The vehicle immobilizer system consists of the ECM, the SMARTRA and ignition keys with built-in transponder.
The ECM carries out the check of ignition key by special encryption algorithm, which runs in the transponder and in the ECM in parallel. Only if the results are equal, the engine can be started. The data of all transponder, which are valid for the vehicle, are stored in the ECM.
The ECM and the SMARTRA communicate by dedicated line. During this communication of ECM and SMARTRA the K line of ECM cannot be used for communication. The ECM controls the communication either to SMARTRA or to other devices (e.g. service tester) on K line by switching of a multiplexer and specific communication procedures. The multiplexer is a part of ECM hardware.The SMARTRA carries out the communication with the built-in transponder of the ignition key. This wireless communication runs by RF (Radio frequency of 125 kHz). The SMARTRA is mounted at the ignition lock close to the antenna coil for RF transmission and receiving. The RF signal from the transponder received by the antenna coil is converted into messages for serial communication by the SMARTRA device. And the received messages from the ECM are converted into the RF signal, which is transmitted, to the transponder by antenna.
The SMARTRA does not carry out the check of validity of transponder or the calculation of encryption algorithm. This device is only an advanced interface, which converts the RF data flow of transponder into serial communication to ECM and vice versa.
The transponder is of Hitag2 type with advanced encryption algorithm. During the key teaching procedure the transponder will be programmed with vehicle specific data. The vehicle specific data are written into the transponder memory. The write procedure is unique; therefore the content of transponder can never be modified or changed. The data are a string of 9 bytes defined by vehicle manufacturer. The transponder memory is split into two strings called authenticator and key password.
After this programming the transponder memory is locked and the data cannot be read or changed respectively. The transponder status changes from "virgin" to "learnt".
Additionally every transponder includes a unique IDE (Identifier number) of 32 bit. Unique means that the IDE of all transponder is different from each other. The IDE is programmed by the transponder manufacturer and is a read-only value.
The authenticator and the key password are not transferred from ECM to transponder or vice versa. Only the results from the encryption algorithm are transferred. It is almost impossible to calculate the vehicle specific data from the encryption result.
For teaching of keys and special purposes the ECM is connected to the tester device. This can be the manufacturer’s service tester, which is in use at service station. The protocol of communication is the K line of ECM.
LIMP HOME BY TESTER
If the ECM detects the fault of the SMARTRA or transponder, the ECM will allow limp home function of the immobilizer. Limp home is only possible if the user password (4 digits) has been given to the ECM before. This password can be selected by the vehicle owner and is programmed at the service station.
The user password can be sent to the ECM via the special tester menu.
Only if the ECM is in status "learnt" and the user password status is "learnt" and the user password is correct, the ECM will be unlocked for a period of time (30 sec.). The engine can only be started during this time. After the time has elapsed, engine start is not possible.
If the wrong user password is sent, the ECM will reject the request of limp home for one hour. Disconnecting the battery or any other action cannot reduce this time. After econnecting the battery to the ECM, the timer starts again for one hour.
LIMP HOME BY IGNITION KEY
The limp home can be activated also by the ignition key. The user password can be input to the ECM by a special sequence of ignition on/off.
Only if the ECM is in status "learnt" and the user password status is "learnt" and the user password is correct, the ECM will be unlocked for a period of time (30 sec.). The engine can be started during this time. After the time has elapsed, engine start is not possible. After a new password has been input, the timer (30 sec.) will start again.
After ignition off, the ECM is locked if the timer has elapsed 8 seconds. For the next start, the input of the user password is requested again.
