Key Fob Programming: The Remote Half of the Job

A car key does two unrelated jobs, and most of what the trade writes about key fob programming only covers one of them. The transponder talks to the immobiliser over a few centimetres of inductive coupling and decides whether the engine is allowed to run. The remote is a battery-powered radio transmitter working over tens of metres, and it decides whether the doors lock. They sit in the same plastic housing, they are made by the same supplier, and on a good number of vehicles they are programmed by completely separate procedures.

That split is where the money gets lost. You cut the blade, enrol the chip, the dash light goes out and the engine starts — and then the customer presses the button on the driveway and nothing happens. The job is not finished, the invoice is awkward, and you are back the following week with a fob you have already been paid for.

This is the remote half of the job. Which of the five key types is in front of you, what frequency it has to transmit on, why a working remote suddenly stops being accepted, and which procedures pair the remote automatically versus which need a second pass. Every specification below is pulled from the Keysolved vehicle database, which records frequency, battery chemistry, button count and blade profile per key variant rather than per model.

The two halves of a key, measured

The practical difference between the two systems is range, and it is not a small difference. Research by Flavio Garcia, David Oswald, Timo Kasper and Pierre Pavlidès of the University of Birmingham and Kasper & Oswald GmbH, published as Lock It and Still Lose It, puts immobiliser RFID range at a few centimetres, passive keyless entry at about one metre, and remote keyless entry at several tens to hundreds of metres.

That is why the two halves fail differently. An immobiliser fault is a contact problem — chip, coil, aerial ring, barrel position. A remote fault is a radio problem — battery, counter, receiver, aerial, or the wrong frequency entirely. If the engine starts and the buttons do not work, stop looking at the transponder. The chip has already proved itself.

It is also why the remote is the half that gets ignored. The immobiliser stops the job dead, so it gets diagnosed. The remote is an inconvenience the customer discovers after you have left.

The five key types, and what each one means for the remote

The database classifies every vehicle record by key type, and that single field tells you most of what you need to know before you open the van door.

Two things follow from that table and both are worth more than they look.

First, the key type changes within a model's life, not just between models. The Qashqai runs fixed_remote on J10, flip_remote on J11 and smart_key on J12. The Jazz runs transponder on the 2001-2008 car and flip_remote on every generation after it. Quoting from the model name alone is how you arrive with the wrong hardware.

Second, transponder records have no remote at all. There is nothing to programme, nothing to charge for, and no fault to chase when the customer says the buttons do not work. They never did.

Why the remote is sometimes a separate job

This is the part that is genuinely architecture-dependent, and the Birmingham research explains it better than any tool manual. In the Hitag2 systems the paper examined, the immobiliser interface can be used to resynchronise the counter the remote relies on — the two halves share a path, so working on the immobiliser can fix the remote as a side effect. In the VW Group systems it examined, the design separates the remote and the immobiliser completely. Same key, same housing, two unconnected subsystems.

You can see the same split in the database. On the Vauxhall Corsa D the stock records include a Philips Crypto 46 board described as enabling keys to be programmed "where remote key not required" — in other words the immobiliser half alone, deliberately, as a cheaper start-only key. On the Vivaro B, by contrast, the OBDSTAR record states that "the remote is automatically generated (paired) after key programming completes". One platform lets you do half the job on purpose; the other will not let you do half of it at all.

Before you quote, check which you are on. The per-vehicle records carry the programming methods per key variant, and the immobiliser fault diagnosis guide covers the start-side symptoms that are easy to confuse with a remote problem.

What frequency do UK car key fobs use?

Almost always 433.92 MHz. Every UK and European key variant checked across the database for this article records 433 or 433.92 MHz — the Focus Mk4 flip remote and smart key, the Vivaro B two-button and three-button remotes, the Clio V key card, the Corolla E210 flip remote, the Corsa D flip remote. The Birmingham paper gives the wider picture: "the 315 MHz band in North America and the 433 MHz or 868 MHz band in Europe". In the UK these bands are licence-exempt for short range devices under Ofcom's UK Interface Requirement IR 2030, last published in April 2026.

The trap is that the chip does not care. The Corolla E210 record spells it out: the global specification flip remote is OEM 89070-02F10 at 433.92 MHz, while the North American part numbers 89070-06790 and 89070-33E90 are 315 MHz. Both carry the same Texas Instruments DST-AES H chip. Order the American part for a UK car and the transponder enrols perfectly, the engine starts, and the doors will never respond to a button for as long as you own the fob. There is no fix and no programming step that recovers it. The part was wrong.

Check the frequency printed on the fob or on the OEM part number before the blade goes anywhere near a cutter. It is thirty seconds of work against a wasted blank and a return visit.

Rolling codes, and why a working remote stops working

Modern remotes are counter-based. The Birmingham paper describes the payload as containing "the Unique Identifier (UID) of the remote control, the rolling counter value, and the pressed button", and the vehicle accepting it only "if the UID is known to the vehicle and the counter is in its validity window". An increased counter is new and accepted; an old one is rejected. That is deliberate, and it is what stops a recorded button press being replayed.

