Immobilizer System

Circuit Diagrams

Wiring Diagram

Description and Operation

Description

The immobilizer system disables the vehicle if the correct ignition key is not used. In addition to existing anti-theft systems such as car alarms, the immobilizer system is designed to dramatically reduce vehicle theft.

1. 1

   Transponder (TP) – Communication with IMMO ECU

   

   TP Read Protocol

   1. After IGN is turned on (or CPU reset is released), the IMMO_ECU sends a challenge to the TP and verifies the serial number and signature.

   2. When the transponder response is incorrect, the input is repeated.

   3. When the transponder response is correct, the data calculated by the encryption operation in the EEPROM is compared with the data received from the TP.

      When the codes match, the input is complete.

      If the codes do not match, input continues until the codes are the same.

   4. If the IMMO_ECU EEPROM code is not programmed when a valid transponder is entered (CRC check OK), input is complete.

   5. After IGN1 is turned on (CPU reset is released), the IMMO_ECU reads the transponder code up to 5 times.

   6. In the IGN1 ON and EMS_state=Lock condition, when an ACKNOWLEDGE is received, the TP performs re-authentication.

      

2. 2

   Transponder / IMMO ECU / EMS Authentication

   

Components and Operation

PCM (Powertrain Control Module)

1. The PCM (ECM) (A) performs verification of the ignition key using a special encryption algorithm programmed in the transponder, and the PCM (ECM) simultaneously performs the same calculation. Only if the results are equal can the engine be started. Data of all transponders valid for the vehicle is stored in the PCM (ECM).

   The ERN (encrypted random number) value between the EMS and the encrypted smart device is verified, and the EMS determines the validity of the encrypted key.

   

IMMOBILIZER UNIT (A)

The IMMOBILIZER communicates with the built-in transponder in the ignition key. This wireless communication operates at a radio frequency (125 kHz). The IMMOBILIZER is installed behind the protective cover near the center cross member.

The radio frequency signal from the transponder, received by the antenna coil, is converted into serial communication messages by the IMMOBILIZER unit. Messages received from the PCM (ECM) are converted into a radio frequency signal, which is transmitted to the transponder via the antenna.

The IMMOBILIZER does not perform validity verification of the transponder or calculation of the encryption algorithm. This device is only an interface that converts the transponder's radio frequency data stream into serial communication for the PCM (ECM) and vice versa.

TRANSPONDER (built into the key)

The transponder features an advanced encryption algorithm. During the initial teaching procedure, the transponder is programmed with vehicle-specific data. The vehicle-specific data is written to the transponder memory. The programming procedure is performed only once; therefore, the contents of the transponder can never be modified or changed.

[Master Folding Key]

[Spare Master Key]

Antenna Coil

The antenna coil (A) performs the following function.

• The antenna coil supplies power to the transponder.

• The antenna coil receives the signal from the transponder.

• The antenna coil sends the transponder signal to the IMMOBILIZER.

  It is located directly in front of the steering column lock.

Repair Procedures

Learning Procedures

1. 1

   Key Teaching Procedure

   Key teaching must be performed after replacing a faulty PCM (ECM) or when providing additional keys to the vehicle owner.

   The procedure begins by requesting the vehicle-specific data (PIN code: 6 digits) from the scan tool. A "new" PCM (ECM) stores vehicle-specific data, and key teaching can be started. A "learned" PCM (ECM) compares the vehicle-specific data from the scan tool with the stored data. If the data is correct, teaching can continue.

   If incorrect vehicle data is sent to the PCM (ECM) three times, the PCM (ECM) will reject key teaching requests for one hour. This time cannot be reduced by disconnecting the battery or by any other action. After the battery is reconnected, the timer starts again for one hour.

   Key teaching is performed with the ignition switched on using the key and an additional scan tool command. The PCM (ECM) stores the relevant data in the EEPROM and in the transponder. The PCM (ECM) then performs the authentication required to confirm the teaching process. A message confirming successful programming is then sent to the scan tool.

   If the key is already known to the PCM (ECM) from previous teaching, the authentication is accepted and the EEPROM data is updated. The transponder contents are not changed in this case (this is not possible for a taught transponder).

   An attempt to teach a key that has already been taught during the same teaching cycle is recognized by the PCM (ECM). The key is rejected and a message is sent to the scan tool.

   The PCM (ECM) rejects invalid keys presented for teaching. A message is sent to the scan tool. The key may be invalid due to faults in the transponder or other causes resulting from unsuccessful data programming. If the PCM (ECM) detects different authenticators in the transponder and the PCM (ECM), the key is considered invalid.

   The maximum number of keys that can be taught is 4.

   If an error occurs during the immobilizer service menu, the engine control module (ECM) status remains unchanged and the specific diagnostic trouble code is stored.

   If the PCM (ECM) status and the key status do not match for key teaching, the scan tool procedure will be stopped and the specific diagnostic trouble code will be stored in the PCM (ECM).

   

   1. PCM (ECM) teaching status.

      

      

      

      

      

      

      

      

      

      

      

   2. PCM (ECM) VIRGIN status

      After replacing a new PCM (ECM), the KDS/GDS shows that the PCM (ECM) is in VIRGIN status in Key Teaching mode.

      The "VIRGIN" status means that the PCM (ECM) does not correspond to any PIN code yet.

