IMMOBILIZER

SYSTEM
• Shinchang type
• SMARTRA type
Shinchang type
Immobilizer
CONTENTS

CONTENTS

1. Application 5. Hi-scan operation

- DTC
2. System Overview
- Current Data
3. Components - Password record / change
- Transponder - Master key record / change
- Antenna Coil - Master key delete
- ICM - Neutral mode
- ECM - Immobilizer reset
4. Communication 6. Case study
7. Fail safe fuction
APPLICATION

1. Application
Type Applicable Vehicles

ELANTRA (RD) TERRACAN (3.5Gas,2.5TCI)

ATOS X-3 ACCENT
XG GALLOPER
EF-SONATA SANTAMO
SHINCHANG CENTENNIAL (LZ) Y-3 SONATA
SANTAFE(Gas-2.0L,2.4L) H-1
TRAJET(Gas-2.0L) H-100
COUPE (~01MY)

LC ACCENT SANTAFE(2.0TCI, Gas-2.7L)

SMARTRA MATRIX (FC) TRAJET(2.0TCI, Gas-2.7L)
COUPE (02MY~) TERRACAN(2.9TCI)
ELANTRA (XD) GETZ (TB)
APPLICATION

1. Application

VEHICLE Displac TYPE EMS Immobilizer

ACCENT 1.3L Alpha-SOHC CARB Shinchang
(X-3) Alpha-SOHC SIEMENS Shinchang
1.5L Alpha-SOHC BOSCH Shinchang
Alpha-DOHC BOSCH Shinchang
ELANTRA 1.6L Beta-DOHC SIEMENS Shinchang
(RD) 1.8L Beta-DOHC SIEMENS Shinchang
Beta-DOHC BOSCH Shinchang
COUPE 1.8L Beta-DOHC SIEMENS Shinchang
(TIBURON) Beta-DOHC BOSCH Shinchang
2.0L Beta-DOHC SIEMENS Shinchang
Beta-DOHC BOSCH Shinchang
 APPLICATION

1. Application
VEHICLE Displac TYPE EMS Immobilizer
SONATA 1.8L SIRIUS-SOHC MELCO Shinchang
(Y-3) SIRIUS-DOHC MELCO Shinchang
2.0L SIRIUS-SOHC MELCO Shinchang
SIRIUS-DOHC MELCO Shinchang
3.0L V-6 MELCO Shinchang
EF SONATA 2.0L SIRIUS-II DOHC MELCO Shinchang
(EF) 2.4L SIRIUS-II DOHC MELCO Shinchang
2.5L DELTA DOHC SIEMENS Shinchang
ATOS 1.0L EPSILON SOHC HYUNDAI Shinchang
ATOS(01MY~) 1.0L EPSILON SOHC BOSCH SMARTRA
GETZ 1.1L EPSILON SOHC BOSCH SMARTRA
1.3L/1.5L ALPHA SO/DO BOSCH SMARTRA
APPLICATION

1. Application
VEHICLE Displac TYPE EMS Immobilizer
XG 25, 30 2.5L DELTA DOHC SIEMENS Shinchang
(XG) 3.0L SIGMA DOHC MELCO Shinchang
ACCENT 1.3L ALPHA SOHC BOSCH SMARTRA
(LC) 1.5L ALPHA SO/DO BOSCH SMARTRA
1.6L ALPHA DOHC BOSCH SMARTRA
TRAJET 2.0L SIRIUS-II DOHC MELCO Shinchang
(FO) 2.7L DELTA DOHC SIEMENS Shinchang
2.0L D (COMMON RAIL) BOSCH SMARTRA
SANTA FE 2.0L SIRIUS-II DOHC MELCO Shinchang
(SM) 2.4L SIRIUS-II DOHC MELCO Shinchang
2.7L DELTA DOHC SIEMENS Shinchang
2.0L D (COMMON RAIL) BOSCH SMARTRA
ELANTRA 1.6L ALPHA DOHC BOSCH SMARTRA
(XD) 1.8L BETA DOHC SIEMENS SMARTRA
2.0L BETA DOHC SIEMENS SMARTRA
APPLICATION

1. Application
VEHICLE Displac TYPE EMS Immobilizer
CENTENNIAL 3.5L SIGMA DOHC MELCO Shinchang
(LZ) 4.5L OMEGA DOHC MELCO Shinchang
TERRACAN 2.5L DIESEL TCI(D4BH) COVEC,MECHA Shinchang
(HP) 3.5L SIGMA DOHC MELCO Shinchang
2.9L J3 (COMMON RAIL) DELPHI SMARTRA
MATRIX 1.6L ALPHA DOHC BOSCH SMARTRA
(FC) 1.8L BETA DOHC SIEMENS SMARTRA
1.5L D (COMMON RAIL) BOSCH SMARTRA
GK 1.6L ALPHA DOHC BOSCH SMARTRA
2.0L BETA DOHC SIEMENS SMARTRA
2.7L DELTA DOHC SIEMENS SMARTRA
SONATA 2.0L SIRIUS-II DOHC MELCO Shinchang
(EF-B) 2.4L SIRIUS-II DOHC MELCO Shinchang
2.7L DELTA DOHC SIEMENS Shinchang
SYSTEM OVERVIEW

