Volvo Key Programming: Complete Locksmith Guide (All Models)

Volvo is not the make you meet every day. It is the one that lands on a Tuesday afternoon, usually an XC60 or a V40 on a school-run driveway, and it is the job that quietly eats the rest of the afternoon if you have priced it like a Focus.

Volvo key programming comes back to one module almost every time. Nearly everything on a modern Volvo answers to the CEM — the Central Electronic Module — and the CEM is not a fuse box with an important name. It holds the list of keys the car will accept, it holds the vehicle PIN, and on most generations it will not give either of those up over the OBD socket. The job is therefore not really a question of which tablet you own. It is a question of whether the car in front of you needs that module out on the bench, and how long out means.

There is a second thing, and it catches more people than the bench work does. On a Volvo the engine starting and the buttons working are two separate systems with two separate gatekeepers. You can finish a job, hand the customer a key that starts the car first turn, and still have a fob that does nothing when pressed. That is not a fault. That is the architecture, and it needs to be in the quote before you start.

The five Volvo security eras

Work out which of these you are looking at before you touch anything. The chip, the code, the procedure and the bill all follow from it.

Two of those rows deserve a warning each. The P1 row spans two different chip families, because the platform carried on long after the chip changed — a 2010 C30 is a Megamos ID48 car and a 2014 V40 on the same platform name is a Hitag Pro car. And the P2 row contains the single worst trap on the whole Volvo range, which is covered below.

The practical consequence of the right-hand column is that a Volvo job is usually a module job. Where the data lives decides whether you are plugging into the socket for forty minutes or lifting a glovebox out and soldering to a board.

Era 1 — P80 Bosch IMMO3 (C70 Mk1, 1996–2005)

The earliest car in the catalogue is the oddity, because the immobiliser is not the CEM at all. The C70 Mk1 uses Volvo IMMO3: a standalone Bosch control box sitting behind the dashboard above the front passenger footwell, authenticating the transponder over a serial link and then releasing the engine ECM.

• Transponder: PCF7935, ID44, Hitag 2 family
• Blade: NE66 — not the HU101 you will reach for on everything later
• Frequency: 433.92 MHz, battery CR2016
• Key capacity: three
• Code: a vehicle PIN held inside the Bosch box, recovered either through Volvo's own system or from a bench read of the box's 93C56 or 93C66 EEPROM

There is no on-board relearn. There is no plug-and-programme OBD add-key. The five-turns-of-the-key routine that works on genuinely old Volvos does nothing here either.

Procedure — add key or all keys lost

1. Verify the car. Check the chassis and the build, because the earliest 1997 to 1998 cars want a PCF7930 or PCF7931 rather than the ID44, and fitting the wrong one is the commonest cause of a no-start on this generation.
2. Cut the blade first, to the driver's door decode. The NE66 profile is not in most Lishi rolls — check your Lishi profile coverage before you promise a time.
3. Find the OBD socket. On this car it is not by the driver's knee: it is in the centre console cubby between the front seats, under a small lid embossed OBD-II, towards the front of the cubby just behind the handbrake. Identical on left- and right-hand drive, because it sits on the centreline.
4. Remove the Bosch box from above the passenger footwell and read its 93C56 or 93C66 serial EEPROM on the bench. If you read in circuit, drop the programmer voltage to around 2.5 V for a clean read.
5. Load the dump, confirm your software parses it, and generate a key into one of the three positions.
6. Write a genuine PCF7935. An Xhorse Super Chip or other XT27 clone will read on the bench and will not lock or start this car.
7. Refit, test the start, test the locking, and let it idle for a minute before handing over.
8. Time: 2.5 to 4 hours, including dismantling and blade work.

Honest note: this is bench work or nothing. If you do not already own a flash programmer you are comfortable with, this is not the car to learn on, and a posted module service is a reasonable answer.

Era 2 — P2 CEM (S60 I and XC90 I, 2000–2009)

The S60 I is where the CEM appears, and where the architecture that defines Volvo for the next twenty years starts. The CEM sits behind the driver's-side lower dash, drives the antenna ring around the ignition barrel, challenges the Megamos Crypto ID48 pill in the key head, and holds the authorised-key list. The engine ECM holds a matching synchronisation value, so the two modules are married — a donor CEM or ECM from another car will not simply drop in.

