There are two types of
immobilizer functions available on the Body Control Module (BCM). The
first is a "SMARTRA (SMART TRansponder Antenna)"type and the second is a
"stand alone" type that will emulate the system known as the "SCE
immobilizer". The hardware to support both types of immobilizer systems in
the BCM is identical. The selection of immobilizer type withinthe BCM is
effected by setting the appropriate EEPROM byte.
All communications
between the BCM and the ECM (Engine Control Module) for the purposes of
immobilization will be over the W line.
The diagnostics
communication for the SMARTRA system will be performed by communicating
with the ECM on it's K line. The ECM will then perform diagnosticson the
BCM via the W line.
At the time of
Transponder validation, the BCM devotes 100% processing power to the
validation process in order to respond in the required time.During
transponder validation, other BCM functions may be
influenced.
1. |
SMARTRA type
immobilizer
The "SMARTRA" type immobilizer system is
applied to the 2.0β engine.
The immobilizer system consists of a passive
challenge-response (mutual authentication) transponder inside the
key head, a stand alone antenna, the BCM unit and the ECM. The BCM
unit shall emulate the original SMARTRA immobilizer as closely as
possible. In this document, the BCM emulating the originalSMARTRA
shall just be known as SMARTRA.
In the SMARTRA system, the immobilizer is
contained within the ECM. The BCM shall provide the low-level
routines and hardware necessary to communicatewith the
transponder. |
2. |
Stand alone type
immobilizer
The "Stand alone" type immobilizer system is
applied to the 2.7δ engine.
The immobilizer system consists of a passive
challenge-response (mutual authentication) transponder inside the
key head, a stand alone antenna, the BCM unit and the ECM. The BCM
unit shall emulate the original SCE type immobilizerto ECM protocol
as closely as possible.
In the Stand alone immobilizer system, the
immobilizer is contained within the BCM. The ECM shall request the
BCM for permission to start the vehicle. The BCM shall perform the
immobilisation functions and reply "start"or no start" permission to
the ECM. |
SYSTEM BLOCK DIAGRAM


1. |
ECM states
State
|
Description
|
Virgin
|
•
|
The EMS is delivered to HMC in
virgin state. |
•
|
There is no VIN* stored in the
EMS. |
•
|
It can only be in Virgin state
once. |
•
|
The EMS will allow starting on the
second cycle of
ignition. |
•
|
Virgin state is exited when a VIN
has successfully been taught by the
BCM. | |
Learnt
|
•
|
Engine start is possible only when
the received VIN from the BCM matches that stored in the
EMS. | |
Neutral
|
•
|
Same as Virgin state except engine
starting not possible on the second cycle of
Ignition. |
•
|
Neutral state is entered if the
BCM changes to Neutral
state. | |
Unknown
|
•
|
Except in the case of Virgin,
Learn, Neutral
states. | |
* VIN(Vehicle Identification
Number)
The Vehicle Identification Number(VIN) is used
for the mutual authentication process between the EMS and
BCM. |
2. |
BCM(Body Control Module) states
State
|
Description
|
Virgin
|
•
|
The BCM is set to Virgin state
during manufacture |
•
|
Virgin state is exited only after
the VIN been learned and the Change to Learnt state
command is
received. | |
Learnt
|
•
|
The BCM contains a
VIN. | |
Neutral
|
•
|
The purpose of the Neutral state
is to allow the EMS to be set to Neutral
state. |
•
|
The BCM Neutral state expires 10
seconds after an Ignition ON → OFF cycle.(OFF=ACC or IG
OFF). | |
Unknown
|
•
|
Locked by timer (After a certain
number of incorrect user Password(4) or PIN Code(6) the
ECM is locked for one hour and no inputs are accepted
during this
time) | |
|
3. |
Key states
State
|
Description
|
1
st 2 nd 3 rd 4 th
|
•
|
Number of the current transponder
Key in the
ignition. | |
Not
Check
|
•
|
It means that BCM cannot check the
transponder data in the key cylinder
- communication circuit problem
between BCM and Antenna coil
- Virgin Transponder
- Key with NO
Transponder
- More than 1(One) Transponder in
the magnetic field
- No Transponder in the magnetic
field
- TP(Transponder) data
blocked
- TP data does not
exist
- TP data changed
- TP Teaching error
- Multiple TP data
input | |
|
TEACHING PROCEDURES
1. |
Key Teaching Procedure.
(2) |
Virgin Status.
After Replacing new "ECM" scantool
displays that ECM is Virgin status in Key Teaching mode
"VIRGIN" status means that ECM has not matched any PIN Code
before.





