Immobilizer Control System General Opperation

GENERAL

- Up to 3 ignition keys with transponder integrated in the key head.
- The antenna (toroidal coil) for energizing and communicate with the transponder with its integrated electronic modulator/demodulator driver.
- The BCM control unit (Body Control Module), in which Immobilizer function is managed The ECM control unit (Engine Control Management).
- The serial data link between BCM and ECM control unit.
- The data link and supply link between BCM control unit and antenna.

GENERAL OPERATION

KEY RECOGNIZING PRINCIPLE




The Immobilizer system is based on the recognizing of the key before each cranking request (inserting the key into the steering lock), by way of an inductive link between the transponder device (integrated in the key head) and the vehicle (toroidal coil placed around the steering lock and wired with the BCM).




Key recognizing is based on a challenge/response principle with an encryption algorithm whose parameter is a secret key (KTR). The algorithm is determined by the transponder supplier.

There is one and only one secret key for each vehicle. The secret key is generated during the first key teaching in the car production line. It must be saved in the non-volatile memory of the BCM and the transponder, associated to the vehicle identification number(VIN) of the production line.

NOTE: The Special equipment in Car Production line will produce " Vehicle Secret Code" (PIN code) which is induced from " Vehicle Serial Identification Number". This " Vehicle Secret Code" (PIN code) allows the teaching of new keys and BCM and/or keys replacement.

When the BCM learns this " Vehicle Secret Code" (PIN code), two other codes are determined during the first key teaching.
- The KTR secret key.
- The VIN-code, used in the communication between.

COMMUNICATION PRINCIPLE BETWEEN BCM AND ECM

The immobilizer system needs a medial of communication between the BCM control unit (which manages the Immobilizer function, including the key recognizing) and the ECM control unit (which controls the engine). This communication is named: release message communication. The information exchange is necessary to lock or unlock the engine control, or to synchronize the Immobilizer system after the first key teaching.
This information is based on the Vehicle Specific Identification Number (VIN), coded in 2 bytes. The VIN-code is calculated by the BCM at the first key teaching using data from PIN code ; the value OFFFFh is not authorized (reserved for virgin ECM). The VIN-code is transmitted from the BCM in the release message communication (only in case of authorized key) using an encoding algorithm.
The ECM automatically learns the VIN-code after receiving the first release response message (that is: after the first key teaching, the ECM internal state being in virgin mode or neutral mode).
The ECM VIN-code is equal OFFFFh when leaving electronic production.
To get a synchronized Immobilizer system (same VIN-codes in BCM and ECM control units, authorized and programmed keys), virgin keys and virgin control units have to be got and special procedures have to be executed (After Market teaching - see Key teaching procedures chapter). Some procedures use the Diagnostic tool equipment; the usage of this tool equipment is restricted to the authorized persons.
In addition BCM and ECM exchange another information: the Model Identification Number (MIN), coded in 1 byte. The MIN is fixed constant value (01H). The MIN-code is checked by the ECM to authorize the engine running, and checked by the BCM,in order to inhibit any unauthorized use of BCM or ECM in a different system model.

COMMUNICATION LINE & SYSTEM CONSTRAINT

The exchange of the immobilization status between ECM and BCM is made on the current K-line. The BCM is inserted on the K-line between the ECM and the diagnosis connector, and manages an internal switch that opens the K-line during the exchange of status after the reset of ECM, or Key Off/On transient under power latch, as soon as the fast wake up pattern from the ECM is recognized. This configuration keeps the K-line accessible by the tool at the diagnosis connector. The only constraint is during the immobilizer communication where BCM and ECM cannot be addressed by the tool for diagnosis.

SYSTEM WORKING IN NOMINAL

MODE

The nominal mode supposes that the different elements of the system are programmed (synchronized Immobilizer system)
- The secret key code is programmed in BCM & keys memory.
- The learnt keys identifiers are stored in BCM memory.
- The corresponding VIN-code is learnt and memorized in the ECM memory.

