Hopefully, lots of you could have already learn the two-part travail of my robust Tile tracker and what it helped me find: a Volvo key fob inadvertently “eaten” by my Honda snowblower earlier that very same day. If not, I encourage you to click on via the hyperlinks and get caught up earlier than coming again right here; if nothing else, you’ll possible find yourself with a chuckle (at my expense, after all).
I’m writing these phrases in the beginning of April, spring has sprung (sorta…that is Colorado, in any case), and the snow berm in entrance of my home (to which the snowblower had deposited the important thing fob within the first place, after first dismembering it) is virtually totally melted. Nevertheless, up to now I’ve solely been capable of finding a couple of items of the important thing fob scattered amidst the vegetation, bushes and bushes:
- Many of the outer case, together with the entrance panel button meeting
- One of many two CR2430 batteries, and
- The PCB contained in the case, which you’ll see shortly
As that final remark foreshadows—if the title of this piece wasn’t already sufficient of a tip off—I intend to actualize the “When life offers you lemons, make lemonade” aphorism by doing a teardown and evaluation on the remnants. Within the course of, I additionally aspire to realize some conceptual perception into how this stuff work.
place to start out on the second aspiration is by determining what to name this factor within the first place. The aforementioned “key fob” is a widespread time period, though Wikipedia prefers “good key.” It’s a key (pun meant) piece of the (extra Wikipedia lingo) “distant keyless system”:
A wise entry system is an digital lock that controls entry to a constructing or car with out utilizing a standard mechanical key. The time period keyless entry system initially meant a lock managed by a keypad situated at or close to the driving force’s door, which required getting into a predetermined (or self-programmed) numeric code. Such techniques now have a hidden touch-activated keypad and are nonetheless accessible on sure Ford and Lincoln fashions. The time period distant keyless system (RKS), additionally referred to as keyless entry or distant central locking, refers to a lock that makes use of an digital distant management as a key which is activated by a handheld system or mechanically by proximity. Extensively utilized in cars, an RKS performs the features of a regular automobile key with out bodily contact. When inside a couple of yards of the automobile, urgent a button on the distant can lock or unlock the doorways, and will carry out different features. A distant keyless system can embrace each a distant keyless entry system (RKE), which unlocks the doorways, and a distant keyless ignition system (RKI), which begins the engine.
The car related to my good secret’s a 2008 mannequin 12 months Volvo XC70 AWD. From what I can collect from on-line analysis coupled with candid vendor discussions, prior mannequin 12 months Volvos used an initially “dumb” key fob that the proprietor might uniquely mate to the actual car him/herself through a “customized” working mode (analogous to the way you hyperlink a storage door distant management to the receiver within the motor meeting). And newer Volvos paradoxically return to this similar user-friendly method, apparently. However starting with my mannequin 12 months, and for a number of years, Volvo good keys got here pre-programmed with a customized code (printed out on an all-important piece of paper) that solely the vendor might (expensively) mate to the automobile. Fortunate me.
As soon as preliminary mating is profitable, operation is conceptually easy, albeit with implementation nuances between producers and fashions. My good secret’s comparatively elementary compared to newer implementations of the idea: built-in buttons permit me to unlock and disarm (one press for driver, a second for all) and lock (all) doorways (these buttons apparently can also management the home windows…I admittedly didn’t know that till I re-read the consumer guide earlier at present whereas researching this piece), illuminate exterior lights as you method, and distinctly unlock and disarm solely the tailgate. There’s additionally a “panic” button that honks the horn and flashes the car lights in case you press it, and an “info” button that works along side inexperienced (higher left), yellow (higher proper) and twin purple (decrease left) LEDs surrounding the button matrix and tells you if the car is unlocked, locked, or alarm-activated (in addition to, within the latter case, if the car senses that somebody’s inside).
When you’ve entered the automobile, baseline beginning of the car entails inserting the important thing in a dashboard slot the place a motor feeds it right into a locked working place, then urgent the “Begin Cease Engine” button subsequent to it.
Sadly, the hot button is liable to getting caught on this place:
Luckily, in my explicit case (as soon as once more, till researching at present I didn’t understand how “particular” I used to be) my automobile apparently got here with an choice (the aforementioned RKI within the Wikipedia entry) that enables me to additionally begin the automobile with the good key nonetheless in my pocket (or elsewhere), so long as I’m sitting within the driver seat and the wi-fi connectivity between the good key and automobile isn’t being RF-blocked. Cool.
That stated, referencing my earlier “elementary compared to newer implementations of the idea” remark, I’m nonetheless not that cool. Contemplate, for instance, my spouse’s Land Rover Discovery; she will lock or unlock no matter door she’s in proximity to solely through a capacitive swap activation on the door deal with, with out eradicating her good key from her purse in any respect removed from urgent buttons on it (once more, so long as the wi-fi connectivity between the good key and automobile isn’t being RF-blocked). That stated, because the vendor I just lately conversed with confirmed, there’s a notable draw back to this method: the good secret’s out of necessity always broadcasting, which has a deleterious impact on battery life. On a number of events already within the few years we’ve owned it, she’s wanted to put the important thing in opposition to the steering column in a specific location so as to have the ability to begin the automobile (which entails inductively-coupled supplemental wi-fi energy switch), instantly adopted by a wise key battery alternative by yours actually as soon as we safely get house (for apparent causes, I hold spares available always). Newer Volvos as an alternative put this “particular spot” within the middle console:
Conceptual therapy concluded, let’s get to the evaluation of at present’s topic. The 2 halves of the case have been already separated (to not point out torn asunder from the backup steel key, which remained connected to the Tile Mate and my others) when I discovered them. I’d briefly pressed them again collectively for the sooner photographs. Right here’s a considerably extra correct semblance of actuality as I got here throughout it (now think about them buried deep in a pile of snow):
Flip them over and the PCB comes into preliminary view:
Because the case was busted, the PCB lifted proper out:
In-between the button matrix and the PCB is a “membrane” which presumably is current to provide the good key some semblance of moisture and broader environmental resistance:
However the PCB’s what we care about most, proper?
