The immobiliser to ECM handshake - TaT€¦ · The Automotive Technician 31 The immobiliser to ECM...
2
The Automotive Technician 31 The immobiliser to ECM handshake by Jack Stepanian and Sam Nazarian A Nissan Pulsar N16, 2001, 1.8 litre was towed in with an engine that would crank but not start. The customer had been told (and was convinced) that the symptom was due to a crank angle sensor and that it should be replaced along with a new cam shaft sensor. Since the customer was sold on these solutions, oscilloscope waveforms were captured and analysed while cranking and not starting. The sensors were found to be in perfect condition (pics 1 and 2). The customer was told that while his wish to replace sensors could be easily granted we were just as sure that neither the cam nor crank sensors were at fault and a proper investigation would be a better approach than just throwing parts at it. So here’s the story of what the handshake between the immobiliser and engine control module (ECM) has got to do with the car cranking but not starting. By way of prelude, once the customer agreed to our systematic approach, the basic checks, like supplies, grounds, fuel pressure and volume, and air leaks all came up OK. Diagnostic trouble code (DTC) P1612 NATS (Nissan Anti-Theft Signal) was noted, yet the immobiliser warning light on the dashboard was not on. A circuit diagram was sourced and we listed the probable components that could cause a no-start condition. The mass airflow sensor (MAF) was OK. It not only displayed a proper signal but also reflected healthy induction oscillations of engine compression and vacuum (pic 3). So the MAF and the condition of the engine were ruled out. Injector and coil trigger signals were captured (pics 4 and 5) and found to be spasmodic. While there was injector signal (injecting fuel) and coil trigger signal (spark) they were occasional. Injector pulses were only one millisecond compared to that of a normal cranking signal of, say, six milliseconds and the coil trigger pulses were once every 0.6 of a second (while cranking). Clearly, the ECM was holding back from starting. The ECM multi-pin connector was then exposed (pic 6) and supply, ground and input signals were measured. All were OK. So, since inputs to the ECM were OK, attention now focused on the NATS DTC code of P1612. The immobiliser handshake In order to increase security and minimise theft almost all manufacturers now use the immobiliser control unit (ICU) along with a transponder chip molded within the head of the mechanical key (pic 7). There is no physical connection between an ICU and the transponder. They are magnetically coupled to each other. And as the mechanical key is inserted into the ignition barrel, the ICU’s microprocessor energises the coil wrapped around the ignition key barrel, thus creating a magnetic field which awakens the transponder chip (within the key head) requesting authentication code. Once the transponder responds with the correct code the ICU then transmits the code as a series of binary coded messages to the ECM, known as the handshake, thus confirming authentication. The ECM, on receipt of this signal, will issue spark, injection (timing advance and so on) for the car to start while cranking. However, should either of the messages fail, such as: a) the failure of the authentication between the ICU and transponder molded in the key head b) the failure of the handshake between the ICU and the ECM c) car will crank but not start. But which one was it? Handshake waveforms In order to confirm which one was responsible, a circuit diagram was sourced and the immobiliser to ECM handshake signal wire was identified at the ICU connector as the brown/yellow wire (pic 8) and waveforms were captured. However, in order to confirm whether the failure was due to either of these possibilities, aluminium foil was wrapped around the transponder chip (pic 9) thus creating a magnetic shield between the ICU and the transponder chip (pic 10). 1. 2. 3. 4. 5.
Transcript of The immobiliser to ECM handshake - TaT€¦ · The Automotive Technician 31 The immobiliser to ECM...
The Automotive Technician 31
The immobiliser to ECM handshake
by Jack Stepanian and Sam Nazarian
A Nissan Pulsar N16, 2001, 1.8 litre was towed in with an engine that would crank but not start.
The customer had been told (and was convinced) that the symptom was due to a crank angle sensor and that it should be replaced along with a new cam shaft sensor.Since the customer was sold on these solutions, oscilloscope waveforms were captured and analysed while cranking and not starting. The sensors were found to be in perfect condition (pics 1 and 2).The customer was told that while his wish to replace sensors could be easily granted we were just as sure that neither the cam nor crank sensors were at fault and a proper investigation would be a better approach than just throwing parts at it.So here’s the story of what the handshake between the immobiliser and engine control module (ECM) has got to do with the car cranking but not starting.By way of prelude, once the customer agreed to our systematic approach, the basic checks, like supplies, grounds, fuel pressure and volume, and air leaks all came up OK. Diagnostic trouble code (DTC) P1612 NATS (Nissan Anti-Theft Signal) was noted, yet the immobiliser warning light on the dashboard was not on.A circuit diagram was sourced and we listed the probable components that could cause a no-start condition. The mass airflow sensor (MAF) was OK. It not only displayed a proper signal but also reflected healthy induction oscillations of engine compression and vacuum (pic 3). So the MAF and the condition of the engine were ruled out.Injector and coil trigger signals were captured (pics 4 and 5) and found to be spasmodic. While there was injector signal (injecting fuel) and coil trigger signal (spark) they were occasional. Injector pulses were only one millisecond compared to that of a normal cranking signal of, say, six milliseconds and the coil trigger pulses were once every 0.6 of a second (while cranking). Clearly, the ECM was holding back from starting. The ECM multi-pin connector was then exposed
(pic 6) and supply, ground and input signals were measured. All were OK. So, since inputs to the ECM were OK, attention now focused on the NATS DTC code of P1612.The immobiliser handshakeIn order to increase security and minimise theft almost all manufacturers now use the immobiliser control unit (ICU) along with a transponder chip molded within the head of the mechanical key (pic 7). There is no physical connection between an ICU and the transponder. They are magnetically coupled to each other. And as the mechanical key is inserted into the ignition barrel, the ICU’s microprocessor energises the coil wrapped around the ignition key barrel, thus creating a magnetic field which awakens the transponder chip (within the key head) requesting authentication code. Once the transponder responds with the correct code the ICU then transmits the code as a series of binary coded messages to the ECM, known as the handshake, thus confirming authentication. The ECM, on receipt of this signal, will issue spark, injection (timing advance and so on) for the car to start while cranking.However, should either of the messages fail, such as:a) the failure of the authentication between the ICU and transponder molded in the key headb) the failure of the handshake between the ICU and the ECMc) car will crank but not start. But which one was it?Handshake waveformsIn order to confirm which one was responsible, a circuit diagram was sourced and the immobiliser to ECM handshake signal wire was identified at the ICU connector as the brown/yellow wire (pic 8) and waveforms were captured. However, in order to confirm whether the failure was due to either of these possibilities, aluminium foil was wrapped around the transponder chip (pic 9) thus creating a magnetic shield between the ICU and the transponder chip (pic 10).
