Component Location
General Description
During the key teaching procedure the transponder will be programmed with vehicle specific data. The vehicle specific data are written into the transponder memory. The write procedure is unique; therefore the content of transponder can never be modified or changed. The data are a string of 9 bytes defined by vehicle manufacturer. The transponder memory is split into two strings called authenticator and key password After this programming the transponder memory is locked and the data(PIN code) cannot be read or changed respectively. The transponder status changes from "virgin" to "learnt". Additionally every transponder includes a unique IDE (Identifier number) of 32 bit. Unique means that the IDE of all transponder is different from each other. The IDE is programmed by the transponder manufacturer and is a read-only value. The authenticator and the key password are not transferred from ECM to transponder or vice versa. Only the results from the encryption algorithm are transferred. It is almost impossible to calculate the vehicle specific data from the encryption result. For teaching of keys and special purposes the ECM is connected to the tester device. When IG is ON, the coil supplies energy to the transponder which in turn accumulates energy in the condenser. Once the energy supply from the coil has stopped, using the stored energy in the condenser, the transponder transmits the ID CODE (stored within the ASIC).
DTC Description
This DTC is defined as Invalid Transponder Data , Transponder program error and Password mode invalid.
DTC Detecting Condition
Item | Detecting Condition | Possible cause |
Enable Condition | ? IG ON | ? Transponder Error ? Faulty SMARTRA(BCM) ? Faulty ECM |
Detecting factors | ? Invalid Transponder Data (Case 1) ? Transponder Program Error (Case 2) ? Password mode invalid (Case 3) |
Case 1 | Detecting Window | ¦ During Transponder IDE ¦ During Transponder Authentication requests ¦ During Transponder Write EEPROM page requests ¦ During Transponder Read EEPROM page requests |
Detecting Criteria | ¦ Corrupted data form Transponder (Tp), or more than one TP in the field, or no TP in the field. |
Case 2 | Detecting Window | ¦ During Transponder Write EEPROM Page request while transponder is in authorized state. |
Detecting Criteria | ¦ Corrupted data from Transponder(TP),or more than one TP in the field or no TP in the field. |
Case 3 | Detecting Window | ¦ During Transponder Write or Read EEPROM Page |
Detecting Criteria | ¦ TP not in password mode, or Transponder transport data has been changed. |
Schematic Diagram
Signal Waveform
ECM :
Virgin(This is status at the end of ECM production line before delivery to customer)
Neutral (This is a status that is erased all data regarding immobilizer by special command from scanner)
Not Check (The status is stored in permanent memory (EEPROM or Flash etc.).
In case of not plausible data from this circuit the ECM cannot check the status.
Locked by timer (After a certain number of incorrect user Password(4) or PIN Code(6) the EMS is locked for one hour and no inputs are accepted during this time)
KEY :
Virgin (It means the key in the key cylinder has not matched with ECM yet)
Invalid (mismatched)
- Key with NO Transponder
- More than 1(One) Transponder in the magnetic field
- No Transponder in the magnetic field.
- TP data blocked
- TP data does not exist
- TP data changed
- TP Teaching error
- Multiple TP data input
Current Data from Immobilizer will show the numbers of Key learnt, ECM status, and Key status as Fig 1. Thanks to this current data, the symptom of unable starting is probably assumed what problem it is. |
Fig. 2 shows possibility of Engine start, Teaching or changing of user password according to ECM status. |
Reference Data
1.Authentification Flow
1. ELP : Encrypted Lock Password
2. EKP : Encrypted Key Password
3. IDE : Identifier
4. RN : Random Number
2.Key Teaching Procedure
Learnt Status.
Virgin Status.
After Replacing new "ECM" scantool displays that ECM is Virgin status in Key Teaching mode“VIRGIN”status means that ECM has not matched any PIN Code before. Key Teaching Procedure Key teaching must be done after replacing a faulty ECM or when providing additional keys to the vehicle owner. The procedure starts with an ECM request for vehicle specific data from the scanner. The “virgin” ECM stores the vehicle specific data and the key teaching can be started.The “learnt” ECM compares the vehicle specific data from the scanner with the stored data. If the data are correct, the teaching can procede. If incorrect vehicle specific data have been sent to the ECM three times, the ECM will reject the request of key teaching for one hour. This time cannot be reduced by disconnecting the battery or any other manipulation. After reconnecting the battery, the timer starts again for one hour. The key teaching is done by ignition on with the key and additional tester commands. The ECM stores the relevant data in the EEPROM and in the transponder. Then the ECM runs the authentication required for confirmation of the teaching process. The successful programming is then confirmed by a message to the scanner. If the key is already known to the ECM from a previous teaching,the authentication will be accepted and the EEPROM data are updated. There is no changed transponder content (this is impossible for a learnt transponder).The attempt to repeatedly teach a key, which has been taught already during the same teaching cycle,is recognized by the ECM. This rejects the key and a message is sent to the scanner.The ECM rejects invalid keys, which are presented for teaching. A message is sent to the scanner.The key can be invalid due to faults in the transponder or other reasons, which result from unsuccessful programming of data. If the ECM detects different authenticators of a transponder and an ECM, the key is considered to be invalid. The maximum number of taught keys is 4. If an error occurs during the Immobilizer Service Menu, the ECM status remains unchanged and a specific fault code is stored. If the ECM status and the key status do not match for teaching of keys,the scanner procedure will be stopped and a specific fault code will be stored at ECM. |
3.ECM Neutralization
This function is for neutralizing the ECM and Key. ex)When lost key, Neutralize the ECM then teach keys.
