I’ve been an automotive locksmith for over 35 years, and keyless remotes have been around for about half of that time. Through the years, I have learned that only two rules apply when it comes to working with keyless remotes:
There are no rules.
When in doubt, see rule number one
Admittedly that sounds like a joke, but it’s really not. There are so many factors involved in doing business in the remote field that it makes herding cats seem easy by comparison. I could never cover everything about remotes in the space I have available here, but I will try to address the basics of automotive remotes.
System Types
Basically, automotive remote systems come down to two major types: factory installed and after-market. By far the easiest to deal with and most common are the factory installed systems. With these systems, you have some hope of consistency, and when all else fails, the consumer can usually go to the dealer for replacement remotes. The after-market systems are much more complex, with many options and as many different types of installations as there are installers out there.
The real problem comes in when the owner has already lost all of the remotes to the vehicle and you have to determine if the vehicle was equipped with a factory system or an after-market system. Sometimes this job alone can make you feel like a detective without any clues. The good news is that keyless remotes are now standard equipment on the vast majority of new vehicles, and most after-market systems are confined to older vehicles.
With either type of system, your job will be easier if the customer still has a remote – even a non-working remote. A lot of information can be obtained from even the remains of a remote that has been run over by a car or rescued from a watery grave. If you have no remote, your job will be a lot harder, and the first question that you need to answer is: “Was the system factory installed or aftermarket?”
Remote Types
All of the remotes in this article operate on “Radio Frequencies” (RF). Other types of remotes use “Infra-Red” (IR) like the remote for your TV, but those systems are rare and as a general rule there is not much you can do outside of replacing the batteries.
RF remotes operate within frequency ranges that are regulated in the United States by the Federal Communications Commission (FCC). Each RF remote has an “FCC ID Number,” usually located on the cover of the remote, but may also be found on the inside. Having this number will go a long way toward identifying the correct replacement remote. Photo 1 shows the back of a typical remote and the information that appears there. This particular remote is for a GM product and the part number for the remote is also included.
Most remotes are essentially short-range radio transmitters that broadcast a series of coded signals. The signals that are sent are decoded by the vehicle as instructions to perform simple tasks such as to unlock the driver’s door, unlock all the doors, open the trunk, turn on the interior lights, start the engine, or sound the alarm. The complexity of the signal varies depending on the system, but the newer the remote system, the more complex the signal will be.
With all of the wireless gadgets on the market, the airwaves are getting more crowded. In order to assure that a remote only does the job it is intended to do, and only on one specific vehicle, the signal must be complex enough to be distinguished from all of the other RF signals surrounding us.
Early remotes used a “Fixed Code” system of preset codes for each button on the remote. That code never changed throughout the life of the remote. The code for individual buttons on the remote was specific for the application, and if you had two or more remotes for the same vehicle, the information sent from each remote for any specific function was identical. The difference between individual remotes was an ID signal that identified the particular remote. The ID signal was incorporated into the signal for each instruction sent from the remote. On early systems, the process of programming the remote into the vehicle basically involved teaching the car to recognize the ID signal of the new remote. If you bought the proper replacement remote for your vehicle, the functions of each button were pre-programmed into the remote out of the box. All you had to do to teach the car to recognize the new remote’s ID signal.
As the number of vehicles equipped with remotes increased, more complexity was needed, not only to accommodate the number of vehicles, but also to provide better security. We’ve all gotten that e-mail about how thieves supposedly could “capture” the signal from your remote and use that captured signal to unlock your car. While some such devices actually do exist, their use is pretty much confined to the early fixed-code systems. Modern systems are specifically designed to prevent that kind of attack.
The first generation of advanced remotes used a “Rolling Code” system, where each remote was programmed with a series of different codes for each operation. As the remote was used, it would cycle through these different codes in a sequence that the vehicle would recognize as valid.
Important: This type of system has inherent problems if one remote is used regularly while another is used only occasionally. The remote that is rarely used may get out of sync with the vehicle and no longer operate. The owner’s manual of the vehicle usually includes a warning and instructions on how to “resynchronize” the remotes.
The current generation of advanced remotes uses an “Encryption” system similar to that used by transponders located in vehicle keys. Both the remote and the vehicle are programmed with a mathematical “algorithm” that allows the remote and the vehicle to communicate. The signal sent between the remote and the vehicle is extremely complex and changes constantly. This Encryption system provides a very high level of security, eliminating the possibility of thieves using a captured signal, since the information changes every time the remote is used.
Programming
Just as the remotes have become more complex, so have the programming procedures. Just as with transponder equipped keys, there are basically two types of programming - on-board-programming and programming that requires the use of a diagnostic device. As a general rule, older vehicles will use on-board programming and programming via a diagnostic machine is generally used on the newer vehicles that use rolling codes or encryption. But some older vehicles will require a diagnostic device and some new vehicles can be programmed with on-board methods.
