Motion Sensing in car security fobs. How?

[PhilHornby]

Does anyone know how "Motion Sensing" is being implemented in this car security fob

I have a Picaxe 08M2 repeatedly sending a 125KHz signal, that I cloned from my Hyundai Tucson's door lock. The fob responds with a blast of 433MHz.

If I stop sending the signal for more than about 3 minutes, the 433MHz does not resume when the 125KHz 'probe' resumes - the fob is 'asleep'. Gently moving the fob wakes it up again and it starts responding. If the 125KHz signal is not interrupted, the fob responds 'indefinitely', without timing out.

I cannot see anything on the PCB that looks remotely like a 'motion sensor'...

 

[papaof2]

Any translatable markings on U3 or the big chip and where is U2?

Maybe get a Bus Pirate device and connect it to the MSCL and MSDA pads to see what the big chip is doing and if/how that signal changes when the fob is moved?

 

[steliosm]

U3 looks like an accelerometer. That could be how it understands motion.
Those are usually i2c devices, so getting a but pirate device or a cheap 8-channel usb type logic analyzer could help you even more identifying this chip.

 

[erco]

Any of those ICs could contain a gyro or accelerometer to sense motion, could well be U3.

Practically free these days at ten for 54 cents! https://www.aliexpress.us/item/3256804423336065.html

 

[Buzby]

... Practically free these days ...

Watch those low price teasers again, we saw it last week on the ultrasonic wind speed gadget.

54 cents is for a single device, the headline advert is for 10.

 

[PhilHornby]

Many thanks for the replies.

Early research indicated that an Accelerometer should/might be present, but I was expecting something much grander than "U3" - (I'd convinced myself that it was using some other mechanism).

It's tempting to connect something to those pads to explore further, but these fobs are hellishly expensive to replace

 

[julianE]

just a little warning, i don't remember the details and am too lazy to search, if the key fob button is pressed too often without opening a door it will brick itself. you have to press it many times but it's something to keep in mind while experimenting. it's very expensive to reprogram a fob if it's bricked.

 

[PhilHornby]

Thanks for the reminder - I had forgotten this. I think the 'Rolling Code' can get out of line, but it seems a relatively simple procedure to resync them on a Hyundai.

 

[erco]

... it will brick itself.

Wow, it thinks it's an FTDI serial adapter!