Decoding the Infra-Red Remote Central Locking

[lightflow 59 1 Cars]

I have a late Phase 2 and am lucky to have a working key fob and receiver for the central locking. The receivers can be subject to damage from water ingress from the roof and the key fob is of course vulnerable to all sort of issues.

 

I've always been fascinated with understanding how the key fob and receiver work and since I bought mine a few years ago I always intended to get into the guts of the electronics and understand how to decode the units - mainly in case I needed to repair, but also for interest. Over the years I have researched and pieced together information from a few sources sources which I've attached.

 

As the circuit technology is now 30 years old, whilst the circuits and electronics may still look modern - original datasheets and information are quite difficult to come by. Added to the fact that this is a security mechanism it's not widely documented how these devices work.

 

I'm going to keep this very short for the moment but will expand if anyone is interested to see more. Most of this information has previously shared by Laurent Deschamps:

 

http://laurent.deschamps.free.fr/plip/plip.htm

 

I thought it would be good to re-share (and add to it) in this topic forum so I have placed of copy of the documents of the key fob circuitry and some of Lauren's information into this forum for future reference.

 

Basically, the phase 1.5/2 key fobs send infra-red light pulses to the receiver dome in the ceiling console. The receiver is continually watching for the pulses and if it sees the correct sequence, it triggers a change of voltage on the wires which run down to the central locking control module which sits to the left of the steering column near the heater matrix. That change in voltage causes the central locking motors to cycle open/closed respectively.

 

The infra-red pulses carry a short, 5 digit, security code. That code is factory encoded into the key fob chip, which in the later Phase 2 key fobs, is the Philips OM1058T - it's an EEPROM device. It can be re-coded and should be possible, but I don't quite have the information on how to program this chip yet as it's not readily available. I know the general mechanism, but not the exact protocol required. It is very likely possible along these lines: Programming an EEPROM with an Arduino

 

The receiver which decodes the infra-red pulses is a variant of  the Philips TEA5500 and is covered in some detail by Laurent's web page. Generally speaking, the receiver is a simpler device than that of the Phase 2 key fob transmitter and the security code sequence is encoded at the factory with either the presence or absence of connections to a positive voltage, ground, or open (not connected). This is achieved by physical track connections on the board, some of which are drilled so that they are "open". It's possible to re-program a receiver to match a key fob by drilling or connecting tracks with solder - I'm not covering this here at the moment.

 

What I did want to start discussing was how to fault diagnose and decode the key fob signal. I'd been wanting to do this for a while and decided to get some components together to do this. I achieved it with some relatively simple electronics and the use of an Arduino Nano micro-controller - pictured in the attached document. I was then able to write some code and decode the key fob. In theory it would be possible to easily place this Arduino into a smaller, low-power, permanent circuit board, and create an after market receiver which could replace the original in the car. By writing this decoder, I have effectively made a central locking receiver module.

 

Let me know if you are interested in seeing more of the circuit and how I programmed the Arduino in order to decode the key fob signal. At the moment - I'm just posting to share that this was made possible using the Arduino and I'll expand more if anyone is interested in seeing how....

 

What I can add if you have a key fob and you are not sure it's working you can use a mobile phone camera to look at the key fob infra-red led as you press the button. You should see a short pulse of purple/white light through your phone screen which is not visible to the naked eye. If you have a key fob which you believe is working, but would like the code for, I should be able to decode it for you using the circuit I've made. This might be helpful if you are trying to put together a fully working pair from a spare receiver (which you can more easily re-code to match)

 

 

 

 

 

Key Fob and Arduino.pdf

Codage_du_numero.pdf

OM1058.pdf

Edited November 1, 2019 by lightflow

[jackherer 543]

1 hour ago, lightflow said:

What I can add if you have a key fob and you are not sure it's working you can use a mobile phone camera to look at the key fob infra-red led as you press the button. You should see a short pulse of purple/white light through your phone screen which is not visible to the naked eye.

Some phones (including at least some iPhones) have an IR filter on the main (rear) camera so this doesn't work, you have to use the secondary (front) camera on my phone. Test your camera using e.g. a TV remote before condemning a 205 plip.

[AaronMountford1990 0 1 Cars]

I found a company that was actually recoding these a while back I think they were on FB. 

 

Yeah I brought a Plip remote about 6 months ago with the intent of pairing it to my system, I just need to strip everything down and read the EEPROM as it's neater than link wiring the receiver. 

[lightflow 59 1 Cars]

Aaron - do you mean re-write the EEPROM? If you did, do have any information on how to do so? The protocol for writing this is not documented anywhere that I have found (yet)

[2-Pugs 57]

NicG and Henry Yorke on here have figured out the coding of those plips, if all you want to do is get it working.  You don't need to reprogram the EEPROM.  The code is set by joining or breaking tracks between pin legs.  Often there is a label with a code written on it, stuck to the chip.  Even if not, its possible to deduce it easily by looking at the circuit board.  You can then pair the two devices.  So if either fails, you can simply get a replacement and then with some judicious pcb work, match it to the plip.  Using this method you can pair as many plips to the receiver as you want.  Its possible to pair either one to the other, as I understand it.

 

But this is my fairly basic understanding of it, Nic may be along to expand :-)

[lightflow 59 1 Cars]

Indeed Rob - how to encode the receiver to match the fob transmitter is all listed in the links at the top of my original post :-) 

 

Aaron knows this I think as he said above "...as it's neater than link wiring the receiver..." :-)

 

My preference would also be to know how to write the EEPROM on the key fob transmitter, there used to be OEM tools for this. However, this information seems to be lost or at least not published and I guess it is unlikely that Philips would ever track this down some c. 30 years later. Perhaps somebody might "know a guy who knows a guy..." at Philips. The informaiton will be somewhere out there I'm sure.

 

Having said that it's only a serial protocol which would be very easy to drive into the chip using something like an Arduino (as per my original post), it's just knowing what that serial protocol is...

Edited December 6, 2019 by lightflow

[stanz 0 2 Cars]

Slight hijack thread but ties in nicely, Not driven mine for a few weeks, was out the other night in it on a dark country lane when the central locking circuit board in the roof console caught fire, could smell it first, thought it was clutch/brake smell then caught sight of the flame flickering just past the sunroof lever, thankfully managed to yank the console down,put the flame out and pull the wires apart. Could have got so much worse so quickly. Car does get really bad condensation when it's sat for a while or could have been leaking through the sunroof, just worth people keeping an eye on theirs. 

[jackherer 543]

1 hour ago, stanz said:

worth people keeping an eye on theirs.

Add a fuse!

 

There has been some discussion on this subject recently, it seems to be happening more and more.

 

[stanz 0 2 Cars]

Thanks for the link. Mine wasn't in use so not taking the chance anymore, going to delete the live from up there, don't think there's any need for it. Any further posting on this I'll put in that other thread