2. System Overview

energy

Transmits
ID code Coil

answer
code

request
ECM code
ICM
SYSTEM OVERVIEW

The immobilizer system is a anti-theft device, designed to prevent and deter

automobile theft

If the ID code transmitted from the key does not match the pre-registered code in
the Immobilizer Control Module(ICM), injection and ignition are not performed by
the engine ECM, thereby disabling the engine. Hence, each vehicle has a set of
keys containing a unique ID code which are registered on the ICM. Therefore, in
addition to the currently available anti-theft systems such as car alarms, the
immobilizer system aims to drastically reduce the rate of auto theft.

This signal is captured by the coil antenna located in the front section of the
steering handle lock and transmitted to the immobilizer control module (ICM).
SYSTEM OVERVIEW

The ICM analyses and verifies the signal to determine if the signal matches the
pre-registered code.

For MELCO systems, if the signal is verified, the ICM transmits a message to the
engine ECM to allow injection. If the signal is not verified by the ICM, fuel
injection and ignition are not performed by the engine ECM. In the case of
SIEMENS systems, once the signal is verified by the ICM, the ECM must also
verify the signal to determine that it matches the pre-registered VIN stored in its
memory. Communication between ICM and ECM communicates through the k-
line of ECM. K-line is also used for the Communication between ECM and scan
tool. There is a relay inside of ICM to switch the communication.
COMPONENTS

3. Components - Transponder
A transponder is incorporated in the head section of the key. The antenna coil
supplies energy to the transponder. The transponder accumulates energy in the
condenser. Once the energy supply from the coil has stopped, using the stored
energy in the condenser, the transponder transmits the ID CODE (stored within
the ASIC).

ASIC
CONDENSER

COIL
COMPONENTS

ID Key - Must be used first to register unique ID

Code in the ICM. This ID code is then recorded
onto the master and sub keys. Both sides of the
key has a Hyundai logo but the color is yet to be
specified.
Master Key - Once the ID Code is recorded onto
the Master Key, this key is for general use. One
side of the key has the Hyundai logo and the other
side has the 'M' symbol. The color of the key is
BLACK.
Sub Key - Similar to the Master key but it is not
possible to operate the trunk and the glove box.
One side of the key has the Hyundai logo and the
other side has a 'S' symbol. The color of the key is
BLACK.
COMPONENTS

3. Components – Antenna Coil

The coil antenna has the following functions.
• supplies energy to the transponder
• receives signal from the transponder
• sends transponder signal to the ICM

It is located directly in front of

the steering handle lock.
COMPONENTS

3. Components – ICM
Immobilizer Control Module (ICM) :
• supplies power to the coil antenna
• receives and analyses signal from the coil antenna.
• transmits signal to engine ECM.
• stores VIN which composes of ID code and password.

If the vehicle equips keyless entry.

ICM
ICM receives a signal from the transmitter
and sends a signal to the ETACS
to operate the door locks.
COMPONENTS

3. Components – ECM
In the Ignition ON position, the engine ECM receives information from the ICM
and permits injection and ignition to take place.
COMMUNICATION

4. Communication
i) Transponder ID Code to ICM.
When Ignition is set 'ON' the ICM receives a request signal from the ECM and
starts ID Code registering sequence.
If the ID code format from the transponder is not correct, the ICM repeatedly
performs the registering sequence.
When the correct ID code format is registered, the code is verified by the ICM.
If the code is not verified, the registering sequence is repeated a maximum of
10 times which is equivalent to 1 second duration.
Once the correct ID code is registered and verified after Ignition is turned ON,
the registering sequence is not re performed until Ignition is turned ON again.
 COMMUNICATION

