Section 9.2: Security and Keyless Entry Systems

Security and Keyless Entry Systems

Immobilizer and Keyless Access Principles

Automotive security systems are split into two primary functions: passive theft prevention (immobilizers) and user convenience (remote keyless entry and push-button start).

Transponder Immobilizer Systems

A passive transponder immobilizer prevents engine operation unless a programmed key is detected:

• Exciter Ring: An electromagnetic coil around the ignition cylinder (or start button) that emits a Low Frequency (LF) field (125–134 kHz).
• Transponder Chip: Embedded in the key head. Powered inductively by the exciter ring field, it has no battery.
• Data Handshake: The chip transmits its unique ID to the immobilizer module, which sends a cryptographic challenge. The key computes a response using rolling codes.
• Start Authorization: If the response is verified, the immobilizer sends a CAN bus start authorization to the Engine Control Module (ECM). If invalid, the ECM disables fuel injection or ignition.

Remote Keyless Entry (RKE)

RKE systems operate at High Frequency (315 MHz in North America, 433 MHz in Europe). Pressing a fob button transmits a command containing a serial number and rolling code counter. A receiver module decodes this, validates the rolling code to block replay attacks, and commands lock actuators via the BCM.

Passive Entry Passive Start (PEPS)

PEPS systems provide keyless door entry and push-button starting:

• Detection Zones: LF antennas in handles and the cabin broadcast search signals.
• Fob Response: Entering a zone awakens the fob to transmit a UHF response to the vehicle receiver.
• Triangulation: The BCM compares signal strengths from antennas to locate the fob (inside vs. outside), preventing vehicle start if the fob is outside, or locking keys inside.

Anti-Theft Alarm Systems

Alarms monitor perimeter security (hood, trunk, door switches). High-end systems add volumetric sensors (motion) and tilt sensors. If breached, the BCM sounds the horn/siren, flashes lights, and disables cranking.

---

Diagnostic and Programming Procedures

Common System Failure Modes

• Dead Fob Battery: Prevents LF wake-up. Placing the fob against the backup slot or start button allows inductive powering via the exciter ring to authorize starting.
• LF Antenna Faults: Water intrusion in door handle antennas can short the LF antenna bus, disabling keyless entry detection and triggering key-not-found warnings.
• Radio Frequency Interference: Aftermarket chargers or electronics can block the 315/433 MHz UHF signals, preventing remote operations.

Diagnostic Flow and Sniffer Tools

1. Verify Fob Output: Use an RF signal detector to confirm UHF output. Replace battery if signal is weak or missing.
2. Test Exciter Ring: Use an LED transponder sniffer loop over the ignition switch/button during cranking. If it flashes, the LF exciter field is present.
3. Scan Tool Live Data: Monitor programmed key count, ignition excitation status, transponder authorization, and security lamp states.

Key Programming Requirements

• Security Access: Adding keys requires a manufacturer security PIN obtained via the vehicle VIN.
• Immobilizer-PCM Sync: Replacing modules requires a sync handshake. Without it, the engine cranks but will not start.

---

System Components & Frequencies

---

Real-World Technician Scenario

Case Study: Push-Button Start Inoperative with "No Key Detected"

A hybrid SUV is towed to the shop with a no-start condition. The instrument panel displays "No Key Detected" when the power button is pressed, and the security indicator flashes rapidly.

The technician first verifies if the backup transponder works by holding the fob directly against the power button. The vehicle starts immediately. This confirms that the transponder chip inside the fob and the exciter ring around the start button are functioning, and the fault lies in the active PEPS circuit.

Using a scan tool, the technician reads live data from the PEPS system. A DTC is stored: B1A11 - LF Antenna Circuit Short to Ground. The technician checks the passenger and driver door door-handle antennas. Visual inspection of the driver's door handle reveals corrosion and green crust within the connector pins due to a torn weather seal. The technician cleans the connector, replaces the door handle antenna assembly, clears the code, and verifies that passive entry and start functions work normally without using the backup slot.

---

Section 9.2 Summary & Key Tips

• Backup Slot Start: Always check the owner's manual for the exact backup transponder slot location when diagnosing "No Key Detected" faults.
• Handshake Codes: Immobilizer modules and PCMs exchange unique rolling codes. If they fall out of sync (often due to battery drain during cranking), a key-learn or synchronization procedure is required.
• RF Interference: Inform customers that mounting cell phone holders or radar detectors near the vehicle's interior RF receiver can block fob signals.