1.
2.
3.
4.
5.
The Automotive Technician 32
Thanks to our sponsors
Read all the latest product news from our advertisers at http://www.tat.net.au/index_product_news.php or follow the link from the front page of the website
The two were now magnetically uncoupled.Indeed, the dashboard light came on (pic 11) indicating a failure had occurred between the ICU and the transponder. This too was reflected in the waveform (pic 12). The foil was then removed, the light on the dashboard went out and the handshake binary code also changed (pic 13). It became obvious that it was the handshake between the ICU and the ECM that was being corrupted or misinterpreted by the ECM. And since the same waveform was measured at the ECM connector terminal it was deduced that the ECM was at fault (not being able to interpret the handshake message). The ECM had to be replaced.A new ECM was installed, the key and ICU were linked and with the very first crank of the engine, a sweet roaring sound filled the workshop. With the captured waveform of the coil trigger signal (pic 14 – compared to that of pic 5) it was confirmed that all systems were OK. It was a delight to observe the waveform perform a dance before our eyes – with proper pulse widths. Pure magic.
SummaryCar makers have become more stringent with their security protocol. While this vehicle adopted an authentication check between the ICU and the transponder chip by a simple handshake with the ECM, others use much more sophisticated protocols such as rolling codes generated by the ECM. These are only to be communicated via the CAN BUS system
(controlled area network bi-directional universal system) that in turn is processed by myriad control units on the BUS. Diagnosticians should be mindful of the protocols used by various manufacturers.
It is with this knowledge that a much more informed diagnosis can be achieved.
Happy handshakes.Sam and Jack
12.
13.
14.
6. 7. 8.
9.
10.
11.
www.ozwiderentals.com.aucheck out our online catalogue
The full range for the local marketFrom Mini to Mack Shock Absorbers by SACHS
SACHS Shock Absorbers are trusted by lea-
ding vehicle manufacturers in both pas-
senger and commercial vehicles.With
the full aftermarket range for cars, utes,
buses and trucks, SACHS has the application for
your vehicle.
www.zf.com/au
tat 12.indd 1 27/03/2012 11:40:41 AM
SM
" Hungry to Clean"
COOLCOMPRESSORS
Buy the right tool first time. There’s nothing worse than having to make-do with a substandard tool because the salesperson only told you what you wanted to hear.
Enough games
The OTC D730P and PC-VCi utilises our knowledge of OE and Aftermarket scantools
to give you great coverage and value.
• Class leading vehicle coverage and depth
• Easy to use operation
• Automatically updates itself (PC-VCi)
• Integrated printer (D730P)
•2YEARSFREEUPDATES
SPX Service Solutions Head Office
Customer [email protected]
03 9544 6222
Mark WhiteSales Executive
VIC/TAS/[email protected]
0400 506 233
Rod GraingerSales ExecutiveNSW/WA/ACT
[email protected] 006 725
Kevin DoveSales Executive
0400 947 116
PC-VCiNextgenerationdiagnostics
Callforademo, the days of finding that a machine only does half of what the salesperson said are over.
D730-P
*Images are for Illustration purposes only, final product may differ somewhat^Prices for a limited time
†Conditions apply
Fullcoveragelistavailable,compareit.
Optional• 4/5GasAnalyser
$5500^+gstIncludes:• 2Channel
Scope• BoreScope
CAPezi-financefrom$31.33†p/w
IntroPrice$3300*+gst
CAPezi-financefrom$18.80†p/w
The full range for the local marketFrom Mini to Mack Shock Absorbers by SACHS
SACHS Shock Absorbers are trusted by leading vehicle
manufacturers in both passenger and commercial
vehicles. With the full aftermarket range for cars, utes,
buses and trucks, SACHS has the application for your
vehicle.
www.zf.com/au
Visit the SACHS stand at the Australian Automotive Aftermarket Expo, Sydney, 11-13 AprilStand D26
tat 13.indd 1 6/02/2013 5:20:16 PM
NatioNal Workforce DevelopmeNt fuND (NWDf) FUNDING FOR AUTOMOTIVE TRAINING
automotive businesses and associations are invited to apply for funding to support training their workers in areas of identified need. Apply NOw.National Workforce Development Fund is an australian Government initiative designed to upskill workers and raise productivity in australia workplaces. applications for new and existing employees can be made through auto Skills australia (aSa) for funding to train in nationally approved qualifications and specific skill sets. Note: a co-contribution from industry is part of this training.
For guidence in accessing funding contact the Workforce Development Team at ASA. Call Jeff Heaney on (03) 8610 2512 or John Scott on (03) 8610 2509 or email: [email protected]
![Op-com Immobiliser Guide[1]](https://static.fdocuments.in/doc/165x107/55cf9bfd550346d033a823bd/op-com-immobiliser-guide1.jpg)
