It’s all the time been fascinating to me to see which of my writeups significantly resonate with the readers (as measured by metrics similar to on-line web page views and the variety of each posted public feedback and personal emails I obtain in response), and to theorize why this is likely to be the case. Unsurprisingly, for instance, teardowns constantly garner numerous consideration. However what’s been fascinating to me is how little that curiosity from you appears to correlate to the value tag of the widget being dissected, and even to any current consciousness of it and its producer. As I advised different staffers at EDN the opposite day whereas we had been discussing the subject:
To be sincere, there’s not a lot “science” to the subjects I select for teardowns…I simply go by what I personally could be curious to poke across the insides of, underneath the belief that at the least some readers are like me. Generally essentially the most cheap, oddball, and many others. teardown topics find yourself getting essentially the most reader response. I’m additionally completely happy that I appear to constantly be capable to craft an fascinating (at the least to me) evaluation out of even essentially the most seemingly easy teardown topic.
After all, it doesn’t damage when the general theme of a bit is of private resonance to the viewers…
Relating to the latest key fob collection, my idea is that there’s a normal sense in the neighborhood that automakers rip off automobile homeowners, particularly for issues like automobile function upgrades and different initial-sale choices, ongoing upkeep (each components and labor), and “aftermarket” updates. I think that my writeups tapped into that angst, translating into reader curiosity.
That collection, for these of you who haven’t already seen it, thus far contains two weblog posts:
Adopted by a teardown:
One touch upon that second weblog submit, from reader “chargehanger”, was particularly intriguing:
The BOM [editor note: bill of materials cost] for this key fob is round 19 Euro [editor note: approximately $19.82 USD as I write these words].
On condition that I’d paid my native Volvo seller $570, inclusive of “labor”, for a alternative key fob, I wasn’t going to go away that remark unexplored. So, within the subsequent teardown, I referenced the sooner remark from “chargehanger”, following up with what I hoped could be a too-tempting-to-ignore invitation:
I’d love any further perception you possibly can provide, “chargehanger” (or anybody else educated on the subject, for that matter) as to the way you got here up with that BOM determine.
Fortunately, as we are saying again in my beginning state of Indiana, he “took the bait”. Christoph Riehl (aka “chargehanger”, full with the appropriately named web site www.chargehanger.com the place he sells overhead cable holders for EVs) emailed me at first of June:
Good day Brian,
I simply learn your article on EDN.
I used to be the one supplying you with a touch on the BOM value for the important thing fob.
I used to be concerned within the improvement of this key, a very long time in the past, and I can provide you some insights (throughout the limits of not breaking commerce secrets and techniques, after all)
I, after all, took him up on his supply that exact same day:
Christophe,
Good to “meet” you! Hope you loved my teardown piece.
I’d like to publish any insights you may have the option and keen to offer on the product’s improvement, function set, invoice of supplies and/or the rest you assume could be of curiosity to the viewers.
What follows is his response despatched to me a number of days later, solely frivolously edited by me for readability:
Good day Brian,
I used to be working at Siemens VDO (which then turned Continental), primarily having RF subsystem obligations, and I labored on this key fob system.
I haven’t been within the business for 10 years, so all it is a bit dated.
All my statements listed here are publicly accessible data, so no commerce secrets and techniques have been damaged, and you may publish this.
There are principally 3 kinds of conventional key fobs, however this Volvo secret is an fascinating particular case:
- Immobilizer-only fobs, with a mechanical key blade and immobilizer transponder capsule (not constructed, for at the least 15 years)
- RKE [editor note: remote keyless entry] fobs, with one LF [editor note: low frequency] coil and capabilities 1, 2, and three solely [editor note: keep reading for function descriptions]. The standard fob manufacturing value right here is about 9 Euro, not together with the important thing blade.
- Passive entry/passive begin key fobs. The standard fob manufacturing value right here is 13 Euro with out a key blade, additionally with out steel within the housing.
Entry and begin are advanced techniques, with many interlinked microcontrollers and generally with further intentional complexity meant to discourage hacking.
Key fobs could seem conceptually easy, however they’re truly very exhausting to engineer as a consequence of their low energy consumption optimization and crypto integration, in addition to the cruel environments during which they should function.
