How Smart Keys and Push-to-Start Work

The PEPS system's passive entry function begins with the vehicle, not the key. The car continuously broadcasts a low-frequency (LF) RF signal at 125 kHz from antenna coils embedded in the door handles, the B-pillars, the rear bumper, and sometimes the interior. This broadcast cycle -- called polling -- happens approximately once per second when the vehicle is locked and inactive, consuming minimal power from the vehicle battery. When a valid key fob enters the polling field's range (typically 0.8 to 1.5 meters from the antenna), the LF signal energizes the fob's receive coil, waking it from its low-power sleep mode. The fob's microcontroller reads the LF signal, which contains a random challenge (different on every poll cycle), computes the cryptographic response using its stored AES or equivalent secret key, and transmits the response back via its UHF (Ultra-High Frequency) transmitter at either 315 MHz or 433 MHz, depending on the market and manufacturer. The vehicle's UHF receiver (typically mounted near the center of the passenger compartment ceiling or near the rear glass) picks up this UHF response. The Body Control Module (BCM) or SMART ECU compares the response to the expected value generated from the same challenge using its own copy of the shared secret key. If the response is valid and the fob's rolling code counter is in the acceptable window, the BCM triggers passive unlocking: the door handle capacitive sensor activates (for touch-unlock doors), or the door unlocks automatically (for older passive-entry implementations).

One of the most sophisticated aspects of PEPS is zone awareness -- the ability to distinguish whether the key is outside the vehicle (approaching), inside the vehicle (ready to start), or at the rear (approaching the trunk/hatch). This zone discrimination is achieved by the combination of multiple LF antennas with different field patterns and the BCM's triangulation of the fob's response strength from each antenna. A typical PEPS-equipped vehicle has five to seven LF antennas: one in each door handle (exterior), one in the interior (under the dashboard or center console), one in the trunk/hatch area (for hands-free trunk opening on equipped models), and sometimes one near the ignition button area. The BCM polls each antenna sequentially and measures the relative signal strength of the fob's UHF response to each poll. By comparing these strengths, the BCM can determine approximately where the fob is positioned relative to the vehicle. This zone information is used to prevent a fob inside the vehicle from triggering exterior passive unlock when a door is opened from inside, and to ensure the push-button start only works when the fob is detected inside the vehicle, not just nearby outside. On some vehicles, the zone discrimination is precise enough to prevent the start button from working if the fob is detected only in the rear seat area (a safety feature to prevent children from starting the vehicle).

The smart key fob serves double duty. For passive entry and passive start functions, it operates in wake-on-LF mode -- the LF signal from the car wakes the fob, the fob responds, and everything happens automatically without any button press. This is the 'passive' in Passive Entry Passive Start: the user does nothing. For remote functions -- actively pressing the Lock, Unlock, Trunk, or Remote Start buttons -- the fob operates as an active UHF transmitter. You press a button, the fob immediately transmits a rolling-code command on 315 MHz or 433 MHz, and the vehicle's UHF receiver decodes and acts on it. This active mode is independent of the LF polling system and works at much greater distances -- typically 30 to 100 meters depending on the fob's transmitter power and environmental factors. The emergency mechanical blade inside the fob is the passive entry fallback for when the battery is dead: the mechanical blade, extracted from the fob housing, physically operates the door lock cylinder (usually accessible under a cap on the door handle). A separate LF-only transponder circuit inside the fob (which requires no battery because it is passive like a traditional transponder key) allows the vehicle to authenticate the fob when placed directly against the start button -- enabling engine start even without a working battery in the fob.

The elegant simplicity of PEPS -- the car polls, the key responds, the door unlocks -- creates an equally elegant attack vector. In a relay attack, two criminals work together. One positions near the target vehicle, holding a relay device. The other stands near wherever the vehicle owner's key is stored -- near the front door of their home, in a pocket near a restaurant window, or in a gym bag. The relay device amplifies and bridges the car's LF polling signal over long distances (30 to 100 meters or more), reaching the key fob as if the key were next to the car. The key responds, the car authenticates the response, and unlocks or starts without any key theft, battery drain, or forced entry. Relay attacks are not theoretical. They have been documented in Georgia and across the country, particularly targeting high-value SUVs and luxury vehicles. The countermeasures available to vehicle owners include: Faraday cage key pouches (signal-blocking wallets or cases that prevent the fob from receiving LF signals when stored at home), disabling passive entry in the vehicle's settings menu (requiring active button press to unlock), and for the newest vehicles, the option of UWB-based ranging (Ultra-Wideband) that can detect the difference between a key physically present and a relayed signal. UWB is now appearing in BMW, Audi, and select other brands as a relay-attack countermeasure.

The most common reason a push-to-start system fails is a dead or weak fob battery. As the fob battery's voltage drops below approximately 2.5 volts, the UHF transmitter loses sufficient power to reach the vehicle's UHF receiver from pocket-distance. The fob may still work when held within 10 centimeters of the start button (because the vehicle's start-button LF coil can energize the fob's passive transponder circuit at close range), but fails at normal pocket distance. Other causes include: faulty LF antenna coil (creates a dead zone near that specific antenna), BCM software fault (usually logged as a DTC code, diagnosable with a scan tool), RF interference from nearby electronics (particularly aftermarket wireless chargers on certain frequencies that overlap with 125 kHz), or a physically damaged fob (cracked PCB from a drop or water damage). Diagnosing intermittent PEPS failure correctly requires isolating which component in the chain is the fault -- a process that starts with a fresh battery and proceeds through systematic antenna and BCM testing.