Immobilizer System

Circuit Diagrams

Wiring Diagram

Description and Operation

Description

The immobilizer system will disable the vehicle if the correct ignition key is not used. In addition to existing anti-theft systems such as the car alarm, the immobilizer system is designed to sharply reduce the rate of vehicle theft.

1. 1
   Transponder (TP) – Communication with IMMO ECU

   

   TP Read Protocol

   1. After IGN is turned on (or CPU reset is released), the IMMO_ECU sends a request to the TP and verifies the serial number and signature.
   2. When the transponder response is incorrect, the input is repeated.
   3. When the response from the input transponder is correct, the data calculated by the encryption operation in the EEPROM program is compared with the data received from the transponder. When the codes match, the input is complete. If the codes do not match, the input continues until the codes match.
   4. If the IMMO_ECU EEPROM code is not programmed when a correct transponder is entered (CRC check OK), the input is complete.
   5. After IGN1 is turned on (CPU reset released), the IMMO_ECU reads the transponder code a maximum of 5 times.
   6. In the IGN1 ON and EMS_state=Lock condition, when ACKNOWLEDGE is received, the TP is re-authenticated.

      

2. 2
   Transponder / IMMO ECU / EMS Authentication

   

Components and Operation

PCM (Powertrain Control Module)

1. The PCM (ECM) (A) verifies the ignition key using a special encryption algorithm, which is also programmed into the transponder and the PCM (ECM) simultaneously. Only if the results are equal can the engine be started. The data of all transponders valid for the vehicle is stored in the PCM (ECM). The ERN (Encrypted Random Number) value is checked between the EMS and the encrypted SMARTRA unit, and the validity of the encrypted key is determined by the EMS.

   

ENCRYPTED IMMOBILIZER (A) The IMMOBILIZER communicates with the transponder built into the ignition key. This wireless communication operates on RF (radio frequency 125 kHz). The IMMOBILIZER is installed behind the crash pad near the center crossmember. The RF signal from the transponder, received by the antenna coil, is converted into serial communication messages by the IMMOBILIZER unit. The messages received from the PCM (ECM) are converted into an RF signal, which is transmitted to the transponder via the antenna. The IMMOBILIZER does not perform verification of transponder validity or encryption algorithm calculation. This unit is only an extended interface that converts the RF data stream from the transponder into serial communication with the PCM (ECM) and vice versa.

TRANSPONDER (built into keys) The transponder has an advanced encryption algorithm. During the key learning procedure, the transponder is programmed with vehicle-specific data. The vehicle-specific data is written to the transponder memory. The writing procedure is performed only once; therefore, the transponder contents can never be modified or changed.

[Master Folding Key]

[Spare Master Key]

Antenna Coil: The antenna coil (A) performs the following functions.

• The antenna coil supplies power to the transponder.
• The antenna coil receives the signal from the transponder.
• The antenna coil sends the transponder signal to the IMMOBILIZER. It is located directly in front of the steering column lock.

Repair Procedures

Learning Procedures

1. 1
   Key Learning Procedure. Key learning must be performed after replacing a faulty Engine Control Module (ECM) or when providing additional keys to the vehicle owner. The procedure begins with the tester requesting the PCM (ECM) to receive specific vehicle data (PIN code: 6 digits). The "new" PCM (ECM) stores the special vehicle data and key learning can be started. The "learned" PCM (ECM) compares the specific vehicle data from the tester with the stored data. If the data is correct, learning can continue. If incorrect vehicle data has been sent to the PCM (ECM) three times, the PCM (ECM) will reject key learning requests for one hour. This time cannot be shortened by disconnecting the battery or other actions. After reconnecting the battery, the timer starts again for one hour. Main learning is performed by turning the ignition on with the key and additional tester commands. The PCM (ECM) stores the relevant data in EEPROM and in the transponder. The PCM (ECM) then performs the authentication required to confirm the learning process. Successful programming is then confirmed by a message to the tester. If the key is already known to the PCM (ECM) from previous learning, authentication will be accepted and the EEPROM data updated. There is no change to the transponder content (this is not possible for a learned transponder). Attempting to re-learn a key that has already been learned during the same learning cycle is recognized by the PCM (ECM). It rejects the key and a message is sent to the tester. The PCM (ECM) rejects invalid keys presented for learning, and a message is sent to the tester. The key may be invalid due to errors in the transponder or other causes resulting from unsuccessful data programming. If the PCM (ECM) detects different authenticators in the transponder and PCM (ECM), the key is considered invalid. The maximum number of learnable keys is 4. If an error occurs during the immobilizer service menu, the PCM (ECM) status remains unchanged and a specific fault code is stored. If the PCM (ECM) status and the key status do not match for key learning, the tester procedure will be stopped and a specific fault code will be stored in the PCM (ECM).