Communication Time Chart

Normal Communication Error No answer from ICM

Transponder
ID 2-20ms
ID 2-20ms 50ms
ICM Q A

Engine ECM
Q A Q A Q Q A
Max 500ms
approx 54ms
Ignition ON
Key

A - Answer Code Q - Request Code

COMMUNICATION

ii) ICM to ECM

When the ID code from the transponder is verified by the ICM then the
registering sequence is complete and a answer signal is sent to the ECM.
• For MELCO - The ICM sends a START or NO START signal to
the ECM.
• For SIEMENS - The ICM sends VIN number to the ECM to be verified.
If the ICM VIN number does not correspond to the VIN
number of the ECM, then injection is not performed by
the ECM.
COMMUNICATION

iii) IMMOBILIZER and ETACS

Vehicles with both the Immobilizer and ETACS systems do not incorporate a
separate receiver unit. Instead, the function of the receiver is performed by
the Immobilizer.
Simens : Immobilizer receives signal from the remote keyless unit and verifies
signal. If the signal is correct then ICM will send message to ETACS to
lock/unlock doors.
Melco : Verification of the signal from remote keyless unit is accomplished by
ETACS. The function of the Immobilizer is only to receive the signal.
COMMUNICATION

iv) REMOTE KEYLESS UNIT and ICM

Saving Keyless Code
• Turn IG ON.
• Wait 5 seconds.
• Switch the Code Save SW from OFF to SET(ON).
• Push the lock and unlock button together on the Remote Keyless Unit.
• Push the lock or unlock button
• It is now registered on the ICM and ETACS.
• Switch the Code Save SW from SET(ON) to OFF.
• Changing the Keyless Code is performed using the same method.
COMMUNICATION

With Immobilizer IMMOBILIZER Communication

ENG.ECM Diagnosis
(Separated type – Shinchang)

ENG.ECM IMMOBILIZER UNIT

Comm. DATA
K Transfer

Relay control

KWD 2000
K
Scanner
detection circuit

HI-SCAN
/ GST
HI-SCAN OPERATION

5. Hi-Scan - DTC
HI-SCAN OPERATION
HI-SCAN OPERATION

Trouble codes Check items

Key, Antenna Coil,

1. Transponder comm. Error
Wiring(Antenna Coil – ICM)

2. ECM communication link mal. Wiring(ICM – ECM), ICM

3. ETACS RF comm. Error ICM : keyless entry only

4. ETACS C/S comm.error Communication (Transmitter code saver

– ICM) : keyless entry only

5. EEPROM comm. Error ICM

6. ECM Request signal error ECM, Wiring(ICM – ECM)

HI-SCAN OPERATION

5. Hi-Scan – Current Data

HI-SCAN OPERATION

5. Hi-Scan – Password record and change

Password
The password may be used to register master keys in the absence of the ID
key. The password is also used with the ID code to form a VIN number (VIN =
Vehicle Identification Number).
Different to the VIN number for the vehicle. This number is only applicable for
the immobilizer.
All model vehicles have the initial password preset by the manufacturer as
2345.
The initial password is replaced by a password nominated by the owner.
A tester such as HI-SCAN pro must be utilized.
HI-SCAN OPERATION

Once the password has been changed from 2345, the ICM is now ready to
record ID code.
The password is 4 digits long between numbers 0 to 9.
If the owner cannot remember the nominated password without ID Key, the
ICM must be replaced and a new password nominated. Then a tester must be
used to neutralize the link between the ICM and ECM for SIEMENS systems.
A function to read recorded password in the ICM is not available.
HI-SCAN OPERATION
HI-SCAN OPERATION
HI-SCAN OPERATION
HI-SCAN OPERATION

Blocking of Password Input

If you input a wrong password, the ICM will stop

receiving any information for a certain period of time
No of wrong inputs → Freeze time
1 time → 10 seconds
2 times → 20 seconds
3 times → 40 seconds
10 times → 3600 seconds (max)
HI-SCAN OPERATION

5. Hi-Scan – Master Key record and change

i) Initial Registration Sequence

Unregistered

Using ID Key, turn ignition ON then OFF.

Within 10
seconds

ID Key is now registered in the ICM.

Using master key 1 turn Ignition ON then OFF.Master key 1 is now

registered on the ICM. Repeat for master key 2.
Within 10
seconds

Using sub key, turn Ignition ON then OFF.

Sub key is registered on the ICM.

Registration Sequence Complete

HI-SCAN OPERATION
HI-SCAN OPERATION
HI-SCAN OPERATION

2). Using Password

Registration complete status of ICM

Insert new master key. Turn IG ON.

Wait 5 seconds Input password using tester

New master key1 is registered. Remove key.

Insert new master key 2 and turn IG ON then OFF.

New master key 2 is registered. Remove key. Repeat for sub key.

Sequence Complete
HI-SCAN OPERATION
HI-SCAN OPERATION

When you do not have the ID Key,

you can register up to 4 Master Keys using the Hi-Scan Pro
HI-SCAN OPERATION

5. Hi-Scan – Master Key delete

HI-SCAN OPERATION
HI-SCAN OPERATION

5. Hi-Scan – Neutral mode

The immobilizer data within the ECM is neutralized for reuse of the ECM

Turn the Key to IG / ON position

Neutralize used by Hi-scan

Turn the Key to IG / OFF position

Ignition ON / OFF
(Repeat Twice)

ECM Neutralized
HI-SCAN OPERATION
HI-SCAN OPERATION

5. Hi-Scan – Immobilizer reset

This process can only be conducted at HMC

factory and does not concern the A/S sector
CASE STUDY

6. Case Study
Case 1. Master key lost
Additional master keys made using ID key or Password.
It is very important to keep in mind that if additional master keys are
made, previously registered master keys are deleted.

