My key fobs have been acting a little funny recently. Only some of the buttons on one of them would work reliably. The other one was getting shorter and shorter range until it stopped altogether. I replaced the batteries in both of them, but that didn't fix the problem in either one.
I could just buy a new one and get it reprogrammed, but I'd rather not. My car requires that it be taken to a locksmith or dealership to reprogram the key fobs. If I can just fix it myself, then I can save a couple bucks and a trip to a dealership. In the event I can't fix it myself, at least the key fob itself is pretty cheap.
Understanding the circuit
My key fobs are registered with the FCC (as most electronic equipment is), so I was able to look them up by their FCC ID to get a lot of information on them. The FCC ID of my key fobs is written on the back of the case: "KOBLEAR1XT". The FCC entry for KOBLEAR1XT has a schematic, a block diagram, and even internal photos of this device. By looking at these I was able to figure out, generally speaking, how my key fob works.
Here's the schematic from the FCC website:
KOBLEAR1XT schematic from the FCC.
And here's what the key fob circuit actually looks like:
KOBLEAR1XT circuit top and bottom.
In the picture below, I labeled the interesting bits of the circuit: the "rolling code generator IC" (a Microchip HCS361), the 315 MHz SAW resonator, 94430-T44 RF transistor, a trace used as an inductor, and the trace used as an antenna.
KOBLEAR1XT labeled circuit.
I did some digging and found out that the "rolling code generator IC" is a Microchip HCS361 (even though it's labeled as HC361 in the schematic.). I probed the PWM output of it and found that it outputs a PWM signal (duh). There are short and long pulses and short and long pauses. If you look at where the signal goes high, you can see it ripple at (I assume) 315 MHz as the transmitter draws power from the battery and causes the system voltage to droop. The short pulses and pauses are about 210 us long, and the long pulses and pauses are about 420 us long.
HC361 PWM output probed with an oscilloscope
The signal appears to consist of a synchronization frame followed by a payload. The synchronization frame is six short pulses and six long pauses followed one extra-long pulse and one extra-long pause. The extra-long pulse and pause are 2.1 ms long.
Following the synchronization sequence, the transmitter sends the data payload. The pulses in the data payload are either a short pulse followed by a long pause or a long pause followed by a short pulse. This means the period of a single bit is about 630 us. That gives a data rate of about 1.6 kbps.
The payload is 67 bits long. According to the HCS361 datasheet, it consists of 3 parts: a 32-bit hopping code, a 32-bit serial number, and 3 status bits. The status bits are used indicate to the car if it should lock, unlock, open the truck, or sound the alarm.
Fixing broken solder joints
One of my key fobs was easy to fix. First I cleaned the gold-plated contacts on the PCB. Then I resoldered the battery clip as it had broken loose from the PCB:
Broken solder joints on battery clip
Fixing a broken SAW resonator
The other key fob also had broken solder joints going to the battery, but resoldering them wasn't enough to get it working. It seemed that the resonator in my second key fob has been damaged: the top of the SAW resonator's package fell off.
The lid fell off the top of the SAW resonator in my second key fob.
Unfortunately, 315 MHz SAW resonators in this package are no longer being produced. Instead, I bought a 312 MHz resonator and a 318 MHz resonator hoping that they would be close enough to get my key fob working again.
|Part Number|Description|Package|Price| |---|---|---| |RO3132A|312 MHZ SAW Resonator|4-SMD|$1.44| |RO3118A|318 MHZ SAW Resonator|4-SMD|$1.26|
First, I desoldered the old broken resonator and replaced it with the new 312 MHz resonator:
Soldering the 312 MHz resonator into place.
I fired up my oscilloscope, probed the output of the RF transistor, and pressed a button on the key FOB. I saw high-frequency noise in the pulses and no high-frequency noise in the pauses between them. I took that as a sign that the resonator was working and assumed that the high-frequency noise was probably 312 MHz.
Scope shot showing the PWM output of the code generator with a high-frequency component when the code generator is outputting a logic high.
Testing it out
After reassembling the key fob, it was time to test it out. I walked out to the parking lot and hit the lock button on the key fob with the new 312 MHz resonator. Nothing. I tried locking my car with the other key fob that I knew worked, and the car locked. I was in range for the working key fob, but the modified key fob wasn't working. Dang.
I walked closer to the car and continued to press the lock button on the modified key fob. Nothing happened until I was within about 15 of my car's trunk (where the keyless entry reciever is located. Once I was really close to the car, I was able to lock and unlock the car again with the modified key fob. Success!
What's wrong?
So the key fob works with the new 312 MHz resonator, but it has a diminished range. Why? Well, the receiver probably has a band pass filter centered at 315 MHz. That band pass filter attenuates the 312 MHz signal from the fixed key fob, and an attenuated signal means shorter range.
Now I'm left with two options: 1) live with the shorter range of the modified key fob, or 2) try to find a 315 MHz resonator that kind of fits where the old one was. I can't get a 315 MHz resonator in the exact right package, but it's possible that one exists where the two active terminals are approximately the same distance apart as they were on the original resonator.
For the moment, I'm happy with the reduced range. I'll revisit this topic later when I feel the need to fix my modified key fob's range. In the mean time, I'm just happy to have two working key fobs again!
Have you done something similar with your car/car accessories? Let me know in the comments!
Photo by Jessica Paterson