Key fob testing

Ask any non-NVH related questions about using PicoDiagnostics software here.
Post Reply
User avatar
RYM6746
TwoWaves
TwoWaves
Posts: 186
Joined: Tue Nov 01, 2016 8:58 am

Key fob testing

Post by RYM6746 »

Hi everyone. Has anyone figured out a way to sniff the signal from a key fob and display the signal using the Pico. There is a couple of good vids on you tube using oscilloscope to show the signal but I tried there methods with no success. I know we have the parking sensor and keyless entry probes. SURELY a key fob probe would be in higher demand as virtually every vehicle now has a fob of some description. I have one of those led IR and RF tools but I had a faulty fob that would illuminate the led on the tool but wouldn't unlock the car. A new fob fixed that problem. Any ideas are appreciated. C'mon Pico I am SURE a fob probe would be a big seller for you and a great help to us.

volrem
TwoWaves
TwoWaves
Posts: 243
Joined: Fri Jan 03, 2014 3:43 pm
Location: Estonia

Re: Key fob testing

Post by volrem »

You have to consider the fact that remote is operational but data that is being sent out is incorrect to unlock/lock car. So even if you can measure signal with Pico you cannot verify it's correct.

Pico and keyfob tester would probably give you same results. False positive possibly.

User avatar
RYM6746
TwoWaves
TwoWaves
Posts: 186
Joined: Tue Nov 01, 2016 8:58 am

Re: Key fob testing

Post by RYM6746 »

Just want to see a square waveform not decode it. I want to see more information than a flashing led. Looking closely at the led tool after having a new key to compare it too, you could see a difference in the amount and length of the led flashes. Just trying to achieve the level of information you get using a scope as seen on you tube. Any one managed to achieve sniffing a fob using pico? If so please inform? Thanks in advance

mcmullanryan
Newbie
Posts: 7
Joined: Wed May 18, 2016 9:58 pm

Re: Key fob testing

Post by mcmullanryan »

When I have had faults like this an option is to go to the RF receiver, from there you can capture the signal in serial form . A little while back I had a transit mk7 with rcl not working, customer had only purchased this key a little more than a month prior hence me going this route. The key when tested was putting out 434Mhz, no DTC present and fuses ect ok so next step was to back probe Linbus on receiver, which showed §it was not picking up/converting signal, I then tried a new un-programmed remote and this was picked up by receiver, so remote was faulty (data sent corrupt identifier possibly). This same procedure can be used on many makes and models with external receiver and even internal receivers when combined in BCM ect. I would imagine it a rare thing that many would go to such lengths to confirm this fault though, if customer only has 1x key I recommend they get a spare and most times this would resolve the issue anyway.

User avatar
RYM6746
TwoWaves
TwoWaves
Posts: 186
Joined: Tue Nov 01, 2016 8:58 am

Re: Key fob testing

Post by RYM6746 »

Sounds good. How would you test for serial data with the aerial built in the BCM? Surely this would be a bit more tricky/time consuming than hooking up an aerial to the Pico scope and pushing a button?

mcmullanryan
Newbie
Posts: 7
Joined: Wed May 18, 2016 9:58 pm

Re: Key fob testing

Post by mcmullanryan »

Regarding in-built receiver yes it would be more involved, I was just making the point that this could also be done. Checking the data at the receiver will tell you if the remote is sending correct Identifier and receiver is working as should (part of many manufacturer test plans). As already mentioned in a previous post the ability to capture the RF signal with the PicoScope via aerial attachment would tell you no more than the RF reader that you already have. In order for the data to be of any use the tool would need to be able to decode the RF of all manufactured remote transmitters to serial and this being such a rare fault it is not likely to warrant the time and investment that would be required, in my eyes anyway. Also bear in mind the data that the remote transmits will change with each successful use, only identifier and some other bits will remain the same.This is why I suggest you check the serial data line from receiver in car of which most use external anyway or offer a new remote key.

User avatar
RYM6746
TwoWaves
TwoWaves
Posts: 186
Joined: Tue Nov 01, 2016 8:58 am

Re: Key fob testing

Post by RYM6746 »

How would you check the serial data from a BCM with the aerial built in? I fail to see how you could proove the signal has been received correctly? My point with this thread is that in this video it would appear to be alot easier to use the scope https://youtu.be/-m5W-bRB-50 I know he decodes the signal in the video, I am not trying to achieve that level of testing. I am trying to achieve the sync and code waveform though. Surely comparing it to a faulty fob, there would be a difference? I have never done it so I might be wrong. I understand it may not be obvious to an amateur but if we all collected and shared known goods from different manafactures it would become much easier. My point is alot of people don't have a second fob and testing serial data would most likely be time consuming and new fobs can be expensive, after watching the you tube video I thought it would be far quicker, easier and provide much more detail than a flashing led. I also thought this would be a good opportunity for pico to make another great tool to go with there scope. If they can decode can bus messages and provide great training videos to do what at first seemed an almost impossible task surely a key fob would be a walk in the park? Maybe I am wrong? It was only a suggestion!

ben.martins
Pico Staff Member
Pico Staff Member
Posts: 539
Joined: Tue May 16, 2017 1:02 pm

Re: Key fob testing

Post by ben.martins »

Hello RYM,

Thank you for your suggestion and please be assured it's on the wish list.

I have previously watched this video and was intrigued to say the least as I've had the same issue you've had where even though the LED lit up, there was still no signal being emitted from the key fob.

I have played around with a receiver from a vehicle, giving it a power supply and scoping the output signals. I did have some success but the problem would be the power supply for something like this to our scope. As you mention there may be issues with security issues if we can decode this signal. However, if we can see the structure and have an an idea of what is good and what isn't should help with our diagnosis.

Thank you all for your continued support and please keep sending us suggestions with potential new products you would like to see. I believed in the product before I started working for Pico and hopefully we can all continue to make it the best it can possible be and hopefully save us time in diagnosing!!

Kind regards

Ben

ashtray1987
OneWave
OneWave
Posts: 48
Joined: Tue Jul 25, 2017 11:52 am

Re: Key fob testing

Post by ashtray1987 »

Hi Guys,

In my opinion trying to test a key fob, with a carrier frequency of around 433Mhz is not possible with an oscilloscope with 20Mhz bandwidth.

You would need an oscilloscope with a bandwidth of at least 1Ghz to perform these measurements. These type of scopes are incredibly expensive.

What would be better is to purchase an inexpensive USB SDR (Software Defined Radio) device that can easily pickup key signals. Try the Nooelec MINI SDR, its about 20USD and use SDR# software (free).

Hope this helps.
Cheers
Ash

AndyM535
OneWave
OneWave
Posts: 15
Joined: Mon Aug 05, 2019 10:11 pm

Re: Key fob testing

Post by AndyM535 »

I've got a RF Explorer (6G combo) handheld spectrum analyser. That can easily see that the fob is transmitting something and it tells you the signal frequency and power but it would be quite a stretch to decode the signal 'off air.' It does have a USB interface so you could use a PC for data capture and analysis. Perhaps that's something to add to Pico Diagnostics?

http://rfexplorer.com has some details

This is what it sees when I click the button on my car key...
Attachments
fullsizeoutput_e5d.jpeg

Post Reply