   

   1. PCM (ECM) teaching status.

      

      

      

      

      

      

      

      

      

      

      

   2. PCM (ECM) Virgin Status. After replacing a new "PCM (ECM)", KDS/GDS shows that the PCM (ECM) is in the virgin state in key learning mode. The "VIRGIN" status means the PCM (ECM) has not previously matched any PIN code.
2. 2
   User Password Learning Procedure. The user password for Limp Home is learned at the dealership. The vehicle owner can select a four-digit number. User password learning is accepted only by a "learned" PCM (ECM). Before the first user password learning of the PCM (ECM), the password status is "virgin" and the Limp Home function is not possible. Learning begins with the ignition on, with a valid (learned) key, and the tester sending the user password. After successful learning, the user password status changes from "virgin" to "learned". A learned user password can also be changed. This can be done if the user password status is "learned" and the tester sends authorization access, either the old user password or the vehicle data. After correct authorization, the PCM (ECM) requests a new user password. The status remains "learned" and the new user password will be valid for the next Limp Home mode. If incorrect user passwords or incorrect vehicle data have been sent to the PCM (ECM) three times in a row or intermittently, the PCM (ECM) will reject password change requests for one hour. This time cannot be shortened by disconnecting the battery or any other action. After reconnecting the battery, the timer starts again for one hour.

   1. User Password Learning

      

      

      

      

      

      ※ If an incorrect password is entered, repeat the procedure from the first step after 10 seconds.
   2. Changing the User Password

      

      

      

      

      

Limp Home Function

1. 1
   Limp Home from Tester. If the PCM (ECM) detects a fault in the SMARTRA or transponder, the PCM (ECM) will allow the immobilizer to operate in emergency mode. Limp Home is only possible if the user password (4 digits) was previously provided to the PCM (ECM). This password can be selected by the vehicle owner and is programmed at the dealership. The user password can be sent to the PCM (ECM) through the special tester menu. Only if the PCM (ECM) is in the "learned" state, the user password status is "learned" and the user password is correct, will the PCM (ECM) be unlocked for a limited time (30 sec.). The engine can only be started during this time. After this time has expired, engine starting is not possible. If an incorrect user password is sent, the PCM (ECM) will reject Limp Home requests for one hour. Disconnecting the battery or any other action cannot shorten this time. After reconnecting the battery to the PCM (ECM), the timer starts again for one hour.

   

   

   

   

2. 2
   Limp Home from Ignition Key. Limp Home can also be activated with the ignition key. The user password can be entered into the PCM (ECM) using a special ignition on/off sequence. Only if the PCM (ECM) is in the "learned" state, the user password status is "learned" and the user password is correct, will the PCM (ECM) be unlocked for a limited time (30 sec.). The engine can be started during this time. After this time has expired, engine starting is not possible. After entering the new password, the timer (30 sec.) starts again. After the ignition is turned off, the engine control module (ECM) is locked if the timer expires after 8 seconds. For the next start, the user password entry is requested again.

   

Replacement

Problems and Spare Parts:

Symptom	Kit	Is KDS/GDS required?
All keys lost	Blank key (4)	YES
Antenna coil unit malfunction	Antenna coil unit	NO
ECM malfunction	PCM (ECM)	YES
Ignition switch malfunction	Ignition switch with antenna coil unit	YES
Unidentified vehicle-specific data appears	Key, PCM (ECM)	YES
SMARTRA unit malfunction	SMARTRA unit	YES

Replacing the ECM and SMARTRA If the ECM is faulty, replace it with a "virgin" or "neutral" ECM. All keys must be learned to the new ECM. Keys that are not programmed to the ECM are invalid for the new ECM (refer to the learning procedure). Vehicle data must be left unchanged due to the unique programming of the transponder. If the SMARTRA is faulty, the SMARTRA must be learned. The new SMARTRA unit replaces the old one, and the SMARTRA must be learned.

1. 1
   Precautions before replacement (PCM (ECM))

   

2. 2
   Precautions before replacement (keys and additional registration)

   

Neutralizing the ECM The PCM (ECM) can be set to the "neutral" state using the scan tool. A valid ignition key is inserted, and after the ignition is turned ON, the PCM (ECM) requests vehicle data from the scan tool. The communication messages are described in "Neutral Mode." After successfully receiving the data, the PCM (ECM) is neutralized. The ECM remains locked. Neither the emergency mode nor the "double ignition" function is accepted by the PCM (ECM). Keys are learned following the procedure described for a virgin PCM (ECM). Vehicle-specific data must remain unchanged due to the unique programming of the transponder. If the data must be changed, new keys with virgin transponders are required. This function is intended to neutralize the PCM (ECM) and key. For example, if a key is lost, neutralize the PCM (ECM), then learn the keys. (Refer to What to do when the key and PIN code of the PCM (ECM) can be set to "neutral" status with the scan tool.) If incorrect vehicle-specific data is sent to the SMARTRA three times in succession or intermittently, the SMARTRA will reject requests to enter neutral mode for one hour. Disconnecting the battery or other manipulation cannot shorten this time. After the battery is reconnected, the timer starts again for one hour.

Neutralizing the SMARTRA The EMS can be set to the neutral state using the scan tool. The ignition key (regardless of key status) is inserted and the ignition is turned ON. If the correct vehicle password is received from the GST, the SMARTRA can be neutralized. Neutralization of the SMARTRA is possible if the PIN is the same as the value entered by the GST. If the SMARTRA status is neutral, the EMS keeps the locked state, and starting is not possible via "double ignition." If the vehicle password is changed, a new original transponder must be used. For a virgin key, after learning the key, the vehicle password can be used. If incorrect vehicle data is sent to the SMARTRA three times in succession or intermittently, the SMARTRA will reject requests to enter neutral mode for one hour. Disconnecting the battery or other manipulation cannot shorten this time. After the battery is reconnected, the timer starts again for one hour.