The MY2005 hardware split

There is a hard change at model year 2005. Cars up to MY2004 use the earlier CEM, where the key data lives in an Intel 28F400 flash device under a soldered metal can. From MY2005 the CEM is a different unit built around a Renesas M32C/85 with high-speed CAN, and the key data moves out to a 93C86 serial EEPROM.

And here is the trap. The folding Key Integrated Remote arrives for MY2004, so a 2004 S60 looks like a later car — but underneath it is still the flash CEM. Tool menus reflect the module, not the badge, so on a 2004 car you select the pre-2004 flash option. Pick the year-matched entry and you will spend an hour chasing an EEPROM that module does not have.

Three codes, and they are not interchangeable

• The CEM PIN
• The immobiliser PIN — the one that actually authorises key work, and a different code entirely
• The remote's own credentials — a 16-character seed code and an 8-character remote code, printed on the sealed packaging of a factory-new remote

Decoding the CEM PIN on an S60 gets you precisely nowhere on keys. That single fact accounts for a large share of the "my tool decoded it and still will not programme" reports on these cars.

Procedure — add key, diagnostic route

1. Cut the blade to the door decode. Nothing happens until the barrel turns to position II.
2. Fit a virgin, unlocked Megamos Crypto ID48 pill.
3. Connect at the OBD socket — driver's footwell, on the lower dash edge hard against the driver's door, immediately alongside the bonnet release. Not the centre console armrest; that is the 850 and the 1998 to 2000 V70.
4. Run the ignition-key application with the immobiliser PIN. Volvo's own route does this as a purchased software download; the aftermarket Volvo PC software will often calculate the immobiliser PIN over the socket in seconds, and where it cannot, the PIN has to be bought from a specialist.
5. Start the car and let it idle for a minute. A half-written key will crank, start and then cut out — find that on your own drive, not the customer's.
6. Time: 45 to 75 minutes with the PIN in hand, plus blade cutting.

Procedure — all keys lost, bench route

1. Produce a cut blade first: decode the driver's door lock, or order a blade cut to VIN against proof of ownership and the customer's V5C.
2. Remove the CEM and open it. On the flash cars, cut the soldered metal can off rather than trying to prise it.
3. Read the device. The 28F400 can be desoldered onto a PSOP44 adapter, or read in circuit over BDM. On a 93C86 car, read it as all three chip variants — only one decodes into readable key positions in any given software, and everything below address 0005 is encrypted, so a perfect read showing no key numbers is expected rather than a failure.
4. Check how many positions are already occupied before you promise the customer a fourth or fifth key.
5. Generate the key into a free position, write the crypto data to a virgin ID48 pill, write the dump back and refit.
6. If it cranks and will not run, that is CEM-to-ECM synchronisation, not the key. Repeating the key write will not fix it.
7. Time: 3 to 5 hours on a flash car, 2.5 to 4 hours on a 93C86 car.

Cloning is genuinely on the table here, because the chip is Megamos ID48 — but budget for it properly. Volvo rolls the ignition signal only about every fifteen minutes, so the eight data collections a copier needs take roughly two hours of waiting, and firing them off back to back simply parks you at 1/8 forever. Our guide to cloning versus programming covers where that wall sits across the chip families.

The XC90 I sits on the same platform but splits by chip rather than by module: PCF7946 Hitag 2 on 2002 to 2009 production, PCF7953 Hitag Pro from roughly 2010. Confirm which before ordering, because the two are not interchangeable and only one of them clones.

Era 3 — P1 CEM (S40, C30, V50, V40, 2004–2019)

This is the Volvo you will see most, and it is the era where the bench read becomes routine rather than exceptional. On the C30 and the V50 the CEM sits above the front passenger footwell behind the glovebox, holds the vehicle PIN, the VIN and a maximum of six keys, and reads the transponder through an antenna ring inside the dash ignition slot.

The immobiliser PIN is not stored as readable text anywhere in the dump. It is derived from the CEM's MCU flash together with its external EEPROM, which is why there is no reliable OBD-only PIN read in the aftermarket key tools and why the module comes out even for a spare key.

