Alarm Fob Replacement

I Hate Being Ripped Off

My home alarm remote control had seen better days.  After more than six years of abuse, the case was finally cactus, as can be seen below.  My wife's fob was in better shape but it's days were also numbered.

I thought I'd just be able to jump on line and find a replacement, but it looks like my Nx-305 system is the 'old one' and while the 'new one' has many sources of cheap fobs, I'm out of luck getting replacements for mine.

So, I did a little investigation.  Popping open a fob showed:

.. a little 8 pin SOIC that was marked HCS300.  This is a Microchip Keeloq rolling code chip, and when registered with my receiver, provides a more secure system than the old school fixed code remotes.

The HCS300 handles all the functions of the remote - reads the buttons, provides the encoded output for the 433 MHz transmitter, even flashes the LED.  Nifty.

So, a little reading up on the new Activor system showed that these fob also used Keeloq.  So I took a punt a bought a pair from eBay.

Straight off the bat, I tried to enroll the fob into my receiver.  Unsurprisingly, it didn't work.  So I cracked that puppy open:

And was happy to find that it also used a HCS300.  So why didn't it work with my receiver?

If you look at both boards, you'll notice they both have a row of test pads - or more correctly PROGRAMMING pads.

From reading the datasheet, a manufacturer's code is programmed into each fob.

So, what I obviously needed to do was build a reader to extract the code from my old fob, then upload that to the new one.  Or swap chips.

To borrow from JFK:

"I chose to do the latter, not because it's easy, but because the other way is hard."  

So a few minutes later with the hot air tool, the chips are off the boards, donor chip on the left, useless chip in the middle.

But, of course, I'm not finished there.  The boards have the switches connected to different pins on the HCS300, because of different PCB layouts.  So the 'alarm on' switch is actually open roller door 2 and the disarm is the arm button ... or was it ... wait, nevermind.. time to fix it in hardware!

The traces that connect the buttons to the HCS300 were simply cut

.. and jumper wires installed.  It's at this point I realised I was out of TCW and made a mental note to buy some more.  Which I haven't done.

One down, one to go....

After all that, the cases still went back together and all worked well.  And this style of case seems to be available all over eBay / Deal Extreme so next time the cases are beat up, I'll just be looking at a PCB swap.  Woot!