Keyless Entry and Remote Start: Rolling Codes, Passive Entry, and Diagnosis

Basic Remote Keyless Entry

Remote keyless entry has been standard equipment for so long it is easy to forget how it actually works. The key fob in your pocket is a small radio transmitter. Press a button, and it sends a coded radio frequency signal — typically 315 MHz in North America, 433 MHz in Europe — to a receiver module in the vehicle. The receiver decodes the signal, verifies it matches a stored authorization, and commands the BCM to activate the door lock actuators.

The receiver is typically located in the interior of the vehicle, integrated into the BCM, or mounted as a separate module. Antennas are routed through the vehicle to improve reception from all directions. A fob that only works from certain angles or distances may have a reception issue — blocked or damaged antenna, or a module with a failing RF receiver circuit.

Rolling Codes

This is one of those elegant engineering solutions that is worth understanding completely. Early keyless entry systems used a fixed code — press the button, it always sent the exact same signal. A thief with a radio scanner could record that signal and replay it ten minutes later to unlock the vehicle. Simple and effective theft.

Modern systems use rolling codes (also called hopping codes). The key fob contains a cryptographic algorithm and a counter. Every time you press the button, the fob advances its counter and uses the algorithm to generate a new unique code. The vehicle's receiver has the same algorithm and tracks the same counter. When it receives a code, it checks whether the code matches the expected next code (or within a small window of future codes, to account for accidental button presses in a pocket). If it matches, it unlocks and advances its own counter to stay synchronized.

The code used five minutes ago will never work again — the vehicle has already advanced past it. A recorded signal replayed by a thief gets rejected as an already-used code. The only way to defeat rolling codes is more sophisticated active jamming attacks, not simple replay.

If a fob and vehicle get out of sync — the fob was accidentally pressed many times in a pocket, advancing its counter far ahead of the vehicle's counter — the fob may stop working until it is resynchronized. The procedure usually involves pressing both lock and unlock simultaneously a specific number of times, or a specific ignition sequence. Look up the manufacturer sync procedure for the platform.

Passive Entry Systems

Passive entry eliminates the button press entirely. Instead of waiting for you to transmit, the vehicle continuously broadcasts a low-frequency (LF) signal through antennas placed around the vehicle — typically in each door handle and at the trunk/tailgate. The LF signal has very short range — a few feet at most.

When your fob enters that field, it wakes up and responds with its rolling code via the standard RF frequency. The BCM authenticates the response and enables a touch-unlock capability. Walk up to the door, touch or pull the handle, and the door unlocks — no button press required. The authentication exchange happens automatically in milliseconds as you approach.

The same system applies to the trunk or liftgate — many vehicles unlock the trunk automatically when you stand at the rear bumper with the fob in your pocket. Some implement kick-to-open using a foot-detection sensor under the bumper for hands-free liftgate operation.

Passive entry diagnostic approach: If button presses work but passive touch-handle does not unlock, the fault is in the door handle LF antenna or its wiring — not the fob itself. The handle antenna is wired through the door and connects at the door harness connector. Check that connector for corrosion, check the antenna resistance if specs are available, and scan for antenna fault codes in the BCM or keyless control module.

Push-Button Start

Push-button start replaces the mechanical ignition switch and key cylinder. The start process uses the same LF/RF authentication as passive entry. When you sit in the vehicle, LF antennas inside the cabin send a wake-up signal. Your fob wakes up and responds via RF. The BCM or keyless entry module verifies the code. If authenticated, the start button becomes enabled — a press of the brake pedal plus the start button cranks and starts the engine.

If the fob is not detected inside the cabin, pressing the start button does nothing (or shows a no-key warning). The system requires the fob to be physically inside the vehicle to authorize the start. This is a theft deterrent — even if someone has your fob code, they need to be inside the vehicle with the fob to start it.

The in-vehicle LF antennas are typically mounted under seats, in the center console, and near the B-pillars. A failed interior antenna means the vehicle cannot detect the fob even when it is sitting in the cupholder. The driver sees a no-key message with the fob right there. Scan for interior antenna fault codes and check antenna wiring before condemning the fob or the control module.

Low Battery Symptoms and Backup Start

Fob battery degradation follows a predictable progression. First, range decreases — you need to be closer to the vehicle for it to respond. Then passive entry becomes unreliable — the LF wake-up signal cannot produce enough response from the weak fob. Then button presses become intermittent. Finally the fob stops working entirely.

Every push-button start vehicle has a mechanical backup for this scenario. The procedure varies by manufacturer but typically involves holding the fob directly against the start button or a designated spot on the steering column trim. A small inductive coil in that location can power the fob's transponder chip at very close range — close enough to read the code without a battery. This is sometimes called the emergency start position, and the owner manual shows the exact location. Know this procedure so you can assist customers who call in with a dead fob and a car that will not start.

Fob Battery and Reprogramming

Most key fobs use a CR2032 coin cell battery. Replacement is simple — a small notch or screw allows the fob case to split open. After replacing the battery, the fob should work immediately without any reprogramming in most cases. The rolling code counter and vehicle authentication data are stored in non-volatile memory that does not lose data when the battery is disconnected.

If a fob stops working after a battery replacement, suspect one of three things: a defective replacement battery, a battery installed backward, or a rolling code synchronization issue from accidental button presses during handling. Try the manufacturer resync procedure before assuming the fob is bad.

Adding a new key fob to a vehicle (lost fob replacement) does require programming. The new fob must be introduced to the vehicle's keyless entry system and its code registered. Some platforms allow dealer-like programming through a specific ignition cycle sequence. Most modern platforms require a scan tool with programming access and sometimes manufacturer server authorization.

Diagnosing Keyless Entry Problems

Systematic approach for keyless entry complaints:

1. Define the specific failure — does button press work but passive entry does not? Does nothing work? Does it work from one side but not the other?
2. Test fob battery first — replace the battery regardless. It is the cheapest possible fix and rules out the most common cause.
3. Scan for DTCs — BCM, keyless entry module, or body electronics module codes point directly to the failed component (antenna, receiver, module).
4. Test with a known-good fob if available — eliminates the fob as the variable.
5. Check RF reception — stand at various distances and angles, note when reception drops. This indicates a reception or antenna issue rather than a fob or authorization problem.
6. Antenna testing — for passive entry failures, test the door handle antenna circuits for continuity and proper resistance.
7. Resync procedure — try the manufacturer fob synchronization procedure before recommending module replacement.

The Bottom Line

Keyless entry and push-button start systems are reliable when properly maintained but have specific failure modes that are easy to chase down once you understand the RF and LF architecture. Dead fob batteries cause most complaints. Passive entry failures usually trace to door handle antenna circuits. System-wide failures point to the BCM or keyless control module. Always scan for codes first and replace the fob battery before diagnosing anything else.

Frequently Asked Questions