Author Topic: Help with key transponder for renault clio (Read 39865 times)

FreeThinker · « **on:** February 19, 2011, 02:04:16 pm »

Hi All
I've got a problem with my clio key plip.It unlocks the car ok but won't disarm the immobilizer. My spare key works ok so it is down to my main key. I opened it up and all looks OK. Googling brought up conflicting info that the transponder was part of the key fob (case) and various other theories until in the end I swapped the electronics from the good key into the faulty key and the fault swapped over too. Strange thing is I've gotten it to work a couple of time so looks like its not a duff chip or in need of reprogramming but I'm struggling to find any bad joints etc. Any ideas to help testing?
ps Renault want £160 for a new key....no wonder the English don't like the French grrr! Found this pic on ebay and snaffled it.Will try and up some hires pics when I find my camera

Fraser · « **Reply #1 on:** February 19, 2011, 05:21:43 pm »

Car ignition transponders often use an inductor/coil to communicate with a partner coil in the steering column. The keyfob picture you have provided appears to have an inductor/communication coil at the bottom left of the pcb. This coil would come into close proximity with another fitted around the keylock cylinder and the security system would detect and communicate with a unique key mounted ID chip via the coils.

Car keys are often dropped and I have had to repair a few in the past. Common failures are cracked solder joints on large (heavier) components or even shattering of fragile components such as ferrite core inductors or SAW resonators. I would suggest you resolder all heavy components to ensure that the solder joints are good. I would also carefully inspect the keys inductor/communications coil for signs of ferrite core or winding damage (continuity check).

When a key requires replacement you are often having to pay for the hardware (key and electronics) plus the time it takes to marry all your keys to the cars security system. It can be an involved process. In the case of Audi, technicians have to enable an encrypted data link between their dealer computer and that of Head Office to activate an automated coding of new keys into the cars security system. This avoids some of the key cloning scams that used to take place in dodgy dealers as the dealer/technician cannot create new keys without the HO authority. Mine took 30 minutes to do, as all keys, including sprares, have to be married to the cars computer, not just the new one.

Fraser

FreeThinker · « **Reply #2 on:** February 19, 2011, 05:55:30 pm »

After posting I noticed in the pic that there are two solder points at each end of the oblong coil, mine is encapsulated in a clear acrylic plastic. May be a point of weakness. What I'm struggling with is how it works.It must hold the code somewhere and calc the next in sequence but (apparently) is unpowered. Also the key has worked since the first time it failed, pointing I suppose to the cracked component or track.What sort of range does the transponder have? with only a handfullof components on the pcb it should be an easy fix but so far everything checks out.Starting to think that the board is multi layer and flexing of the board around the button has cracked a trace as button failure is a common problem.

Fraser · « **Reply #3 on:** February 19, 2011, 06:07:28 pm »

It is important to differentiate between the transponder and central locking elements of a modern car key.

Central locking keys often use Radio Frequencies of around 433MHz and operate a rolling code system to help prevent code harvesting and use to open your vehicle. This was possible and prevalent in the UK some years ago. The rolling code prevents this type of attack and relies upon synchronising keys and the car security system.

The transponder is a totally different and separate part of the keys functionality. The communication coil passes data from the keys ID chip to the cars security system. The keys ID does not change. This is why a car is married to a particular set of keys.... it has to be programmed with all expected key ID's. The transponder in my Audi Key is a small block of plastic and contains the same type of technology that you would find in a Dog/Cat ID chip. Basically a communications coil connected to a tiny IC. The whole transponder is probably in the coil assembly on your key. Take a close look at it, as it is one of the heavier and more vulnerable components. PS The transponder does not normally require any power from the key itself. Power comes from inductive coupling between the cars steering column coil and that of the key.

If you Google 'RFID tags' you should find heaps of info on the technology

EDIT - Looking at the picture again I can see that the coils has a capacitor across it, so is a tuned circuit forming the low frequency aerial tuned to the operating frequency of the communications link. The ouput of this aerial appears to be going to the chip to it's right. This would suggest that the key uses a custom IC that handles both the central locking and the transponder functions in one package. The transponder is still a separate function however and there is no rolling code. You shoudl check all connections from the transponder aerial to the IC and ensure they are not cracked.

Fraser · « **Reply #4 on:** February 19, 2011, 06:27:38 pm »

Take a look here for info on transponder / RFID yechnology used in cars:

http://www.elastic-rfid.com/index.php?cmsid=10&cid=62&sid=67

http://www.elastic-rfid.com/index.php?cmsid=10&theme=transponder key

http://www.elastic-rfid.com/index.php?cmsid=5&theme=RFID

As you will see, some renault keys have the transponder in the plastic case whilst others, like yours, do not. Sadly your particular transponder design appears to be a Renault custom job. More modern transponders tend to be the small plastic block type and not part of the PCB.

