Engine Immobilizer: The Next Security Protocol In Automobiles

Introduction: 

 Vehicle insurance companies demanded in the 90’s an effective technical protection against car theft to be developed by the car manufacturers. A primary requirement of the insurance companies was that the anti-theft system should activate itself automatically. Therefore, the car manufacturers developed the self-activating immobilizer system as an electronic anti-theft device. It prevents an engine start with an ignition key unknown to the immobilizer system. This means that the immobilizer function is only deactivated when the ignition is switched on with a registered key and activated automatically when the ignition is switched off.

What is the immobilizer system?

The immobilizer system prevents the vehicle theft by allowing only the authorized key to start the engine. The transponder inside the key communicates with the immobilizer installed in the key box and the system permit the engine to start after confirming the encrypted coding from the engine ECU. The engine immobilizer system is designed to prevent the vehicle from being stolen. This system uses a transponder key ECU that stores the key codes of authorized ignition keys. If an attempt is made to start the engine using an unauthorized key, the ECU sends a signal to the ECM to prohibit fuel delivery and ignition, effectively disabling the engine.In the meantime, the technical progress has produced more sophisticated systems improving the protection against vehicle theft.

BASIC FUNCTIONS OF IMMOBILIZER KEY:

The immobilizer system is a vehicle theft protection device that only allows an engine start with keys that have been registered previously. So it serves to prevent theft by means such as a forged key or electrical 'hotwiring'. 

During operation the engine start is prevented because the PCM (Powertrain Control Module) has not been activated to enable ignition, fuel supply / injection and starter. For their activation, the PCM needs an enable signal that the right key is being used in the ignition lock. 

Therefore, each original key of the car is fitted with a microchip containing a unique Identification number, which is registered in the control module of the immobilizer system. The immobilizer system activates itself automatically when the ignition switch is turned to 'ACC' or 'LOCK' position. The system can only be deactivated with a registered key. 

Depending on the immobilizer type the security light signalizes system activation and malfunctions or only system malfunctions. All immobilizer systems are equipped with an OBD (On-Board-Diagnostic) function to detect, indicate and diagnose malfunctions. 

A detected malfunction can be indicated as a DTC (Diagnostic Trouble Code) by a corresponding flashing pattern of the security light and / or can be retrieved from the immobilizer control module with the aid of the WDS (Worldwide Diagnostic System). 

Door Lock Buttons: 

Lock (Press):

If you press this button briefly, all doors and the tailgate are locked and the theft deterrent mode is activated. When the theft deterrent mode is activated, the hazard warning flashers blink twice. 

Door Unlock/ Panic Button:

1. Unlock (Press) 

If you press this button briefly, all doors and the tailgate are unlocked and the theft deterrent mode is deactivated. When the deterrent mode is deactivated, hazard warning flashers blink once. 

2. Panic function (press and hold) 

If you are in your vehicle and feel threatened while the ignition key is inserted into the key switch, you may activate 

the alarm to call attention. If you press this button, the warning siren will sound. The panic function will stop when any of the buttons on the remote control key is pressed. 

Engine Immobilizer may not work:

1) When two or more immobilizer keys come into contact with each other. 

2) When the key is close to any device sending or receiving electromagnetic fields or waves. 

3) When the key is close to any electronic or electric devices such as lightening equipment, security keys or security cards. 

4) When the key is close to a magnetic or metal object or a battery.In the following cases, a driver may be unable to start the vehicle with the immobilizer. 

OPERATION OF IMMOBILIZER SYSTEM: 

The purpose of the Immobilizer system is to provide additional theft deterrence to the vehicle in which it is installed and to prevent it from being stolen or driven by 

unauthorized users.The transponder sends an encrypted signal to the unit as a response. The transmitted code is changed to an encrypted signal in the unit. The system compares the signal from the transponder and the encrypted signal in immobilizer unit. The verification of the user authorization is done by an ignition key with the integrated transponder. 

 The external LED displays the Immobilizer status and has an additional theft deterrence function. To secure the communication, the status is exchanged between the Immobilizer and the ECM in the encoded data. 

These encoded data is composed of a mixture of random data and two types of fixed code the Vehicle Model Identification Number (MIN) and a Vehicle Identification Number (VIN). 

The MIN is known from the first supply of the system. The VIN is realized by ICU on the special order from the key coding (reading of transponder code and storing it as valid key code in Immobilizer ROM Storage). 

A different random data is computed at each key transition. All the immobilization communication between the ECM and ICU is made on K-line (K-line: Serial data line). Both the ICU and ECM can stay in 3 stable modes 

1) Virgin mode (VIN not encoded) 

2) Learnt mode (VIN encoded) 

3) Neutral mode (for a new VIN encoding) 

In the case of using the valid key, the release message communication with the ECM takes place and the LED displays the Immobilizer status valid key. 

 In the case of using the invalid key,the ECM disables the fuel injector circuit with coded intervention and sets DTC (Diagnostic Trouble Code), the above conditions are maintained until the ignition is switched off. An ECM that is used with an immobilizer, can't be interchanged with the another ECM without an engine immobilizer control unit. 

The Immobilizer control unit and ECM must have a matching ID code. ID coding and key coding are accomplished by using special Scanner

The Immobilizer system consists of:

1) Ignition keys with integrated transponder 

2) The Detection coil for energizing and 

reading the transponder mounted at the ignition lock. 

