The immobiliser - The Automotive Technician

The immobiliser
to ECM handshake
by Jack Stepanian and Sam Nazarian
A
Nissan Pulsar N16, 2001, 1.8 litre
was towed in with an engine
that would crank but not start.
The customer had been told (and was
convinced) that the symptom was due
to a crank angle sensor and that it
should be replaced along with a new
cam shaft sensor.
Since the customer was sold on these
solutions, oscilloscope waveforms were
captured and analysed while cranking and
not starting. The sensors were found to be
in perfect condition (pics 1 and 2).
The customer was told that while his wish
to replace sensors could be easily granted
we were just as sure that neither the
cam nor crank sensors were at fault and
a proper investigation would be a better
approach than just throwing parts at it.
So here’s the story of what the handshake
between the immobiliser and engine
control module (ECM) has got to do with
the car cranking but not starting.
By way of prelude, once the customer
agreed to our systematic approach, the
basic checks, like supplies, grounds, fuel
pressure and volume, and air leaks all
came up OK.
Diagnostic trouble code (DTC) P1612
NATS (Nissan Anti-Theft Signal) was
noted, yet the immobiliser warning light on
the dashboard was not on.
A circuit diagram was sourced and we
listed the probable components that
could cause a no-start condition. The
mass airflow sensor (MAF) was OK. It not
only displayed a proper signal but also
reflected healthy induction oscillations of
engine compression and vacuum (pic 3).
So the MAF and the condition of the
engine were ruled out.
Injector and coil trigger signals were
captured (pics 4 and 5) and found to
be spasmodic. While there was injector
signal (injecting fuel) and coil trigger
signal (spark) they were occasional.
Injector pulses were only one millisecond
compared to that of a normal cranking
signal of, say, six milliseconds and the coil
trigger pulses were once every 0.6 of a
second (while cranking). Clearly, the ECM
was holding back from starting. The ECM
multi-pin connector was then exposed
(pic 6) and supply, ground and input
signals were measured. All were OK.
So, since inputs to the ECM were OK,
attention now focused on the NATS DTC
code of P1612.
1.
The immobiliser handshake
In order to increase security and minimise
theft almost all manufacturers now use the
immobiliser control unit (ICU) along with a
transponder chip molded within the head
of the mechanical key (pic 7).
There is no physical connection between
an ICU and the transponder. They are
magnetically coupled to each other.
2.
And as the mechanical key is inserted
into the ignition barrel, the ICU’s
microprocessor energises the coil
wrapped around the ignition key barrel,
thus creating a magnetic field which
awakens the transponder chip (within the
key head) requesting authentication code.
Once the transponder responds
with the correct code the ICU then
transmits the code as a series of binary
coded messages to the ECM, known
as the handshake, thus confirming
authentication. The ECM, on receipt of
this signal, will issue spark, injection
(timing advance and so on) for the car to
start while cranking.
3.
However, should either of the
messages fail, such as:
a) the failure of the authentication
between the ICU and transponder molded
in the key head
4.
b) the failure of the handshake between
the ICU and the ECM
c) car will crank but not start.
But which one was it?
Handshake waveforms
In order to confirm which one was
responsible, a circuit diagram was
sourced and the immobiliser to ECM
handshake signal wire was identified at
the ICU connector as the brown/yellow
wire (pic 8) and waveforms were captured.
5.
However, in order to confirm whether
the failure was due to either of these
possibilities, aluminium foil was wrapped
around the transponder chip (pic 9) thus
creating a magnetic shield between the
ICU and the transponder chip (pic 10).
The Automotive Technician 31
6.
7.
The two were now magnetically uncoupled.
Indeed, the dashboard light came on
(pic 11) indicating a failure had occurred
between the ICU and the transponder. This
too was reflected in the waveform (pic 12).
8.
9.
The foil was then removed, the light on the
dashboard went out and the handshake
binary code also changed (pic 13).
It became obvious that it was the
handshake between the ICU and the ECM
that was being corrupted or misinterpreted
by the ECM. And since the same waveform
was measured at the ECM connector
terminal it was deduced that the ECM
was at fault (not being able to interpret the
handshake message).
12.
10.
The ECM had to be replaced.
A new ECM was installed, the key and ICU
were linked and with the very first crank of
the engine, a sweet roaring sound filled the
workshop. With the captured waveform of
the coil trigger signal (pic 14 – compared
to that of pic 5) it was confirmed that all
systems were OK.
13.
14.
It was a delight to observe the waveform
perform a dance before our eyes – with
proper pulse widths. Pure magic.
11.
Summary
Car makers have become more stringent
with their security protocol. While this
vehicle adopted an authentication check
between the ICU and the transponder chip
by a simple handshake with the ECM,
others use much more sophisticated
protocols such as rolling codes generated
by the ECM. These are only to be
communicated via the CAN BUS system
The full range for the local market
From Mini to Mack
Shock Absorbers by SACHS
(controlled area network bi-directional
SACHS Shock
Absorbers
are trusted
by leauniversal system)
that
in turn
is processed
ding vehicle manufacturers in both pasby myriad control
units
on the vehicles.With
BUS.
senger
and
commercial
the full aftermarket range for cars, utes,
Diagnosticians
should be mindful of the
buses and trucks, SACHS has the application for
protocols used
by various manufacturers.
your vehicle.
Thanks to our sponsors
Happy handshakes.
Sam and Jack
COOL
COMPRESSORS
www.zf.com/au
tat 12.indd 1
check out our online catalogue
It is with this knowledge that a much more
informed diagnosis can be achieved.
Visit the SACHS stand at
the Australian Automotive
Aftermarket Expo,
Sydney, 11-13 April
Stand D26
27/03/2012 11:40:41 AM
www.ozwiderentals.com.au
n"
SM
NatioNal
Workforce
DevelopmeNt
fuND (NWDf)
FUNDING FOR
AUTOMOTIVE
TRAINING
gry
n
" Hu
lea
to C
The full range for the local market
From Mini to Mack
Shock Absorbers by SACHS
SACHS Shock Absorbers are trusted by leading vehicle
manufacturers in both passenger and commercial
vehicles. With the full aftermarket range for cars, utes,
buses and trucks, SACHS has the application for your
vehicle.
www.zf.com/au
tat 13.indd 1
6/02/2013 5:20:16 PM
automotive
businesses
associations
Read
all the latest
productand
news
from our advertisers at http://www.tat.net.au/index_product_news.php or follow the link from the front page of the website
t time. There’s
nothing
worse
having
to make-do with a
are invited
to apply
for than
funding
to support
The
Automotive
Technician
32youof
cause the
salesperson
only told
what
you wanted to hear.
training
their workers
in areas
identified
need. Apply NOw.