Key Teaching
Procedure
Key teaching must be done after
replacing a faulty ECM or when providing additional keys
to the vehicle owner. The procedure starts with an ECM
request for vehicle specific data from the scanner. The
"virgin" ECM stores the vehicle specific data and the
key teaching can be started. The "learnt" ECM compares
the vehicle specific data from the scanner with the
stored data. If the data are correct, the teaching can
proceed.
If incorrect vehicle specific data
have been sent to the ECM three times, the ECM will
reject the request of key teaching for one hour. This
time cannot be reduced by disconnecting the battery or
any other manipulation. After reconnecting the battery,
the timer starts again for one hour.
The key teaching is done by
ignition on with the key and additional tester commands.
The ECM stores the relevant data in the EEPROM and in
the transponder. Then the ECM runs the authentication
required for confirmation of the teaching process. The
successful programming is then confirmed by a message to
the scanner. If the key is already known to the ECM from
a previous teaching, the authentication will be accepted
and the EEPROM data are updated.
There is no changed transponder
content (this is impossible for a learnt
transponder).
The attempt to repeatedly teach a
key, which has been taught already during the same
teaching cycle, is recognized by the ECM. This rejects
the key and a message is sent to the
scanner.
The ECM rejects invalid keys,
which are presented for teaching. A message is sent to
the scanner.
The key can be invalid due to
faults in the transponder or other reasons, which result
from unsuccessful programming of data. If the ECM
detects different authenticators of a transponder and an
ECM, the key is considered to be invalid. The maximum
number of taught keys is 4.
If an error occurs during the
Immobilizer Service Menu, the ECM status remains
unchanged and a specific fault code is stored. If the
ECM status and the key status do not match for teaching
of keys, the scanner procedure will be stopped and a
specific fault code will be stored at
ECM. | | |
2. |
ECM Neutralization





This function is for neutralizing the ECM and
Key. ex)When lost key, Neutralize the ECM then teach keys.(Refer to
the Things to do when Key & PIN Code The ECM can be set to the
"neutral" status by a scanner. A valid ignition key is inserted and
after ignition on is recorded, the ECM requests the vehicle specific
data from the scanner. The communication messages are described at
"Neutral Mode". After successfully receiving the data, the ECM is
neutralized.
The ECM remains locked. Neither the limp home
mode nor the "twice ignition on" function is accepted by
ECM.
The teaching of keys follows the procedure
described for virgin ECM. The vehicle specific data have to be
unchanged due to the unique programming of transponder. If data
should be changed, new keys with virgin transponder are
requested. |
3. |
Password Teaching / Changing