Sionyn · « **Reply #5 on:** February 19, 2011, 07:04:44 pm »

seems pretty weak to me

http://en.wikipedia.org/wiki/KeeLoq

Fraser · « **Reply #6 on:** February 19, 2011, 08:50:07 pm »

True, but I suspect you are a tad smarter than the average lowlife car thief

Sure Black hats can and will crack the coding but I am pleased that the effort has been made to make the attack harder to accomplish with basic code harvesting and re-transmission techniques.

I believe my Audi security system also incorporates a lockout on brute force code attempts

FreeThinker · « **Reply #7 on:** February 20, 2011, 11:40:42 am »

Thanks for your time and effort you have cleared up a couple of fuzzy points for me, ie the rolling code only applying to the door unlocking and not the immobilizer makes much more sense. Your observations that the coil at the lower is an aerial left seems spot on. I'll need to do a bit more poking around in this area as the fault defiantly seems to be a cracked or high resistance joint somewhere as it has worked twice during testing but gone back off again after locking/unlocking the door.

Fraser · « **Reply #8 on:** February 20, 2011, 12:53:59 pm »

You could also consider contacting some car scrap yards and enquiring whether they have a key like yours. The transponder ID code would be wrong but you would have a replacement coil and PCB if that is the problem. Your IC would just need to be transplanted onto the 'new' PCB.

FreeThinker · « **Reply #9 on:** February 20, 2011, 06:24:06 pm »

Well I've re soldered the aerial, cap and reflowed the pins on the chip (upsteps murphy) I'd just flowed solder over the pins to wick off the excess, yep you guessed it No solder wick damn you murphy

.Will need to complete tomorrow

Fraser · « **Reply #10 on:** February 20, 2011, 07:06:20 pm »

It would be worth checking the continuity of the aerial coil as the ECW that they use is easily broken at the point where it is soldered to the PCB pin. There are a lot of turns on the aerial so don't expect a reading of zero ohms but it should be a relatively low reading and definitely not open circuit.

If it's O/C you will need a high magnification Loupe or magnifying glass to see where the break is.

PCB tracks can also fracture at the point where they meet the PCB solder pads. It can be very hard to see such breaks in the track so always check for continuity between the component pin and the pcb track some distance from the pcb solder pad.

FreeThinker · « **Reply #11 on:** February 20, 2011, 07:16:10 pm »

I've checked continuity and seems ok. One thing I've noticed (and forgot to post) is that the pcb layout is different and there is large roundish component near the top of the pcb looks like an oscillator Chrystal so assume it is part of the door lock circuit. Will make a big effort tomorrow to post some pics and complete my repairs so far.

FreeThinker · « **Reply #12 on:** February 21, 2011, 01:12:29 pm »

Well I finally bit the bullet and cracked open my working key (didn't want to end up without a usable key) 30 seconds with my meter proved my gut feeling right, the aerial was shot. I was reading around 300 ohms which I felt was a tad high but on the working key it's only 30 ohms. Out with the soldering Iron and solder sucker but could not get the damn thing free closer inspection revealed five little spots under the aerial. Glue! Off to Ebay and a second key bought for £5. Back to the faulty key and a quick poke with a screwdriver levered it off the board. As I have mentioned before my aerial is encapsulated but when I got it off the board it is only encapsulated on the top and sides, the bottom had the coil exposed but why? What I suspect is that the original design had problems with vibration causing the aerial to fail so Renault decided to encapsulate it to support the coil But left the bottom clear because of mounting clearance. In this case it appears the clearance was not quite enough and caused the solder pad to fail

. possibly due to board flex when operating the door button. Waiting for replacement key to swop out the chip.

Sionyn · « **Reply #13 on:** February 21, 2011, 01:48:39 pm »

ah bugger

any pictures
or info on the chip used ?

FreeThinker · « **Reply #14 on:** February 21, 2011, 03:13:06 pm »

The main chip is a TM 027M the chip to the right and above simply has the number 100 and a batch number (think this is an oscillator).The two pads above the aerial pads are where I removed the tac switch looking for damage.Sorry the pics aren't great photography is not my bag (good job there were no heads in the pic or I would of chopped them off

). on one of the glue points you can clearly see it has pulled off a piece of wire as I gently removed it (hee hee). Not really intended to come apart methinks!

flolic · « **Reply #15 on:** February 21, 2011, 09:35:16 pm »

Chip is U9280M (http://www.atmel.com/dyn/resources/prod_documents/doc4591.pdf), inductor resistance on my key is 29 ohm

I hope you can fix it, I had to exchange both of my keys. But fortunately, car was under warranty back then

Sionyn · « **Reply #16 on:** February 22, 2011, 05:59:53 pm »

toyota do it much differently

FreeThinker · « **Reply #17 on:** March 01, 2011, 02:27:58 pm »

Quick update
My replacement key arrived from ebay

it is totally different

. Research has dug up that the immobilizer fitted depends on the month, year, of manufacture plus if it was raining that day or if there was a r in the month etc etc. OK plan b. source a new transponder coil. I've found a few possible replacements but have come unstuck with the details of the coil. I know it's physical size and it's approx resistance (29 ohms thanks flolic) but need it's inductance in mh (or would this not matter too much?) anyone help?

