iFOBing A Mazda
Ditching the Key
I hate keys. I am on a mission to dispose of them all. There is currently a key pad to enter the SparkFun building, a key pad on my home, and RFID to get into the interior rooms at SparkFun. It is my goal to get rid of the last key in my pocket, my Mazda key! I combined the Nike+iPod device and my key fob, with an Arduino Pro Mini, to create the iFOB.
Code: iFOB pde
A few years back we posted a tutorial on how to use the Nike+iPod for active RF identification. The Nike footpod transmits a unique ID every time it is used. I would much rather have a small footpod in my pocket than my full car keys. So how can I get a Nike footpod to unlock my car? It was actually not too hard:
You can see the internals of the footpod (it's a Nordic IC!) and the receiver hooked up to our iPod serial board. The iPod Serial board allows direct access to the Apple receiver. Here are the two initialization strings:
0xFF, 0x55, 0x04, 0x09, 0x07, 0x00, 0x25, 0xC7
and
0xFF, 0x55, 0x02, 0x09, 0x05, 0xF0
Once we send these two serial strings to the iPod receiver, the receiver will report a serial string of about 33 hex characters every time a footpod is heard. Within these 33 characters is the unique ID of any footpod within range.
So here in lies the goal of iFOB: design a system that listens for a unique ID (kind of like active RFID) and does something when the correct ID is heard. In this case, unlock the doors to my car.
So here is iFOB! In the middle is the Arduino Pro Mini running at 3.3V. The Mini is powering the iPod serial board (at 3.3V) and has serial lines connected (TX and RX) so that the Mini can configure and then listen to serial responses from the iPod receiver. I used a clear SparkFun enclosure so I could see the status LED on the Mini for debugging.
At the bottom of the picture is the internals from the key fob to my car. I've got one wire connected to ground (the gray one) and two wires connected to the other side of the 'lock' and 'unlock' buttons. When the Arduino Pro Mini tells the red wire to go low, the key fob thinks I am pressing the lock button, and my car locks! Simple enough. The fob currently uses its own 3V lithium coin cell, but I may connect 3.3V from the Mini some day. The coincell lasts for months or years so I'm not too concerned.
On the right is a foot pod used for testing. It's labeled 'AE' (the last hex digits in its unique ID) so that I can tell it apart from the other footpods I had laying about.
This entire device lives inside my car. The Mazda computer is smart enough to ignore the key fob if the car is running so I don't have to worry about spurrious signals from my pocket locking and unlocking my doors while I'm driving.
At the bottom of the picture is the internals from the key fob to my car. I've got one wire connected to ground (the gray one) and two wires connected to the other side of the 'lock' and 'unlock' buttons. When the Arduino Pro Mini tells the red wire to go low, the key fob thinks I am pressing the lock button, and my car locks! Simple enough. The fob currently uses its own 3V lithium coin cell, but I may connect 3.3V from the Mini some day. The coincell lasts for months or years so I'm not too concerned.
On the right is a foot pod used for testing. It's labeled 'AE' (the last hex digits in its unique ID) so that I can tell it apart from the other footpods I had laying about.
This entire device lives inside my car. The Mazda computer is smart enough to ignore the key fob if the car is running so I don't have to worry about spurrious signals from my pocket locking and unlocking my doors while I'm driving.
While testing I found the range of the transmitter (the footpod) was really pretty impressive at 50+ feet. This was cool, but I didn't want my car to be unlocking/lock while walking around my house or office. To cut down on the reception, I sabotaged the antenna. I could have hacked into the footpod, but then it wouldn't have fit so nice in my pocket. Instead, I completely wrapped the receiver with a few layers of aluminum foil. This cut the reception down to 20-25ft. Jeesh! What do I have to do to kill the power on these things? These devices are designed and built very well!
I needed to pull power from the car's battery so I created a simple wiring harness. I was a bit worried about the iFOB mercilessly frying my electrical system, so I put in an inline fuse for a $1 worth of insurance.
Here is the iFOB with antenna snubber (that's heat shrink to hold the foil on), Arduino Pro Mini and the stock FOB for my car. The board on the left is the internals of a USB cigarette adapter. This USB adapter takes in 12-24V from the car's electrical outlet (the now universal cigarette jack), and outputs 5V so that you can charge USB devices. I then wired this 5V to the raw input pin on the Mini. The Mini then regulates this (some what noisy) 5V down to a clean 3.3V, all with pretty decent efficiency. I don't want a power hog draining the car battery!