Procedure — add key (slot-key car)

1. Confirm it is a slot-key car and not Keyless Drive. Slot-key cars have an exposed barrel in the door handle and no knob in the dash slot. Keyless Drive cars have a covered barrel, a removable knob in the slot, and a KVM box — under the driver's seat on the V50.
2. Match the remote before ordering. The 2008-on V50 remote is the CR2450 type; the 2004 to 2007 remote is a different unit on CR2032. Read the existing key's remote information first and note whether the car uses 16- or 24-digit remote data.
3. Fit battery support. The CEM write drops out below roughly 12 V, and a low or noisy supply during a CEM write can brick the module.
4. Remove the glovebox or passenger storage tray, unplug the CEM, strip it to the board. It carries two Freescale MCUs — MC9S12DT256 and MC9S12DG128 depending on version — and there are two wiring layouts, so follow the diagram for the board in your hand rather than the year on the V5C.
5. Read both MCUs, save both files, and keep a backup before you write anything.
6. Refit, insert the new remote in the dash slot, turn to position II.
7. On the tool, load both CEM files, choose Add key, then enter the 8-digit remote ID and the 16- or 24-digit remote code from the new remote's box.
8. Test: start from the slot, and all five buttons. Existing keys stay programmed.
9. Time: 2 to 3 hours.

All keys lost is the same bench step with no working key needed, plus one difference worth telling the customer: opening the door on the emergency blade sets the alarm off, and it stops only when a key the CEM recognises is turned in the slot. Re-learn any original keys the customer still holds in the same session, because the AKL function wipes every stored key. Time: 2.5 to 3.5 hours.

Two routes carry their own planning overhead. The Lonsdor path on the C30 reads the CEM EEPROM and flash, then sends both dumps to a technician service that returns a licence file — the turnaround is not instant, so start it the day before rather than on the driveway. Some OBDSTAR software only gained the C30 fobik entry from Volvo package V40.33 onwards, so an older tablet will tell you the car is unsupported when in truth the software is out of date.

The later V40 keeps the platform name and changes the chip to Hitag Pro, which means cloning is off the table and the add-key route moves to OBD with a working key present. All keys lost still goes to the bench in most cases. Add key: 30 to 50 minutes. All keys lost: 3 to 4 hours.

Era 4 — P3 CEM and Hitag Pro (2007–2017)

The P3 cars — V70 III, XC70 and XC60 I — are the easiest Volvos on the list, and the only era where a spare key is a straightforward socket job.

• Transponder: PCF7953, Hitag Pro, throughout
• Blade: HU101, four-button remote head key, CR2032, 433 MHz
• Cloning: not possible — the rolling code rules it out
• Add key: OBD
• All keys lost: CEM EEPROM read

Conventional key start on base trims; push-button start with keyless entry appears on R-Design and Summum from roughly 2012. The HU101 blade is the same profile you cut for a contemporary Ford, which is convenient and also the reason people reach for the wrong Volvo blade on an older car.

Procedure — add key

1. Connect at the OBD socket in the driver's footwell below the steering column.
2. Navigate to the Volvo immobiliser menu and select add key for the model and year.
3. Present the working key where the tool prompts, let it authenticate with the CEM.
4. Present the new HU101 Hitag Pro key when prompted. The tool writes the transponder and the remote data through the CEM.
5. Test the start, all four buttons, and confirm the original key still works.
6. Time: 20 to 35 minutes.

All keys lost moves to a CEM read and is an expert-level job on these cars. Time: 2 to 4 hours depending on how much dash has to come apart.

Era 5 — SPA and CMA (2015–2024)

The modern cars split into two families that look identical from the driver's seat and are not the same job.

SPA — XC90 II, XC60, S60 III, V60 II

The XC60 SPA and XC90 II run Hitag Pro — NCF2951 or PCF7941 depending on the record — with push-button start throughout and passive entry as standard or optional. The 2021 facelift changed the styling and the infotainment and changed nothing about the CEM, the chip family or the key hardware. T8 plug-in hybrid and Recharge variants share identical key hardware; there is no powertrain distinction.