Detaching a few retention tabs permits the multi-button meeting to carry proper off, bringing the circuitry on the entrance aspect of the PCB into full view:
Instantly seen are the six switches, three of them in proximity to the sooner talked about info LEDs. And at one finish of the PC is an IC marked CC1020, which seems to be a “single-chip FSK/OOK CMOS wi-fi transceiver for narrowband apps in 402-470 and 804-940 MHz vary.” Right here’s a hyperlink to the product web page for Texas Devices’ variant of the chip, though the seller marking on this explicit IC is unknown to me.
In distinction, though the supply of the opposite IC (in the course of the swap matrix) is indeniable, its operate is considerably mysterious. Labeled F7953C05 and with a Philips Semiconductor stamp on it, Google analysis suggests that it’s extra just lately equipped by NXP Semiconductor (which is smart, since NXP was created in 2006 from Philips’ spin-off of its semiconductor division)…however I can’t even discover a product web page for it, removed from a datasheet.
To be taught extra, I’m going to briefly divert your consideration to a closeup view of one of many different case fragments:
There’s simply sufficient plastic nonetheless intact to allow me to discern the FCC ID, KR55WK49266, which as-usual led me to an abundance of further info. Amongst different issues, take a look at this block diagram from the VDO (the German model of Continental Automotive, beforehand a part of Siemens) consumer guide, a extra discernable model of which I snagged from one other supply:
My assumption is that all the pieces throughout the blue rectangle is dealt with throughout the F7953C05, with the CC1020 tackling the RF Stage operate. And looking back, the dearth of public info on the F7953C05 compared to different ICs I analysis in these teardowns isn’t that shocking (though Google did disclose to me that BMW makes use of the identical IC in a few of its good keys). In any case, no producer needs somebody aside from the proprietor to have the ability to unlock and enter the car, removed from begin it and drive it away—a grim situation that Honda paradoxically skilled only a few days earlier than I sat down to jot down. One factor I nonetheless don’t know for positive (however assume), for instance, is that if the Volvo system employs “rolling code.” Wikipedia once more:
Most keyless techniques use a way referred to as rolling code to keep away from replay assaults, wherein the open command is intercepted for use by a thief at a later time. Within the rolling code, a pseudorandom quantity generator is used to generate a unique unlock sequence to be despatched every time the automobile is unlocked.
One different factor to notice on this aspect of the circuit board is the “PCB loop antenna” for transmission, which routes above the highest 4 buttons. And talking of PCBs, we haven’t but taken an in depth have a look at the opposite aspect; let’s repair that omission:
The little bit of shiny steel in a single quadrant, which to me appears to be like one thing like a German Iron Cross, is the unfavorable terminal for the decrease CR2430 within the two-battery “sandwich” (oddly, by the best way, the aforementioned Siemens-now-Continental consumer information says that the good key takes solely one battery). However that’s possible not what first caught your eye. What’s the take care of the sizeable mysterious soldered-down gray sq. factor containing the next topside advertising?
232D
H743
At first I assumed that this was the supply of the transmitter’s encrypted-data processing. Seems, although, that per FCC inner photographs it’s simply the reception antenna (once more, word the PCB-embedded antenna surrounding it on the fringe of the circuit board). A reception antenna? Why? Effectively, in line with the FCC documentation, this good key operates at two completely different frequencies, 902.16 MHz and 903.575 MHz (though curiously, Wikipedia signifies that “most RKEs function at a frequency of 315 MHz for North America-made vehicles and at 433.92 MHz for European, Japanese and Asian vehicles”…the latter explaining the choice frequencies dealt with by the CC1020). And quoting from the consumer guide (with spelling correction by yours actually):
The RF distant management system consists of a distant key which is a RF transmitter / receiver and a RF transmitter / receiver unit on the car. The Distant Secret is used to transmit info for locking or unlocking the car (as additionally Trunk Lid/Method Gentle/Panic /consolation open/Consolation Shut/Test car standing/Passive lock/passive unlock/passive begin operations) by a bidirectional RF transmission line for regular distant operation by urgent a button.
If the telegram which was acquired from the car unit is just not corrupted the car unit will ship an acknowledgement message to the Distant key. If the acknowledgement message is just not acquired by the Distant key, the distant key will repeat the transmission on the second channel.
In closing, I assumed I’d additionally share some photographs of the intact successor good key from the vendor, to indicate you what it appears to be like like when not run via a snowblower first. To that time, because it set me again almost $600, I belief you’ll forgive me for not trying a full disassembly!
Popping off the again panel to switch the batteries is a bit nerve-wracking however not too dangerous:
And talking of $600, in my earlier write-up I intentionally-not-subtly proposed that the revenue margin on this good key was possible outrageous. Reader “chargehanger” was first to reply post-publication with the next perception (bracketed textual content is mine):
The BOM [bill of materials] for this key fob is round 19 Euro [$21 USD as I write this].
I might love any further perception you possibly can provide, “chargehanger” (or anybody else educated on the subject, for that matter) as to the way you got here up with that BOM determine. Extra usually, as all the time let me know your ideas within the feedback!
—Brian Dipert is Editor-in-Chief of the Edge AI and Imaginative and prescient Alliance, and a Senior Analyst at BDTI and Editor-in-Chief of InsideDSP, the corporate’s on-line e-newsletter.
Associated Content material