1. Ignition ON transition phase :
Introducing a valid key into the steering lock, the system wakes up and BCM control unit sends to the key transponder a random data question (named challenge).
Transponder and BCM calculate the corresponding response by the encryption algorithm, and the response is sent back by transponder to the BCM which compares it with its own response. If they match, the BCM Immobilizer function switches in released state.
If they do not match, the BCM Immobilizer function switches in blocked state.
Then, turning ON the ignition, the BCM switches its internal K-line relay to isolate BCM & ECM control units from the system K-line, and in order to allow communication between BCM and ECM during a predefined tuned time window.

CAUTION:
- If the user waits for more than a predefined tuned time (10 sec.) between inserting of valid key and turning ON the ignition, the BCM Immobilizer function switches back in blocked state after this delay ;
- In this case, or if transponder communication has failed, a new communication with key transponder is carried out at Ignition ON transition to evaluate again Immobilizer state.

2. BCM-ECM Communication phase.
After this first" Ignition ON transition" phase, a communication between BCM & ECM control units takes place.
Turning ON the ignition, the ECM control unit controls the engine in a normal way for starting and running, and starts communication with the BCM, sending a VIN request to the BCM and waiting for a valid release message from it until the release time period has ended.
In case of BCM Immobilizer function state is " blocked" , the BCM answer is the " no release" message. ECM enters into the locked state, which causes the activation of the immobilization actions of the engine.
In case of BCM Immobilizer function state is " released" , the BCM answer is the " release" message, including the information " BCM in learnt mode" and the VIN-code.
- If VIN-code received by the BCM is the same as ECM VIN-code, and if MIN-code received by the BCM is the same as ECM MIN-code, ECM enters in the unlocked state, which allows continuing the running of the engine.
- If VIN-code received by the BCM is different than ECM VIN-code, or if MIN-code received by the BCM is the different than ECM MIN-code, ECM enters in the locked state, which causes the activation of the immobilization actions of the engine.
- If the ECM doesn't receive a response message from the BCM within the release time period, ECM enters in the locked state, which causes the activation of the immobilization actions of the engine.
- If the BCM doesn't receive any ECM request within the defined time, the BCM Immobilizer function switches in released state.
- If the ECM request contains a MIN-code different than BCM MIN-code, the BCM Immobilizer function switches in blocked state.

3. Ignition OFF transition phase :
Turning OFF the ignition, the BCM Immobilizer function stays in released state (if already in this state) during a predefined tuned time (10 sec.), allowing a fast restart of engine without key transponder communication, and then returns in blocked state.
After that, to restart the engine, a new communication with key transponder will be carried out:
- By removing and inserting again the key in the steering lock.
- By turning ON again the ignition.

IMMOBILIZER LAMP




The status indicator is a LAMP indicator. It is indicator the state of BCM immobilizer function, start of LIMP HOME and complete of key teaching.
BCM contains the LAMP driver hardware for direct connection of one LAMP.

GLOBAL RULES FOR STATUS LED PATTERN

1. Lamp should be turned OFF, when IGN off, or when engine is running.
2. Immobilizer lamp is on in case : IGN1 is ON and (TP identified correctly or Limp Home Password entered correctly).

NOTE: In case BCM-EMS communication error, then Immobilizer lamp off after 2 sec.

3. Immobilizer lamp is blinking
In case: (TP identification failed and Limp Home Password not running and Limp Home Password is not success) or (Limp Home Password entering failed and TP identification not running and TP identification not success).
Except if (BCM virgin and TP identification failed ), Then lamp is off.

4. During Limp Home Password entering sequence, the lamp reflects the IGN1 signal state : if IGN1 is ON, then lamp is ON, if IGN1 is OFF, then lamp is OFF

LIMP HOME MODE

A Limp Home mode is provided in order to allow starting the engine in case of transponder or antenna failure (backup solution).
The user password for LIMP HOME is taught at service station. The owner of the vehicle can define a number with four digitals.
The user password teaching is only accepted by " learnt" BCM(No necessary to check " learnt" ECM). Before first teaching of user password to BCM the status of this password is " virgin". LIMP HOME function is impossible.