There is one rule that you can count on most of the time, and that is that most vehicles, new and old, use what is called “all at once programming.” Any time you put the vehicle into the programming mode, all of the currently programmed remotes are erased from the vehicle’s memory. All of the remotes, both old and new, must then be programmed back into the vehicle. This process is sometimes referred to as “re-initialization.”
On-board Programming
On-board programming can vary greatly from one vehicle to another and makes use of controls that are built into the vehicle such as the key-minder switch in the ignition, door logic switches in the individual doors and trunk, brake pedal switch, etc. Sometimes jumper wires are used to temporarily connect two or more circuits, usually through the On-Board Diagnostic port (OBD). Here are two examples of typical on-board programming procedures.
1995 Nissan 300ZX
Photo 2 shows a 1995 Nissan 300ZX that is my personal vehicle, and yes it has been thorough a hurricane – two in fact – and a tree fell on it during hurricane Ivan. As you can see in photo 3, I have also completely worn out the plastic bail that is used to attach the remote to my keychain, so the original remote will no longer stay on the keychain. This is a common problem.
Photo 3 also shows the two new remotes that I’m going to program into my car. This car uses a fixed-code system and the remotes can be cloned. (I’ll cover the cloning procedure later.) The KeylessRide remote shown on the right was ordered over the Internet already programmed with the information necessary to operate on Nissan 300ZX vehicles made in 1994 and 1995. The second remote is a generic cloneable remote that operates on the same frequency as the original remote. For the purposes of this article, I cloned the functions from my original remote into the generic remote only.
As soon as I cloned the original remote into the generic remote, it would operate my vehicle just like the original OEM remote. This gave me two compatible remotes, only one of which is programmed into my vehicle. Because of the all at once programming, in order to add the second remote, I will need to perform the on-board programming procedure with both new remotes. This programming will erase all of the existing remotes from the vehicle memory and then program the two new remotes into the vehicle.
Using the programming procedure for my vehicle that was supplied along with the remote purchased from KeylessRide, I programmed the car to accept both remotes. This programming procedure is also available from other sources such as the “Autodata” book shown in photo 4, through “Alldata,” from the dealer, and other sources. Regardless of where you obtain the procedure, you must follow the procedure to the letter.
Below are the steps needed to program this particular vehicle using on-board programming:
Step 1: Open the trunk and leave it open throughout the programming (photo 5).
Step 2: Enter the vehicle and lock both doors.
Step 3: Insert the ignition key fully into the ignition lock and then remove it more than six times in ten seconds (photo 6). When this procedure is complete, all existing remotes will have been erased from the system.
Step 4: Unlock and then relock the door using the manual lock control – NOT the power door lock control (photo 7).
Step 5: Press the lock button on the first remote to be programmed. The first remote should now be programmed (photo 8).
Step 6: To program additional remotes, unlock and then relock the door using the manual lock control – NOT the power door lock control (photo 7 again).
Step 7: Press the lock button on the second remote to be programmed (photo 9).
Repeat steps six and seven for additional remotes up to a maximum of four remotes.
The above programming procedure applies only to Nissan 300ZX vehicles made in 1994 and 1995, but it is typical of the general type of programming that used on many vehicles. Once this procedure was completed, both of the new remotes worked properly.
1999 Chevrolet Astro
Photo 10 shows a 1999 Chevrolet Astro. Once again, this is my personal vehicle, but this time, I will be programming in an original GM remote. This vehicle requires the use of a jumper wire to close the circuit between two pins in the OBD port. A jumper wire can be made from just about anything conductive; in fact I’ve used a paperclip for this job on many occasions. The jumper wire that I’ll be using here is just a short piece of wire with both ends stripped back and tinned with a soldering iron.
Step 1: Photo 11 shows the OBD connector from my Astro van. Each pin in the plug is assigned a number in the order shown in the photo. For this programming, the instructions tell us to connect pins four and eight with the jumper wire as shown in photo 12. As soon as the circuit is complete, the power door locks on all of the doors will cycle from lock to unlock. All of the remotes that were programmed into the vehicle have now been erased from memory.
Step 2: Press and hold both the lock and unlock buttons on the first remote as shown on photo 13 until the power door locks cycle. The new remote is now programmed.
Step 3: A maximum of four remotes can be programmed into this vehicle. If additional remotes are needed, repeat step two for each of the new remotes.
Step 4: to complete the programming, remove the jumper wire and test each of the remotes.
Cloning Procedures
Through the years, several cloning devices have been marketed to locksmiths, all with the same basic operation. First you will have to determine the frequency of the remote, then select a compatible remote, copy all of the information from the original remote into your cloning device and then download that information into the new remote.
After you have determined that the remote is cloneable, the next step is to verify the frequency on which it operates. Older devices require you to place your remote in contact with the device and press any button on the remote. The display should now show the frequency of the remote as illustrated in photo 14.
