Component Location
General Description
The SMARTRA carries out communication with the built-in transponder of the ignition key. This wireless communication runs on RF (Radio frequency of 125 kHz). The SMARTRA is mounted at the ignition lock close to the antenna coil for RF transmission and receiving.
The RF signal from the transponder received by the antenna coil is converted into messages for serial communication by the SMARTRA device. And the received messages from the ECM are converted into an RF signal,which is transmitted, to the transponder by the antenna. The SMARTRA does not carry out the validity check of transponder or the calculation of encryption algorithm. This device is only an advanced interface, which converts the RF data flow of the transponder into serial communication to ECM and vice versa.
DTC Detecting Condition
Item | Detecting Condition | Possible cause |
Enable Condition | ? IG ON | ? Open or short in Antenna circuit ? Faulty SMARTRA ? Faulty ECM |
Detecting Factors | ? Antenna Coil error (Case 1) ? Invalid request from ECM or Corrupted data (Case 2) ? Transponder Program error (Case 3) |
Case 1 | Detecting Window | ? Before transponder communications |
Detecting Criteria | ? Antenna open/shrot circuit |
Case 2 | Detecting Window | ? End of C.M request message |
Detecting Criteria | ? Protocol layer violation -. Invalid request or invalid check sum |
Case 3 | Detecting Window | ? During Transponder Write EEPROM page request While Transponder is in authorized state. |
Detecting Criteria | ? Corrupted data from Transponder(TP), or more than on TP in the field, or no TP in the field. |
Schematic Diagram
Signal Waveform
ECM :
Virgin(This is status at the end of ECM production line before delivery to customer)
Neutral (This is a status that is erased all data regarding immobilizer by special command from scanner)
Not Check (The status is stored in permanent memory (EEPROM or Flash etc.).
In case of not plausible data from this circuit the ECM cannot check the status.
Locked by timer (After a certain number of incorrect user Password(4) or PIN Code(6) the ECM is locked for one hour and no inputs are accepted during this time)
KEY :
Virgin (It means the key in the key cylinder has not matched with ECM yet)
Invalid (mismatched)
- Key with NO Transponder
- More than 1(One) Transponder in the magnetic field
- No Transponder in the magnetic field.
- TP data blocked
- TP data does not exist
- TP data changed
- TP Teaching error
- Multiple TP data input
Current Data from Immobilizer will show the numbers of Key learnt, ECM status, and Key status as Fig 1. Thanks to this current data, the symptom of unable starting is probably assumed what problem it is.
Fig. 2 shows possibility of Engine start, Teaching or changing of user password according to ECM status.
Rererence Data
Authentification Flow
note1. ELP : Encrypted Lock Password
2. EKP : Encrypted Key Password
3. IDE : Identifier
4. RN : Random Number
Key Teaching Procedure.
Learnt Status.
Virgin Status.
After Replacing new "ECM" scantool displays that ECM is Virgin status in Key Teaching mode “VIRGIN”status means that ECM has not matched any PIN Code before.
noteKey Teaching Procedure
Key teaching must be done after replacing a faulty ECM or when providing additional keys to the vehicle owner. The procedure starts with an ECM request for vehicle specific data from the scanner. The “virgin” ECM stores the vehicle specific data and the key teaching can be started. The “learnt” ECM compares the vehicle specific data from the scanner with the stored data. If the data are correct, the teaching can procede.
If incorrect vehicle specific data have been sent to the ECM three times, the ECM will reject the request of key teaching for one hour. This time cannot be reduced by disconnecting the battery or any other manipulation. After reconnecting the battery, the timer starts again for one hour.
The key teaching is done by ignition on with the key and additional tester commands. The ECM stores the relevant data in the EEPROM and in the transponder. Then the ECM runs the authentication required for confirmation of the teaching process. The successful programming is then confirmed by a message to the scanner. If the key is already known to the ECM from a previous teaching, the authentication will be accepted and the EEPROM data are updated.
There is no changed transponder content (this is impossible for a learnt transponder). The attempt to repeatedly teach a key, which has been taught already during the same teaching cycle, is recognized by the ECM. This rejects the key and a message is sent to the scanner. The ECM rejects invalid keys, which are presented for teaching. A message is sent to the scanner. The key can be invalid due to faults in the transponder or other reasons, which result from unsuccessful programming of data. If the ECM detects different authenticators of a transponder and an ECM, the key is considered to be invalid. The maximum number of taught keys is 4.
