Copyright © [2019] by [MA for auto repair]

All rights reserved.

No portion of this book may be reproduced in any form without written permission from the publisher or author, except as permitted by U.S. copyright law.

This publication is designed to provide accurate and authoritative information in regard to the subject matter covered. It is sold with the understanding that neither the author nor the publisher is engaged in rendering legal, investment, accounting or other professional services. While the publisher and author have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional when appropriate. Neither the publisher nor the author shall be liable for any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential, personal, or other damages.

Book Cover by [MA for auto repai]

Illustrations by [MA for auto repai]

[Edition Number] edition [2019]

1-Introduction to the car's immobilizer system

1.2-History immobilizer system

2- immobilizer System Basics

2.1- Why RFID

2.2- RFID System Selection

2.3- RFID ISO Standards

2.4- Frequency Regulation

3- RFID Systems and Applications

3.1- Low Frequency (LF)

3.1.1- FDX Technology

3.1.2- HDX Technology

3.2- High Frequency (HF)

3.3- Ultra High Frequency (UHF)

4- RFID in Automotive

4.1- Immobilizer System

4.2- System Operation

4.3.1- IMMOBILIZER ECU

4.3.2- ANTENNA

4.3.3- TRANSPONDER

4.3.4- TYPES OF TRANSPONDER

5- Key programming for BMW 520i E39

5.1- How to register a key in a BMW? Introductory information about keys and EWS3 immobilizer.

5.2- The procedure for recording a new key, a BMW car , into the EWS3 immobilizer unit.

5.3- How to register key buttons on a BMW car to control the central locking?

5.4- Additional information on keys for BMW cars, E38, E39, E46 and E53.

6- Key programming for BMW X3 E83 (EWS4.4)

6.1- Reading the firmware from the EWS4.4 immobilizer unit

6.2- programming the key for EWS4.4 of the BMW X3 E83

7- transponder programming for BMW X5 E70

7.1- How to disassemble the ignition key of a BMW E70?

7.2- BMW E-Series. How to make a new one from a used key?

7.3- Are we registering the ignition key for a BMW X5 E70 with a CAS3 system?

8- Car key programming - Honda CR-V RD1

8.2- Honda CR-V RD1. Megamos ID13. ImmoBox 93c46

8.2- Honda CR-V RD1. We make a chip for autorun, using an ImmoBox dump

9- transponder programming for Infiniti QX70 S51

9.1- We calculate PIN Code by BCM number

9.2- Training a new Intelligent Key

10- Key programming for Kia Rio

10.1- How to register a key/chip in a Kia Rio car using Abrites?

11- Key programming for Mercedes M-Class W163

11.1- How to prepare a blank PCF7935 chip for programming it in a Mercedes W163

11.2- How to register a prepared chip in the DAS system of a Mercedes ML320 W163?

12- transponder programming for Nissan Note

12.1- How to register a key/chip in a Nissan Note car?

12.2- How to calculate the PIN code for registering a key/chip in a car?

12.3- How to register a key/chip in a Nissan Note using SBB Key Programmer?

13- transponder programming for Peugeot 206

13.1 Peugeot 206. Algorithm of action in case of complete loss of keys

13.2- Peugeot 206. Prepare the chip and calculate the pin

13.3- Peugeot 206. How to register the ignition key

14- Key programming for Renault Duster Ph2

14.1- Original key for Renault Duster Phase 2

14.2- Chinese key for Renault Duster Phase 2

14.3- Key programming for Renault Duster Phase 2 using Autel MS919

14.4- Key programming for Renault Duster Phase 2 using Renolink 1.87

15- Key programming for Renault Fluence

15.1- How to read the firmware from the BCM of a Renault Fluence car

15.2- How to register a key/key card/chip in a Renault Fluence car

16- Key programming for VW Touareg

16.1- How to register a key/chip in a Volkswagen Touareg using Abrites?

16.2- A few additions:

16.3- What to do if your keys are completely lost?

1-Introduction to the car's immobilizer system

Due to the immobilizer system depending on RFID This section of the book will give you an overview of the basic RFID functionality as well as current and future applications, without going into deep technical details. The information may also help developers from other technology areas, to understand the basics of RFID and to develop efficient concepts and techniques suitable for RFID systems.