Sionyn · « **Reply #18 on:** March 01, 2011, 05:05:45 pm »

sucks man

lol r in the month

like that is good security idiots

Fraser · « **Reply #19 on:** March 01, 2011, 11:27:54 pm »

From your DCR figure of 29 Ohms it would appear to be just under 2mH according to the datasheet you provided (this of course assumes the same core ferrite material is used). The coil forms part of an RF Tank circuit resonant at the RFID frequency. To approach this with maths you would need to be certain of the frequency and then work out what capacitance in parallel is required to make it resonant. For 125kHz the datasheet suggests around 820pF would be required.

Measuring the operating frequency of the transponder data link could be challenging as it can be a very brief 'conversation' with an initial 'power' pulse sequence, followed by the data segments.

It would be worth attempting a practical approach. Measure the capacitor that is across the (no longer fitted) coil on the broken fob pcb and see how it compares to your data sheet. If it looks similar to the 205X coil's requirement of around 820pF you could try the 205X and if it doesn't work, temporarily fit a trimcap and find the required value empirically. Then measure the trimcaps capacity and fit the closest standard value fixed capacitor you can find.

It may be easier to buy another key off ebay after asking the seller to confirm it looks like yours inside ?

Good luck

eju · « **Reply #20 on:** January 31, 2017, 09:47:44 am »

Type fault in this key is RFID ferrite-antenna. It has been glued with 5 points.
Frequency 125 khz, so 1.8 nF kond. needs 0.9 mH coil.
I have ordered from coil manifacture 4 pcs. 10 € coils, 40 € transport to Finland.
So, I have good expectations that it works.
Remote control is 433 MHz and there is PCB copper antenna.

DenzilPenberthy · « **Reply #21 on:** January 31, 2017, 12:48:02 pm »

It sounds like you're on the right track with the hardware fault you've found. I had a similar issue with my Mk1 Clio. (Although that is an IR remote rather than RF). Water was leaking into the receiver (via the famous leaky Clio sunroofs). I fixed the receiver but was then still having problems which I eventually traced to a flat battery in the key fob. It was transmitting enough for the IR LED to be visible on my phone's camera but not quite powerful enough to actually trigger the receiver.

There is a big time-wasting puzzle which I had to overcome though which may also be the case with the RF remotes!!... The key fob transmits a new 'rolling code' each time you press it. The key and the ECU in the car have some algorithm so that the car will accept the new rolling codes. HOWEVER!! If you press the button more than some large number of times (I think it was like 500 or something) without the ECU registering a valid unlock code, the rolling codes sent by the key become out of range of what the ECU will recognise. The key then stops working even if the battery, IR receiver etc etc are all working fine. I suppose they thought it was enough presses but I got through that many presses while fault-finding my dodgy water damaged receiver and flat battery combo...

There is a small program you can download which you enter the serial number on the PCB and it generates a code you can enter into the car via the lock/unlock button near the gearstick, then there is a procedure to re-synchronise the ECU with the key-fob's rolling code. It also involved digging a very old PC out of a cupboard at work because the program is 16-bit and won't run on modern Windows :/ Grrr....

As I say this may or may not be the case with Clio II RF remotes but it certainly kept me busy for a few days puzzling it out with the Clio I Infra-red remote.

CJay · « **Reply #22 on:** January 31, 2017, 04:41:48 pm »

Quote from: Fraser on February 19, 2011, 08:50:07 pm

True, but I suspect you are a tad smarter than the average lowlife car thief

Sure Black hats can and will crack the coding but I am pleased that the effort has been made to make the attack harder to accomplish with basic code harvesting and re-transmission techniques.

I believe my Audi security system also incorporates a lockout on brute force code attempts

But it can still be cracked via OBD (usually fairly easy to access outside the vehicle) and there are rumours (from a reliable source) that there are 'boxes' which can unlock a few makes of German cars remotely.

Keeloq is an old technology now I think (but obviously still in older vehicles)?

Jeroen3 · « **Reply #23 on:** January 31, 2017, 06:50:50 pm »

It's fairly complicated with the Germans. Especially if you've lost all keys.

If I recall correctly, all cars since 1995 can be remotely hacked. Because they all use the same stuff. With the exception of a few rare brands.
Not sure about brand new cars. But this was recent news last year, so...

antonio60 · « **Reply #24 on:** February 14, 2017, 10:02:37 pm »

Quote from: eju on January 31, 2017, 09:47:44 am

Type fault in this key is RFID ferrite-antenna. It has been glued with 5 points.
Frequency 125 khz, so 1.8 nF kond. needs 0.9 mH coil.
I have ordered from coil manifacture 4 pcs. 10 € coils, 40 € transport to Finland.
So, I have good expectations that it works.
Remote control is 433 MHz and there is PCB copper antenna.

You have a link (which can indicate) where to order "RFID-ferrite antenna" for these keys Renault Clio?
Thank you


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee

Author Topic: Help with key transponder for renault clio (Read 39865 times)

Share me