A key fob has extra capabilities than you may assume:
- Mechanical key
At present usually solely seen as a backup, to open the door when the important thing or automobile battery is useless. Can solely begin the automobile if the old-style ignition lock, fitted with an immobilizer, authenticates the transponder. - RKE (automobile opening/closing by urgent the button on the fob)
The important thing sometimes sends out a 434 or 315 MHz sign to the automobile, with none suggestions. The sign features a “rolling code”, which is principally a counter incremented at every use, signed cryptographically so it can’t be replayed (every code is legitimate for just one use). Typical vary: 20m - Immobilizer begin (transponder)
The important thing fob can be utilized to start out the automobile with a RFID-style passive transponder at 120 kHz. It makes use of a proprietary protocol primarily based on a crypto problem/response that authenticates the fob to the engine controller. The engine controller is usually put in at an deliberately hard-to-access location so it can’t be simply “swapped” to be able to steal the automobile. The immobilizer reader can energy the fob controller by way of one of many LF coils. The important thing fob can due to this fact perform even when no battery is current, and even when the important thing fob is rotted away by corrosion (to wit, the LF circuit is selectively varnished in order that it may survive practically something). When the important thing battery is useless, you possibly can open the door with the mechanical key and begin the automobile by placing the important thing into/onto the immobilizer reader. Typical vary: 10cm. - Passive entry
When the driving force pulls on the automobile deal with, in addition to on a cyclic foundation, the automobile sends out a 120 kHz wakeup sign with a crypto problem. If in LF vary (sometimes 2m) the important thing fob wakes up, calculates crypto, locates itself with LF area power measurements, and solutions to the automobile by transmitting on the RF hyperlink. The localization step is essential not solely to test if the fob is close to sufficient, but additionally to find out whether it is at the moment inside or outdoors the automobile (If inside, no locking is allowed, however beginning is allowed. Exterior is the reverse). Localization normally requires 3-6 LF antennas, distributed strategically within the automobile inside and handles. Localization makes use of a 3D antenna on the important thing fob. The LF hyperlink is unidirectional solely; the prolonged 2m vary doesn’t permit the fob to transmit, even when usually the identical antennas are used for bidirectional immobilization. Listening on a regular basis makes the important thing fob battery final a lot much less lengthy than with fundamental RKE-only keys. - Passive begin
When urgent the beginning button, the identical fundamental steps as with perform 4 occur, this time to permit the engine to start out provided that the secret’s contained in the automobile. Working vary is decreased to “contained in the automobile solely”.
Trendy techniques use Bluetooth along side a cellphone, or UWB. Rising UWB could be made resistant to relay assaults as a result of it may make a safe time-of-flight measurement. In distinction, all different current applied sciences are by precept susceptible to relay assaults. The vulnerability of legacy techniques was broadly recognized within the business, however no different existed previous to UWB changing into accessible inexpensively. Subsequently, previous to UWB, OEMs and suppliers simply “ignored” the issue, counting on the perceived technical complexity of relay assaults to attenuate its probability of prevalence.
Your 6-button Volvo key fob appears to have a number of ripped-off parts on the base of the RF antenna, near the CC1020 transceiver. When you changed them, the fob may work once more.
It’s a “particular case” key fob as a result of it has a bidirectional 100m vary RF hyperlink (utilizing 900 MHz in US). It could actually additionally show the automobile standing on LEDs in the event you press the “i” key. “Assured” 100m is kind of tough to realize given the important thing fob’s small type issue constraints; that is the explanation for the 2 huge batteries, together with the advanced bidirectional RF transceiver primarily based on the CC1020.
The 5-button model of the design is a a lot easier RKE key with out suggestions and with solely 20m vary.
The large element talked about in your teardown is a reception antenna, however not for 902 MHz, as you assumed. It’s for 3D reception at 120 kHz.
The principle chip within the design is the widespread PCF7953 [editor note: this is the IC I’d referred to as the “F7953C05” in my earlier teardown, and is based on a Philips Semiconductor-now-NXP Semiconductors low-power, 8-bit microcontroller architecture], which integrates all the pieces besides the RF circuitry. Newer chips may also embody the RF transmitter.
Relating to your remark “a membrane which presumably is current to offer the good key some semblance of moisture and broader environmental resistance”, sure! Fobs basically are engineered to resist a whole lot of abuse, examined to (for instance) come out nonetheless working after a number of washing-machine 90°C wash cycles. The watertightness can fail after some years, when supplies degrade, however the silicone membrane in your case does not likely age. Sadly, snow blowers weren’t thought-about within the design specs 😉
Tough and fast beneficiant BOM value estimation for the PCB, in excessive quantity, and previous to latest COVID-induced chip shortages:
- CC1020: 2,7 Euro [editor note: approximately $2.82 USD]
- PCF7953: 2,5 Euro [~$2.61 USD]
- Whole for different small parts: 4 Euro [~$4.17 USD]
- Board: 2 Euro [~$2.09 USD]
- Labor: 2 Euro [~$2.09 USD]
- Overhead: 3 Euro [~$3.13 USD]
Actual prices are in all probability decrease.
Christophe concluded with some additional-information hyperlinks for additional reader analysis:
I’d prefer to thank Christophe Riehl for his generosity each in taking the time to put in writing me in such size and element, for his willingness to share his insights with different readers, and for the extraordinarily fascinating data he’s supplied. I think he’ll additionally see this writeup, so I encourage you to go away him (and me) your questions and different ideas within the feedback!
—Brian Dipert is Editor-in-Chief of the Edge AI and Imaginative and prescient Alliance, and a Senior Analyst at BDTI and Editor-in-Chief of InsideDSP, the corporate’s on-line e-newsletter.
Associated Content material