The consequence on the driveway is that a remote can desynchronise. On the Hitag2 implementation the paper examined, the fob transmits only "the 10 least-significant bits of a 28-bit counter", with both car and remote storing the full value — so the carry into the upper bits happens once every 1,024 presses, which the authors note "usually happens only a couple of times a year". On the VW systems tested, a rolling code arriving at "ctr−2 or less" against the expected value led to blocking, and so did a counter "increased by more than 250 compared to the last stored value". The authors are explicit that these figures were observed in their own testing rather than published as a specification, so treat them as the shape of the behaviour and not as a number to quote at a customer.

Practically, this is the fob that has been pressed repeatedly in a coat pocket, or the spare that has sat in a drawer through three years of the other key being used. The cure is the manufacturer resynchronisation procedure for that platform, not a reprogramme — and on a Hitag2-era car, running the immobiliser procedure may resynchronise it as a side effect. Time: 10–20 minutes including the road test.

The procedures

Adding a remote alongside a working key over OBD

The common case, and on most flip_remote records the remote is paired as part of key enrolment rather than separately. Using the Focus Mk4 flip remote as the worked example, the database procedure is:

1. Verify the vehicle — VIN plate, generation and key variant. Mk4 Focus flip remote and smart key are different parts and different procedures.
2. Confirm proof of ownership and photographic identification before anything else.
3. Connect the tool to the OBD port — driver's footwell, left of the pedals, above the footrest, no trim removal.
4. Select Ford, then Focus, then MK4, then Flip Remote.
5. Insert the existing working flip key and turn the ignition on when prompted.
6. Insert the new cut key and follow the prompts. The tool takes BCM security access over OBD, usually automatically or online. If security access fails, the incode route is Ford FDRS or ETIS.
7. Test the new key properly — engine start, lock, unlock, and boot release on the third button.
8. Time: 20–30 minutes.

Adding a proximity key card where the gateway blocks you

The Clio V is the modern shape of this problem, and it is a longer job than the Mk4 Focus by a wide margin.

1. Verify the trim. Handsfree cards sit on Iconic and above; Play and base trims take the non-handsfree card. Both use the NCF29A1M Hitag AES chip at 433.92 MHz, so the chip is not the differentiator — the module is.
2. Confirm ownership documentation.
3. Fit battery support. The database flags a minimum maintained voltage as mandatory on this platform family.
4. Connect the gateway bypass — a Renault/Nissan 16+32 adapter, or the ADC2017 bypass cable on Smart Pro, which connects to the BCM through two 40-pin connectors. The OBD port is used only for power on that route.
5. Run the add-key function. No manual PIN entry is required on supported tools, because the bypass handles extraction. On OBDSTAR the function clears and re-programmes all keys, to a maximum of four.
6. Test every card, not just the new one, because the function may have rewritten all of them.
7. Time: 45–75 minutes on a car you have done before, longer the first time.

All-keys-lost on this platform is a different job again. The HFM uses a locked Renesas RH850 microcontroller that cannot be read with the bench programmers that covered the Clio IV, and the PIN is not available over OBD at all in an all-keys-lost scenario. That is a module-out bench read, and it belongs in a different quote.

The remote-only visit

Not every remote fault is a programming job, and the fastest money on the list is the one that needs no tool.

1. Confirm the engine starts and the immobiliser light behaves. If it does, the transponder is proven and the fault is radio-side.
2. Open the fob and check the cell against the database value for that variant, not against whatever is in the drawer. The Focus Mk4 takes CR2032, the Vivaro B takes CR2016, the Corolla E210 flip remote takes CR1620. They are not interchangeable.
3. Inspect the board for a cracked solder joint at the switch, water ingress, and a corroded battery clip. Button membranes fail far more often than transmitters.
4. Test both keys at range and then at the glass. A fob that works at one metre and not at ten is a transmitter or battery problem; one that works nowhere may be the vehicle receiver.
5. If the fob is sound and still ignored, run the platform resynchronisation procedure.
6. Time: 15–25 minutes.

Tool coverage for remote work

Remote capability is not advertised separately from key capability, which is exactly why it catches people out. The honest position by tier, with the database notes attached:

Advanced Diagnostics Smart Pro — the UK trade standard on the Renault-architecture vans, and the database records all-keys-lost on the Vivaro B completing in approximately three minutes with no UCH corruption reported. Coverage is confirmed to the end of 2017 builds, with reports of an unknown software version warning on late 2018 plates. On the Clio V the ADC2017 cable covers add-key only. Token-based pricing, so price the job accordingly.

Autel MaxiIM IM608 Pro II and IM508S — broad coverage, and a subscriber community tip on the Vivaro B records an IM508S completing the job in a few minutes where a Lonsdor K518 Pro could not retrieve the PIN. The limitation to read twice: the database flags that Toyota all-keys-lost was removed from North American firmware in 2024, and that the European firmware retains Toyota 8A non-smart all-keys-lost for the Corolla E210. Verify your own unit's region before quoting.