Case 2. All keys lost including ID key

Additional master keys made using password.

Case 3. All keys lost including ID key and password forgotten

The ICM need to be replaced. For SIEMENS systems, the ECM must
be neutralized using HI-SCAN.
CASE STUDY

Case 4. ICM replaced with NEW ICM

The new ICM contains initial password of 2345.
For MELCO :
- Change password
- Register ID Key
- Register master and sub key
For SIEMENS :
- Neutralize ECM
- Change password
- Register ID, Master and Sub key
CASE STUDY

Case 5. ICM replaced with USED ICM

ID key corresponding to OLD ICM available :
- The key will not mechanically fit the key cylinder.
Password corresponding to OLD ICM is known :
- Master keys registered on ICM using password.
Password not known without ID key:
- Used ICM cannot be utilized in this case.

Case 6. ECM replaced with NEW ECM

No effect. For SIEMENS, the VIN number will be recorded when ignition is
turned ON.

Case 7. ECM replaced with USED ECM

For MELCO - No effect.
For SIEMENS - The ECM must be neutralized to erase the OLD VIN number.
FAIL SAFE FUNCTION

7. Fail Safe function

Fail Safe Condition :
1. Unmatched MIN or VIN
2. Transponder Malfunction
Fail Safe Operation : ie. when the password is 2345
The number of IG ON/OFF must coincide with the password.

Over 5s ON 3-10s OFF △T △T △T

ON
start
IG.
OFF
0.2-5s 0.2-3s
IG.ON IG.OFF
LIMP HOME CODE 2 3 4 5
SMARTRA type
Immobilizer
CONTENTS

CONTENTS

1. Application 5. Hi-scan operation

2. System Overview - Current Data
- Password teaching / changing
3. Components
- Teaching
- Transponder
- Neutral mode
- SMARTRA
- Limp home mode
- Immobilizer lamp
6. DTC
4. Communication
7. Reference
APPLICATION

1. Application
Type Applicable Vehicles

ELANTRA (RD) TERRACAN (3.5Gas,2.5TCI)

ATOS X-3 ACCENT
XG GALLOPER
EF-SONATA SANTAMO
SHINCHANG CENTENNIAL (LZ) Y-3 SONATA
SANTAFE(Gas-2.0L,2.4L) H-1
TRAJET(Gas-2.0L) H-100
COUPE (~01MY)

LC ACCENT SANTAFE(2.0TCI, Gas-2.7L)

SMARTRA MATRIX (FC) TRAJET(2.0TCI, Gas-2.7L)
COUPE (02MY~) TERRACAN(2.9TCI)
ELANTRA (XD) GETZ (TB)
SYSTEM OVERVIEW

2. System overview

Transponder Smartra
Antenna Coil

ECM
(Engine Control Module)

Immobilizer Lamp
SYSTEM OVERVIEW

The immobilizer system consists of the ECM, the SMARTRA, the lamp and
ignition keys with built-in transponder.
The ECM carries out the check of ignition key by special encryption algorithm,
which runs in the transponder and in the ECM in parallel.
Only if the results are equal the engine can be started.
The data of all transponder, which are valid for the vehicle, are stored in the ECM.
COMPONENTS

3. Components - Transponder

During the key teaching procedure

the transponder will be programmed
with vehicle specific data.
The vehicle specific data are written
into the transponder memory.
The write procedure is unique; therefore the content of transponder can never be
modified or changed.
The data are a string of 9 bytes defined by vehicle manufacturer.
The transponder memory is split into two strings called authenticator and key
password
After this programming the transponder memory is locked and the data(PIN code)
cannot be read or changed respectively.
COMPONENTS

The transponder status changes from "virgin" to "learnt".

Additionally every transponder includes a unique IDE (Identifier number) of 32 bit.
Unique means that the IDE of all transponder is different from each other.
The IDE is programmed by the transponder manufacturer and is a read-only value.
The authenticator and the key password are not transferred from ECM to
transponder or vice versa.
Only the results from the encryption algorithm are transferred.
It is almost impossible to calculate the vehicle specific data from the encryption
result.
For teaching of keys and special purposes the ECM is connected to the tester
device.
COMPONENTS

The IDE information in ECM is erased by teaching procedure, if ECM is teached

newly.
All key, will be used, have to be registered again through teaching meathod.
Lost key can not start the engine.
Registered Pin code in the key can not be changed.
Used key can not be used again, if the PIN code is changed.
COMPONENTS