Radio Frequency Identification (RFID) is the most reliable way to electronically identify, data capture, control, track, and inventory items using RF communication. Today RFID is ubiquitous having a very broad use but most of the time such systems are invisible or are not recognized by the users.

The basic RFID system consists of a Reader and a Transponder. The Reader or Transceiver is the unit acting as the master and supplies the RFID transponder with energy and triggers the communication signals to force the transponder to execute the requested action. The reader control can be either via a computer terminal or the automatic execution of program scripts. In stationary installations, fixed readers are connected to power and communication lines, whereas in mobile applications, hand held readers (not connected to main power or communication lines) are used. For further data exchange, the reader may be connected to a host computer or database as shown in Fig. 1.

The Transponder or Tag is the identification device which is located on the item to be identified. Most RFID transponders are without an internal power source (battery) and are called passive transponders. The power supply of a tag is the RF field generated by the reader. The tag generates its own supply voltage by rectifying the induced voltage from the Reader’s RF signal. Active transponders have an integrated power source (internal battery) and behave the same way as passive devices but with increased performance. These tags are using the battery to supply the circuitry and to generate the response data. Their activation is mostly triggered by the reader signal.

1.2-History immobilizer system

RFID technology developments started back in the 1950s where these systems were developed specifically for Governmental and Military use in USA and USSR. Semiconductor technologies at that time were in their infancy and devices were large in size with high-current consumption and expensive, which did not recommend their use for passive RFID systems. The real explosion of passive RFID technology was at the end of the 1980s and was made possible by the improved size, current consumption of the circuitries, and price of semiconductor technologies. This enabled an acceptable RFID performance (communication distance) for passive systems under acceptable investment.

The first generations of RFID tags were only used as identification devices, having only a fixed identification code stored into the tag’s memory. There was mainly a one way communication with the tag communicating back its memory content when triggered by reader activation. An example of an early RFID system patent from Mario Cardullo is shown in Fig. 2.

Now RFID systems are widely used in applications with the primary task to identify items, but there are also new applications where higher security and computation as well as integrated sensors and actors are required. Due to the current cost structure of RFID systems, new application fields can be justified based on Return of Investment (ROI).

2- immobilizer System Basics

Transponders basically operate as active or passive devices. The functionality of both types is similar; the main difference is the increased performance in view of communication distance and computation capabilities of the active vs. the lower cost of the passive transponders. The integrated battery increases the cost of the transponder, limits the tag’s life time, causes environmental issues over disposal, and limits the form factor and thickness of the tag. These disadvantages of the active transponders limit the applications where these tags can be used. Due to the very high market share of the passive technology, only this technology will be presented in the following sections.

The transponder mostly acts as a slave and relies on the reader to activate it using the “Reader Talks First” (RTF) concept. The reader supplies energy via the RF field and transmit requests/commands to instruct the transponder about the action to be executed. The transponder receives and decodes RF signals coming from the reader, executes the instructed action, and may respond with data or status information. The cost structure of the transponder can be roughly split in costs for IC, antenna, assembly, and test. The electronics part (IC, Integrated Circuit) of the transponder consists of some basic functional modules which are used to enable certain functionality as shown in Fig. 3

The induced voltage is rectified by the Rectifier to supply the IC with energy.

• The Limiter limits the RF voltage at the inputs pins to avoid over voltage which would destroy the circuitry.

• The Clock Regenerator extracts the frequency signal from the RF signal which is used as an internal clock.

• The Demodulator decodes the incoming data signal and generates a binary bit stream representing the command and data to be executed. These data are used by the IC to execute the requested activities.

• The Modulator modulates the decoded response data.

• The Logic part represents the microcontroller or digital circuitry of the transponder.

• The Memory unit (mostly EEPROM) contains the transponder specific data as well as additional memory where application specific data can be programmed.

2.1- Why RFID

In the past, the most used identification system has been the barcode. The main reason for the wide usage of this system is the low cost of a barcode by simply printing it on the items and the improved performance (detection rate, and reliability) of the new generation of scanners. There are still some disadvantages of this technology though:

• Data cannot be modified or added

• Requires line of sight for operation (label must be seen by the reader)

• High maintenance effort for the complex scanner optics

Modern application processes like item tracking, require extended capabilities of the ID system which cannot be achieved by the barcodes. In these applications, RFID systems can add value through extended functionality. This should not be misunderstood to imply the complete replacement of barcodes by RFID. RFID is an alternative to barcodes which will lead to a coexistence of both technologies based on the performance and capability requirements and the specific investment to use the RFID technology for these applications. Most applications will require the use of both, barcode and RFID in parallel.

Summarizing the advantages of the RFID systems in relation to other identification systems currently in use and especially barcode:

• Battery-less. Supply voltage derived from the RF field

• No line-of-sight required for the communication

• Large operating and communication range

• Read and Write capability of the transponder memory

• High communication speed

• High data capacity (user memory)

• High data security

• Data encryption/authentication capability

• Multiple tag read capability with anticollision (50–100 tags)

• Durability and reliability

• Resistant to environmental influence

• Reusability of the transponder

• Hands free operation

• Miniaturized (IC size <1mm2)

• Very low power

2.2- RFID System Selection

“The Universal” RFID system which covers all application requirements does not exist. The selection of the right RFID system for a specific application is difficult and depends on a number of factors to be considered. The final solution may be something of a compromise between the various parameters and will represent the “best fit.” The most important system parameters are frequency, communication range, and cost.

The choice of the right frequency mainly dictates the communication range and data rate based on the existing regional or worldwide regulations. The right frequency choice in combination with the required features (e.g., memory size, security, etc.) will dictate the design complexity. This complexity will be translated in chip size on the tag side, and associated cost. Due to the high ratio between readers and transponder used in the application, low transponder costs are essential.

For the implementation of RFID technology, additional parameters like standards and system coexistence must be considered (Fig. 4). The use of application and technology standards enables, a multiple sourcing of the system components and the use of lower cost “of the shelf” products. In cases where an installed base already exists, the coexistence (operation in parallel without interfering each other) of the systems must be considered.

2.3- RFID ISO Standards

From the beginning of RFID and until a few years ago, most of the companies involved developed their own systems, trying to improve the technology performance to cover specific customer/application needs. All these solutions were based on similar concepts, but smaller differences especially in the frequency and data coding lead to interoperability issues of these technologies in the field and a “monopoly” for the component sourcing. Users were bound to a single supplier with all the disadvantages related to a single source.

Users and RFID manufactures recognized that this situation could not help to enter new high volume applications where competition, multiple source, and interoperability are the main requirements. The best way out of this situation was to define International Organization for Standardization (ISO) standards [11]. Standards

may not provide the optimized cost and performance and mostly represent a compromise over all the available systems, but can guarantee the minimum functionality and interoperability at least for the majority of the applications.

The most important RFID Standards defining communications cover the following applications:

• Animal identification

• Item management

• Logistics

• Access control

• Smart cards

• Payment

• e-Passports

• Waste management

Low Frequency Standards 134.2/125 kHz:

• ISO11784 – Animal ID code structure

• ISO11785 – Animal ID technical concept

• ISO14223 – Animal; Advanced transponders

• ISO18000-2 – Item management; Air interface and protocol structure for LF

High Frequency Standards 13.56 MHz:

ISO/IEC15693 – Vicinity cards;

ISO/IEC14443 – Proximity cards;

ISOIEC18000-3 – Item management; Air interface and protocol structure for HF

Ultra High Frequency Standards 868/915 MHz:

ISO/IEC18000-6 – Air interface and protocol structure

EPC Gen 2 – Air interface and protocol structure (ISO18000-6C) [5]

There are also some additional standards available defining the Air interface

communication at other ISM frequency bands which mainly cover some niche applications.