USER PASSWORD SETTING PROCEDURE

The teaching is started by ignition ON with a valid key and sending the user password by tool. The communication message are described " Diagnostic tool display" . After successful teaching the status of user password changes from " virgin" to" learnt".
The " learnt" user password can also be changed. This can be done if user password status is " learnt" and the tool sends for authorization of access either the old user password or PIN code (Only access PIN code is applied in MUT tool).
After correct authorization the BCM requests new " User Password" . The status remains in " learnt" and the new user password will be valid.
If wrong user passwords or PIN code has been sent to BCM three times, the BCM will reject the request of password changing for one hour. Disconnecting the battery or other manipulation cannot reduce this time. After connecting the battery the timer starts again for one hour. When a valid TP is authenticated before tentatives' counter value reaches to limit, the tentative counter is reset, but the timer counter (1 hour) is not affected.

NOTE: It's recommended setting " User Password" whenever the car be sold. If the password has not been set at dealer shop, the Password can be set by the thieves and then the vehicle might allow the Limp Home Mode.

LIMP HOME TOOL

If the BCM detects a fault of antenna or transponder, the BCM will allow limp home function of immobilizer.
Limp home mode is only possible if the user password (4 digits) has been learnt to the BCM before.
This password can be defined by end user and is programmed at the service station.
The BCM informs the driver about the limp home condition by driven the status indicator. Then the user password can be sent to the BCM by special tool menu.
The diagnostic messages are described in " Diagnostic tool display".
Only if the BCM is in status " learnt" and the user password status is " learnt" and the " User password" is the correct one, the BCM is " released" and send " unlock" request to ECM for the time (typical 30 sec). The engine can only be started during this time. After elapsing of timer no engine start is possible.
The number of starts by tester is limited to 255.
If wrong user passwords have been sent to BCM three times, the BCM will reject the request of limp home for one hour. Disconnecting the battery or other manipulation cannot reduce this time. After the connecting of battery to ECM the timer starts again for one hour. When a valid TP is authenticated before counter value reaches to limit, the ten counter is reset, but the timer counter (1 hour) is not affected.

LIMP HOME BY IGNITION KEY




The limp home can be activated also by the ignition key. The BCM informs the driver by driven the status indicator about the limp home condition.
Then the input of user password to BCM can be done by special sequence of ignition on/off. The timing is described in the following diagram.
- Ignition On period : 0.2 sec - 5 sec
- Ignition Off period : 0.2 sec - 3 sec
- Pausing duration between two passwords input: 3 sec - 10 sec

If wrong user password is recognized by BCM three times, the BCM will reject the request of limp home for one hour. Disconnecting the battery or other manipulation cannot reduce this time. After the connecting of battery to ECM the timer starts again for one hour. When a valid TP is authenticated before counter value reaches to limit, the counter is reset, but the timer counter (1 hour) is not affected.
Only if the BCM is in status " learnt" and the user password status is " learnt" and the user password is the correct one,the BCM is released and the ECM is unlocked for the time (typical 30 sec). The engine can be started during this time. After elapsing of timer no engine start is possible. After new input of user password the timer (typical : 30 sec) starts again.
After ignition off the BCM is blocked and the ECM is locked (typical 10 sec) is elapsed. For next start the input of user password is requested again.

