12.2 Security, Immobiliser & Central Locking Systems
Key Takeaways
- A transponder immobiliser inhibits at least one of fuel, ignition or starter, so the engine cranks normally but will not run or will start and stall within a second or two.
- The exciter coil around the ignition lock energises a passive transponder chip in the key, so a key with a flat remote battery still starts the engine by transponder.
- Passive entry systems use low-frequency antennas near 125 kHz to wake the key and a radio-frequency link near 315 or 433 MHz for the reply.
- Central locking actuators are reversible DC motors, so a single door failing usually means a broken conductor in the door-to-body harness boot.
- Key programming requires manufacturer security access and usually a timed lockout, and unauthorised bypass of an immobiliser must be refused.
What the Competency Standard Requires
Two competency units inside Repair Comfort and Safety Features cover this ground:
- Repair Security and Immobiliser - start the vehicle to check for any failure, find the failure with a scanner and fix it, and check the condition of the receiver key and replace it if required.
- Repair Center Locking System - check the remote battery with a multimeter, check the fuse module and wiring circuit current flow, and investigate abnormal noise from door lock actuators.
The listed underpinning knowledge names the immobiliser, the immobiliser key coding method and the centre locking system.
How a Transponder Immobiliser Works
- The key contains a transponder chip, a passive device with no battery of its own.
- An exciter coil (antenna ring) surrounds the ignition lock barrel or the start button. When the ignition is switched on, this coil radiates a low-frequency field.
- That field induces enough energy in the transponder for it to transmit its identity code back.
- The immobiliser control unit compares the code against its stored list and, if it matches, sends an authorisation message to the engine ECU.
- Without that authorisation the engine ECU inhibits at least one of fuel injection, ignition or the starter.
The signature symptom: the engine cranks perfectly normally but either will not fire at all, or fires and then stalls within a second or two. That distinguishes an immobiliser fault from a starting system fault, where the engine does not crank properly in the first place.
Because the transponder is passive, a key whose remote-control battery is flat still starts the engine when held at the ignition barrel. That is a useful customer explanation and a fast diagnostic separation between the remote function and the immobiliser function.
Code security
Early systems used a fixed code, which could be captured and replayed. Modern systems use a rolling or encrypted challenge-response code in which the control unit issues a random challenge and the transponder returns a computed answer, so a recorded exchange is useless the next time.
Passive Entry and Push-Button Start
Smart-key systems remove the mechanical action entirely:
- Low-frequency exciter antennas, typically operating near 125 kHz, are distributed around the vehicle: in the door handles, the cabin and the boot. They wake the key and establish where it is.
- The key replies over a radio-frequency link, commonly near 315 MHz or 433 MHz depending on the region.
- The module builds a picture of which antennas heard the key, which is how the vehicle knows whether the key is inside the cabin or outside a particular door.
- A backup transponder coil is built into the start button or a marked slot, so a key with a dead battery can still authorise a start when held against it.
Diagnosing "key not detected"
| Cause | Confirmation |
|---|---|
| Flat key battery | Measure the cell with a multimeter; a CR2032 should read close to 3.0 V and is suspect below about 2.8 V. Test the backup transponder position |
| Radio interference | Try the vehicle away from the original location; nearby transmitters and some chargers block the link |
| Key stored next to a phone or another key | Advise separation and retest |
| Failed low-frequency antenna | Live data shows which antennas detect the key |
| Damaged key from water or impact | Test with the spare key first, always |
Always test with the spare key before condemning any vehicle component. It is the single fastest and cheapest diagnostic step in this section.
Diagnostic Route for Immobiliser Faults
- Observe the security lamp. Most systems illuminate it briefly at key-on and extinguish it once the key is authorised. A lamp that flashes rapidly or stays on signals an authentication failure, and on some vehicles the flash pattern itself is a code.
- Try the spare key. If the spare works, the original key or its transponder has failed.
- Read fault codes from the immobiliser and engine modules. Typical entries name transponder communication failure, key not programmed, or an authentication mismatch between the immobiliser and the engine ECU.
- Check live data for transponder read status and the number of keys currently programmed.
- Check supply and earth to the immobiliser module and the antenna ring. A broken antenna ring wire at the column, or a chafed loom where the column adjusts, is a common physical cause.
- Check the engine ECU authorisation status. An immobiliser that reads the key correctly but cannot reach the engine ECU points to a network fault rather than a key fault.
