Repairing a remote car key

I’ve had this lying in a drawer for some time, it stopped working from one moment to the other. Imagine unlocking your car, driving around some, and then being unable to lock it again. Good thing that mechanical locks are not totally uncommon. I still had one remote in spare though, and together with a bought new one the set was complete once again. To be precise, these are pretty old models (’94-’96) made by Volvo and cost some 40 Euros or thereabouts. I would guess that is pretty much the same for each car manufacturer, as are the inner workings.

All was well until another key broke down – same procedure, different day. Maybe static electricity was to blame, I don’t know. But it made me wonder if it could be fixed – so I cracked it open.

Volvo remote keyThis picture was taken after the repair, which explains the flux residues ;-). The circuit you are seeing can be identified using an EPCOS resonator AppNote linked at the bottom of this article. The resonator (marked in picture) is a S+M R701, manufactured by Siemens Matsushita Components, a joint venture that later brought forth EPCOS. While there are other manufacturers like RFM, these models seem to be a pretty common brand for such keys as far as I have seen. Inside the metallic-ceramic casing is a parallel LC resonance circuit which has been precisely trimmed for a specific resonant frequency. The current types are mostly pin compatible to the old ones.

Just in case: Those resonators cost you a few cents at Farnell, but I would guess Digikey also has them. Use the datasheets to get the correct one for your frequency and pin layout. They are a real pain in the ass to solder by hand! But, to be fair, they were not really designed for it. Use hot air or reflow techniques if you can, or else heat the ground plane from the side, OR remove the resonator by applying a small amount of solder to the case top and heat it up completely. Take care not to rip the copper traces off the pcb, as the glue keeping them there becomes flexible when overheated. To solder on the new one, place it onto the cleaned pads and flow solder underneath the pins from the side, for each pin individually. Do not heat the resonator for too long. I did it like this twice, but as said – pain!

A good place to start is the EPCOS R920 resonator.

As I found out later, the resonator was perfectly working. I swapped it anyways – even swapped the old one back once I found the error – to make sure, but the real culprit was the HF output transistor which I have marked in the lower left.

How it works, in easy words: The signal generated by the microcontroller is a digital pulse signal containing the remote code. This signal is fed into the resonator through a resistor and a capacitor, and from the resonator back through said capacitor to the base of the output transistor. The resistor limits the output impedance of the controller pin to prevent it from clamping the transistor base to a fixed voltage and allow the resonator to overlay an AC component onto the DC voltage. Now, as the resonator…well…resonates at its designed frequency, excited by the impulse coming through the capacitor when the controller pin turns ON, the resonance waveform is coupled into the base of the transistor, which in turn amplifies it and pushes it out onto the antenna. Imagine repeatedly hitting a tuning fork with a small hammer and touching it to stop the vibration in a certain pattern while picking up the generated sound with a microphone to amplify it.

What you get is a high frequency signal during each high-level time of the remote code signal and no signal during each low-level time. This is called OOK, or on-off-keying. It can be seen as an extreme example of amplitude modulation (AM), and the principle is identical to the way TV remotes work – only that RF is used instead of IR light. There is a lot more theory behind this, you can look it up in dedicated books about high frequency circuits and transmitter circuits. As for this circuit, have a look at page 6 of the AppNote linked below. It features a standard circuit that very closely resembles my remote key, plus a detailed function explanation.

Back to the repair – checking the original transistor with a standard multimeter showed proper diode behaviour (meaning it was a bijunction npn or pnp transistor), but this is not always sufficient for a diagnosis of a working device in HF circuits. The output to the antenna (the copper strip along the left edge) appeared near-zero and the pulse signal after the coupling resistor was pretty deformed, too. With some remote keys you can test the RF output by holding a radio scanner set to 433,92 MHz or whatever frequency the key uses next to it and listening for pulsing tones/noise upon a key press. If you don’t get any response, you are either unable to hear the specific modulation (uncommon, as the modulation is pretty slow to ensure good reception) or the transmitter is (still) be broken. In the end, you probably have to find out by trial and error. Owning a GHz scope greatly simplifies the task, of course. I don’t, so I’d advise you to first swap the transistor and then the resonator. R/C/L are pretty uncommon to fail, whereas the transistor is sensitive to static electricity like most semiconductors. What you can measure, though, is the pulse signal from the controller.

Now, to get a suitable replacement, you can either buy a transistor that works for frequencies up to above the operating frequency of your device and has the same pinout – or you can simply go look for a cheap remote controllable wall socket, wireless weather station or the likes. Whatever you choose should use the same frequency, of course, and run on batteries. The probability of finding a suitable transistor inside such a transmitting device is very high. This will be the one nearest the feeding point of the antenna, like in the picture above. You’ll need to confirm the pinout by looking into the circuit or searching for a datasheet by the SMD marking on the case – if present.

I had to try two different transistors, the first one was probably already dead before transplantation (I already wondered why I never used that remote control). A second one worked like a charm! I have noted the designation of the found replacement in the picture above. The last thing to try is the range, but there is not much to gain with only about 3V of operating voltage – ideally, you’ll get whatever range the key had before. If the range is much less, the transistor is most likely not up to the job.

Remember that most car keys “forget” their assigned codes upon battery removal. You will need to reassign the key to your vehicle according to the proper method designated by the manufacturer.

Links: