Sensing an RFID car key? - Page 1
Forum section: electronics / projects

author: iXod
author_rank: Frequent Contributor
timestamp: August 30, 2019, 05:02:51 pm
content: Is there an electronic way to locate a lost car key? It’s a 2004-vintage transponder key which uses the immobilizer system (315 MHz?)I can get to within 12” (30 cm) of where I suspect the key is. I have a spare key to experiment with if necessary.No need to communicate (challenge/response) with the key—indeed this is beyond my skills.A new key and programming is more than US$200 so I’m motivated to try something geeky...Thanks..

author: Yansi
author_rank: Super Contributor
timestamp: August 30, 2019, 05:10:18 pm
content: Immobiliser is 125kHz.And I strongly doubt you can locate it very far, especially using simple equipment.If you are just a foot away from where it is, then just stick there a hand and take it out. Not sure what kind of localisation would you help with searching a cubic foot.

author: iXod
author_rank: Frequent Contributor
timestamp: August 30, 2019, 05:24:46 pm
content: I can get to within 12”—along 1000 feet (330 m) surface—of the area I need to search.Let’s stick to the viability of electronic means to search.Thanks.

author: Yansi
author_rank: Super Contributor
timestamp: August 30, 2019, 05:39:51 pm
content: Okay understood then! Just get/build yourself a GDO (resonance dip meter for 125kHz). It should be possible to detect the 125kHz resonant circuit in the RFID transponder even at such distance, if the meter will be sensitive enough. (Which you can of course test and improve before searching it ib the wild)I hope you don't have it inside sone metal tube or sorts. That would not work.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: August 30, 2019, 05:47:13 pm
content: I'm not familiar with the specific protocols used in keyfob transponders, but in some cases all you need to do is create a 125kHz field and look for any modulation in the loading of it - a simple diode detector can do this.For 12" range you'd want an antenna of similar diameter. A possible issue is that the antennas in keys are rather directional, so you will either need to try the antenna in different orientations, or use multiple antennas with different orientations.

author: Yansi
author_rank: Super Contributor
timestamp: August 30, 2019, 05:58:03 pm
content: NO, most of the transponders do NOT send any data (modulate the carrier), unless challenged to using correct command.You can only detect the presence of a resonant circuit by the energy dissipated in the circuit.EDIT also interesting to note as your key is not probably a "keyless entry" type, you will have to have the generated field quite in parallel with the orientation of the transponder coil. (Most cases the coil axis is the same as the axis of the key inserted to the keyway. Keyless entry systems use "3D" coils and the field orientation does not matter).

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: August 30, 2019, 07:35:49 pm
content: Quote from: Yansi on August 30, 2019, 05:58:03 pmAs lots of things will attenuate 125K, what you probably want to do is transmit alternate 125k and 100k and look for a difference in the attenuation between the two frequencies to detect the 125k absorbtion by the key, or do a sweep and look for a dip

author: iXod
author_rank: Frequent Contributor
timestamp: August 31, 2019, 04:01:15 am
content: This needs to be portable and the smallest scope I have is a Tek 2465 series. Can an analog meter be used to watch for dip?Something like: a sweeping (100k-150k ?) signal source driving a coil antenna, with an analog meter movement across the antenna (with rectifier and suitable multiplier resister in series with the movement)?I have an Agilent 33120A arb gen that has a HV output. Specs say 10v p-p into 50 ohms; 20v p-p open-circuit.Please help me by recommending a better circuit.Thanks.

author: Psi
author_rank: Super Contributor
timestamp: August 31, 2019, 05:01:06 am
content: I wonder if you removed the ignition key assembly from the car, and apply power to it, if it will request data from any key in the lock.Then you'd just have to figure out how to boost it's range to 30cm and make a simple receiver to watch for that data modulation.Or if you're lucky maybe the module has a output pin that chances when it senses any RFID keyBut im guessing you're kinda time limited as you want to find the key before it rains.

author: iXod
author_rank: Frequent Contributor
timestamp: August 31, 2019, 05:47:06 am
content: The rfid antenna is a ring around the key hole in the ignition switch. All that’s there is the antenna. The car’s ECU generates the RF signal and transmits & receives key IDs.Your solution would require the antenna and an ECU. Looking at the car’s wiring diagram, there’s no “valid key” output. With a valid key the fuel pump runs and the ignition coils work.

author: Psi
author_rank: Super Contributor
timestamp: August 31, 2019, 05:51:19 am
content: Quote from: iXod on August 31, 2019, 05:47:06 amI doubt the ECU is generating RF and sending it to keyswitch module. Since that would need shielded RF cable running ECU to Keyswitch module.It must be a digital link to ECU So keyswitch module will have some smarts to talk RF to key.Keyswitch module will talk over RF to the key and the ECU will talk digitally to the Keyswitch module.So it's possible that even without an ECU connected the keyswitch module may poll for a key, even if it doesn't know what to do with it.But yeah, im just guessing.

author: Yansi
author_rank: Super Contributor
timestamp: August 31, 2019, 07:22:35 am
content: All the electronics of the RFID reader is near the keyway. No coaxial cables.Not sure what would you need all those bulky measurement instruments for. Build a damn GDO! It is just a couple of trannies and a analog needle meter.https://www.google.com/search?q=grid+dip+oscillator&client=firefox-b-d&channel=trow&source=lnms&tbm=isch&sa=X&ved=0ahUKEwjR_uS8yazkAhVHLFAKHfdMCTQQ_AUIESgB&biw=1442&bih=775

author: Psi
author_rank: Super Contributor
timestamp: August 31, 2019, 08:58:24 am
content: Quote from: Yansi on August 31, 2019, 07:22:35 amIt's a car, not a Stargate.Yeah, i know what you mean.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: August 31, 2019, 09:51:17 am
content: Quote from: iXod on August 31, 2019, 04:01:15 amYou could probably do it using audio - the ear is very good at hearing patterns and changes - I'd suggest something like sweeping the carrier with maybe a 1khz sinewave, and feeding the detector to an audio amp and headphones. Use the key you have to optimise the sweep range and audio sensitivity. It may also be possible to just switch between 2 frequencies instead of sweeping.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: August 31, 2019, 10:00:20 am
content: Quote from: Psi on August 31, 2019, 05:51:19 amIt's only 125KHz, barely RF. I've definitely seen schematics showing only the coil in the key/button assembly, don't know if they used shielded cable or not. Bear in mind these are only polled at startup, so it won't have noise from engine or other systems to contend with.

author: vk6zgo
author_rank: Super Contributor
timestamp: August 31, 2019, 10:04:39 am
content: Is it a "real" car key, with a metal bit you put into the ignition & turn?If so, you would be better off forgetting any "high tech" methods related to its RFID function, & just look for it with a metal detector.They are usually sensitive enough to detect wedding rings & the like, so they should be able to pick up the key.In a pinch, the copper on the PCB may be detectable.

author: Yansi
author_rank: Super Contributor
timestamp: August 31, 2019, 12:29:24 pm
content: Quote from: mikeselectricstuff on August 31, 2019, 10:00:20 amNo they are not polled only at startup. Most of them not.

author: Yansi
author_rank: Super Contributor
timestamp: August 31, 2019, 12:31:18 pm
content: Quote from: vk6zgo on August 31, 2019, 10:04:39 amDoubt a metal detector would pick a smidge of copper on the pcb. It should pickup the mechanical key though quite well.

author: langwadt
author_rank: Super Contributor
timestamp: August 31, 2019, 01:06:14 pm
content: Quote from: Yansi on August 31, 2019, 12:29:24 pmwhat would be the point of polling other than at startup? don't want the engine to shut driving down the road off just becausethe communication with the key is sketchy

author: RoGeorge
author_rank: Super Contributor
timestamp: August 31, 2019, 01:13:37 pm
content: -trained dog-thermal camera-magnet dragged through the garden-metal detector-RFID reader-buy another key-buy another car

author: mzzj
author_rank: Super Contributor
timestamp: August 31, 2019, 01:50:56 pm
content: Quote from: langwadt on August 31, 2019, 01:06:14 pmTheft protection for relay link type attacks?But yeah, cars I'm familiar keep running even if the "key" is not present after initial startup. Maybe throw a warning.Keyless system on new Ford Focus gives warning bleeps if you start your car and later leave your keys in the hallway... if you drive off without keys it actually gives you warning after turning off the engine that keys are not present and engine wont re-start after opening the driver side door!

author: Alex Eisenhut
author_rank: Super Contributor
timestamp: August 31, 2019, 02:17:41 pm
content: I don't get it. You have an area to search but are limited to how close you can get to it? How do you plan on reaching it if you did manage to find it?Use a Shop Vac over the entire area."1000 feet (330 m) surface"That's a length, not a surface.

author: mzzj
author_rank: Super Contributor
timestamp: August 31, 2019, 02:56:34 pm
content: Quote from: Alex Eisenhut on August 31, 2019, 02:17:41 pmLets guess: Thick grass over one square kilometer so you can detect the keys from 30cm away. Or sand. Or snow.

author: iXod
author_rank: Frequent Contributor
timestamp: August 31, 2019, 03:10:15 pm
content: It is a physical, classic key with RFID chip in the “handle”.Other metal is present in the search area so a metal detector, magnet and shop vac are useless.Area was searched by hand, no joy. But much opportunity to miss a small key.Thanks to those continuing to offer creative suggestions.

author: Yansi
author_rank: Super Contributor
timestamp: August 31, 2019, 08:01:22 pm
content: I still vote for the GDO. Try building one and pimp it to perfection, to get the most sensitivity out of it.Similar concept to metal detection, however in this case specifically at 125kHz to detect the resonant circuit in the transponder.

author: iXod
author_rank: Frequent Contributor
timestamp: August 31, 2019, 09:08:57 pm
content: Quote from: mikeselectricstuff on August 31, 2019, 09:51:17 amIgnorant question: Doesn’t sweeping entail at least 2 frequencies? Sweeping a 125 KHz signal with 1 KHz, how is that done?Thanks.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: September 01, 2019, 10:11:50 am
content: Quote from: iXod on August 31, 2019, 09:08:57 pmVoltage controlled oscillator or synthesiser

author: iXod
author_rank: Frequent Contributor
timestamp: September 01, 2019, 03:51:52 pm
content: Quote from: mikeselectricstuff on September 01, 2019, 10:11:50 amHardware aside, the method you’re recommending is 125 KHz swept by 1 KHz to 1.5 KHz? Or...?Thanks.

author: Yansi
author_rank: Super Contributor
timestamp: September 01, 2019, 04:01:58 pm
content: The purpose of the frequency sweep is to be able to distinguish a general broadband signal attenuation and a "sharp" resonance dip at 125kHz."sharp" because the loaded LC circuit in the transponder will not have very large Q, so a few kHz sweep is likely very small to have any effect. The sweep should be across at least a few tens of kHz.

author: iXod
author_rank: Frequent Contributor
timestamp: September 02, 2019, 04:27:47 pm
content: So if I AM modulate the 125 KHz by 1 KHz, sweeping from approximately 115 to 135 KHz, this will give an audio indication (a change in the 1 KHz tone) when the RFID circuit resonates?Please suggest corrections to the method and my understanding.Thanks.