2.4- Frequency Regulation

To allow the use of radio frequency communication without interference from other services, the frequency spectrum has been split in spectrum bands and assigned to specific services which are allowed to operate within that spectrum. These are called primary services, like cell phone, astronomy, broadcast, etc. The frequency spectrum is managed by the different national and international organizations like ITU [12], FCC [8], ETSI [7], CEPT [3], ERO [6] etc. In addition to these primary user bands there are some frequency bands defined which can be used by different services. These bands are called industrial, scientific and medical (ISM). RFID is not assigned as a primary user of a particular frequency band, and is only allowed to operate within these general use ISM bands. The most important ISM bands for RFID systems are following frequency bands: 125/134 kHz, 13.56 MHz, 868/915 MHz, 2.45 GHz, and 5.8 GHz (Fig. 5).

There is not an ideal operating frequency, which can cover all application requirements. Every frequency has its pros and cons, which are given by the properties of the frequency itself but also given from the regulation restrictions (level and bandwidth).

3- RFID Systems and Applications

RFID systems [10,15] operate mainly in three frequency bands which are worldwide available.

• LF – Low frequency

• HF – High frequency

• UHF – Ultra high frequency

3.1- Low Frequency (LF)

A large variety of applications are using LF frequency for the RF communication (Fig. 6). Two basic systems dominate this band, FDX (Full Duplex) and HDX (Half Duplex). The communication concept of these systems is different, but due to their properties, both systems can coexist without interfering with each other. LF systems use the magnetic component of the electromagnetic field.

At low frequency, the antenna volume and the form factor mean that tag volumes may be higher than for tags in higher frequencies but this allows for higher flexibility and variations in the antenna design. The typical operating distance under normal operation is around 1m.

The applications with the highest volumes are animal identification, vehicle immobilizers, access control, and leisure applications. The main tag form factors are cards for access control, discs for industrial process control, and ear tags and glass encapsulated transponders for animal identification. Glass transponders are used for injection into pets and fish, as well inside boluses for ruminant animals.

3.1.1- FDX Technology

FDX systems use a communication concept, where, at the same time as the transponder is supplied with energy by the readers’ RF field, the RF field is modulated by the transponder modulator circuit. The field modulation is in accordance with the data to be transmitted to the reader. Typically the FDX systems use amplitude shift keying (ASK) as their modulation concept. The communication concept is shown in Fig. 7.

The characteristics of the FDX technology are:

• RF frequency is used as system clock. No internal oscillator is needed

• Simple, low cost implementation

• Optimization of “Reader to Tag” and “Tag to Reader” communications cannot be done. The final adjustment of the system is a compromise between the two communication directions

• The system may be further compromised by using lower quality factors for the resonance frequency circuits

• High signal to noise (S/N) ratio of the ASK modulation can result in reduced performance and communication reliability

• The simultaneous presence of the strong reader RF signal and the weak transponder response signal (about −60dB) means that readers have to use sophisticated methods to extract the response signal from the field. The bit error rate of this communication concept and data modulation is quite high

• Minimum number of components for the transponder (antenna and IC)

Due to the continuous RF signal during communication, the system does not need an additional external storage capacitor (CS) for operation, but some of the systems use an external resonance capacitor (CT) parallel to the antenna (LT). Due to the low capacitance of the resonance capacitor, this capacitor can be integrated in the IC.

3.1.2- HDX Technology

HDX systems  use a communication concept, where the transponder energy supply and the response data communication take place sequentially. HDX systems use frequency shift keying (FSK) modulation for the data communication from the trasponder to the reader. The main difference between FDX and HDX systems is that the HDX system needs a storage capacitor (CS) to store its energy for operation, before the response of the data. During the so called “Charge Phase,” the readers’ RF field induces energy in the transponder which is stored in the charge capacitor. After the charge phase, the reader switches off the RF field, and the transponder sends the response using the charge capacitor as an “internal” power source. The communication concept is shown in Fig. 8.

The characteristics of the HDX technology are:

• RF frequency cannot be used as system clock. An internal oscillator or clock generation is needed.

• Sophisticated implementation concepts are needed.

• Optimized performance for the Reader to transponder communication, which means High Quality factor resonance circuits can be used on the reader and transponder side, allowing higher induced voltages on the tag side.