Procedure — add key over OBD with a working key

1. Connect at the OBD socket, driver's footwell to the left of the column above the pedal cluster. The location is consistent across the whole SPA family — see the OBD port location guide for the awkward ones on other makes.
2. Volvo, model, year, immobiliser, smart key, add key.
3. Place the working smart key in the LF field where the tool prompts, usually the centre console.
4. Present the new HU101 Hitag Pro smart key — Keyless Drive capable, four-button, 433 MHz, CR2032 — when prompted. The transponder and remote data are written together.
5. Test proximity entry at the door handle, push-button start, and all four buttons. Confirm the original key still works.
6. Time: 20 to 30 minutes.

All keys lost is a different proposition. The SPA CEM is more deeply embedded than the P1 module and removal requires partial lower-dash disassembly, so plan on a bench read. Abrites references OBD-capable all-keys-lost on newer SPA CEM variants — verify it against your own release notes for the specific model year before you quote it, and treat bench as the fallback. Time: 4 to 6 hours.

CMA — XC40

The XC40 is the one most likely to surprise you, because the chip is not Hitag Pro at all. It is Texas DST-AES, the 8A chip, and the CEM sits under the steering wheel above the pedal cluster rather than behind the glovebox.

CEM removal is required for every key operation on this car — add key included, working key present or not. The code is a 10-digit CEM PIN, unique per vehicle, never user-entered, and extracted from the CEM chip by the tool's bench programmer in ICP mode. No dealer involvement and no original PIN card is needed.

There are two CEM hardware generations inside one production run, and they are not the same job:

• 2018 to 2021: SPC5646C, dual-CPU, two-connector ICP setup
• 2022 to 2024: SPC5748G, single-CPU, different internal board layout

That split drives everything about tooling. Yanhua's Volvo module needs the A302 licence for the earlier cars and A303 for 2022 on, and A302 holders have to buy A303 as an upgrade rather than receiving it. From roughly MY2023.07 production an additional CEM interface board set is required on top of the licence. OBDSTAR added 2022-on XC40 support as a separate software expansion in March 2024. Lonsdor's Volvo licence covers the XC40 from 2020 onwards only — 2018 and 2019 cars are not supported and need a different tool.

Procedure — add key or all keys lost

1. Disconnect the vehicle battery.
2. Photograph the CEM connector arrangement, then remove the module from under the steering wheel.
3. Open the housing, connect to the bench programmer and select the correct chip type for the board — SPC5646C or SPC5748G. Check the marking, not the registration.
4. Read and save the CEM security data: PIN plus immobiliser data.
5. Reassemble, refit, reconnect the battery.
6. Connect at the OBD socket — driver's footwell left of the pedals, above the footrest, no cover — and run add smart key or all keys lost, loading the saved CEM file when prompted.
7. Place each new key in the recognition area as prompted.
8. Verify the start function and the key count.
9. Time: 1.5 to 2.5 hours for add key, 2 to 3 hours for all keys lost including the second key.

One genuinely useful field check on this generation: Volvo's own owner documentation states that a total of twelve keys can be programmed to one car, and that each new key adds a driver profile. The current count is visible to anyone in Settings, System, Driver Profiles on the centre display — which means you can count the car's keys before you touch a tool, and you can prove the count afterwards.

The same documentation is explicit about the other half of a stolen-key job: where a key is lost, the code of the lost remote must be erased from the system as an anti-theft measure, and all remaining keys must be brought in. That is the correct order of work on any all-keys-lost Volvo, and it is the line to put in writing when a customer asks you to add a key to a car whose old key is "somewhere in the house".

Tool coverage, honestly

No tool covers the whole Volvo range, and the ones that come closest do it by doing bench work rather than by avoiding it. Counted coverage across the whole catalogue is in the key programmer comparison; what follows is Volvo specifically.

Tier 1 — the ones that finish Volvo jobs

Abrites AVDI — the database records it as the primary confirmed aftermarket route for P1 and SPA CEM work, both add key and all keys lost. Read the manufacturer's own page before you plan around that, because it is more conservative than the resellers: Abrites states that all Volvo functionality is included in the basic AVDI software with an active AMS and that no additional Volvo licences are required, names S60, S80, V40, V60, V70 and XC60 specifically, and describes key programming as supported on Volvos "equipped with Hitag 2 security systems". Older notes referring to a separate ABB001 Volvo licence do not match that page. Check your own AMS and the current user manual rather than assuming a model is in.