※ In case of putting wrong password, retry
from first step after 10 seconds.
The user password is used only for limp home
function. The user password for limp home is taught at the service
station. The owner of the vehicle can select a number with four
digits. User password teaching is only accepted by a " learnt" ECM.
Before first teaching of user password to an ECM, The status of the
password is "virgin". No limp home function is possible. The
teaching is started by ignition on, with a valid key and sending the
user password by scanner. After successful teaching, the status of
the user password changes from "virgin"to "learnt". The learnt user
password can also be changed. This can be done if the user password
status is "learnt" and the scanner sends authorization of access,
either the old user password or the vehicle specific data. After
correct authorization, the ECM requests the new user password. The
status remains "learnt" and the new user password will be valid for
the next limp home mode. If incorrect user passwords or wrong
vehicle specific data have been sent to the ECM three times, the ECM
will reject the request to change the password for one hour. This
time can not be reduced by disconnecting the battery or any other
actions. After reconnecting the battery, the timer starts again for
one hour.
The user password can be in
status.
00. Not yet checked.
The status is stored in the EEPROM. In case of
incorrect or no plausible data from this circuit, the ECM can not
check the status and the ECM sends Not yet checked.
01. Learnt
The password has been taught successfully to
the ECM.
02. Virgin
This is the status at the end of the ECM
production line before delivery to the final customer.
04. Locked by timer
After a certain number of incorrect inputs,
the ECM is locked for one hour and no inputs are accepted during
this time.
05. Teaching not accepted
This status is set,for example,if the ECM is
in neutral status. |
LIMP HOME FUNCTION (For 2.0 ENG)
1. |
LOCKING OF ECM
If engine shut off (ignition off by key) the
EMS is locked from now on.
If the timer is more than 30sec without
Cranking in Ignition status "ON" by Valid Key, ECM have to do new
authentication if user attempts engine start.
In case of engine stalling about start of limp
home the timing of ECM locking is as follows:
start, after ignition off the time for
repeated engine start is limited to 8 sec. After elapsing this time
new authentication is done or in case of limp home the input of user
password is requested again. |
2. |
LIMPHOME PROCEDURE




(1) |
By scanner
If the ECM detects a fault of SMARTRA or
transponder, the ECM will allow limp home function of
immobilizer. Limp home is only possible if the user password
(4 digits) has been given to the ECM before. This password can
be selected by the vehicle owner and is programmed at the
service station. The ECM informs the driver about the limp
home condition by blinking the immobilizer indicator. Then the
user password can be sent to the ECM via the limp home mode
menu. Only if the ECM is in status "learnt" and the user
password status is "learnt" and the user password is correct
the ECM will be unlocked for a period of time (30 sec.). The
engine can only be started during this time. After the time
has elapsed, engine start is not possible. If the wrong user
password is sent, the ECM will reject the request of limp home
for one hour. Disconnecting the battery or other actions
cannot reduce this time. After connecting of battery to ECM,
the timer starts again for one hour.

|
(2) |
By ignition key
The limp home can be activated also by
the ignition key. The ECM informs the driver by blinking the
immobilizer indicator for the limp home condition. Then the
user password can be input to ECM that can be done by special
sequence of ignition on/off as picture above. Only if the ECM
is in status "learnt" and the user password status is "learnt"
and the user password is correct. the ECM will be unlocked for
a period of time (30 sec.). The engine can be started during
this time. After the time has elapsed, engine start is not
possible. After a new password has been input the timer (30
sec.) start again. After ignition off the ECM is locked (If
timer 8 sec. is elapsed). For next start the input of user
password is requested
again. | |
3. |
Things to remember before a repair(1) -
Installing the ECM

|
4. |
Things to remember before a repair(2) -
Replace keys & Additional registration