Key programming: the professional boundary
Adding or erasing keys requires manufacturer security access, normally a PIN or an online security credential tied to the vehicle identification number, and frequently a timed security lockout of several minutes to make brute-force attempts impractical.
Three professional rules follow:
- Verify ownership before programming any key. Legitimate workshops record the owner's identity and proof of ownership against the job.
- Erase lost keys when programming new ones, so a lost key can no longer start the vehicle. Explain this to the customer, because it means every existing key must be present at programming on many systems.
- Never bypass, emulate or defeat an immobiliser to get a vehicle running. Fitting a bypass module or cloning around a fault removes the vehicle's theft protection and may void insurance. Repair the fault instead.
Central Locking
The central locking system is simpler but is where most of the day-to-day faults live.
Architecture. A body control module receives a lock or unlock request from the key remote receiver, the interior switch, the door handle sensor or the key barrel, and then drives a reversible DC motor actuator in each door by reversing polarity for a fraction of a second. Most actuators are current-limited or have an internal clutch so they stall harmlessly at the end of travel.
Additional functions:
- Deadlock or superlock disables the interior handle so a broken window does not allow entry.
- Crash unlock releases all doors when the airbag module reports a deployment.
- Speed-sensitive auto-lock locks the doors above a set road speed.
- Selective unlock opens only the driver door on the first press.
Diagnosing Central Locking
One door fails, the rest work
This is by far the most common complaint, and the cause is usually mechanical wear on an electrical conductor:
- The door harness boot. The rubber concertina between the A-pillar and the door carries every door circuit and flexes every time the door opens. Individual strands fracture inside the insulation, giving an intermittent circuit that works when the door is in one position and fails in another. Peel the boot back and flex the loom while watching the circuit.
- The actuator itself. Listen for the characteristic weak whirr or grinding. Operate the lock manually to check the linkage is free before blaming the motor.
- The latch-integrated switch. Modern latches contain the lock actuator, the ajar switch and the lock-status switch in one sealed assembly, so a single failure can produce several unrelated symptoms in that door.
Test method: drive the actuator directly with a fused jumper, reversing polarity to prove both directions. If it works, the fault is upstream in the harness or the module.
All doors fail together
Check the fuse and the body control module supply and earth, then confirm the module is receiving requests. If the interior switch works but the remote does not, the receiver or the remote is at fault rather than the locking circuit.
The remote
The competency requires checking the remote battery with a multimeter. A coin cell such as a CR2032 should read close to 3.0 V; below about 2.8 V under load the transmitter range collapses, which customers describe as "I have to stand right next to the car". Check also for corrosion on the battery contacts, a cracked circuit board from being dropped, and worn button contacts.
If a remote has lost synchronisation with the receiver after repeated out-of-range pressing, most systems resynchronise automatically when the key is used in the door barrel or the ignition, and others require a documented resync procedure.
Abnormal noise from an actuator
The standard specifically calls this out. Interpret it as follows:
| Noise | Cause |
|---|---|
| Rapid clicking with no movement | Stripped internal plastic gear |
| Grinding | Worn gear teeth or debris in the mechanism |
| Weak, slow whirr | Failing motor, or a low supply from harness resistance |
| Motor runs but the lock does not move | Broken linkage or a detached actuator rod |
| Actuator cycles repeatedly by itself | Water ingress into the latch or a shorted lock-status switch, which also drains the battery |
That last row is worth remembering: a door lock that self-cycles is both a comfort complaint and a genuine parasitic drain, which links straight back to the drain testing method in section 3.3.
Faults the Practical Assessment Likes to Present
- Engine cranks but will not run, security lamp flashing - immobiliser authentication, and the spare key is the first test.
- Remote works at one metre only - flat coin cell.
- One door does not lock, and the interior light stays on - fractured conductors in that door's harness boot.
- Vehicle does not detect the key when parked near a radio mast - interference, not a vehicle fault.
- Locks cycle by themselves overnight and the battery is flat by morning - water in a door latch.
A vehicle cranks normally but will not start, and the security indicator on the instrument panel flashes rapidly. Which diagnostic step should be taken first and why?
A customer reports that only the front passenger door fails to lock or unlock with the central locking, while all other doors operate normally. The actuator operates correctly when driven directly with a fused jumper lead. Where should the technician look next?
Why does a vehicle with a completely flat remote-control key battery usually still start when the key is held against the ignition barrel or the marked backup position on a push-button start system?