HomeElectronicsInvestigating a Volvo key fob: a educated reader shares his insights

Investigating a Volvo key fob: a educated reader shares his insights

It’s at all times been fascinating to me to see which of my writeups notably resonate with the readers (as measured by metrics akin to on-line web page views and the variety of each posted public feedback and personal emails I obtain in response), and to theorize why this is likely to be the case. Unsurprisingly, for instance, teardowns constantly garner a lot of consideration. However what’s been fascinating to me is how little that curiosity from you appears to correlate to the value tag of the widget being dissected, and even to any present consciousness of it and its producer. As I instructed different staffers at EDN the opposite day whereas we have been discussing the subject:

To be sincere, there’s not a lot “science” to the matters I select for teardowns…I simply go by what I personally could be curious to poke across the insides of, beneath the idea that not less than some readers are like me. Generally probably the most cheap, oddball, and so forth. teardown topics find yourself getting probably the most reader response. I’m additionally joyful that I appear to constantly be capable to craft an fascinating (not less than to me) evaluation out of even probably the most seemingly easy teardown topic.

After all, it doesn’t damage when the general theme of a chunk is of private resonance to the viewers…

Relating to the current key fob collection, my idea is that there’s a normal sense locally that automakers rip off automobile house owners, particularly for issues like automobile characteristic upgrades and different initial-sale choices, ongoing upkeep (each components and labor), and “aftermarket” updates. I think that my writeups tapped into that angst, translating into reader curiosity.


That collection, for these of you who haven’t already seen it, to this point contains two weblog posts:

Adopted by a teardown:

One touch upon that second weblog put up, from reader “chargehanger”, was particularly intriguing:

The BOM [editor note: bill of materials cost] for this key fob is round 19 Euro [editor note: approximately $19.82 USD as I write these words].

On condition that I’d paid my native Volvo seller $570, inclusive of “labor”, for a substitute key fob, I wasn’t going to go away that remark unexplored. So, within the subsequent teardown, I referenced the sooner remark from “chargehanger”, following up with what I hoped could be a too-tempting-to-ignore invitation:

I might love any further perception you possibly can provide, “chargehanger” (or anybody else educated on the subject, for that matter) as to the way you got here up with that BOM determine.

Fortunately, as we are saying again in my start state of Indiana, he “took the bait”. Christoph Riehl (aka “chargehanger”, full with the appropriately named web site www.chargehanger.com the place he sells overhead cable holders for EVs) emailed me originally of June:

Whats up Brian,

I simply learn your article on EDN.

I used to be the one supplying you with a touch on the BOM value for the important thing fob.

I used to be concerned within the growth of this key, a very long time in the past, and I can provide you some insights (throughout the limits of not breaking commerce secrets and techniques, in fact)

I, in fact, took him up on his provide that exact same day:


Good to “meet” you! Hope you loved my teardown piece.

I’d like to publish any insights you may give you the chance and keen to offer on the product’s growth, characteristic set, invoice of supplies and/or anything you suppose could be of curiosity to the viewers.

What follows is his response despatched to me a number of days later, solely evenly edited by me for readability:

Whats up Brian,

I used to be working at Siemens VDO (which then grew to become Continental), primarily having RF subsystem tasks, and I labored on this key fob system.

I haven’t been within the business for 10 years, so all this can be a bit dated.

All my statements listed below are publicly out there data, so no commerce secrets and techniques have been damaged, and you’ll publish this.

There are mainly 3 sorts of conventional key fobs, however this Volvo secret’s an fascinating particular case:

  • Immobilizer-only fobs, with a mechanical key blade and immobilizer transponder tablet (now not constructed, for not less than 15 years)
  • RKE [editor note: remote keyless entry] fobs, with one LF [editor note: low frequency] coil and features 1, 2, and three solely [editor note: keep reading for function descriptions]. The everyday fob manufacturing value right here is about 9 Euro, not together with the important thing blade.
  • Passive entry/passive begin key fobs. The everyday fob manufacturing value right here is 13 Euro and not using a key blade, additionally with out metallic within the housing.

Entry and begin are advanced techniques, with many interlinked microcontrollers and generally with further intentional complexity meant to discourage hacking.

Key fobs could appear conceptually easy, however they’re truly very arduous to engineer because of their low energy consumption optimization and crypto integration, in addition to the cruel environments during which they should function.