If an error occurs during the Immobilizer Service Menu, the ECM status remains unchanged and a specific fault code is stored. If the ECM status and the key status do not match for teaching of keys, the scanner procedure will be stopped and a specific fault code will be stored at ECM.
3. ECM Neutralization
This function is for neutralizing the ECM and Key. ex)When lost key,Neutralize the ECM then teach keys.(Refer to the Things to do when Key & PIN Code The ECM can be set to the “neutral” status by a scanner. A valid ignition key is inserted and after ignition on is recorded, the ECM requests the vehicle specific data from the scanner. The communication messages are described at ” Neutral Mode”. After successfully receiving the data, the ECM is neutralized.
4. Password Teaching / Changing
? In case of putting wrong password, retry from first step after 10 seconds
The user password is used only for limp home function. The user password for limp home is taught at the service station. The owner of the vehicle can select a number with four digits. User password teaching is only accepted by a " learnt" ECM. Before first teaching of user password to an ECM, The status of the password is "virgin". No limp home function is possible. The teaching is started by ignition on, with a valid key and sending the user password by scanner. After successful teaching, the status of the user password changes from "virgin"to "learnt". The learnt user password can also be changed. This can be done if the user password status is "learnt" and the scanner sends authorization of access, either the old user password or the vehicle specific data. After correct authorization, the ECM requests the new user password. The status remains "learnt" and the new user password will be valid for the next lmp home mode. If incorrect user passwords or wrong vehicle specific data have been sent to the ECM three times, the ECM will reject the request to change the password for one hour. This time can not be reduced by disconnectiong the battery or any other actions. After reconnecting the battery, the timer starts again for one hour
The user password can be in status.
00. Not yet checked
The status is stored in the EEPROM. In case of incorrect or no plausible daa from this circuit, the ECM can not check the status and the ECM sends Not yet checked
01. Learnt
The password has been taught successfully to the ECM
02. Virgin
This is the status at the end of the ECM production line before delivery to the final customer
03. Locked by timer
After a certain number of incorrect inputs, the ECM is locked for one hour and no inputs are accepted during this time
04. Teaching not accepted
This status is set,for example,if the ECM is in neutral status
5. Limp Home Function
1) LOCKING OF ECM
If engine shut off (ignition off by key) the EMS is locked from now on.
If the timer is more than 30sec without Cranking in Ignition status “ON” by Valid Key, ECM have to do new authentication if user attempts engine start
In case of engine stalling about start of limp home the timing of ECM locking is as follows:
Start, after ignition off the time for repeated engine start is limited to 8 sec. After elapsing this time new authentication is done or in case of limp home the input of user password is requested again
2) LIMPHOME PROCEDURE.
(1) By scanner
If the ECM detects a fault of SMARTRA or transponder, the ECM will allow limp home function of immobilizer. Limp home is only possible if the user password (4 digits) has been given to the ECM before. This password can be selected by the vehicle owner and is programmed at the service station. The ECM informs the driver about the limp home condition by blinking the immobilizer indicator. Then the user password can be sent to the ECM via the limp home mode menu. Only if the ECM is in status “learnt” and the user password status is “learnt” and the user password is correct the ECM will be unlocked for a period of time (30 sec.). The engine can only be started during this time. After the time has elapsed, engine start is not possible. If the wrong user password is sent, the ECM will reject the request of limp home for one hour. Disconnecting the battery or other actions cannot reduce this time. After connecting of battery to ECM, the timer starts again for one hour.
2) By ignition key
The limp home can be activated also by the ignition key. The ECM informs the driver by blinking the immobilizer indicator for the limp home condition. Then the user password can be input to ECM that can be done by special sequence of ignition on/off as picture above. Only if the ECM is in status “learnt” and the user password status is “learnt” and the user password is correct. the ECM will be unlocked for a period of time (30 sec.). The engine can be started during this time. After the time has elapsed, engine start is not possible. After a new password has been input the timer (30 sec.) start again. After ignition off the ECM is locked (If timer 8 sec. is elapsed). For next start the input of user password is requested again.
6. Things to remember before a repair(1) - Installing the ECM
7. Things to remember before a repair(2) - Replace keys & Additional registration
8. Things to remember before a repair(3)
9. Things to remember before a repair(4)
10. Things to do when Key & PIN Code are lost