OBDSTAR X300 DP Plus — on the Vivaro B the green Renault gateway adapter is mandatory, not optional; a standard OBD cable alone will not establish CAN communication with the UCH. The full all-keys-lost cycle is recorded at approximately 90 minutes, against the Smart Pro's three. The remote pairs itself once key programming completes.

Lonsdor K518Pro — add-key only on the Vivaro B and Trafic III. The database is unambiguous: Lonsdor is confirmed as not supporting all-keys-lost on that platform. It is a capable tool that will send you home from the wrong call-out.

Abrites AVDI — the recovery tool. The database records AVDI as uniquely able to repair a UCH internal dongle error caused by a failed all-keys-lost attempt on the Vivaro B. Expensive, licence-gated, and the one worth owning when you are already turning work away.

The full coverage matrix counts confirmed variants per tool across the database if you are deciding what to buy rather than what to use today.

Common pitfalls

The engine starts and the doors will not lock The transponder has proved itself, so the fault is radio-side. Check the frequency on the fob against the database value for that variant first, because a North American 315 MHz part on a UK car is the commonest version of this and it is unrecoverable. Then battery, then resynchronisation, then the vehicle receiver.

Ordering by model name instead of by variant The Qashqai is a fixed_remote, a flip_remote and a smart_key depending on which generation turns up. So is the Focus. Pull the record for the year in front of you, not the model.

The wrong coin cell CR2032, CR2016 and CR1620 all fit a drawer labelled "fob batteries" and do not all fit the fob. The database carries the cell per key variant; a CR2016 in a CR2032 housing will rattle, make intermittent contact and come back as a programming complaint.

Turning up to an all-keys-lost with an add-key tool The Vivaro B is the clearest example in the database — add-key on Lonsdor, all-keys-lost not supported — but the same pattern runs through the Clio V and the Toyota smart boxes. Confirm add-key and all-keys-lost separately before you quote. They are different capabilities and the database records them as different capabilities.

Assuming the remote half is included On most flip_remote records it is. On fixed_remote architectures it may be a second procedure, and on the Corsa D you can deliberately fit a start-only key with no remote at all. Say which you are supplying, in writing, before the customer discovers it.

Skipping the paperwork because it is "only a remote" It is not only a remote on a fob that also carries the transponder. Proof of ownership, identification matching the keeper and a kept record apply to the whole job. Master Locksmiths Association members work to this as a condition of membership, and with SERMI live in the UK the expectation across the trade has hardened — the Independent Garage Association confirmed the scheme live on 1 April 2026, with 22 manufacturer brands committed and DBS checks part of onboarding.

Frequently asked questions

What frequency do UK key fobs transmit on?

433.92 MHz in almost every case. Every UK and European key variant checked in the Keysolved database for this article records 433 or 433.92 MHz. North American vehicles use 315 MHz and some European systems use 868 MHz, so an imported fob with the correct chip can still be the wrong part.

Can a key fob remote be programmed without programming the transponder?

Sometimes. On Hitag2-era architectures the immobiliser and remote share a path, and on some platforms a start-only key with no remote is a deliberate option — the Vauxhall Corsa D records a transponder board for exactly that. On other architectures the two are entirely separate subsystems, and on proximity keys they are a single unit with no separate remote step. Check the per-vehicle record before quoting.

Why has a key fob that worked yesterday stopped working?

Most often the battery, then counter desynchronisation. Counter-based remotes are only accepted when the transmitted counter falls inside the vehicle's validity window, so a fob pressed repeatedly away from the car, or a spare left unused for years, can fall outside it. The fix is the platform resynchronisation procedure, not a reprogramme.

Does a new fob need the same battery as the old one?

It needs the battery the variant specifies, which is not always the one the old fob had in it. The database records CR2032 on the Ford Focus Mk4, CR2016 on the Vauxhall Vivaro B and CR1620 on the Toyota Corolla E210 flip remote.

How long does it take to programme a key fob?

On a flip remote paired during key enrolment over OBD, 20 to 30 minutes including testing. On a proximity key card needing a gateway bypass, 45 to 75 minutes. A battery, button or resynchronisation visit with no programming is 15 to 25 minutes. All-keys-lost on a module-locked platform is a bench job and does not belong in the same quote.

Will a universal aftermarket remote work?

On many platforms, yes, provided the profile generated onto it matches the vehicle and the frequency is right. Verify the specific vehicle against your tool's current list rather than the platform claim — the database records several cases where a tool covers a platform for add-key and not for all-keys-lost, and generating a remote to the wrong profile produces hardware that reads as faulty.

The short version

Treat the remote as a separate system with its own failure modes, because on a good number of architectures it is one. The engine starting tells you the transponder is enrolled and tells you nothing at all about the buttons.

Before you order a blank, pull the record. Search the Keysolved database for the exact make, model and year and you will get the key type, the frequency, the battery, the button count, the blade profile and the tools confirmed against that variant — add-key and all-keys-lost listed separately. For the chip side of the same key, the transponder chip cross-reference maps the families to makes and generations, and cloning versus programming covers which chips still copy. For getting the tool onto the car in the first place, the OBD port location guide has the awkward ones.