A key fob has extra features than you may suppose:

  1. Mechanical key
    In the present day typically solely seen as a backup, to open the door when the important thing or automotive battery is lifeless. Can solely begin the automotive if the old-style ignition lock, fitted with an immobilizer, authenticates the transponder.
  2. RKE (automotive opening/closing by urgent the button on the fob)
    The important thing sometimes sends out a 434 or 315 MHz sign to the automotive, with none suggestions. The sign features a “rolling code”, which is mainly a counter incremented at every use, signed cryptographically so it can’t be replayed (every code is legitimate for just one use). Typical vary: 20m
  3. Immobilizer begin (transponder)
    The important thing fob can be utilized to begin the automotive with a RFID-style passive transponder at 120 kHz. It makes use of a proprietary protocol based mostly on a crypto problem/response that authenticates the fob to the engine controller. The engine controller is usually put in at an deliberately hard-to-access location so it can’t be simply “swapped” so as to steal the automotive. The immobilizer reader can energy the fob controller via one of many LF coils. The important thing fob can subsequently perform even when no battery is current, and even when the important thing fob is rotted away by corrosion (to wit, the LF circuit is selectively varnished in order that it may possibly survive practically something). When the important thing battery is lifeless, you possibly can open the door with the mechanical key and begin the automotive by placing the important thing into/onto the immobilizer reader. Typical vary: 10cm.
  4. Passive entry
    When the driving force pulls on the automotive deal with, in addition to on a cyclic foundation, the automotive sends out a 120 kHz wakeup sign with a crypto problem. If in LF vary (sometimes 2m) the important thing fob wakes up, calculates crypto, locates itself with LF discipline energy measurements, and solutions to the automotive by transmitting on the RF hyperlink. The localization step is vital not solely to examine if the fob is close to sufficient, but additionally to find out whether it is at the moment inside or outdoors the automotive (If inside, no locking is allowed, however beginning is allowed. Outdoors is the reverse). Localization often requires 3-6 LF antennas, distributed strategically within the automotive inside and handles. Localization makes use of a 3D antenna on the important thing fob. The LF hyperlink is unidirectional solely; the prolonged 2m vary doesn’t permit the fob to transmit, even when typically the identical antennas are used for bidirectional immobilization. Listening on a regular basis makes the important thing fob battery final a lot much less lengthy than with primary RKE-only keys.
  5. Passive begin
    When urgent the beginning button, the identical primary steps as with perform 4 occur, this time to permit the engine to begin provided that the bottom line is contained in the automotive. Working vary is diminished to “contained in the automotive solely”.

Fashionable techniques use Bluetooth along side a telephone, or UWB. Rising UWB may be made resistant to relay assaults as a result of it may possibly make a safe time-of-flight measurement. In distinction, all different present applied sciences are by precept susceptible to relay assaults. The vulnerability of legacy techniques was extensively identified within the business, however no different existed previous to UWB turning into out there inexpensively. Subsequently, previous to UWB, OEMs and suppliers simply “ignored” the issue, counting on the perceived technical complexity of relay assaults to reduce its chance of incidence.

Your 6-button Volvo key fob appears to have a number of ripped-off elements on the base of the RF antenna, near the CC1020 transceiver. In case you changed them, the fob may work once more.

It’s a “particular case” key fob as a result of it has a bidirectional 100m vary RF hyperlink (utilizing 900 MHz in US). It could actually additionally show the automotive standing on LEDs if you happen to press the “i” key. “Assured” 100m is sort of tough to realize given the important thing fob’s small type issue constraints; that is the rationale for the 2 huge batteries, together with the advanced bidirectional RF transceiver based mostly on the CC1020.

The 5-button model of the design is a a lot easier RKE key with out suggestions and with solely 20m vary.

The large part talked about in your teardown is a reception antenna, however not for 902 MHz, as you assumed. It’s for 3D reception at 120 kHz.

The principle chip within the design is the frequent PCF7953 [editor note: this is the IC I’d referred to as the “F7953C05” in my earlier teardown, and is based on a Philips Semiconductor-now-NXP Semiconductors low-power, 8-bit microcontroller architecture], which integrates all the things besides the RF circuitry. Newer chips may embody the RF transmitter.

Relating to your remark “a membrane which presumably is current to present the good key some semblance of moisture and broader environmental resistance”, sure! Fobs basically are engineered to resist a number of abuse, examined to (for instance) come out nonetheless working after a number of washing-machine 90°C wash cycles. The watertightness can fail after some years, when supplies degrade, however the silicone membrane in your case does probably not age. Sadly, snow blowers weren’t thought of within the design specs 😉

Tough and fast beneficiant BOM value estimation for the PCB, in excessive quantity, and previous to current COVID-induced chip shortages:

  • CC1020: 2,7 Euro [editor note: approximately $2.82 USD]
  • PCF7953: 2,5 Euro [~$2.61 USD]
  • Whole for different small elements: 4 Euro [~$4.17 USD]
  • Board: 2 Euro [~$2.09 USD]
  • Labor: 2 Euro [~$2.09 USD]
  • Overhead: 3 Euro [~$3.13 USD]

Actual prices are most likely decrease.

Christophe concluded with some additional-information hyperlinks for additional reader analysis:

I’d prefer to thank Christophe Riehl for his generosity each in taking the time to jot down me in such size and element, for his willingness to share his insights with different readers, and for the extraordinarily fascinating info he’s offered. I think he’ll additionally see this writeup, so I encourage you to go away him (and me) your questions and different ideas within the feedback!

Brian Dipert is Editor-in-Chief of the Edge AI and Imaginative and prescient Alliance, and a Senior Analyst at BDTI and Editor-in-Chief of InsideDSP, the corporate’s on-line e-newsletter.

Associated Content material



Please enter your comment!
Please enter your name here

Most Popular

Recent Comments