KEY TEACHING PROCEDURES

The key teaching procedures are done after replacing defective BCM at service station or for providing of additional key(s) to the vehicle owner.
The key teaching procedures are managed by the BCM control unit.
This is the teaching mode used by the dealers in order to replace the BCM and/or the set of keys, or to program additional keys for an existing system At service station, the PIN code attached to the vehicle will be communicated to BCM for BCM replacing or additional key teaching. For this purpose, the attached " Vehicle Serial Identification Number" should be sent to After Service Center which office can produce again the " Vehicle secret code" (PIN code), and then with received vehicle secret code (PIN code) the teaching procedure can be carried out
By writing the PIN code to BCM via Diagnostic tool, the After Market mode teaching starts. With this Diagnostic command, a parameter is set to identify the After Market mode.

TEACHING PROCEDURES DESCRIPTION

1. The procedure starts with Transponder key teaching start diagnostic command from tester, after having inserted the first key to be learnt into the steering column (Key IN signal = ON).
With this Diagnostic command, a parameter is set to identify the Teaching mode.
2. The BCM is then waiting for the PIN code entry.
Then the PIN code is entered and sent to BCM via Input PIN code" diagnostic command from tester.
3. The "virgin" BCM stores the PIN code, calculates and memorizes the KTR secret key, and the keys teaching can be started (case of BCM replacement).
The "learnt" BCM compares the PIN code from tester with the stored data If the data are correct, the keys teaching can be started. In case of wrong PIN code, the teaching procedure is cancelled (case of new keys teaching).
If wrong PIN codes have been sent to BCM three times, the BCM will reject the request of key teaching for one hour This time cannot be reduced by disconnecting the battery or other manipulation . After the connecting of battery the timer starts again for one hour But when an authentication of TP is done before counter value reach to limit, the Counter is reset.
4. The teaching of the first key is done by sending 1st key teaching request" diagnostic command from tester. The BCM sends back the message "response pending" to the tester, in order to avoid diagnostic communication time-out.
5. Then BCM challenges the transponder communication to read out the transponder key serial numbers.
If key is " virgin" (not locked for programming), the key' s transponder is programmed with this secret key, authenticate by encryption to check the program, and locked to inhibit any further program. This lock operation can be inhibited by way of a parameter. The BCM memorizes the serial number of this key (used as identifier of the key).
If the key is already known to BCM from previous teaching, then the BCM challenges the transponder communication to readout the transponder key serial numbers and to authenticate by encryption to check the program. The BCM memorizes the serial number but there is no change of transponder content (this is impossible for locked learnt transponder).

6. The successful programming/teaching is confirmed by message " 1 st key teaching completed" to tester.
7. The teaching of the other keys is done by inserting another key into the steering column (Key IN signal = ON) and sending additional tester commands, in the same way than for the first key.

WARNING: Some reason may generate a Diagnostic communication breakdown; in this case, tester should initialize again the communication, but teaching procedure will not be cancelled because of the breakdown.

8. The attempt of repeated teaching of a key, which has been taught already during the same teaching cycle, is recognized by BCM The BCM rejects this key and a message is sent to the tester

9. The BCM rejects invalid keys, which are presented for teaching. A message is sent to tester. The key can be invalid due to faults of transponder or other reasons, which result into not successful programming or reading of data If the BCM detects wrong KTR and serial number of transponder, the key is considered to be invalid

10. The key teaching procedure ends
- By input of a wrong PIN code.
- By Diagnostic request ' 1st/2nd/3rd/4th key teaching" with request parameter No" or wrong PIN" By power supply cut-off.
- By Diagnostic request ' stop communication" or end of Diagnostic session.
- Automatically after the successful teaching of the last key (4th key in After Market mode, this number is programable between 1 and 4 by Diagnosis command).

11. If the procedure ends during or before first key teaching, the BCM returns in its previous configuration (learnt mode with the previous set of learnt keys, or virgin) the procedure is considered as cancelled (unsuccessful).
If the procedure ends during or before 2nd/3rd/4th key teaching, the BCM switches to nominal mode operation (learnt mode) with the keys already learnt during the current procedure; it is now ready to emit the VIN-code to ECM control unit at the next Ignition ON transition, the procedure is considered as finished (successful).

NOTE: The maximum number of taught keys is 4.