(Refer to the Things to do when Key & PIN Code The ECM can be set to the “neutral” status by a scanner. A valid ignition key is inserted and after ignition on is recorded, the ECM requests the vehicle specific data from the scanner. The communication messages are described at ” Neutral Mode”. After successfully receiving the data, the ECM is neutralized.
The ECM remains locked. Neither the limp home mode nor the “twice ignition on” function is accepted by ECM.
The teaching of keys follows the procedure described for virgin ECM. The vehicle specific data have to be unchanged due to the unique programming of transponder. If data should be changed, new keys with virgin transponder are requested.
4.Password Teaching / Changing
? In case of putting wrong password, retry from first step after 10 seconds
The user password is used only for limp home function. The user password for limp home is taught at the service station. The owner of the vehicle can select a number with four digits. User password teaching is only accepted by a " learnt" ECM. Before first teaching of user password to an ECM, The status of the password is "virgin". No limp home function is possible. The teaching is started by ignition on, with a valid key and sending the user password by scanner. After successful teaching, the status of the user password changes from "virgin"to "learnt". The learnt user password can also be changed. This can be done if the user password status is "learnt" and the scanner sends authorization of access, either the old user password or the vehicle specific data. After correct authorization, the ECM requests the new user password. The status remains "learnt" and the new user password will be valid for the next limp home mode. If incorrect user passwords or wrong vehicle specific data have been sent to the ECM three times, the ECM will reject the request to change the password for one hour. This time can not be reduced by disconnecting the battery or any other actions. After reconnecting the battery, the timer starts again for one hour.
The user password can be in status.
00. Not yet checked.
The status is stored in the EEPROM. In case of incorrect or no plausible data from this circuit, the ECM can not check the status and the ECM sends Not yet checked.
01. Learnt
The password has been taught successfully to the ECM
02. Virgin
This is the status at the end of the ECM production line before delivery to the final customer.
04. Locked by timer
After a certain number of incorrect inputs, the ECM is locked for one hour and no inputs are accepted during this time.
05. Teaching not accepted
This status is set,for example,if the ECM is in neutral status.
5.Limp Home Function
1) LOCKING OF ECM
If engine shut off (ignition off by key) the EMS is locked from now on.
If the timer is more than 30sec without Cranking in Ignition status “ON” by Valid Key, ECM have to do new authentication if user attempts engine start.
In case of engine stalling about start of limp home the timing of ECM locking is as follows:
start, after ignition off the time for repeated engine start is limited to 8 sec. After elapsing this time new authentication is done or in case of limp home the input of user password is requested again.
2) LIMPHOME PROCEDURE.
(1) By scanner
If the ECM detects a fault of SMARTRA or transponder, the ECM will allow limp home function of immobilizer. Limp home is only possible if the user password (4 digits) has been given to the ECM before. This password can be selected by the vehicle owner and is programmed at the service station. The ECM informs the driver about the limp home condition by blinking the immobilizer indicator. Then the user password can be sent to the ECM via the limp home mode menu. Only if the ECM is in status “learnt” and the user password status is “learnt” and the user password is correct the ECM will be unlocked for a period of time (30 sec.). The engine can only be started during this time. After the time has elapsed, engine start is not possible. If the wrong user password is sent, the ECM will reject the request of limp home for one hour. Disconnecting the battery or other actions cannot reduce this time. After connecting of battery to ECM, the timer starts again for one hour.
(2) By ignition key
The limp home can be activated also by the ignition key. The ECM informs the driver by blinking the immobilizer indicator for the limp home condition. Then the user password can be input to ECM that can be done by special sequence of ignition on/off as picture above. Only if the ECM is in status “learnt” and the user password status is “learnt” and the user password is correct. the ECM will be unlocked for a period of time (30 sec.). The engine can be started during this time. After the time has elapsed, engine start is not possible. After a new password has been input the timer (30 sec.) start again. After ignition off the ECM is locked (If timer 8 sec. is elapsed). For next start the input of user password is requested again.
6.Things to remember before a repair(1) - Installing the ECM
7.Things to remember before a repair(2) - Replace keys & Additional registration
8.Things to remember before a repair(3)
9.Things to remember before a repair(4)