Every car key fob, garage-door remote and wireless alarm keypad is built from one of the least glamorous chip categories in the industry: a battery-powered Sub-GHz transmitter, a matched superheterodyne or image-reject receiver, and a key-storage-and-authentication block that decides whether the command is genuine. Throughput is irrelevant here — a door command is a few bytes a few times a day — so the whole application logic revolves around not wasting microamperes while waiting for a signal that almost never arrives. This article explains how remote keyless entry (RKE) and rolling-code remote-control links are actually engineered, what is changing in the technology, and which domestic suppliers offer concrete candidates. For continuous data links in the same bands, our Sub-1 GHz transceiver article covers the throughput-oriented side of the story.
Application logic: engineering for a signal that rarely arrives
An RKE link spends almost its entire life asleep. The fob transmitter wakes on a button press, sends a short frame and goes back to sleep; the vehicle receiver, however, must listen continuously without draining the battery, which is where the architecture splits:
- Wake-on-air discipline — receivers use periodic polling, duty-cycled sniff modes or a separate low-frequency (125 kHz) wake channel before the UHF receiver is powered at all; every microampere in the waiting state is multiplied by years of parking.
- Rolling-code authentication — each press transmits a counter value encrypted or MAC-protected with a secret key shared during pairing; the receiver accepts counters inside a forward window and resynchronises after out-of-range presses, so replaying an old capture opens nothing.
- Pairing and key learning — during production or a service procedure, the fob's key and counter base are written into the receiver's NVM over the LF channel or a wired diagnostic link; losing the key store means losing every paired fob, so update procedures are part of the design.
- Band and modulation choice — 315 MHz (Americas, Japan) and 433 MHz (Europe, China) with OOK or 2-FSK at a few kilobits per second; the narrow bandwidth trades data rate for a dozen decibels of extra range.
- LF wake and bidirectional confirmation — the 125 kHz coil on the fob picks up an immobiliser or wake challenge at centimetre-to-metre range, and modern two-way systems confirm lock status over the UHF return path.
- Coin-cell arithmetic — transmit current of 7–25 mA for a few milliseconds per press must average out with sleep current below a microampere to reach a five-year battery life; the sleep number, not the transmit number, decides the datasheet.
Parameters that decide whether the link opens the door
- Standby and polling current — the average receive current, including the duty-cycle overhead of waking the digital section, is the number that sizes the battery; a part that listens at 2 mA instead of 12 mA changes the whole power budget.
- Sensitivity at the actual data rate — −110 to −121 dBm figures are quoted at specific bit rates and deviation; at 2.4 kbps with narrow deviation the number is real, at 50 kbps it is fiction.
- Block-image rejection in a switched-mode environment — the receiver sits next to a body controller full of switching regulators; a receiver with poor blocking desensitises every time the lamp driver fires.
- Crystal tolerance versus channel bandwidth — at 433 MHz a ±30 ppm pair of crystals can drift tens of kilohertz apart over temperature; the channel filter must swallow the worst case or the link fails only on winter mornings.
- Key-store security — rolling-code strength depends on the algorithm and on whether the key can be read out through debug ports; parts with locked NVM and hardware crypto survive a teardown.
- Transmitter harmonics — OOK transmitters rich in harmonics need fewer external filters when the output stage is inherently clean; harmonics decide how much PCB the BOM pays for.
- ESD and load-dump immunity — fobs live in pockets and door handles; pair the antenna port with the philosophy in our antenna-port ESD article.
What is changing in RKE and remote-control technology
Three currents are reshaping the category. First, passive entry goes two-way and location-aware: passive-entry/passive-go (PEPS) systems pair a 125 kHz transmit loop on the vehicle with an always-listening UHF receiver on the fob, measuring LF signal strength per antenna to place the key within a metre — and the newest systems measure the same geometry with UWB precision ranging to defeat relay attacks, which is why the fob is converging with the UWB anchor role described in our UWB ranging article. Second, smartphone takeover with a hardware fallback: BLE digital keys are entering production cars and locks in volume, yet the 315/433 MHz emergency path remains mandatory for coin-dead phones, so the modern fob SoC increasingly integrates BLE alongside the Sub-GHz radio. Third, integration and calibration: single-die CMOS parts now integrate the LF wake receiver, the crypto accelerator and the NVM key store, and are shipped with factory-calibrated synthesizers that remove manual frequency alignment from production — the same integration pressure that reshaped the general-purpose transceiver market. For the MCU side of key management, see our firmware-protection guide.
Domestic alternatives: suppliers and indicative cost
Domestic coverage of this category is genuinely strong, because Sub-GHz remote control is a volume business with demanding cost discipline. HOPERF (CMOSTEK, Shenzhen) offers the CMT2300A transceiver family — 127–1020 MHz, OOK/2-FSK, −121 dBm sensitivity, +20 dBm output, 300 nA sleep — alongside dedicated transmitter, receiver and encoder-transmitter chip lines that map one-to-one onto classic fob architectures; its application notes explicitly list remote keyless entry among target uses. Additional domestic design houses ship Sub-GHz transmitter and superheterodyne receiver families aimed at the same alarm and access-control volumes, and paired rolling-code logic is available as MCU firmware rather than dedicated silicon, which lets a generic MCU plus a radio replace the classic encoder chip. Imported anchors — the Microchip HCS301-class rolling-code encoder and KEELOQ-style transponder parts, Infineon and NXP automotive RKE/PEPS transceiver families — remain the reference points in export vehicle programmes and wherever a functional-safety qualification trail is contractual. Verify every cross-reference against your band plan and pairing protocol; family-level candidates are a starting point, not a conclusion.
