Introduction:
When a vehicle is equipped with an electronic immobilizer, it prevents the vehicle from being driven away without authorization. The immobilizer module can block the engine management system. Without authorization, the engine management system will not activate the fuel injection and ignition. Vehicles equipped with security class 1 have an immobilizer. There are different versions. Almost always, the power supply to the fuel pump and the control of the ignition coil are disabled. The engine then receives no fuel and no spark is produced. This is characteristic of an engine that stalls after running for a second, in combination with a flashing key symbol. It is also possible that the starter motor control is interrupted; in that case the starter motor will not turn.
The immobilizer system consists of the following components:
- receiver in the ignition lock;
- ignition key with built-in transponder chip: when the key is inserted into the lock cylinder of the ignition lock, the transponder comes close to the receiver in the ignition lock. They do not need to make contact, but should be approximately 1 cm apart. The engine can only be started if the vehicle’s control unit recognizes the key’s code.
- immobilizer module. This contains the oscillator, demodulator and a microcontroller. This is also called the immobilizer.
- engine control unit (ECU).
The image below shows an older system from a VW Golf IV where the immobilizer IC is integrated with the electronics of the instrument cluster. The instrument cluster therefore releases the engine ECU at the moment the correct key is recognized. Nowadays, the CAN bus network is often used.
Losing a key is very annoying. A new key then has to be ordered. With some luxury cars, this key can be made to number and is automatically recognized by the vehicle’s control unit. Usually, a new key also has a new transponder. This must be taught in or programmed using a workshop diagnostic tool. During this process, the old key codes are removed from the system and the transponder codes of the new keys are added.
Operation of the immobilizer:
The key code is stored in the memory of the transponder in the key. The immobilizer module stores the vehicle identification number (VIN) and the key codes of multiple keys. When the key is inserted into the ignition lock, the coils of the key transponder and the immobilizer module are located close to each other (see image below). In the immobilizer module, an internal oscillator in combination with the coil acts as an energy transmitter. When the vehicle’s ignition is switched on, the immobilizer module supplies energy to the coil. The transponder coil picks up a sinusoidal alternating voltage. The transponder places the key code onto this alternating voltage, which is then sent back to the immobilizer module.
The demodulator in the immobilizer module reads the key code from the alternating voltage. This is called “demodulation”. The key code is sent to the controller. In the controller, the key code is encoded before it is sent to the engine ECU. The engine ECU checks the encoded signal. This leads to the following possibilities regarding the received signal:
- incorrect: the fuel supply, ignition, and any starter motor control are not released.
- correct: the engine can be started and the engine ECU sends a newly encoded signal to the immobilizer module.
The new encoded signal is stored in the controller and used the next time the engine is started. The codes between the immobilizer module and the engine ECU constantly change. This “rolling code” prevents the engine from being started with a simulated code if the code were always to remain the same. Multiple keys can also be recognized, each with its own key code. The key codes must be taught into the immobilizer module.
Nowadays, the transponder in the key sends a different encoded signal to the immobilizer module each time the engine is started. This prevents malicious parties from reading out the key code with receiving equipment and copying it. The key code itself remains unchanged, but is encoded by the electronics in the key. Communication between the immobilizer module and the engine ECU often runs via the CAN bus.
Key codes and rolling codes:
As explained in the previous paragraph, a rolling code is used. Every time the engine is started, the signal is re-encoded. In the image below, three keys are shown with the fictional key numbers: 121, 163 and 188.
These three codes are stored in the EEPROM in the immobilizer module. When the controller in the immobilizer demodulates a code, the code is checked in the controller. This results in a G (good) or F (faulty). When the key code matches a code in the EEPROM, it is encoded with a rolling code that is already prepared (it was stored the previous time). In the image this is code “204”. In all other cases, a block command follows to the engine ECU and the immobilizer warning light will illuminate or flash. In the case of G, the rolling code is sent to the engine ECU. Another check follows there. If this check is satisfactory, the engine can be started. If not, the software will be blocked.
After the rolling code has been approved by the ECU, the code is changed using an algorithm. In the example, 5 is added to it and the engine ECU sends this code to the immobilizer module. Code 209 then becomes the new code for the next start procedure.