Lonsdor K518Pro — strong across P2 flip keys, P1, P3 and SPA, and the Volvo licence is a one-time device activation included free on the Pro. Two limits to know: the C30 route needs a licence file returned by Lonsdor's technician service, which is not same-hour, and the XC40 is covered from 2020 only.

Autel MaxiIM IM608 Pro II with the XP400 Pro — the workhorse combination for CEM reads from P2 through CMA, using the APA109 harness on the MC9S12 boards. Be precise about the adapter: APA109 pairs with the XP400 Pro, while the older APA106 is for the XP401 and XP404 and will not fit. Autel add-key coverage on SPA and on the V40 is confirmed; Autel all-keys-lost on XC60 SPA and V40 P1 is not confirmed in the database, so do not quote it without checking your current coverage list.

Tier 2 — capable with caveats

OBDSTAR X300 DP Plus — carries the Volvo immobiliser package including the C30 fobik entry from V40.33 and the V50 semi-proximity entry, and expects a bench read with the P001 before key learning. Note the year ranges in the menus rather than trusting them: the S60 blade key is listed for 2006 to 2009, which leaves a 2005 car in a gap despite having the same generation CEM.

OBDSTAR X300 Classic G3 with the MP001 — the route the database records for XC40 CEM PIN reads and for the XC60 II CEM password. Software must be V30.01 or later, and the 2022-on XC40 needs the March 2024 expansion.

Yanhua Mini ACDP and ACDP-2 — reads the CEM in ICP mode without soldering, which is a real advantage on these boards. Licence structure is the catch: A302 for XC40 2018 to 2021, A303 for 2022 on as a paid upgrade, and an extra interface board set for MY2023.07 and later. Module 12 covers the legacy Volvo CEM and KVM password reads.

Xhorse VVDI2 with VVDI Prog — the best-documented route on the P2 cars specifically, including a recorded 2004 S60 all-keys-lost recovery. It is flash and EEPROM work, not a guided procedure.

Tier 3 — specialist and supporting

Launch X431 IMMO Plus with X-PROG 3 — groups the P1 cars under a toothless knob key procedure with the full function set including CEM cloning. Run Key Remote Control Information first and screenshot it, because it tells you whether the car wants 16- or 24-digit remote data before you buy the remote.

Xtool KC501 — the Read D-FLASH and obtain PIN code function on the C30 and V50 is the step that unlocks the rest of the job. Tablet-side coverage lags the KC501's own list, so confirm the Volvo entry on your own device.

Tango — useful if it is already on the bench and you want it doing the key maths on a dump another programmer pulled. It shows how many key positions are written, which is worth knowing before you quote.

ZedFull — not the tool that writes the car, but it unlocks and virginises used ID48 pills and recycles original remotes. On a make where a Volvo ID48 locks itself to the first car it is written to, that is the difference between a scrap second-hand key head and a usable one.

VIDA with a DiCE interface — the dealer route, and worth understanding even if you cannot use it. Keys added through Volvo's own system are recorded on Volvo's servers and come back automatically if the CEM is ever replaced or reloaded; keys written on the bench are lost the moment that happens. The factory system also refuses to programme keys at all while immobiliser or alarm faults are stored, so read and clear those first.

On access more generally: the SERMI scheme went live in the UK on 1 April 2026, giving certified independent operators a manufacturer-recognised route to security-related repair and maintenance information, including data linked to immobilisation. The SERMI Trust Centre describes that as covering diagnostics, software updates and key programming across participating manufacturers. It does not change the bench work on a 2008 V50, but it changes the conversation on the newest cars.

Common pitfalls

The car starts on the new key and the buttons do nothing. This is the defining Volvo complaint and on most generations it is not a fault at all. On the P2 cars the remote is registered in the UEM inside the interior rear-view mirror, not the CEM — two modules, two operations. On the P1 cars the remote needs its own 8-digit remote ID and 16- or 24-digit remote code, printed on the sealed packaging of a factory-new remote and unrecoverable from the fob. One locksmith logged exactly this on a 2011 XC60 in the Keysolved community tips: smart key added, engine started with the key in the slot, fob buttons would not programme. Price the two halves separately and say so up front.

A second-hand remote with no box is scrap. Not difficult, not expensive — impossible. The seed and remote codes cannot be recovered from the fob itself, and no route including the factory one will pair it. Remote transfer between cars is also restricted to model-year families, so a remote lifted from a 2003 S60 will not take on a 2004.