• During transponder to Reader communication (RX) the quality factor of the resonance circuit of the reader is switched to a lower value, optimizing the bandwidth for higher data rate communication. The adjustment of the system can be optimized for both communication directions.

• The system performance can be improved by use of higher quality factors for the resonance frequency circuits.

• The S/N ratio of the FSK modulation is lower and therefore the reliability of the reception of the return signal is higher.

• The absence of the strong reader RF signal and the associated noise during the response means a simple reader can be used and the bit error rate is quite low.

• It needs external storage capacitor, which due to the required capacity of 100– 300 nF cannot be integrated (Fig. 9).

Examples of LF transponders with different form factors are shown in Fig. 10 and Fig. 11.

LF readers Fig. 12 are available as mobile readers with internal antenna and stationary readers with external antennae.

3.2- High Frequency (HF)

HF systems operate at 13.56 MHz, using mainly the FDX communication concept as used for LF systems. HF systems also use the magnetic component of the electromagnetic field to transfer energy (Fig. 13).

Due to the higher frequency, there are some advantages compared with LF, such as the ability to have higher data rates. Due to higher resonance frequency of the antenna circuit, the inductance and the capacitance values used in the resonance circuit can be reduced. The lower antenna inductance of the transponder means a fewer number of turns (5–10) (Fig. 15) (compared to 200–300 turns for the LF systems), gives the possibility of being produced not only from copper wire but also printed or etched on foil. These antennas are flexible and can be easily laminated in a credit card or label form factor. These basic advantages lead to a lowered cost for the system.

There is a variety of HF application. The higher volumes applications are banking/ payment, [4] credit cards, access control, ticketing, item tracking, library, laundry, drug pedigree (Fig. 16) and authentication, and supply chain management. The typical operating distance under normal operation is about 0.7 m.

The main tag form factors are PVC cards, paper labels, and encapsulated tags. The credit card sized tags (Fig. 15) are used for payment and payment applications as well as access control and ticketing. Tags laminated in paper are mostly used for item tracking and ticketing. Encapsulated tags (Fig. 17) are used for applications like Laundries, where these tags have to withstand in the rough environmental conditions such as humidity, temperature, and chemicals. The communication concept of HF systems is shown in Fig. 14.

The characteristics of the HF technology are:

• The carrier frequency is used as system clock. No internal oscillator needed.

• Simple, low cost transponder.

• Higher data rate capability.

• Support of simultaneous identification of transponders (see Fig. 16) based on collision avoidance protocols.

• The simultaneous presence of the strong reader RF signal and the weak tag response signal (about −60dB) means that reader has to use sophisticated methods to extract the response signal from the field. The bit error rate of this communication concept and data modulation is quite high.

• Minimum number of external components (only antenna and IC, Fig. 15).

• Flexible tags on foil, which can be laminated (PVC or paper, Fig. 15).

• Worldwide regulation of frequency and power levels.

The transponder is supplied with energy by the continuous presence of the RF signal during communication; therefore the system does not need an additional external capacitor to store energy for operation (Fig. 14). Due to the low capacitance of the transponder resonance capacitor (CT), this can be integrated in the IC. In that case, the components needed are an IC and an antenna (Fig. 14).

3.3- Ultra High Frequency (UHF)

UHF systems operate in the frequency bands of 866–868MHz in Europe, 902– 928MHz in USA, and 952–954MHz in Japan. The electric component of the electromagnetic field is used for energy propagation with backscatter modulation used for the tag’s response (Fig. 19).

The regulation of the UHF frequency band and power levels is different depending on the region of operation. This complicates the design of the systems which must have the ability to operate in different frequencies.

The antennas used in UHF systems are typically dipole antennas. These antenna can be linear or circular polarised depending on the application. Dipole antennas are directional and do not radiate uniformly in all directions. These antennas are normally etched on foil or printed and can be made very small, at a lowest cost.

One of the characteristics of UHF systems is the so-called “Multipath signal transmission”: The signal radiated by a reader may arrive at the tag by different routes. Depending on the object materials (floors, roof, walls, etc) in the operating range, the signal may be reflected, and may arrive at the tag at a slightly different time to the direct signal. This effect may cause field nulls (signal disappears) and field peaks (signal amplified) which influences the system operation. In addition, the signal may be absorbed (signal disappears) by the environment.