I removed the housing and USB connector from the cigarette adapter and installed a JST connector. This made i so that I could easily disconnect the iFOB from the car if need be. I was worried that I may need to remove the iFOB if I took my car into the dealer, or if I parked the car for an extended amount of time. It turns out this was a very good addition as I ended up reprogramming the device quite a bit before I got the code working solidly.
I removed the housing and USB connector from the cigarette adapter and installed a JST connector. This made i so that I could easily disconnect the iFOB from the car if need be. I was worried that I may need to remove the iFOB if I took my car into the dealer, or if I parked the car for an extended amount of time. It turns out this was a very good addition as I ended up reprogramming the device quite a bit before I got the code working solidly.
I decided to intall the iFOB in the passenger side foot well. I figured this would be a good place to find a 12V power wire. I know nothing about cars so I just started pulling back panels until I found wiring. Wow is there a lot of it!
Don't cut the red wire!
To find 12V I used my trusty multimeter. Luckily, I found a wire nearly immediately that registered 12V but it was a thin black and gray wire. To be sure this was directly off the battery and not a control wire, I tried to do a continuity test from the positive terminal of the battery to this pin. No good - I didn't get direct continuity. Is it because I am testing the impendance of a rather long wire? I'm not sure. But it's 12V right? I used some nifty automotive quick splice connectors and tapped the black and gray wire. I just need a few mili-amps, no big deal right?
The iFOB behaved very oddly. Sometimes it would work, sometimes not at all. I couldn't figure out what the problem was. I guessed that the power system might be causing the ATmega168 on the Arduino Pro Mini to latchup, so I decided to add a watch dog timer to my Arduino code. The watch dog timer runs in the background of the chip and if the system code freezes, the watch dog resets the chip, clearing out the locked up variable or code. It worked for the Apollo missions - why not now?
The iFOB wired up and hanging out in foot well
I'm not sure what the black and gray wire is, but every time I plugged
the iFOB into the car, the car would honk. I assumed this was the iFOB
powering up (GPIOs tend to twiddle during power up) and accidentally hitting the lock button twice (causes the car to honk).
Over time I began to realize I found some sort of 'honk' wire. I also found out that this wire would turn off after an unknown amount of time, kind of like your dome
light turns off after the car is locked for 15 seconds. It was too difficult to sit in the car for hours on end to find out if in fact the wire was powering down, so instead I just tapped into the big fat red wire that registered 12V. This is a direct line off the battery. And when I plug in the iFOB, the horn doesn't honk! Hrmm.
After a few more days of testing, frustration continued. The system worked during testing, but during normal, everyday use, it did some very annoying things. Mainly, as I walked up to the car, the doors would lock! What in the world? More testing, and I found out that the Mazda has a neat security feature built in: if an unlock command is received by the car's computer, but a door is not opened within 25 seconds, the computer will automatically re-lock the cars.
Ah hah! The iFOB was picking up my footpod some distance away from the car (like in the stair well down to the parking lot). If it took me 28 seconds to get to my car (from the point at which the receiver picked up the footpod) the car would automatically re-lock after 25 seconds, right before I pulled on the handle. A bit more Arduino code and the iFOB now unlocks the doors every 10 seconds while the footpod is heard, and until the car is started. This extra bit of code fixed the relocking problem.
The system now works great! When you've got a handful of stuff, it's great to know the doors will automatically unlock as you approach. However, I still have use a key to start the car. The next step is get a big red button wired up for button start so that I don't have to carry my key. Someday.
The iFOB behaved very oddly. Sometimes it would work, sometimes not at all. I couldn't figure out what the problem was. I guessed that the power system might be causing the ATmega168 on the Arduino Pro Mini to latchup, so I decided to add a watch dog timer to my Arduino code. The watch dog timer runs in the background of the chip and if the system code freezes, the watch dog resets the chip, clearing out the locked up variable or code. It worked for the Apollo missions - why not now?
