Programming and Relearning
IMMOBILIZER STATES1. Engine Control Module (ECM) States
The ECM has three defined states. These are described.
2. Body Control Module (BCM) states
The Body Control Module (BCM) has three defined states. These are described below.
TEACHING PROCEDURES
1. Key Teaching Procedure
Key teaching must be done after replacing a defective ECM or when providing additional keys to the vehicle owner.
The procedure starts with an ECM request for vehicle specific data from the tester. The "virgin" ECM stores the vehicle specific data and the key teaching can be started. The "learnt" ECM compares the vehicle specific data from the tester with the stored data. If the data are correct, the teaching can precede.
If incorrect vehicle specific data have been sent to the ECM three times, the ECM will reject the request of key teaching for one hour. This time cannot be reduced by disconnecting the battery or any other manipulation. After reconnecting the battery, the timer starts again for one hour.
The key teaching is done by ignition on with the key and additional tester commands. The ECM stores the relevant data in the EEPROM and in the transponder. Then the ECM runs the authentication required for confirmation of the teaching process. The successful programming is then confirmed by a message to the tester.
If the key is already known to the ECM from a previous teaching, the authentication will be accepted and the EEPROM data are updated. There is no changed transponder content (this is impossible for a learnt transponder).
The attempt to repeatedly teach a key, which has been taught already during the same teaching cycle, is recognized by the ECM. This rejects the key and a message is sent to the tester.
The ECM rejects invalid keys, which are presented for teaching. A message is sent to the tester. The key can be invalid due to faults in the transponder or other reasons, which result from unsuccessful programming of data. If the ECM detects different authenticators of a transponder and an ECM, the key is considered to be invalid.
The maximum number of taught keys is 4.
If an error occurs during the Immobilizer Service Menu, the ECM status remains unchanged and a specific fault code is stored.
If the ECM status and the key status do not match for teaching of keys, the tester procedure will be stopped and a specific fault code will be stored at ECM.
2. User Password Teaching Procedure
The user password for limp home is taught at the service station. The owner of the vehicle can select a number with four digits.
User password teaching is only accepted by a "learnt" ECM. Before first teaching of user password to an ECM, the status of the password is "virgin". No limp home function is possible.
The teaching is started by ignition on, with a valid key and sending the user password by tester. After successful teaching, the status of the user password changes from "virgin" to "learnt".
The learnt user password can also be changed. This can be done if the user password status is "learnt" and the tester sends authorization of access, either the old user password or the vehicle specific data. After correct authorization, the ECM requests the new user password. The status remains "learnt" and the new user password will be valid for the next limp home mode.
If incorrect user passwords or wrong vehicle specific data have been sent to the ECM three times, the ECM will reject the request to change the password for one hour. This time cannot be reduced by disconnecting the battery or any other actions. After reconnecting the battery, the timer starts again for one hour
THE USER PASSWORD CAN BE IN THE STATUS
00. Not yet checked
The status is stored in the EEPROM. In case of incorrect or no plausible data from this circuit, the ECM cannot check the status and the ECM sends 00.
01. Learnt
The password has been taught successfully to the ECM.
02. Virgin
This is the status at the end of the ECM production line before delivery to the final customer.
04. Locked by timer
After a certain number of incorrect inputs, the ECM is locked for one hour and no inputs are accepted during this time.
05. Teaching not accepted
This status is set if, for example, the ECM is in neutral status.
LIMP HOME FUNCTION
Limp home mode allows the driver to start a car when the immobilizer system has failed but the BCM is still able to communicate with the ECM. When the limp home mode is activated, the BCM will send the data back to the ECM. This is irregardless of the values of the VIN, MIN, Transponder or Random number stored within the BCM. Limp home mode is activated by "entering" the limp home password of the system via activations of the ignition key. The timing for entering the password are shown below in timing chart.
The password is stored in EEPROM. The password is also stored in RAM. If both the EEPROM and RAM copy match then the vehicle is allowed to start once upon the next cycle of ignition. After the vehicle has been allowed to start once, the RAM copy is cleared thus preventing further starting.
At the dealer, the new owner is asked to choose a password which is 4 digit (2 bytes) in length. All digits chosen by the user must be between zero and nine. This password is placed within the BCM EEPROM using the Hi-scan command.
If limp home mode is required, the owner enters the password via the ignition key. The password is decoded by the BCM then placed in RAM for comparison with the EEPROM copy. The password may also be placed directly in RAM using the Hi Scan. However, the tester must be still connected at the time of starting.
If the user forgets the password, the dealer shall use the forgotten password menu on the HiScan. The HiScan will prompt the dealer to enter the pin code as obtained from the HMC database for the vehicle in question.
NOTE: The password and the pin code are not the same. Pin code is scanned from a bar code at the End Of Line (EOL). The password is a number chosen by the owner for the purposes of limp starting.
1. By tester
If the ECM detects the fault of the BCM or transponder, the ECM will allow limp home function of the immobilizer. Limp home is only possible if the user password (4 digits) has been given to the ECM before. This password can be selected by the vehicle owner and is programmed at the service station.
The user password can be sent to the ECM via the hi-scan menu.
In case of "SMARTRA" type immobilizer system, only if the ECM is in status "learnt" and the user password status is "learnt" and the user password is correct, will the ECM be unlocked for a period of time (30 sec). The engine can only be started during this time. After the time has elapsed, engine start is not possible.
But the ECM unlock timer (30 sec) is not necessary in the "Stand alone" type immobilizer system.
If the wrong user password is sent, the ECM will reject the request of limp home for one hour Disconnecting the battery or any other action cannot reduce this time. After reconnecting the battery to the ECM, the timer starts again for one hour
2. By ignition key
The limp home can be activated also by the ignition key. The user password can be input to the ECM by a special sequence of ignition on/off.
Limp home code entry is enabled after the key has been in the ignition position for greater than 5 seconds If the ignition is turned on for longer than five seconds during the sequence, the sequence is then restarted and all timers cleared. If the ignition is off for longer than three seconds during the entry, the code number for that digit of the limp home password is determined. If the ignition is turned off for longer than 10 seconds at any time before during or after code entry, all timers are cleared and limp home mode is deactivated. The number "0" is represented by 10 cycles of the ignition key.
Only if the ECM is in status "learnt" and the user password status is "learnt" and the user password is correct, will the ECM be unlocked for a period of time (30 sec). The engine can be started during this time. After the time has elapsed, engine start is not possible. After a new password has been input, the timer (30 sec) will start again.
But in case of "Standard alone" type immobilizer system, the engine start is possible after the time (30 sec) has elapsed.
After ignition off, the ECM is locked if the timer has elapsed 8 seconds For the next start, the input of the user password is requested again.
But in case of "Standard alone" type immobilizer system, the ECM is locked instantly after ignition off.