TIBURON(GK) >2008 > G 2.7 DOHC > Body Electrical System > Immobilizer System>Description and Operation  
DESCRIPTION
There are two types of immobilizer functions available on the Body Control Module (BCM). The first is a "SMARTRA (SMART TRansponder Antenna)"type and the second is a "stand alone" type that will emulate the system known as the "SCE immobilizer". The hardware to support both types of immobilizer systems in the BCM is identical. The selection of immobilizer type withinthe BCM is effected by setting the appropriate EEPROM byte.
All communications between the BCM and the ECM (Engine Control Module) for the purposes of immobilization will be over the W line.
The diagnostics communication for the SMARTRA system will be performed by communicating with the ECM on it's K line. The ECM will then perform diagnosticson the BCM via the W line.
At the time of Transponder validation, the BCM devotes 100% processing power to the validation process in order to respond in the required time.During transponder validation, other BCM functions may be influenced.
1.
SMARTRA type immobilizer
The "SMARTRA" type immobilizer system is applied to the 2.0β engine.
The immobilizer system consists of a passive challenge-response (mutual authentication) transponder inside the key head, a stand alone antenna, the BCM unit and the ECM. The BCM unit shall emulate the original SMARTRA immobilizer as closely as possible. In this document, the BCM emulating the originalSMARTRA shall just be known as SMARTRA.
In the SMARTRA system, the immobilizer is contained within the ECM. The BCM shall provide the low-level routines and hardware necessary to communicatewith the transponder.
2.
Stand alone type immobilizer
The "Stand alone" type immobilizer system is applied to the 2.7δ engine.
The immobilizer system consists of a passive challenge-response (mutual authentication) transponder inside the key head, a stand alone antenna, the BCM unit and the ECM. The BCM unit shall emulate the original SCE type immobilizerto ECM protocol as closely as possible.
In the Stand alone immobilizer system, the immobilizer is contained within the BCM. The ECM shall request the BCM for permission to start the vehicle. The BCM shall perform the immobilisation functions and reply "start"or no start" permission to the ECM.
SYSTEM BLOCK DIAGRAM

IMMOBILIZER STATES

1.
ECM states
State
Description
Virgin
The EMS is delivered to HMC in virgin state.
There is no VIN* stored in the EMS.
It can only be in Virgin state once.
The EMS will allow starting on the second cycle of ignition.
Virgin state is exited when a VIN has successfully been taught by the BCM.
Learnt
Engine start is possible only when the received VIN from the BCM matches that stored in the EMS.
Neutral
VIN has been deleted.
Same as Virgin state except engine starting not possible on the second cycle of Ignition.
Neutral state is entered if the BCM changes to Neutral state.
Unknown
Except in the case of Virgin, Learn, Neutral states.

* VIN(Vehicle Identification Number)
The Vehicle Identification Number(VIN) is used for the mutual authentication process between the EMS and BCM.
2.
BCM(Body Control Module) states
State
Description
Virgin
The BCM is set to Virgin state during manufacture
No VIN is stored.
Virgin state is exited only after the VIN been learned and the Change to Learnt state command is received.
Learnt
The BCM contains a VIN.
Neutral
The purpose of the Neutral state is to allow the EMS to be set to Neutral state.
The BCM Neutral state expires 10 seconds after an Ignition ON → OFF cycle.(OFF=ACC or IG OFF).
Unknown
Locked by timer (After a certain number of incorrect user Password(4) or PIN Code(6) the ECM is locked for one hour and no inputs are accepted during this time)

3.
Key states
State
Description
1 st
2 nd
3 rd
4 th
Number of the current transponder Key in the ignition.
Not Check
It means that BCM cannot check the transponder data in the key cylinder
- communication circuit problem between BCM and Antenna coil
- Virgin Transponder
- Key with NO Transponder
- More than 1(One) Transponder in the magnetic field
- No Transponder in the magnetic field
- TP(Transponder) data blocked
- TP data does not exist
- TP data changed
- TP Teaching error
- Multiple TP data input

TEACHING PROCEDURES
1.
Key Teaching Procedure.
(1)
Learnt Status.

(2)
Virgin Status.
After Replacing new "ECM" scantool displays that ECM is Virgin status in Key Teaching mode "VIRGIN" status means that ECM has not matched any PIN Code before.