After you have determined the frequency and made sure that you have a compatible remote to work with, you are ready to copy the information from the original remote. Begin by pressing and holding one button at a time on the remote while it is in contact with the reader as shown in photo 15. The reader will tell you when it has successfully read the information for each button on the remote, and when to move on to the next button.
After the original remote has been successfully copied into the cloning device, connect the new remote to the device by way of a cable as shown in photo 16. The information that has been saved into the cloning device is then downloaded into the new remote, and if all goes well the new remote will now operate the vehicle properly. If any mistakes were made, such as assigning the trunk opening function to the door lock button, the remote can be re-read and re-programmed until the functions are correct.
A modern and user-friendly cloning system is now marketed through KeylessRide, known as “Learn & Burn.” This system automates most of the functions of cloning and eliminates most of the common mistakes that happened with the older systems. The Learn & Burn system is updated via the Internet, and you can download the functions of most cloneable remotes directly from the KeylessRide website.
Using “Learn & Burn”
Since the Learn & Burn system is PC-based, the first step is to launch the Learn & Burn software on your computer. After the program is running, you will be prompted to either enter a part number for the remote that you wish to clone – if you know the part number - or to look up the remote by the vehicle application. Most of the time, you’ll be looking up the remote by its application, and the software will walk you through the selection of the vehicle by make. model and year.
Once a vehicle is selected, the system will display a screen showing a sample of the OEM remote and any compatible KeylessRide remotes. If the photo shown matches the remote you’re looking for, you can then choose to either “Originate” or “Duplicate” the remote onto a KeylessRide remote.
“Originate” refers to burning the factory pre-sets into the blank remote so that you can then program the remote into the vehicle with an on-board procedure, or with a diagnostic device. The “Duplicate” option allows you to clone the customer’s existing remote onto a blank remote. A “duplicated” remote will operate on the vehicle without additional programming because it is an electronic copy of a working remote. You would only choose the “Originate” option if the customer did not have a working remote. Photo 17 illustrates the different screens that the Learn & Burn system uses to walk you through the remote identification and selection processes.
If you are originating a remote, first verify the compatibility of your blank remote, and then attach the remote to the Learn & Burn device. The software will then guide you through the burning process to download the factory settings into your blank remote so that you can then program it into the vehicle. The software will also show you the correct on-board programming procedure to use and whether or not you will need to use a diagnostic device as shown in photo 18.
If you are duplicating the remote, you need to verify the compatibility just as before, but you will also have to download the information from your customer’s existing remote into the new blank remote. Once again, the Learn & Burn software will walk you through each step, as shown in photo 19. Along the way, you will press each button on the original remote and Learn & Burn will recognize and automatically map each button as they are learned. Should you make a mistake or a customer changes their mind, the remote can always be programmed over again.
Using a Diagnostic Device
Many new vehicles, especially those on the CAN system, require the use of a diagnostic device for remote programming. Because the sale and programming of remotes has become so profitable for the manufacturers, most of these vehicles are intentionally designed to encourage the owner to bring the vehicle back to the dealer for new remotes.
Aftermarket diagnostic devices can be used on some of these vehicles, and the manufacturers of the aftermarket devices are constantly adding more functions, but a lot of vehicles simply cannot be programmed with aftermarket devices.
Programming a PT Cruiser with an SDD or TKO
The SDD tool is an earlier version of the TKO tool from Silca and the programming procedure shown here would apply to both machines. The remote programming features of these tools are somewhat limited, but the programming process itself is typical of the diagnostic tools available to locksmiths. Silca refers to remotes and the remote programming process by the acronym RKE, which stands for “Remote Keyless Entry.” Silca also offers a packaged set of remotes like the one shown in photo 20, but these are OEM remotes that are also available from many other sources, including the dealers.
Programming a PT Cruiser (photo 21) with the SDD is quick and straightforward. After you have verified that you have the correct replacement remote, plug the diagnostic device into the OBD Port and then select “Remote Controls” as shown in photo 22.
In the “Remote Controls” menu, select Chrysler and then select the appropriate vehicle (PT Cruiser) as shown in photos 23 and 24. You will then be instructed to turn on the ignition and press any key on the machine as shown in photo 25. At this point, you will be informed that the vehicle will only accept four RKE transmitters as shown in photo 26. The number of remotes that can be programmed into a vehicle will vary according to the make and model of the vehicle.
Next, you will be instructed to press any button on the remote to program that remote into the vehicle. A chime will sound from under the dash to indicate the remote was successfully programmed. (On some vehicles the power door locks will cycle to indicate successful programming.) You can now add as many as three more remotes by pressing any button on the remote that you wish to add. Unplug the machine to complete the programming.
Many new vehicles use an integrated remote such as those shown in photo 27. These keys contain a transponder that must be programmed into the vehicle as well as a remote transmitter. Depending on the vehicle, the remote may have to be programmed separately, or it may be programmed at the same time as the transponder.