3) The Immobilizer control unit(ICU) 

4) Power supply 

5) Ignition input circuit 

6) Transponder modulation and demodulation unit 

7) EEPROM 

8) Driver electronic for the external status LED 

9) Serial Data Link hardware 

10) The External Status LED for displaying the Immobilizer 

status 

11) The Serial Data Link between Immobilizer and ECM 

ELECTRONICALLY CODED KEYS:

Each valid ignition key has an internal transponder which is a read /write transponder. The transponder contains an implementation of a crypto code i.e. an algorithm with 96 bits of user configurable secret-key contained in EEPROM and transmits data to the ICU by modulating the amplitude of the electromagnetic field, and receives data and commands in a similar way. 

DETECTION COIL: 

The detection coil is mounted at the ignition lock in front of the key barrel. It is connected to the ICU with a four terminal connector fixed at the body of the coil. The length of the connection between coil and Immobilizer is restricted to 50cm. The correct placement on the ignition lock and the exact electrical data is very important for the reading distance of transponder.

               The detection coil and receiving coil inside the transponder built a transformer. During the reading process, the coil induces energy into the transponder. The transponder charges the field and generates an amplitude modulated a signal with the encoded data. This charge of the field is demodulated inside the Immobilizer. The Immobilizer contains the coil driver hardware for direct the connection of the toroidal coil. 

IMMOBILIZER CONTROL UNIT:

The function of the Immobilizer System is shared between the ICU and the ECM. The task of the Immobilizer Electronic Control unit (ICU) are: 

1) Reading of the input information “ignition ON/OFF” 

2) Controlling the status LED 

3) Controlling the transponder read/write process (modulation, demodulation, decoding, comparison of the read code with the code of the valid keys). 

4) Communication with the ECM after ignition ON (receiving of the ECM-request and transmission of a release message). 

5) Special functions for calculation and handling of the VIN-code. 

IMMOBILIZER ANTI-THEFT SYSTEM:

 

The VIN code is calculated by the Immobilizer using a random generator. The VIN code is transmitted from the Immobilizer in the release message communication only in case of using an authorized key. Without an authorized key, it is not possible to get the system VIN code.In the case of ECM internal the state is in Virgin mode or neutral mode, the ECM learns the system VIN code automatically after receiving the first release response message. 

              To get a synchronized Immobilizer system (the same VIN code in Immobilizer and ECM, authorized key) the DLC 

test equipment has to be used for authorization of the keys(first key coding). The usage of this test equipment is restricted to authorized persons. 

               Main functions of the anti-theft system are the communication with the DLC-test equipment, the key coding procedure, the VIN-code handling and the support for system test functions and handling of the software watch log.

Operation:

In the active mode of immobilizer (engine OFF, IG key OFF) the status LED is blinking as mode A. When the ignition is turned ON, the system wakes up and tries to read out the transponder. 

In the case of the detection of a valid key , The release message communication with the ECM takes place and LED displays the Immobilizer state as 'valid key'. After turning off the ignition(ignition OFF detection similar to the ECM ignition OFF detection), the Immobilizer changes to the active mode. The status LED is blinking as Mode A. 

Data Link Connector (DLC) Mode: 

                When the ignition is on, a scan tool can switch the immobilizer the control unit to the DLC mode for diagnostics, key coding, and ID coding. The status LED is turned off during DLC-mode and the Immobilizer will answer all correct messages, which are defined as Immobilizer messages. 

ID Code Handling 

One of the total VIN codes is stored in the immobilizer EEPROM. The VIN code can be erased by using 'Reset VIN code' command of the scan tool. When the immobilizer controls unit calculates a new VIN code, ECM VIN code should be reset to get identical with the immobilizer control units. 

 During diagnostic procedures, the VIN code can be read for comparison with the ECM, the VIN code by using the scan tool’s “Read immobilizer control unit VIN code” command. 

SERIAL DATA LINK: 

Serial data can be exchanged between a scan tool and the ECM and the Immobilizer control unit. 

ELECTRONIC CONTROL MODULE (ECM):

ECM in Virgin mode 

In this mode, the ECM knows only the model vehicle identifier code. The engine can be locked/unlocked. ECM requests to ICU the VIN number. As soon as the ECM receives two correct consecutive communication frames with the same VIN code the ECM learns it. The VIN code will be stored in non-volatile memory. At the end of power latch phase, ECM enters in Learnt mode. 

ECM in Learnt mode 

In such a state, ECM checks on every communication, the correct encoding of the ICU. If the code received is not correct, then the vehicle is immobilized. The code of data emitted by ECM is a mixture of MIN code and random code. 

ECM in Neutral mode 

This mode is a special intermediate mode, used for ICU replacement or immobilizer option installation. ECM request to ICU the VIN number. As soon as the ECM receives two correct consecutive communication frames with the same VIN code the ECM learns it. The VIN code will be stored in non-volatile memory at the end of power latch phase. ECM enters in the Learn mode. After turning on the ignition the ECM will control the engine in a normal way for starting and running while waiting for a valid release response message from the Immobilizer. 

1. After receiving a response message including the information 'ICU in Learnt mode' and the correct system 

VIN-code, the ECM enters the release state, which allows continuing the running of the engine. 

2. After receiving a response message including the information 'ICU in Learnt mode' and a wrong system VIN-code the ECM does not send a new request and enters the blocked state, which causes the activation of the immobilization actions of the engine. 

SECURITY INDICATOR: 

            There is a security indicator on the instrument panel.