Key Teaching Procedure
Key teaching must be done after replacing a faulty ECM or when providing additional keys to the vehicle owner. The procedure starts with an ECM request for vehicle specific data from the scanner. The "virgin" ECM stores the vehicle specific data and the key teaching can be started. The "learnt" ECM compares the vehicle specific data from the scanner with the stored data. If the data are correct, the teaching can proceed.
If incorrect vehicle specific data have been sent to the ECM three times, the ECM will reject the request of key teaching for one hour. This time cannot be reduced by disconnecting the battery or any other manipulation. After reconnecting the battery, the timer starts again for one hour.
The key teaching is done by ignition on with the key and additional tester commands. The ECM stores the relevant data in the EEPROM and in the transponder. Then the ECM runs the authentication required for confirmation of the teaching process. The successful programming is then confirmed by a message to the scanner. If the key is already known to the ECM from a previous teaching, the authentication will be accepted and the EEPROM data are updated.
There is no changed transponder content (this is impossible for a learnt transponder).
The attempt to repeatedly teach a key, which has been taught already during the same teaching cycle, is recognized by the ECM. This rejects the key and a message is sent to the scanner.
The ECM rejects invalid keys, which are presented for teaching. A message is sent to the scanner.
The key can be invalid due to faults in the transponder or other reasons, which result from unsuccessful programming of data. If the ECM detects different authenticators of a transponder and an ECM, the key is considered to be invalid. The maximum number of taught keys is 4.
If an error occurs during the Immobilizer Service Menu, the ECM status remains unchanged and a specific fault code is stored. If the ECM status and the key status do not match for teaching of keys, the scanner procedure will be stopped and a specific fault code will be stored at ECM.
2.
ECM Neutralization

This function is for neutralizing the ECM and Key. ex)When lost key, Neutralize the ECM then teach keys.(Refer to the Things to do when Key & PIN Code The ECM can be set to the "neutral" status by a scanner. A valid ignition key is inserted and after ignition on is recorded, the ECM requests the vehicle specific data from the scanner. The communication messages are described at "Neutral Mode". After successfully receiving the data, the ECM is neutralized.
The ECM remains locked. Neither the limp home mode nor the "twice ignition on" function is accepted by ECM.
The teaching of keys follows the procedure described for virgin ECM. The vehicle specific data have to be unchanged due to the unique programming of transponder. If data should be changed, new keys with virgin transponder are requested.
3.
Password Teaching / Changing

※ In case of putting wrong password, retry from first step after 10 seconds.
The user password is used only for limp home function. The user password for limp home is taught at the service station. The owner of the vehicle can select a number with four digits. User password teaching is only accepted by a " learnt" ECM. Before first teaching of user password to an ECM, The status of the password is "virgin". No limp home function is possible. The teaching is started by ignition on, with a valid key and sending the user password by scanner. After successful teaching, the status of the user password changes from "virgin"to "learnt". The learnt user password can also be changed. This can be done if the user password status is "learnt" and the scanner sends authorization of access, either the old user password or the vehicle specific data. After correct authorization, the ECM requests the new user password. The status remains "learnt" and the new user password will be valid for the next limp home mode. If incorrect user passwords or wrong vehicle specific data have been sent to the ECM three times, the ECM will reject the request to change the password for one hour. This time can not be reduced by disconnecting the battery or any other actions. After reconnecting the battery, the timer starts again for one hour.
The user password can be in status.
00. Not yet checked.
The status is stored in the EEPROM. In case of incorrect or no plausible data from this circuit, the ECM can not check the status and the ECM sends Not yet checked.
01. Learnt
The password has been taught successfully to the ECM.
02. Virgin
This is the status at the end of the ECM production line before delivery to the final customer.
04. Locked by timer
After a certain number of incorrect inputs, the ECM is locked for one hour and no inputs are accepted during this time.
05. Teaching not accepted
This status is set,for example,if the ECM is in neutral status.
LIMP HOME FUNCTION (For 2.0 ENG)
1.
LOCKING OF ECM
If engine shut off (ignition off by key) the EMS is locked from now on.
If the timer is more than 30sec without Cranking in Ignition status "ON" by Valid Key, ECM have to do new authentication if user attempts engine start.
In case of engine stalling about start of limp home the timing of ECM locking is as follows:
start, after ignition off the time for repeated engine start is limited to 8 sec. After elapsing this time new authentication is done or in case of limp home the input of user password is requested again.
2.
LIMPHOME PROCEDURE

(1)
By scanner
If the ECM detects a fault of SMARTRA or transponder, the ECM will allow limp home function of immobilizer. Limp home is only possible if the user password (4 digits) has been given to the ECM before. This password can be selected by the vehicle owner and is programmed at the service station. The ECM informs the driver about the limp home condition by blinking the immobilizer indicator. Then the user password can be sent to the ECM via the limp home mode menu. Only if the ECM is in status "learnt" and the user password status is "learnt" and the user password is correct the ECM will be unlocked for a period of time (30 sec.). The engine can only be started during this time. After the time has elapsed, engine start is not possible. If the wrong user password is sent, the ECM will reject the request of limp home for one hour. Disconnecting the battery or other actions cannot reduce this time. After connecting of battery to ECM, the timer starts again for one hour.