2. 2

   User Password Teaching Procedure

   The user password for Limp Home mode is taught at the service center. The vehicle owner may select a four-digit number.

   User password teaching is accepted only by a "learned" PCM (ECM). Until the first user password teaching, the PCM (ECM) password status is "VIRGIN". The Limp Home function is not possible.

   Teaching is started by switching the ignition on with a valid (taught) key and sending the user password with the scan tool. After successful teaching, the user password status changes from "VIRGIN" to "LEARNED".

   The learned user password can also be changed. This can be done when the user password status is "LEARNED" and the scan tool sends access authorization, either the old user password or the vehicle data. After correct authorization, the PCM (ECM) requests a new user password. The status remains "LEARNED", and the new user password will be valid for the next Limp Home mode.

   If incorrect user passwords or incorrect vehicle data are sent to the PCM (ECM) three times in succession or with interruptions, the PCM (ECM) will reject the password change request for one hour. This time cannot be reduced by disconnecting the battery or by any other action. After the battery is reconnected, the timer starts again for one hour.

   1. User Password Learning

      

      

      

      

      

      ※ If an incorrect password is entered, repeat the procedure from the first step after 10 seconds.

   2. Changing the User Password

      

      

      

      

      

Limp Home Function

1. 1

   Limp Home Mode from Scan Tool

   If the PCM (ECM) detects a fault in the SMARTRA or transponder, the PCM (ECM) will allow the immobilizer to operate in emergency mode. Limp Home mode is possible only if the user password (4 digits) has been previously sent to the PCM (ECM). This password can be selected by the vehicle owner and programmed at the service center.

   The user password can be sent to the PCM (ECM) through the special scan tool menu.

   Only if the PCM (ECM) is in the "learned" state, the user password status is "LEARNED", and the user password is correct, will the PCM (ECM) be unlocked for a limited time (30 sec.). The engine can be started only during this time. After the time expires, engine start is not possible.

   If an incorrect user password is sent, the PCM (ECM) will reject the Limp Home request for one hour. Disconnecting the battery or any other action cannot shorten this time. After the battery is reconnected to the PCM (ECM), the timer starts again for one hour.

   

   

   

   

2. 2

   Limp Home Mode from Ignition Key

   Limp Home mode can also be activated with the ignition key. The user password can be entered into the PCM (ECM) using a special ignition on/off sequence.

   Only if the PCM (ECM) is in the "learned" state, the user password status is "LEARNED", and the user password is correct, will the PCM (ECM) be unlocked for a limited time (30 sec.).

   During this time the engine can be started. After the time expires, engine start is not possible. After entering a new password, the timer (30 sec.) starts again.

   After the ignition is switched off, the PCM (ECM) locks if the timer expires after 8 seconds. For the next start, the user password is requested again.

   

Replacement

Troubleshooting and Part Replacement:

Replacement of ECM and SMARTRA

If the ECM is faulty, replace the unit with a "virgin" or "neutral" ECM. All keys must be learned to the new ECM. Keys that are not learned to the ECM are invalid for the new ECM (refer to the key learning procedure). Vehicle-specific data must remain unchanged due to the unique transponder programming.

If the SMARTRA is faulty, the SMARTRA must be learned. The new SMARTRA unit replaces the old one, and the SMARTRA must be learned.

1. 1

   Precautions before replacement (PCM (ECM))

   

2. 2

   Precautions before replacement (keys and additional registration)

   

Neutralization of ECM

The PCM (ECM) can be set to the "neutral" state using the tester.

A valid ignition key is inserted, and after the ignition is switched on, the PCM (ECM) requests vehicle-specific data from the tester. Communication messages are described in "Neutral Mode". After the data is successfully received, the PCM (ECM) is neutralized.

The ECM remains locked. Neither the emergency home mode nor the "double ignition on" function is accepted by the PCM (ECM).

Key learning is performed according to the procedure described for the PCM (ECM) primary module. Vehicle-specific data must remain unchanged due to the unique transponder programming. If the data must be changed, new keys with a new transponder are required.

This function is intended to neutralize the PCM (ECM) and keys. Example: if a key is lost, neutralize the PCM (ECM), then learn the keys.

(Refer to What to do if the key and PIN code of the PCM (ECM) can be set to "neutral" status with the scan tool.) If the SMARTRA receives three incorrect requests in a row or intermittently, the SMARTRA will reject requests to enter neutral mode for one hour. Disconnecting the battery or other manipulations cannot shorten this time. After the battery is reconnected, the timer starts again for one hour.

Neutralization of SMARTRA

The EMS can be set to the neutral state by the tester.

The ignition key (regardless of key status) is inserted and after IGN ON. When the correct vehicle password is received from the GST, the SMARTRA can be neutralized. Neutralization of the SMARTRA is possible if the DPN matches the value entered in the GST.

If the SMARTRA status is neutral, the EMS maintains the lock state. Starting by "double ignition" is not possible.

When the vehicle password is changed, only the new original transponder must be used. In the case of the primary key, after learning the vehicle key, the password can be used.

If incorrect vehicle data is sent to the SMARTRA three times in a row or intermittently, the SMARTRA will reject the request to enter neutral mode for one hour. Disconnecting the battery or other manipulations cannot shorten this time. After the battery is reconnected, the timer starts again for one hour.