3. Components - SMARTRA
The SMARTRA Stands for SMARt TRansponder Antenna.

The SMARTRA communicates to a engine control module via a dedicated

communications line.
The SMARTRA carries out the communication with the built-in transponder of
the ignition key.
This wireless communication runs by RF (Radio frequency of 125 kHz).
COMPONENTS

The RF signal from the transponder received by the antenna coil is converted into
messages for serial communication by the SMARTRA device.
And the received messages from the ECM are converted into the RF signal, which
is transmitted, to the transponder by antenna.
The SMARTRA does not carry out the check of validity of transponder or the
calculation of encryption algorithm.
This device is only an advanced interface, which converts the RF data flow of
transponder into serial communication to ECM and vice versa.
When transponder is insert within
24 degree(figure), it can be recognized
by antenna.
COMPONENTS

3. Components – Imobilizer lamp

The driver is informed about successful authentication
by immobilizer lamp on cluster.
The lamp is on after successful authentication until the
detection of minimum engine speed for ECM operation (begin of engine cranking).
The ECM informs the driver about the limp home condition by 5 times blinking for
5 second
COMMUNICATION

4. Communication
i) Communication between ECM and SMARTRA
During communication of ECM and SMARTRA the K line of ECM cannot be
used for communication.
The ECM controls the communication either to SMARTRA or to other devices
(e.g. Hi-scan Pro) on K line by switching of a multiplexer and specific
communication procedures.

The multiplexer is a part of ECM hardware.

COMMUNICATION

IMMOBILIZER Communication
With Immobilizer (SMATRA)
ENG.ECM Diagnosis

ENG. ECM BCM

Comm. DATA
Transfer

KWD 2000 SMARTRA

K K

HI-SCAN
/ GST
COMMUNICATION

With Immobilizer (Separated type – BCM) IMMOBILIZER Communication

ENG.ECM Diagnosis

ENG. ECM BCM

Comm. DATA
K
Transfer

Relay control

KWD 2000
K
Scanner detection
circuit

HI-SCAN
/ GST
HI-SCAN OPERATION

5. Hi-scan operation
Trouble code is displayed on engine diagnostic trouble code function of Hi-scan
Pro.
Following informations are displayed on immobilizer menu of Hi-scan Pro.
1. current data for immobilizer
2. user password teaching, changing
3. teaching for PIN code
4. neutralize
5. limp home
The diagnosis monitors
- the communication between ECM and SMARTRA,
- the function of SMARTRA and transponder
- the data (stored at ECM) related to the immobilizer function.
HI-SCAN OPERATION

5. Hi-scan operation – Current data

HI-SCAN OPERATION
HI-SCAN OPERATION
HI-SCAN OPERATION

5. Hi-scan operation – Password teaching / changing

The user password is used only for limp home function.
The user password for limp home is taught at service station.
The owner of the vehicle can define a number with four digits.
The user password teaching is only accepted by "learnt" ECM.
Before first teaching of user password, the status of user password is "virgin".
Limp home function is impossible.
The teaching is started by ignition on with a valid key and sending the user
password by tester.
Refer the user password teaching procedure.
After successful teaching, the status of user password changes from "virgin" to
"learnt".
HI-SCAN OPERATION

The learnt user password can also be changed.

This can be done if the user password status is "learnt" and the tester sends for

authorization of access either the old user password or the vehicle specific data.

After correct authorization the ECM requests new user password.

The status remains in "learnt" and the new user password will be valid for next limp

home mode.

If wrong user passwords or wrong vehicle specific data have been sent to ECM three

times, the ECM will reject the request of password changing for one hour.

This time cannot be reduced by disconnecting the battery or other manipulation.

After connecting the battery the timer starts again for one hour.
HI-SCAN OPERATION

The user password can be in the following status

Learnt
The password has been taught successfully to ECM.

Virgin
This is the status at the end of ECM production line before delivery to final
customer.

Locked by timer
After a certain number of incorrect inputs the ECM is locked for one
hour and inputs are not accepted during this time.

Teaching not accepted

This status is set if the ECM is in neutral or virgin status.

The status of ECM defines the possibility of vehicle operation related to the
immobilizer and the teaching of keys.
This status depends on the handling of ECM by tester operation.
HI-SCAN OPERATION

The status of user password defines the possibility of limp home function.
After request from the tester the ECM sends the status information.
The status of ECM is one of the following:
Learnt
At least one key has been taught successfully.

Virgin
This is the status at the end of ECM production line before delivery to final
customer

Neutral
By special command from tester this status can be set.

