Subjects:
- Immobilizer Components
- How the immobilizer works
- Key codes and role codes
Immobilizer Components:
When a vehicle is equipped with an electronic immobilizer, it is prevented that it can be driven away inadvertently. The immobilizer module can block the engine management system. Without release, the engine management system will not enable fuel injection and ignition. Vehicles equipped with security class 1 have an immobilizer. There are different versions. The power supply to the fuel pump and the ignition coil control are almost always disabled. The engine then receives no fuel and no spark is produced. This is typical of an engine that stalls after a second of running in combination with a flashing key symbol. It is also possible that the starter motor control is interrupted; the starter motor will not turn.
The immobilizer system consists of the following parts:
- receiver in ignition lock;
- ignition key with built-in transponder chip: when the key is inserted into the ignition lock cylinder, the transponder comes close to the receiver in the ignition. These do not have to make contact, but should be approximately 1 cm apart. Only if the car's control unit recognizes the key code, can it start.
- immobilizer module. This contains the oscillator, the demodulator and a microcontroller. This is also known as the immobilizer.
- engine control unit (ECU).
The image below shows a somewhat older system from a VW Golf IV where the immobilizer IC is integrated with the instrument panel electronics. The instrument panel thus releases the engine ECU as soon as the correct key is recognised. Nowadays, the CAN bus network is often used.
If a key is lost, it is very annoying. A new key must then be ordered. On some luxury cars, this key can be made by number and is automatically recognized by the control unit in the car. Usually a new key also has a new transponder. This must be taught in or programmed with the readout computers of a workshop. The old key codes are removed from the system and the transponder codes of the new keys are added.
How the immobilizer works:
The key code is stored in the transponder's memory in the key. The vehicle's chassis number and the key codes of several keys are stored in the immobilizer module. When the key is inserted into the ignition, the coils of the key transponder and the immobilizer module are close to each other (see figure below). In the immobilizer module, an internal oscillator in combination with the coil provides an energy transmitter. When the car's ignition is turned on, the immobilizer module delivers energy to the coil. The transponder coil thus collects a sinusoidal alternating voltage. The transponder places the key code on this AC voltage, which is then sent back to the immobilizer module.
The demodulator in the immobilizer module reads the key code from the AC voltage. This is called “demodulation”. The key code is sent to the controller. The key code is encoded in the controller before it is sent to the engine-ECU. The engine-ECU checks the coded signal. This creates the following possibility about the received signal:
- incorrect: the fuel supply, ignition and any starter motor control are not released.
- correct: the engine can be started and the engine-ECU is sending a new coded signal to the immobilizer module.
The new coded signal is stored in the controller and will be used the next time the engine is started. The codes between the immobilizer module and engine-ECU keep changing. This “roll code” prevents the engine from being started with a simulated code, if the code were always the same. Multiple keys can also be recognized, each of which has its own key code. The key codes must be taught in the immobilizer module.
Today, the transponder in the key sends a different coded signal to the immobilizer module with every engine start. This prevents malicious parties from reading the key code with receiving equipment and copying the key code. The key code remains intact, but is coded into the key by the electronics. Communication between the immobilizer module and the engine-ECU is often through CAN bus.
Key codes and the role codes:
As explained in the previous section, a role code is used. Each time the engine is started, the signal is re-encoded. The image below shows three keys with the invented key numbers: 121, 163 and 188.
These three codes are stored in the EEPROM in the immobilizer module. When the controller in the immobilizer demodulates a code, the code is checked in the controller. This results in a V (correct) or O (wrong). When the key code corresponds to a code in the EEPROM, it is encoded with a roll code that is already ready (which was stored last time). In the picture that is code “204”. In all other cases, a stall command is sent to the engine-ECU and the immobilizer indicator light comes on or flashes. With a V, the roll code is sent to the engine-ECU. There will be another check. If this check is found to be OK, the engine can be started. If not, the software will be blocked.
After the role code has been approved by the ECU, the code is changed using an algorithm. In the example, 5 is added and the engine ECU sends this code to the immobilizer module. The code 209 then becomes the new code for the next start procedure.
