Analogue / Radio advice needed. I've built something I don't understand :-)

[PhilHornby]

I've been doing some investigation into my Hyundai Tucson's PKES system. The key fob is supposed to be equipped with a 'sleep mode' to defend against Relay Attacks, but I was struggling to demonstrate this. The obvious solution, was to capture the signal from the car door lock, decode it and reproduce it on a Picaxe

(In a nutshell, the car sends out a OOK-modulated 125KHz 'signal' and the fob responds using its battery-powered 433MHz transmitter. There is apparently usually more than one handshake in the sequence, but I was only interested in there being any kind of response).

AIUI, the 125KHz signal emanates as a magnetic field, rather than a radio wave - so rather like a Current Transformer (the so-called 'Near Field'). I bought myself a pre-wound 'RFID' coil and spent happy hours searching for the optimum capacitor to tune it to 125KHz. Since the coil has a DC resistance of only 7Ω, I used a series L-C arrangement, directly connected to a Picaxe output. I ended-up with a 30VPk-Pk signal across the coil and nothing scary at the Picaxe.

I borrowed the Data Signal Modulator approach from this thread to create my 125KHz signal. Adding a Hope 433Mhz RF receiver allowed me to detect the Fob's response and "the job's a good 'un!" as the saying goes...

I achieved everything I hoped to - including a 60cm range, just using a Picaxe output. However...

I moved my circuit from my main Breadboard onto a smaller one, as a precursor to making a PCB for it. At this point, it stopped working .

I soon discovered that it worked with the AXE027 plugged into the AXE029, but stopped working when that was unplugged. It was when I discovered that the AXE027 didn't need to be plugged into the PC end to make it work, that I realised that this isn't a simple wiring issue (such as a bad earth) . For all the world, it seemed like I was generating a 125KHz Radio signal and the AXE027 acts as an aerial. (An old PSU with a mono jack plug also works!)

At this point, I thought: So what exactly is the coil bringing to the party then? Sure enough it does work with the coil removed, but only if the associated capacitor (C2) is connected to GND. The range drops considerably in this mode, to 10cm or so.

What have I built - and more to the point, what should I do to get rid of the need for an AXE027 to be plugged in

 

[inglewoodpete]

My only hypothesis is that the "out" pin on an AXE027 socket is the shield or screen of the dual core cable. The wavelength of 125kHz in air 2.391 kilometres so even a 1/4 wavelength antenna would be cumbersome! Being driven by a digital source, the signal will be pretty rich in harmonics.

I'd suggest that you experiment with more modest antenna lengths but with a good ground plane. Perhaps not a solution but it may pave a path to understanding. Another thought: you could experiment with a ferrite rod antenna with a parallel capacitor but getting resonance would require a larger capacitance (eg 10 to 20nF? I'm guessing).

 

[john2051]

Hi, sorry this is rather hurried but just about toi shut off computer. The radio modules in clocks use a 60kHz ferrite rod, perhaps you could use one and parallel more capacitors to achieve resonance.
john

 

[PhilHornby]

Thanks for the replies.

The suggestion to try a ferrite rod sounds like a good one - I'll investigate further. If I can't find something intended for 125KHz, maybe I can use two coils intended for 60KHz, on one rod. The "Lightning Detecting community" seems to be a good source of information on them

I did some further experiments - modifying the circuit and measuring the distance achieved. If I remove the coil and connect C2 to GND, I get about 9cm range (with or without the AXE027) - so that's something. But how does that work? Looking at the Picaxe output on the scope, all that is happening, is that the square wave output now has 'nasty' rounded edges. Puzzling

I tried using my receiver circuit - same sort of coil with parallel cap, followed by OA47 diode and a CA3140 to 'square things up' - as a kind of Field Strength Meter. What became obvious, is that it is working purely through Induction/Magnetism/Near-field. It's not receiving 'radio' signals at all! I can get a massive signal, if it's physically touching the transmitter coil, but it drops off rapidly over the space of a centimetre or so - just like an RFID tag does.

This explains why I had to have physical contact with the car, in order to detect its signal. So, my 'Radio' receiver was actually using NFC and my transmitter (which I thought was using NFC) is transmitting radio waves

Am I even allowed to transmit 125KHz Radio waves

 

[eclectic]

Ofcom UK Frequency Allocation (UKFAT) Page

e

 

[PhilHornby]

I can't find any ready-made Ferrite rod aerials that are suitable, so I've ordered some bare Ferrite rods and another RDM6300 kit. I'm going to try and rewind the coil from the latter around the former to make my own. (Former, in both senses of the word )

(The object of the exercise, is to build a small battery-powered unit that hangs next to where the car keys are kept. When the keys are hung up, it will detect the Fob and alert me to the fact. Pressing a button will stop the detection for three minutes - when it resumes, the Fob should be sleeping and not detectable. If the fob is definitely sleeping, then it is safe from so-called Relay Attacks).

This is what I have so far - it works, but with a rather limited range. I'm very conscious of the fact that any layout changes might stop it working, when I try and make it permanent - (the coil isn't actually connected for this test).

The Fob in the video is initially 'asleep'. It hasn't been moved for at least three minutes, nor has it heard the 125KHz signal from the circuit.

The RED led signals that the circuit is sending 125KHz queries to the fob. The GREEN led shows that it received an answer.

Initially, there is no answer - until the fob is moved. When the fob is taken out of range, the response stops. When the fob is returned the response resumes.

Once awake, the fob will respond (for at least 5 hours), until it is motionless and the circuit is powered off (both for at least 3 minutes).

 

[PhilHornby]

I rewound the pictured coil onto a suitable ferrite rod (which was fun ) - the inductance changed from 375μH to 5.5mH and with the addition of a suitable capacitor I now have about the same range as I originally achieved with the AXE027 connected. I see about 68Vrms across the coil.

Doing more research, I see that Ferrite rods are not particularly recommended as transmitting aerials and I'm surprised that the Picaxe is able to provide enough ooomph to give the range I'm now getting (about 40~50cm).

This datasheet for the ATMEL ATA5275 - which is dedicated to the job - uses 12V and sends up to to 1.5A to the transmitter coil