A two-way bench is quick to assemble from catalogue stock: a Tai-Saw TA0224A SAW filter to define the receive channel, a Mini-Circuits PHA-13LN+ as a reference low-noise stage for sensitivity measurement, a Cosine COS2991S LDO for coin-cell-representative supply ripple, a Titan Micro TS2502PN guarding the antenna port, and an Artery AT32F403ACGT7 implementing the rolling-code pairing logic and counter windows in firmware.
Price figures below are indicative public-market reference ranges for moderate volumes, compiled from publicly observable listings. They fluctuate with the spot market, package option, grade (industrial, automotive, screened) and order quantity, and must not be read as a quotation. Ask us for a firm price on your exact part numbers and quantities.
| Function (imported anchor) | Example import part / class | Indicative import price (USD) | Domestic candidate | Indicative domestic price (USD) |
|---|---|---|---|---|
| Rolling-code encoder / fob TX | Microchip HCS301-class encoder + discrete TX | 0.6 – 1.6 | HOPERF encoder-TX chip and CMT TX families (family level) | 0.15 – 0.5 |
| Sub-GHz transceiver (fob or node) | Infineon / NXP automotive RKE transceiver classes | 1.5 – 4.0 | HOPERF CMT2300A family | 0.25 – 0.8 |
| Superheterodyne receiver IC | Legacy 315/433 MHz superhet RX classes | 0.8 – 2.2 | HOPERF dedicated RX chip line (family level) | 0.2 – 0.6 |
| LF 125 kHz wake receiver | NXP / Infineon PEPS LF front-end classes | 1.5 – 3.5 | Integrated in newer domestic SoC lines (family level) | 0.6 – 1.5 |
| Receive channel SAW filter | Murata / Taiyo Yuden 433 MHz SAW | 0.25 – 0.9 | Tai-Saw SAW (site stock: TA0224A, TB0614A) | 0.08 – 0.3 |
| Control MCU for pairing & key store | STM32-class general purpose | 1.2 – 3.0 | AT32F403ACGT7 (Artery) | 0.4 – 0.9 |
| Coin-cell LDO | Classic 150 mA LDO classes | 0.3 – 0.8 | COS2991S (Cosine) | 0.08 – 0.25 |
Read the table as a screening tool, not a quotation. The practical reality at this tier: domestic Sub-GHz radios undercut imported parts by a factor of three to six while matching the classic sensitivity and current numbers, and the genuine engineering work has moved into the protocol layer — rolling-code implementation quality, counter-window robustness, key-store protection — which is firmware you control regardless of radio vendor. Where imported automotive transceivers still justify their premium is the qualified PEPS package: LF wake, crypto and AEC-Q100 screening bundled with an OEM-recognised part number.
Validation flow before you commit
Validate range and battery life together, because optimising either alone misleads. Sweep sensitivity at your exact data rate and deviation in an anechoic or at least a cabled setup, then repeat radiated range tests with the fob in a hand, against a car body panel and at floor level — ground reflections dominate 433 MHz behaviour at parking-lot scale. Exercise the rolling-code state machine deliberately: fifty presses with the receiver unpowered (the classic out-of-window failure), replay attempts from recorded frames, and a battery-swap reset. Measure average current over a full duty cycle with a µCurrent-class meter, including the polling spikes your oscilloscope will miss. Finally, hammer the pairing procedure across production-rate volumes; key-learning corner cases are where field returns of remote-control products actually come from.
Frequently asked questions
What exactly makes a rolling code secure?
Each transmission carries an encrypted or MAC-protected counter that advances with every press; the receiver accepts counters within a window and rejects anything older. Security rests on the shared key never leaving the pairing procedure and on counters surviving dead-battery presses through resynchronisation logic.
Can domestic Sub-GHz radios replace imported RKE transceivers?
At the radio level the domestic families match sensitivity and current figures at a fraction of the price. Automotive PEPS programmes should verify AEC-Q100 qualification and OEM approval; alarm, access-control and industrial remote-control applications qualify domestic parts routinely.
Why does my remote fail after about fifty presses with a dead car battery?
The transmitter counter kept advancing while the receiver could not acknowledge; once the difference exceeds the acceptance window the fob must resynchronise. Reputable designs allow this by pressing the button twice or via the LF channel - test it explicitly.
Is BLE going to replace 433 MHz remotes entirely?
BLE digital keys are replacing the phone-side convenience layer, but the Sub-GHz emergency path persists because it works with a coin cell for ten years and a $0.30 radio. Expect both radios in the same fob for years.
About us & trademarks: JTDZ Tech (Shenzhen Jingteng Electronics Technology Co., Ltd.) is an independent distributor of electronic components. We are not an authorised distributor or representative of the imported manufacturers named in this article. Manufacturer, brand and part names are used for identification purposes only; all trademarks remain the property of their respective owners. Cross-reference information in this article is based on publicly available sources, is subject to change, and is not a substitute for your own engineering validation. Always verify specifications against the manufacturer's datasheet before design-in or purchase.