You decoded the CEM PIN and still cannot programme. On the P2 cars the immobiliser PIN is a different code. The CEM PIN authorises nothing on keys. If your software's decode-immobiliser option is greyed out, the immobiliser PIN has to come from a specialist and there is no way around it.

The 93C86 reads perfectly and shows no keys. Expected. Everything below address 0005 is encrypted, and the chip is fitted in three variants of which only one decodes in any given software. Read each variant in turn before deciding the module is unreadable. This single point explains most of the tool-failure reports on facelift P2 cars.

You picked the menu entry that matches the year. On a MY2004 S60 that is wrong — the flash CEM carries over, so you want the pre-2004 option. On an XC40 the board tells you whether it is SPC5646C or SPC5748G, and the registration does not. Match the module, never the paperwork.

It cranks and will not run after a successful key write. That is CEM-to-ECM synchronisation, not the key. The ECM holds a matching value and both sides have to agree. Repeating the key write will not fix it, and it is a separate operation. If you are not certain which of the two you are looking at, work through the immobiliser fault diagnosis checks before writing anything else.

You started the CEM write without battery support. A low or noisy supply during a CEM write can brick the module, and a bricked CEM on a P1 Volvo turns a £250 job into a liability. Fit support every time.

You quoted the keyless half as certain. On the P1 Keyless Drive cars the KVM is a separate module with its own data, and aftermarket coverage for the keyless side is thin — on the V50 the specialist Volvo OBD software cannot code the KVM at all. Sequence the job so the customer has a working start before you reach the keyless step, and tell them plainly that passive entry may need the dealer.

Frequently asked questions

Can a Volvo key be cloned?

It depends entirely on the era. The Megamos Crypto ID48 cars — P2 and early P1, broadly 2000 to 2013 — can be cloned for a start-only spare using a KD-48, JMA TPX2 or Xhorse Super Chip in 48 mode. From Hitag Pro onwards, meaning P3, late P1 and everything on SPA, cloning is not possible and the key must be enrolled. A clone never gives you the buttons on any Volvo.

Does Volvo key programming always need the module removed?

No, but more often than most makes. P3 cars add a key over OBD in well under an hour. SPA cars add a key over OBD with a working key present. Everything else — P80, P2 all keys lost, P1 including spare keys, and every XC40 operation — needs the CEM or the Bosch box out and read on the bench.

Where is the OBD port on a Volvo?

Driver's footwell below or outboard of the steering column on every car from the P2 onwards, usually beside the bonnet release lever. The exception is the P80 C70, where it sits in the centre console cubby between the front seats under a lid marked OBD-II.

How many keys can a Volvo hold?

Six on the older CEM generations. Volvo's own documentation for the XC40 states twelve, with a driver profile added for each key, and the count visible in the centre display settings. Read the count before promising a customer an extra key.

What blade does a Volvo use?

HU101 on almost everything from the P1 onwards, which is the same ten-cut profile as a contemporary Ford. Earlier cars differ: HU56 on the P2 S60, and NE66 on the P80 C70. Confirm the profile against the specific vehicle record rather than the make.

Is an all-keys-lost Volvo worth taking on?

On a P3 or an XC40, yes — both are well-documented and the XC40 is rated as a skilled rather than expert job in the database. On a P2 or a P1 with Keyless Drive, only if you are comfortable with flash and MCU work and you have priced three to five hours. A posted module service is an honest alternative on a car that is already off the road.

Before you quote the job

The pattern across all five eras is the same. Identify the module, not the model year. Establish whether the start and the buttons are two jobs or one. Confirm the chip before ordering a key, because Volvo changed chip within platform more than once and the wrong transponder is a wasted call-out. Then price the bench time honestly, because on most Volvos it is not optional.

Everything in this guide is pulled from the structured records behind Keysolved's Volvo coverage — fifteen vehicles with key variants, transponder types, frequencies, battery sizes, blade profiles, OBD port locations, per-tool compatibility notes and locksmith-written field tips. If the car on the driveway is not one of the examples above, look up the exact generation rather than working from the one next to it: on this make, the one next to it is frequently a different job. For the chip families themselves, the transponder cross-reference chart maps Megamos, Hitag and Texas families to makes, generations and what still clones.