and
analog products. In addition, Microchip’s quality system for the design
and manufacture of development systems is ISO 9001:2000 certified.

 2003-2011 Microchip Technology Inc. Confidential DS00249B_C-page 29

 Worldwide Sales and Service
AMERICAS ASIA/PACIFIC ASIA/PACIFIC EUROPE
Corporate Office Asia Pacific Office India - Bangalore Austria - Wels
2355 West Chandler Blvd. Suites 3707-14, 37th Floor Tel: 91-80-3090-4444 Tel: 43-7242-2244-39
Chandler, AZ 85224-6199 Tower 6, The Gateway Fax: 91-80-3090-4123 Fax: 43-7242-2244-393
Tel: 480-792-7200 Harbour City, Kowloon India - New Delhi Denmark - Copenhagen
Fax: 480-792-7277 Hong Kong Tel: 45-4450-2828
Tel: 91-11-4160-8631
Technical Support: Tel: 852-2401-1200 Fax: 45-4485-2829
Fax: 91-11-4160-8632
http://www.microchip.com/
Fax: 852-2401-3431 France - Paris
support India - Pune
Australia - Sydney Tel: 91-20-2566-1512 Tel: 33-1-69-53-63-20
Web Address:
Tel: 61-2-9868-6733 Fax: 91-20-2566-1513 Fax: 33-1-69-30-90-79
www.microchip.com
Fax: 61-2-9868-6755 Germany - Munich
Atlanta Japan - Yokohama
China - Beijing Tel: 49-89-627-144-0
Duluth, GA Tel: 81-45-471- 6166
Tel: 86-10-8569-7000 Fax: 81-45-471-6122 Fax: 49-89-627-144-44
Tel: 678-957-9614
Fax: 86-10-8528-2104 Italy - Milan
Fax: 678-957-1455 Korea - Daegu
China - Chengdu Tel: 39-0331-742611
Boston Tel: 82-53-744-4301
Tel: 86-28-8665-5511 Fax: 39-0331-466781
Westborough, MA Fax: 82-53-744-4302
Tel: 774-760-0087 Fax: 86-28-8665-7889 Netherlands - Drunen
Korea - Seoul
Fax: 774-760-0088 China - Chongqing Tel: 82-2-554-7200 Tel: 31-416-690399
Tel: 86-23-8980-9588 Fax: 82-2-558-5932 or Fax: 31-416-690340
Chicago
Itasca, IL Fax: 86-23-8980-9500 82-2-558-5934 Spain - Madrid
Tel: 630-285-0071 China - Hangzhou Tel: 34-91-708-08-90
Malaysia - Kuala Lumpur
Fax: 630-285-0075 Tel: 86-571-2819-3180 Tel: 60-3-6201-9857 Fax: 34-91-708-08-91
Cleveland Fax: 86-571-2819-3189 Fax: 60-3-6201-9859 UK - Wokingham
Independence, OH China - Hong Kong SAR Tel: 44-118-921-5869
Malaysia - Penang
Tel: 216-447-0464 Tel: 852-2401-1200 Fax: 44-118-921-5820
Tel: 60-4-227-8870
Fax: 216-447-0643 Fax: 852-2401-3431 Fax: 60-4-227-4068
Dallas China - Nanjing Philippines - Manila
Addison, TX Tel: 86-25-8473-2460 Tel: 63-2-634-9065
Tel: 972-818-7423 Fax: 86-25-8473-2470 Fax: 63-2-634-9069
Fax: 972-818-2924
China - Qingdao Singapore
Detroit Tel: 86-532-8502-7355 Tel: 65-6334-8870
Farmington Hills, MI
Fax: 86-532-8502-7205 Fax: 65-6334-8850
Tel: 248-538-2250
Fax: 248-538-2260 China - Shanghai Taiwan - Hsin Chu
Tel: 86-21-5407-5533 Tel: 886-3-6578-300
Indianapolis Fax: 86-21-5407-5066 Fax: 886-3-6578-370
Noblesville, IN
Tel: 317-773-8323 China - Shenyang Taiwan - Kaohsiung
Fax: 317-773-5453 Tel: 86-24-2334-2829 Tel: 886-7-213-7830
Fax: 86-24-2334-2393 Fax: 886-7-330-9305
Los Angeles
Mission Viejo, CA China - Shenzhen Taiwan - Taipei
Tel: 949-462-9523 Tel: 86-755-8203-2660 Tel: 886-2-2500-6610
Fax: 949-462-9608 Fax: 86-755-8203-1760 Fax: 886-2-2508-0102

Santa Clara China - Wuhan Thailand - Bangkok

Santa Clara, CA Tel: 86-27-5980-5300 Tel: 66-2-694-1351
Tel: 408-961-6444 Fax: 86-27-5980-5118 Fax: 66-2-694-1350
Fax: 408-961-6445 China - Xian
Toronto Tel: 86-29-8833-7252
Mississauga, Ontario, Fax: 86-29-8833-7256
Canada China - Xiamen
Tel: 905-673-0699 Tel: 86-592-2388138
Fax: 905-673-6509 Fax: 86-592-2388130
China - Zhuhai
Tel: 86-756-3210040
05/02/11
Fax: 86-756-3210049

DS00249B_C-page 30 Confidential  2003-2011 Microchip Technology Inc.