The iFOB wired up and hanging out in foot well
After a few more days of testing, frustration continued. The system worked during testing, but during normal, everyday use, it did some very annoying things. Mainly, as I walked up to the car, the doors would lock! What in the world? More testing, and I found out that the Mazda has a neat security feature built in: if an unlock command is received by the car's computer, but a door is not opened within 25 seconds, the computer will automatically re-lock the cars.
Ah hah! The iFOB was picking up my footpod some distance away from the car (like in the stair well down to the parking lot). If it took me 28 seconds to get to my car (from the point at which the receiver picked up the footpod) the car would automatically re-lock after 25 seconds, right before I pulled on the handle. A bit more Arduino code and the iFOB now unlocks the doors every 10 seconds while the footpod is heard, and until the car is started. This extra bit of code fixed the relocking problem.
The system now works great! When you've got a handful of stuff, it's great to know the doors will automatically unlock as you approach. However, I still have use a key to start the car. The next step is get a big red button wired up for button start so that I don't have to carry my key. Someday.
I used to install Ignition Interlock Devices (Read: Breathalyzers) on cars, and learned alot from that. Tapping into random wires can be pretty dangerous to your vehicle because depending on the wire you can ground out computer modules which are expensive to fix. http://www.the12volt.com/Default.asp? is a good resource for vehicle wiring.
While theres nothing wrong with putting the device in the passenger side foot well, it would have probably been easier to put it in the driver side kick panel, right below the steering wheel. Thats where we always stashed the IIDs.
If you want any input on the big red start button or vehicle wiring, just shoot me an email chansuke (at) gmail.com
Thanks for this tutorial, but I have a few questions
I'd like to do this for my car, except with bluetooth. My issue is that my key fob only has a single button to both lock & unlock the car. I fear that my device could get out of sync and accidentally lock the car as I approach and unlock as I leave. Any suggestions for that? Also, I'm curious as to why you didn't (need to) use a MOSFET? The original example I found: http://www.instructables.com/id/Bluetooth-Garage-Door-Opener-Car-Starter/ required a MOSFET to digitally open/close the circuit.
The pod only transmits when you walk or you can keep it in the pocket? I ask this because, in the other page, was said about the power generation capabilty of the speaker(gold circle)
It's funny coming back and reading this now.....Sadly enough, us hackers don't have to do this for the newer cars :-/
Hi Nate! I really liked your tutorial/idea and i wanted to expand on it. So I did. I took an atmega328 and a few components and relays and built a system I call MVCS (Mitsubishi Vehicle Control System). My system listens for a specific Nike+ Shoe Sensor using the Nike+Ipod USB to serial converter. When it recognizes the sensor, it disarms the factory alarm, unlocks the doors, and chirps the siren twice. When the driver (not me because I am only 14) enters the vehicle, he can push a button as long as the Nike+ sensor is still in range and the car will start. The steering wheel and the shift lever unlock so that the car can be driven. No key is necessary but in case the system fails, the car's key will shut it off when inserted and the car can be started with it. While driving, the car cannot be stopped by the button unless it is in park. When the car is locked and the sensor is no longer in range, the car locks, and the factory alarm is armed. I directly tapped into the cars wiring and i am not using a spare remote like you are. My next addition to this alarm is speech so it can say things like "Back away from the car", or "Alarm system armed." but I cant because as I mentioned I am 14 and i cant really afford it. Anyway my point is that I am using your code in my system to recognize the Nike+ sensor and although when the real-time operating system on the atmega328 starts up, over the serial port a friendly thank you and credits message appears for you because i acknowledged that i am using your code, I was wondering, do I have your permission to implement your code into mine? (Yes im asking a little too lake, and yes Credit is given)? Well thank you for reading this and thank you if i get your permission to use your code.
OH BY THE WAY HERES A VIDEO: http://www.youtube.com/watch?v=QdzGmz9S5d4
Has anyone written a basic example arduino script to make this work they care to share? I've messed with the iFOB script to reduce it to just turn on an output when there's a footpod in range, with no luck. It just doesn't seem to get past the init_pod and start receiving. My footpod/receiver combo works fine with the VB script running direct (yes, I've put my footpod id from the VB into the iFOB code).