|
5. |
Things to remember before a
repair(3)
(1) |
When there is only one master key
registered and you wish to register another master key, You
need to re-register the master key which was already
registered. |
(2) |
When the master key #1 is registered and
master key #2 is not registered, Put the master key #1 in the
IG/ON or the start position and remove it. The engine can be
started with the unregistered master key #2.
(Note that master key #2 must be used
within 10 seconds of removing master key
#1) |
(3) |
When the master key #1 is registered and
master key #2 is not registered, Put the Unregistered master
key #2 in the IG/ON or the start position.
The engine cannot be started even with
the registered master key #1.
When you inspect the immobilizer
system, refer to the above paragraphs 1, 2 and 3. Always
remember the 10 seconds
zone. | | |
6. |
Things to remember before a
repair(4)
(1) |
If the pin code & password are
entered incorrectly on three consecutive inputs, the system
will be locked for one hour. |
(2) |
Be cautious not to overlap the
transponder areas.
A. |
Problems can occur at key
registration or vehicle starting if the transponders
should overlap. |
B. |
This can be caused by the smartra
& TP conducting radio
communication. | | |
Limp Home Mode (For 2.7 ENG)
Limp home mode allows
the driver to start a car when the immobilizer system has failed but BCM
is still able to communicate with the EMS. Limp home mode is activated by
"entering" the Limp Home Password of the system via activations of the
ignition key. The timing for entering the password are shown blow in
Figure2.
At the dealer, the new
owner is asked to choose a PASSWORD which is 4 digit(2byte) in
length.
The PASSWORD may also be
placed directly in RAM using the scanner.
If the password is to be
changed (for example if the user forgets the password), the dealer shall
use the change Password menu on the scanner. The scanner will prompt the
dealer to enter the 6 digit PIN code as obtained from the HMC database for
the vehicle in question.
The PASSWORD and the PIN* code are not the
same. The PASSWORD is a number chosen by the owner for the purposes
of limp starting.
Limp home mode is not active when the BCM is
in virgin state.
*PIN code : P Identification Number (Vehicle
Secret Code) |
1. |
Limp Home lockout timer
If the limp home password is incorrectly
entered with the scanner, and the IGN is cycled from IGN OFF to IGN
ON, a counter is incremented in the BCM. If this counter reaches 3,
the BCM enters lock out mode.
During this time period, the BCM will not
respond in Limp home mode if any password is entered via the
scanner. If the power to the BCM is removed, when it is restored,
the one hour timer will restart. Manual limp home mode (using the
ignition key) is still possible though.

Limp home code entry is enabled after the key
has been in the ignition position for greater than 5 seconds. If the
ignition is turned on for longer than five seconds during the
sequence, the sequence is then restarted and all timers cleared. If
the ignition is off for longer than three seconds during the entry,
the code number for that digit of the Limp Home Password is
determined. If the ignition is turned off for longer than 10 seconds
at any time before during or after code entry, all timers are
cleared and limp home mode is deactivated. The number "0" is
represented by 10 cycles of the ignition key.
For limp home mode, IGN OFF is defined
as Ignition OFF position or ACC
position. | |
2. |
Lock out mode
The BCM will enter lock out mode if the 9 byte
seed in EEPROM does not match the 9 byte seed in RAM for three
attempts of the following commands:
A. |
Teach Transponder Keys to
BCM |
B. |
Change Limp home
Password |
C. |
Scantool entry of Limp home
Password. |
Upon activation, this mode locks out access to
these commands for a period of 1 hour. This period cannot be reduced
in any way – even if diagnostics mode is terminated and then
re-entered. If power is disconnected to the BCM, the 1 hour timer
will be restarted upon restoration. This ensures that a potential
car thief cannot easily crack the 9 byte security code, and hence
steal the vehicle. |
3. |
Things to remember before
repairing
A repair
case
|
Things to
remember
|
Needed
Item
|
Registration (Missing
all keys)
|
Register
new keys with the PIN code
|
New
keys
|
Registration (additional
new key)
|
Register
new key with the PIN code (Be sure
that keys which were already registered are need to
re-register)
|
New
key
|
Replace
New BCM
|
Register
all keys which were already registered with the PIN
code
|
New
BCM
|
Replace
BCM registered another car
|
BCM
registered another car can't use
|
New
BCM New Keys
|
Replace
New ECM
|
Do not
need to register
|
New
ECM
|
Replace
ECM registered another car
|
If key
is turned IG ON, ECM registered another car is
registered. Be sure that below
things.
1. |
ECM registered another car must be
neutralized before
removing. |
2. |
After neutralizing, Key must be
turned IG ON(ON → OFF → ON) within 10
sec. | |
ECM
registered another
car
|
| |