(2)
By ignition key
The limp home can be activated also by the ignition key. The ECM informs the driver by blinking the immobilizer indicator for the limp home condition. Then the user password can be input to ECM that can be done by special sequence of ignition on/off as picture above. Only if the ECM is in status "learnt" and the user password status is "learnt" and the user password is correct. the ECM will be unlocked for a period of time (30 sec.). The engine can be started during this time. After the time has elapsed, engine start is not possible. After a new password has been input the timer (30 sec.) start again. After ignition off the ECM is locked (If timer 8 sec. is elapsed). For next start the input of user password is requested again.
3.
Things to remember before a repair(1) - Installing the ECM

4.
Things to remember before a repair(2) - Replace keys & Additional registration

5.
Things to remember before a repair(3)
(1)
When there is only one master key registered and you wish to register another master key, You need to re-register the master key which was already registered.
(2)
When the master key #1 is registered and master key #2 is not registered, Put the master key #1 in the IG/ON or the start position and remove it. The engine can be started with the unregistered master key #2.
(Note that master key #2 must be used within 10 seconds of removing master key #1)
(3)
When the master key #1 is registered and master key #2 is not registered, Put the Unregistered master key #2 in the IG/ON or the start position.
The engine cannot be started even with the registered master key #1.
When you inspect the immobilizer system, refer to the above paragraphs 1, 2 and 3. Always remember the 10 seconds zone.
6.
Things to remember before a repair(4)
(1)
If the pin code & password are entered incorrectly on three consecutive inputs, the system will be locked for one hour.
(2)
Be cautious not to overlap the transponder areas.
A.
Problems can occur at key registration or vehicle starting if the transponders should overlap.
B.
This can be caused by the smartra & TP conducting radio communication.
Limp Home Mode (For 2.7 ENG)
Limp home mode allows the driver to start a car when the immobilizer system has failed but BCM is still able to communicate with the EMS. Limp home mode is activated by "entering" the Limp Home Password of the system via activations of the ignition key. The timing for entering the password are shown blow in Figure2.
At the dealer, the new owner is asked to choose a PASSWORD which is 4 digit(2byte) in length.
The PASSWORD may also be placed directly in RAM using the scanner.
If the password is to be changed (for example if the user forgets the password), the dealer shall use the change Password menu on the scanner. The scanner will prompt the dealer to enter the 6 digit PIN code as obtained from the HMC database for the vehicle in question.
The PASSWORD and the PIN* code are not the same. The PASSWORD is a number chosen by the owner for the purposes of limp starting.
Limp home mode is not active when the BCM is in virgin state.
*PIN code : P Identification Number (Vehicle Secret Code)
1.
Limp Home lockout timer
If the limp home password is incorrectly entered with the scanner, and the IGN is cycled from IGN OFF to IGN ON, a counter is incremented in the BCM. If this counter reaches 3, the BCM enters lock out mode.
During this time period, the BCM will not respond in Limp home mode if any password is entered via the scanner. If the power to the BCM is removed, when it is restored, the one hour timer will restart. Manual limp home mode (using the ignition key) is still possible though.

Limp home code entry is enabled after the key has been in the ignition position for greater than 5 seconds. If the ignition is turned on for longer than five seconds during the sequence, the sequence is then restarted and all timers cleared. If the ignition is off for longer than three seconds during the entry, the code number for that digit of the Limp Home Password is determined. If the ignition is turned off for longer than 10 seconds at any time before during or after code entry, all timers are cleared and limp home mode is deactivated. The number "0" is represented by 10 cycles of the ignition key.
For limp home mode, IGN OFF is defined as Ignition OFF position or ACC position.
2.
Lock out mode
The BCM will enter lock out mode if the 9 byte seed in EEPROM does not match the 9 byte seed in RAM for three attempts of the following commands:
A.
Teach Transponder Keys to BCM
B.
Change Limp home Password
C.
Scantool entry of Limp home Password.
Upon activation, this mode locks out access to these commands for a period of 1 hour. This period cannot be reduced in any way – even if diagnostics mode is terminated and then re-entered. If power is disconnected to the BCM, the 1 hour timer will be restarted upon restoration. This ensures that a potential car thief cannot easily crack the 9 byte security code, and hence steal the vehicle.
3.
Things to remember before repairing
A repair case
Things to remember
Needed Item
Registration
(Missing all keys)
Register new keys with the PIN code
New keys
Registration
(additional new key)
Register new key with the PIN code
(Be sure that keys which were already registered are need to re-register)
New key
Replace New BCM
Register all keys which were already registered with the PIN code
New BCM
Replace BCM registered another car
BCM registered another car can't use
New BCM
New Keys
Replace New ECM
Do not need to register
New ECM
Replace ECM registered another car
If key is turned IG ON, ECM registered another car is registered.
Be sure that below things.
1.
ECM registered another car must be neutralized before removing.
2.
After neutralizing, Key must be turned IG ON(ON → OFF → ON) within 10 sec.
ECM registered another car