Locked by timer
After a certain number of incorrect inputs the ECM is locked for one hour and no
inputs are accepted during this time.
HI-SCAN OPERATION
HI-SCAN OPERATION
 HI-SCAN OPERATION

5. Hi-scan operation – Teaching

PIN Code
PIN code is abbreviation of Product Identification Number code.
PIN code is made by special encryption algorithm through the VIN(vehicle
identification number).
PIN code is a unique code for each vehicle.
PIN code is registered in production line.
Also, it can be registered by Hi-scan Pro through the teaching procedure in the
field.
PIN code must be needed when the teaching for ECM and key.
For example,
1. When replaceing with new ECM or used ECM(neutralized ECM)
2. When a key is lost
3. When a key is added
HI-SCAN OPERATION

PIN code is control by Overseas service team or specified dealer for field service.
They have a special program which can find out lost PIN code for each
vehicle.Therefore, send a VIN(vehicle identification number) to above office, if
dealer shop want to know the PIN code.
Wrong PIN code can be registered to new ECM or neutralized ECM.
But, it will make a big problem later because nobody can find out registered wrong
code.
HI-SCAN OPERATION

The key teaching is done at the end of production line, after replacing defective ECM at
service station or for providing of additional keys to the vehicle owner.
The procedure starts with ECM request of vehicle specific data from tester.
The "virgin" ECM stores the vehicle specific data(PIN code), the key teaching can be
started.
The "learnt" ECM compares the vehicle specific data from tester with the stored data.
If the data are correct, the key teaching can be started.
If wrong vehicle specific data have been sent to ECM three times, the ECM will reject
the request of key teaching for one hour.
This time cannot be reduced by disconnecting the battery or other manipulation. After
connecting the battery the timer starts again for one hour
HI-SCAN OPERATION

The key teaching is done by ignition on with key and additional tester command.
The ECM stores the relevant data(IDE->Identifier number) in the EEPROM and in
the transponder(PIN code).
Then the ECM runs the authentication for confirmation of teaching process.
The successful programming is confirmed by message to tester.
If the key is already known to ECM from previous teaching the authentication will
run and the EEPROM data are updated.
There is no change of transponder content (this is impossible for learnt
transponder).
The attempt of repeated teaching of a key, which has been taught already during
the same teaching cycle, is recognized by ECM.
The ECM rejects this key and a message is sent to the tester.
HI-SCAN OPERATION

The ECM rejects invalid keys, which are presented for teaching.
A message is sent to the tester.
The key can be invalid due to faults of transponder or other reasons, which result
into not successful programming of data.
If the ECM detects different authenticators of transponder and ECM, the key is
considered to be invalid.
The maximum number of taught keys is 4.
If an error occurs during the Immobilizer Service Menu, the ECM status remains
unchanged and a specific fault code is stored.
If the ECM status and the key status do not match for teaching of keys, the tester
procedure will be stopped and a specific fault code is stored at ECM.
HI-SCAN OPERATION
HI-SCAN OPERATION
HI-SCAN OPERATION
HI-SCAN OPERATION

5. Hi-scan operation – Neutral mode

HI-SCAN OPERATION
HI-SCAN OPERATION
HI-SCAN OPERATION

5. Hi-scan operation – Limp home

ⅰ) LOCKING OF ECM
By engine shut off (ignition off by key) the ECM is locked after elapsing the timer
8 sec.
ECM accepts new start within this time without considering the result of new
authentication.
In case of engine stalling the timing of ECM locking is as follows:
without ignition off there is no time limit for repeated engine start, after ignition off
the time for repeated engine start is limited to 8 sec.
After elapsing this time new authentication must be performed or in case of limp
home the input of user password is requested again.
HI-SCAN OPERATION

ⅱ)UNLOCKING OF ECM
This is the release of fuel injection and ignition by ECM for successful start of the
engine.
The normal operation is with valid key.
A key is valid after successful programming of vehicle specific data to the
transponder and storing of relevant data of the transponder in the ECM.
After ignition on the authentication procedure starts.
At first the unique IDE of transponder is checked.
If it is equal to one of the transponder known to ECM the authentication procedure
starts.
The authenticator, the IDE and a random number are converted into the
encrypted lock password and transferred to the transponder via the SMARTRA.
HI-SCAN OPERATION

The transponder compares the data with its calculation result.

If the results are equal, the transponder sends back the encrypted key password
to ECM.
If this is equal to the calculation result of ECM, the ECM will be unlocked until
switching off ignition.
The unlocked ECM releases fuel injection and control of ignition.
 HI-SCAN OPERATION

Limp home function implemented to cover faults of transponder or SMARTRA.

1. Twice ignition
2. Limp home by Hi-scan Pro
3. Limp home by ignition key

1. Limp home on virgin status of ECM(Twice ignition)

For special purposes during the vehicle manufacturing process the function
"twice ignition on" is implemented.
The unlocked status remains for the time 30 sec.
After elapsing of timer the ECM is locked again.
By using a valid key a new authentication runs after begin of cranking.
In case of limp home and twice ignition new inputs are requested.
* Twice ignition : Ig. key on --> off --> on, start
HI-SCAN OPERATION

The engine can be started by the sequence

- ignition on with no cranking,
- ignition off,
- ignition on with cranking within a time interval.

