Introduction:
When a vehicle is equipped with an electronic immobilizer, it prevents unauthorized driving. The immobilizer module can block the engine management system. Without authorization, the engine management system will not activate the fuel injection and ignition. Vehicles equipped with security class 1 have an immobilizer. There are different versions. Almost always, the power supply to the fuel pump and the activation of the ignition coil are disabled. The engine then receives no fuel, and no spark is produced. This is characteristic of an engine that stalls after a second of cranking, accompanied by a flashing key symbol. It is also possible for the starter motor activation to be interrupted; the starter motor will not turn.
The immobilizer system consists of the following components:
- receiver in the ignition lock;
- ignition key with built-in transponder chip: when the key is inserted into the ignition lock cylinder, the transponder comes close to the receiver in the ignition lock. They do not need to make contact but should be about 1 cm apart. Only if the vehicle’s control unit recognizes the key code can the vehicle be started.
- immobilizer module. It contains the oscillator, demodulator, and a microcontroller. This is also referred to as the immobilizer.
- engine control unit (ECU).
The following image shows an older system from a VW Golf IV where the immobilizer IC is integrated with the instrument panel electronics. The instrument panel grants access to the engine ECU at the moment the correct key is recognized. Nowadays, the CAN bus network is often used.
Losing a key is very inconvenient. A new key must be ordered. In some luxury cars, this key can be made by number and is automatically recognized by the vehicle’s control unit. Usually, a new key also has a new transponder. This must be learned or programmed with the workshop’s diagnostic computers. The old key codes are removed from the system, and the transponder codes of the new keys are added.
Operation of the Immobilizer:
The key code is stored in the memory of the transponder in the key. In the immobilizer module, the vehicle’s chassis number and the key codes of multiple keys are stored. When the key is inserted into the ignition, the coils of the key transponder and the immobilizer module are close to each other (see image below). In the immobilizer module, an internal oscillator, combined with the coil, acts as a power transmitter. When the vehicle ignition is activated, the immobilizer module supplies energy to the coil. The transponder coil receives this sinusoidal alternating voltage. The transponder places the key code on this alternating voltage, which is then sent back to the immobilizer module.
The demodulator in the immobilizer module reads the key code from the alternating voltage. This is called “demodulation.” The key code is sent to the controller. The controller encodes the key code before sending it to the engine ECU. The engine ECU verifies the encoded signal. The following possibilities arise regarding the received signal:
- incorrect: the fuel supply, ignition, and possibly the starter motor activation are not authorized.
- correct: the engine can be started, and the engine ECU sends a new encoded signal to the immobilizer module.
The new encoded signal is stored in the controller and is used the next time the engine is started. The codes between the immobilizer module and engine ECU constantly change. This “rolling code” prevents the engine from being started with a simulated code if the code were always the same. Multiple keys, each with its own key code, can also be recognized. The key codes must be programmed into the immobilizer module.
Nowadays, the transponder in the key sends a different encoded signal to the immobilizer module each time the engine is started. This prevents malicious parties from reading the key code with receiving equipment and copying the key code. The key code remains intact but is encoded by the electronics in the key. Communication between the immobilizer module and the engine ECU often occurs via CAN bus.
Key Codes and Rolling Codes:
As explained in the previous section, a rolling code is used. Each time the engine is started, the signal is re-encoded. In the image below, three keys are shown with the fictional key numbers: 121, 163, and 188.
In the EEPROM of the immobilizer module, these three codes are stored. When the controller in the immobilizer demodulates a code, it is verified in the controller. This results in a V (valid) or O (faulty). When the key code matches a code in the EEPROM, it is encoded with a rolling code already prepared (which was stored the previous time). In the image, this is code “204.” In all other cases, a block command is sent to the engine ECU, and the immobilizer warning lamp lights up or blinks. If valid, the rolling code is sent to the engine ECU. There, another check follows. If this check is deemed satisfactory, the engine can be started. If not, the software will be blocked.
After the rolling code is validated by the ECU, the code is changed using an algorithm. In the example, 5 is added, and the engine ECU sends this code to the immobilizer module. The code 209 then becomes the new code for the next start procedure.