For me, I have the Arduino Pro Mini 328 - 3.3V/8MHz powered off a 3.3V power source going to the Nike serial adapter. 3.3V & ground, then TX to RX & RX to TX. Simple enough. I'm using the FTDI Basic Breakout - 3.3V to program and get serial out for debugging.
While I enjoy messing with this stuff as much as anyone else, there comes a point where I need to move on to the next level please! Anybody offer any assistance? If I figure it out before then, I'll post up my results.
Figured it out.
2 undocumented features to work around:
NIKE_quick_start.pde
This may be a stupid question, but how does one find out their unique footpod ID? And just to make sure, i need to hook use both the RX and TX ports right?
Hello,
Is there a schematic for your setup? I am not sure if I connect the RX from the iPod Serial to the RX of the Arduino and the TX from the iPod Serial to the TX of the Arduino or do I connect the TX from the iPod Serial to the RX of the Arduino and the RX from the iPod Serial to the TX of the Arduino. Also how did you determine the unique ID for your FOB? I used the VB program that was listed at the iPod Serial webpage and I entered my unique ID into the arduino program but I am not having any luck in getting this project to work.
THANK YOU,
Biz
I'm in the process of doing this myself, I was wondering if you could be a little clearer on the connections between the ipod serial board and the Pro Mini; I'm a little new to Arduino, my expertise is in the automotive field. All the pictures show the top of the board, I can't really see where the connections are being made, if you had a schematic that would be great too. I don't know what your link policy is, but there are a lot of Mazda 3 forums that have instructions that could show you how to make it so that your windows and sunroof will close when you leave the car as well. Also a better place to tap for power would have been right off the battery in the engine bay, the plastics in the cabin are flimsy and are liable to snap after being pulled apart a few times, being in the engine bay would have made it more accessible and would have made all the wire sniffing unnecessary; just a thought. Love your site though, I've been getting into this stuff in a big way lately and it's been solely because of how accessible you guys have made this tech.
Woah... I just set up almost the exact same system in my car last week, but using RFID instead of Nike+iPod. I had a spare remote, which I wired up to my Arduino and a Parallax serial RFID reader. I'm getting an RFID implant (similar to the glass tag you sell) soon that'll allow me to walk up to the car and put my hand on the window to unlock the doors. I'm currently using the setup with a credit-card like tag that I keep in my wallet.
Nice job writing this up. And for those of you who are concerned about security... Think about your average car burglar/thief. How many of them are going to go to the trouble of detecting the ID of a Nike+iPod/RFID tag and somehow rebroadcasting it to get into your car? Someone capable of pulling that off would probably be doing something other than breaking into cars in their spare time. Plus, it'd be way easier to just break the window.
Great idea but very scary way to hook it up to a vehicle! I am a total noob when it comes to most of this EE stuff but right now I am hacking away at my car. Just bought a SCT tuner (reads the PCM and re-writes it). I have a couple items that I would like to make (that's why I am here) for the car but have some questions concerning using items (like an arduino) with the 12V that some of the sensors put out. I would like to make a WOT shift box, (when the gas is all the way to the floor, and the clutch is depressed, send a signal to the vehicle shut down relay to kill the engine for x amount of time to shift without lifting the gas.) and maybe another "widget" or two. What reading would you recommend that I do? Are there better items to use with 12V? or can I use the arduino with a shield that I have yet to read about?
Hi there,
NATE i'm a new guy with an arduino, my job is to install security devices (car alarms,engine kill switches,gps,etc,etc) and i've bought the ipod serial board and the arduino itself (duemilanove atmega328).
The ipod serial board is working good without the arduino once i follow your tuto an loadup the sketch from the same page everything seems to be working fine and then i make all my conections to the arduino board the ipod serial board RED LED lits but none of the TX or RX seem to work.
can you explain to me what i'm doing wrong and please can you say it in english (not speaking in computer language)for a newie guy.
thanks in advance (SORRY FOR MY ENGLISH GUYS STILL LEARNING)
GREAT TUTORIAL
Hi Nate. First thank you for your great project. Do you have a wiring diagram you can share???