The following timing conditions have to be fulfilled for successful start:

- first ignition on less than 1.5 sec
- ignition off time is limited by the minimum of 0.2 sec and the maximum of 1.5 sec
- ignition on and cranking within 30 sec

The following conditions must be fulfilled for unlocking the ECM:

the ECM and the transponder are in status "virgin" and the timing condition is
fulfilled.
HI-SCAN OPERATION

The number of engine starts by "twice ignition on" is limited.

The maximum value is defined by S/W constant (value is 16) and cannot be
modified by application tools.
After exceeding the maximum number no further engine start by this function will
be possible.
Every ignition on/off/on sequence with correct timing is counted even without

cranking.
HI-SCAN OPERATION
2. Limp home by Hi-scan Pro
If the ECM detects a fault of SMARTRA or transponder, the ECM will allow limp
home function of immobilizer.
Limp home is only possible if the user password (4 digits) has been taught to the
ECM before.
This password can be defined by vehicle owner and is programmed at the service
station (See user password teaching).
The ECM informs the driver about the limp home condition by blinking immobilizer
lamp.

Then the user password can be sent to the ECM by Hi-scan Pro menu.

Only if the ECM is in status "learnt" and the user password status is "learnt" and the
user password is the correct one, the ECM is unlocked for the time 30sec.
HI-SCAN OPERATION

The engine can only be started during this time. After elapsing of timer no engine
start is possible.
The number of starts by tester is limited to 255.
If wrong user passwords have been sent to ECM three times, the ECM will reject
the request of limp home for one hour.
Disconnecting the battery or other manipulation cannot reduce this time.
After ignition key “ON”, the timer starts again for one hour.

3. Limp home by Ignition Key

The limp home can be activated also by the ignition key.
The ECM informs the driver by blinking immobilizer lamp about the limp home
condition.
HI-SCAN OPERATION

Then the input of user password to ECM can be done by special sequence of
ignition on/off.
The timing is described on following figure.
Only if the ECM is in status "learnt" and the user password status is "learnt" and
the user password is the correct one, the ECM is unlocked for the time 30sec.
HI-SCAN OPERATION

The engine can be started during this time.

After elapsing of timer no engine start is possible.
After new input of user password the timer 30sec starts again.
After ignition off the ECM is locked (if timer 30sec is elapsed).
For next start the input of user password is requested again.
HI-SCAN OPERATION
HI-SCAN OPERATION
DIAGNOSIS TROUBLE CODE

6. DTC
The following table shows the assignment of immobilizer related faults:

CODE DESCRIPTION

P1610 IMMOBILIZER SMARTRA ERROR

P1800 IMMOBILIZER ANTENNA ERROR

P1801 IMOBILIZER T/P(TRANSPONDER) ERROR

P1803 IMMOBILIZER ECM SIGNAL ERROR

P1805 IMMOBILIZER EEPROM ERROR

DIAGNOSIS TROUBLE CODE

6 – 1 P1610 SMARTRA ERROR

- No signal from SMARTRA to ECM
- Invalid signal from SMARTRA to ECM

Diagnosis Procedure
1) Inspect the power supply and grounding of the system
2) Inspect the circuit between the SMARTRA and ECM
3) Neutralize the ECM
4) Re-register the key under the teaching mode
※ If you are unable to register any key, Replace the SMARTRA
5) Register additional keys (max : 4 keys)

6) Registration completed
DIAGNOSIS TROUBLE CODE

6 – 2 P1800 ANTENNA ERROR

- Antenna Coil abnormal

Diagnosis Procedure

1) Inspect the power supply and grounding of the system

2) Inspect the circuit between the Coil and SMARTRA
3) Neutralize the ECM
4) Re-register the key under the teaching mode
※ If you are unable to register any key, Replace the Antenna coil
5) Register additional keys (max : 4 keys)

6) Registration completed
DIAGNOSIS TROUBLE CODE

6 – 3 P1801 IMOBILIZER T/P(TRANSPONDER) ERROR

- TP data blocked - TP change
- TP data does not exist - Multiple
- TP teaching error

Diagnosis Procedure
1) Inspect the power supply and grounding of the system
2) Inspect the circuit between the coil and SMARTRA
3) Neutralize the ECM
4) Re-register the key under the teaching mode
※ If you are unable to register any key, Replace the transponder
5) Register additional keys (max : 4 keys)
6) Registration completed
DIAGNOSIS TROUBLE CODE

