Group Actions
Engagement
  • Author Author: Jan Cumps
  • Date Created: Date Created
  • Views 7671 views
  • Likes 13 likes
  • Comments 19 comments
Related
Recommended

A Smart Car Key - What's Inside?

Jan Cumps

I opened an end-of-life smart car key.

It uses radio for locking / unlocking and IR to switch the vehicle off and on.

image
A deep dive is available here.

 

The type of key here is one that you can use from a distance to open or close the car, but that you have to physically plug into a dashboard slot to start the engine.

When the key is removed, the engine stops.

 

The locking /  unlocking mechanism works from a distance. A few 10s of meters. It's a radio circuit powered by a coin cell.

(true story: if you press the key against your temple when using it, the range is extended by several 10s of meters)

 

To activate the car and be able to run the engine, you have to insert the key into a dedicated receptacle in the dashboard.

A bidirectional infrared bridge communicates between dashboard and key. That circuit is powered via induction.

The coil on the key gets power from a coil in the receptacle.

image

 

Let's see how many components can be identified. Chime in if you have more info.

 

1: unknown function

Maxwell 1436 PQT 711011 Q2 W

The only reference I could find was other similar keys.

 

2: unknown

ROBINIE 441KP14

I saw the following different codenames on the internet: FICHTE, APFEL, WEIDE

All are German names for trees:

Acacia, Fig, Appel, Willow

Probably an ASIC or mistified OEM.

 

3: memory

5ACAT 439YTHS

This is a Microchip 25AA640A SPI EEPROM:

image

 

4: Schottky diode

45 SOT-23 package is a jellybean Schottky

 

5: tantalium capacitor

476 6K 430

47 µF, problably 6.3 V, 1411 package

 

6: oscillator

manufacturer: Nihon Dempa Kogyo Co., Ltd. (NDK)

18.000  :49

Crystal or resonator, 18 MHz?

 

7: NPN transistor

H1 SOT-23 package is a jellybean NPN.

 

A: red LED

B: inductor: extracts power from the car. Powers the IR circuit when starting and while driving. Takes care that the IR circuit doesn't need coin cell power. 190 µH.

C: I saw this before and forgot what it was. I bet it's a fuse. edit: no a TVS. edit no it's a 6.7 nF capacitor.

D: IR sender and receiver. There's a matching inverse pair in the dashboard of the car.

image

Using my tablet as a detector (digital cameras see iR), I found that the left 2 pins are cathode and anode of the LED.

 

The two buttons are to open and close the door locks.

 

image

Parents

  • Hi Jan,

     

    Very interesting and good luck. I love a challenge and spent my 'morning hour catchup' doing some delving and found virtually nothing. A website for a Chinese clone was interesting though as the tree theme (PALME = palm in German) and similar format part number crops up:

    image

    My suggestion prior to this was that IC2 was a MCU based solely on the positioning of the SPI flash memory. The clone above used Atmel, you've already checked out the flash as Microchip and perhaps your IC2 is also an Atmel MCU? Some probing with a scope to find fixed pins might help match up against a datasheet for QFN packages - noting many MCU can configure pins to many functions, so clock, voltage and ground are the best bets.

     

    My other thoughts are SPI flash...IC2 could be an FPGA and the flash loads up on boot. The SPI flash contains an encrypted bitstream, once loaded they may instance a softcore MCU and that gets the program code from the SPI flash also. The flaw in this idea is that there is a second important looking IC. If the FPGA were employed then it would be likely whatever IC1 does would also be brought into that FPGA.

     

    IC1 I would guess is something like the Microchip Keeloq - a rolling code generator that can accept the next N in the sequence but shuts out all previous codes once a valid one is accepted. This would stop a thief inserting a simple repeater unit that could have already stolen your code e.g. by powering up the keys days earlier on a chance meeting.

     

    As as I was about to click send and do my chores for the day I notice your 'deep dive' link....so the fun will continue tonight image

Comment

  • Hi Jan,

     

    Very interesting and good luck. I love a challenge and spent my 'morning hour catchup' doing some delving and found virtually nothing. A website for a Chinese clone was interesting though as the tree theme (PALME = palm in German) and similar format part number crops up:

    image

    My suggestion prior to this was that IC2 was a MCU based solely on the positioning of the SPI flash memory. The clone above used Atmel, you've already checked out the flash as Microchip and perhaps your IC2 is also an Atmel MCU? Some probing with a scope to find fixed pins might help match up against a datasheet for QFN packages - noting many MCU can configure pins to many functions, so clock, voltage and ground are the best bets.

     

    My other thoughts are SPI flash...IC2 could be an FPGA and the flash loads up on boot. The SPI flash contains an encrypted bitstream, once loaded they may instance a softcore MCU and that gets the program code from the SPI flash also. The flaw in this idea is that there is a second important looking IC. If the FPGA were employed then it would be likely whatever IC1 does would also be brought into that FPGA.

     

    IC1 I would guess is something like the Microchip Keeloq - a rolling code generator that can accept the next N in the sequence but shuts out all previous codes once a valid one is accepted. This would stop a thief inserting a simple repeater unit that could have already stolen your code e.g. by powering up the keys days earlier on a chance meeting.

     

    As as I was about to click send and do my chores for the day I notice your 'deep dive' link....so the fun will continue tonight image

Children
No Data