So couldn't you theoreticly use the RF capabilities in an iPhone to create a UI to do this? The RF Transceiver is the Infineon GSM/EDGE RF transceiver but - the problem is that the iPhone OS will not let you access it. One other possibility is to "hack" it by going around the OS restrictions of Apple - and access the Infineon chip directly at the lower levels. Would be neat but would definately never end up in the app store :)
I have heard some stories of people messing around with the wiring under the dash and having the air bags deploy and seriously injure or possibly kill them. idk. I was always skeptical of these claims but it wouldn't surprise me if it was possible.
Great Tutorial btw. Loved the work. Very innovative! One thing you could do is use an add-a-fuse kit which allows you to wire things directly into your existing fuse box in your car. The only thing is some cars don't have extra places for fuses.
Thanks,
Joe
why not put it in your nike+ shoe?
I generally like stuff like this, but some tech has in my opinion a long way to go. Off the top of my head keys have a couple of advantages that I'm unwilling to forgo 1) they never ever run out of batteries b) if I fall in a pool or wash my keys they still work. 3) I have to drop a key from the 10th floor to do any harm to it, and even then I've got a good chance. Case in point I have two keys with the little lock/unlock buttons. One key works, the other got washed and doesn't. I dropped the 'bad' key yesterday and it bounced down the stairs then off the deck for a 4 meter fall onto the concrete. The 'key part' was unharmed. I've never had anything with batteries that could take that sort of abuse.
That aside, this is still pretty damn cool.
Good work outta you,
Thanks for reading! I agree batteries and the clothes washer can be death to a good system. Both of these problems (battery life and physical hardiness) can be solved in time. The current footpod is actually nearly indestructible, but you can't easily change the battery (2 year life).
When in doubt for power, tap off the cigarette lighter or the fuse pannel.
I would have much rather used power from the cigarette port but it unfortunately turns off when the car is turned off.
@CHaskins: Be careful, alot of cars turn off their cigarette lighters then the car is off. Mine does, and that would mean that it wouldn't work for this project.
@Nate: At the end of the article you mentioned an extra bit of code that unlocks the car every 10 seconds until the car is started. I didn't see anything that sensed the car being started, so I assume that it constantly does this while you're in the car, it is just ignored while the car is on. If this is the case, that 3v lithium battery will die much faster, you should think about powering off of the 3.3v available from the Arduino.
Also, remember that with this installed, it's pretty hard to leave your car unlocked. It will be unlocking as you walk away and then relock 25 seconds after you're out of range. Probably not a problem since you'd have the iFOB with you, but something to remember.
Mike - I was worried about that car locking/unlocking randomly while I was driving (not real safe). The Mazda computer is smart enough to ignore all FOBs when the key is in the ignition. I've also noticed that driving/sitting is not enough movement (even with a clutch) to set off the accelerometer in the footpod, so after 10 seconds the footpod shuts off.
Car locking question: If the footpod is not heard for 5 seconds (assumes I've walked away), the iFOB hits the lock button. It's there in the code, but I failed to mention it in the tutorial.
Ah, so the footfod only transmits when it detects motion(makes sense), and driving the car isn't enough to set it off. That's just about perfect then, isn't it?
Cool idea, but I don't think I'd trust the Nike+Ipod device with my car. Especially since the ID isn't even encrypted.
I guess it would be less convenient, but I'd probably make a RF device and then use
TEA or RC4. Both of which are small enough to implement on an AtMega 168, with enough space left over for some significant key storage.
Then you would have rolling code security. While TEA and RC4 have weaknesses, they are much more secure than simply sending out a code every time you step on the ground.
Or use Bluetooth. That way I could have my cellphone control everything. It's the way of the future! Your new cellphone will be able to be your credit card, TV, computer, keys, music player, alarm clock, and government overseer! (Big Brother is now in your pants...eww)
Anyways, to each his own. I just think that I wouldn't base my security around something for which I sell modules to circumvent.
That was my first thought as well. It seems like you really need a challenge / authentication code, which would make it much harder for somebody to clone. A rolling one-way code with some kind of cryptographic authentication would be a good start, but you would have to do more rcvr-side work to keep somebody from recording your working code and replaying it later.
The Toyota keyless entry system that my Camry Hybrid has is the coolest improvement to cars since air conditioning. It unlocks when you touch the door handle (with FOB in pocket). I keep on walking up to other types of doors and wondering why they don't unlock for me.
Anyway, nice job on the iFOB, I'll probably try to make my own a few projects from now.