6 – 4 P1803 ECM SIGNAL ERROR

- Invalid ECM request signal
- No/Blocked ECM request signal

Diagnosis Procedure

1) Inspect the power supply and grounding of the system

2) Inspect the circuit between the SMARTRA and ECM
3) Neutralize the ECM
4) Re-register the key under the teaching mode
※ If you are unable to register any key, Replace the ECM
5) Register additional keys (max : 4 keys)

6) Registration completed
DIAGNOSIS TROUBLE CODE

6 – 5 P1805 EEPROM ERROR(ECM)

- Mismatching data
- Unauthorized data
- Unauthorized SMARTRA data recorded

Diagnosis Procedure
1) Inspect the power supply and grounding of the system
2) Inspect the circuit between the SMARTRA and ECM
3) Neutralize the ECM
4) Re-register the key under the teaching mode
※ If you are unable to register any key, Replace the ECM
5) Register additional keys (max : 4 keys)

6) Registration completed
REFERENCE

7. Reference
The following table describes the functions depending on ECM status.
Teaching or
Engine start Engine start by Twice ignition Teaching of
Status changing of
with valid key limp home on function key
user p/word
Yes,with
Virgin NO NO Yes NO
virgin key

Yes, with learnt

Learnt Yes NO Yes
user password

Neutral NO NO NO Yes NO

Locked by
NO NO NO NO NO
timer

The ECM status, the number of valid keys and the status of the inserted key can
be read by tester.
The corresponding communication messages are described on the Hi-scan.
REFERENCE

7. Reference – Things to do when Key & PIN Code are lost

Both Key & PIN code are

Type Only the Key is lost Remarks
lost

▶Replace both ECM & Key ▶Need Hi-Scan & PIN code -Key : 2
-Unable to check the PIN -Select the Neutral Mode -Smartra
code through HMC nor (Neutralizes the ECM data) -Immobilizer Lamp
the regional office -Select Teaching Not applied to
-Register a New ECM & some models like
SMARTRA -Register a new Blank Key
Blank Key XD & MX
-ECM
-PIN code
REFERENCE

7. Reference – replacing of ECM and SMARTRA

In case of defective ECM it has to be replaced by "virgin" or "neutral" ECM.
All keys have to be taught to the new ECM. Keys, which are not taught to ECM,
are invalid for the new ECM.
The vehicle specific data(PIN code) have to be unchanged due to the unique
programming of transponder.
In case of defective SMARTRA there are no special procedures required.
A new SMARTRA device simply replaces the old one.

There are no transponder-related data stored in this device

The ECM can be set to the status "neutral" by tester.

REFERENCE

A valid ignition key is inserted and after ignition on the ECM requests the vehicle
specific data from tester.
Refer to the neutralizing procedure.
After successful receiving of data the ECM is neutralized.
The ECM remains locked. Neither the limp home mode nor the "twice ignition on"
function is accepted by ECM.
The teaching of keys follows the procedure described for virgin ECM.
The vehicle specific data have to be unchanged due to the unique programming
of transponder.
If data(PIN code) should be changed, new keys with virgin transponder are
required.
REFERENCE

7 - 1 When installing used ECM

Repair Procedure

1) When installing the ECM of car “A” on car “B”

2) Neutralize the ECM of car “A”
※ All non-virgin ECM’s need to be neutralized before installing
on other vehicles
3) Install the ECM of car “A” on car “B”
4) Register the keys with the PIN code of car “B”
5) Register additional keys (max : 4 keys)
※ All phases of key registration should be completed within 10 seconds

6) Registration completed
REFERENCE

7 – 2 When replacing keys

Repair Procedure
1) Replace keys and additional registration
2) Turn the key to the IG ON position
※ You must know the PIN code before executing this procedure
3) Initialize the ECM (under the neutral mode)
4) Insert the key you want to register and turn it to the IG ON position
5) Register the keys (under the teaching mode)
6) Register additional keys (max : 4 keys)
※ All phases of key registration should be completed within 10 seconds

7) Registration completed
 REFERENCE

1. When there is only one master key registered and you wish to register another master key,
You need to re-register the master key which was already registered.
2. When the master key #1 is registered and master key #2 is not registered,
Put the master key #1 in the IG/ON or the start position and remove it.
The engine can be started with the unregistered master key #2.
(Note that master key #2 must be used within 10 seconds of removing master key #1)
3. When the master key #1 is registered and master key #2 is not registered,
Put the Unregistered master key #2 in the IG/ON or the start position.
The engine cannot be started even with the registered master key #1.
※Conclusion
When you inspect the immobilizer system, refer to the above paragraphs 1, 2 and 3.
Always remember the 10 second zone.
REFERENCE

1. If the pin code & password are entered incorrectly on three consecutive inputs,
the system will be locked for one hour
2. Be cautious not to overlap the transponder areas

※Problems can occur at key registration

or vehicle starting if the transponders
should overlap as in the picture

※This can be caused by the SMARTRA

& TP conducting radio communication