At the UHF frequency, tags are also sensitive to materials on which they are attached. This influence can affect the system operating performance, and can be mostly overcome by tuning/selecting the tags for the particular material.

The operating range of the UHF systems depends mainly on the regional regulation

(frequency, bandwidth, channels, and power level). The typical operating distance under normal operation is in the range of 1–6 m. The operating concept is shown in Fig. 20.

The UHF system became very popular after the implementation of the “Gen2” system protocol defined by the Electronic Product Code (EPC) organization [5]. These activities are supported by large worldwide operating retailers likeWal-Mart, Metro, Tesco, Marks & Spencer, etc. The main applications targeted by the Gen2 system are the Supply Chain applications, Item management, and Logistics. Currently the growth in Gen2 protocol implementations is only modest partly because the cost expectation <$0.05 for a complete tag cannot be achieved within today (Figs. 21).

4- RFID in Automotive

Automobile theft has increased year by year creating demands for extra vehicle security systems beyond the mechanical key. Especially after boarders with Eastern Europe fell in the 1990s, automobile theft has increased dramatically. European insurances companies required immobilizer systems to decrease theft rates.

Different systems appeared on the market such as locks with pin codes and electronic contact sticks, besides the mechanical key. Systems with RFID transponders appeared to be most convenient for the user because they did not require an additional process to start the engine, they were transparent to the user, and the RFID transponder operated battery-less. Since the adoption of the immobilizer system with RFID transponders the automobile theft rate decreased continuously in Europe. Immobilizer systems are now used worldwide and the majority of new cars are equipped with immobilizer systems based on RFID technology. Immobilizer systems were the first high volume application for RFID.

4.1- Immobilizer System

An immobilizer system (Fig. 23) consists of an RFID transponder (Fig. 25) and an RFID transceiver to communicate with the transponder. The transponder is encapsulated in the mechanical key and the transceiver is located typically close to the mechanical key lock at the steering column. The communication between transponder and transceiver is typically controlled by the dash board control unit or engine control unit.

Immobilizer systems operate at low frequency of 120–140 kHz. The transceiver module is mounted at the ignition lock cylinder and the air coil antenna is mounted around the ignition lock cylinder (Fig. 24). The transceiver module contains mostly just an RFID reader ASIC and a few external components. Because of the short communication range requirements of 1–5 cm, both systems FDX and HDX are commonly used. The communication time is unrecognized by the driver because it is well below 100 ms.

4.2- System Operation

The driver places the ignition key into the ignition lock cylinder and turns the key. Not recognized by the driver the communication between transponder and transceiver is initiated by the control module. After successful verification of the key the engine is started.

fixed code transponder 

The first generation of immobilizer systems used fixed code transponders. Two types of transponder were used for fixed code systems – Read Only (R/O) and Write Once Read Many (WORM). Read-only transponders are factory programmed by the transponder manufacturer with a unique number where no duplicate is allowed. WORM transponders are programmed by the system supplier with a non-unique number. Duplicates of such transponders can easily be made by programming of “blank” transponders with commercially available RFID readers.

password-protected transponder

A different approach to increase the security level of the immobilizer system is to use a password-protected transponder. The transponder responds only after the reception of valid password. Typical passwords used have a length of 8–32 bits. Advantage of this approach is that a transponder is secured against activation away from the vehicle. An attacker may attempt to guess the password until the transponder responds. This is quite easy if the password is just 8 bits but gets time consuming if a password is 32 bits when each attempt has a communication time of 100 ms.

challenge–response authentication technology 

Today’s immobilizer systems use challenge–response authentication technology with encryption key length of 40–96 bits. A random challenge number is sent to the transponder. After calculation with an encryption module the transponder replies with the encrypted response. The control module verifies the correctness of the response

signal before starting the engine.

In future, immobilizer systems require longer encryption keys. Across all car manufacture it seems that the Advanced Encryption Standard (AES) with 128-bit key length is the preferred encryption algorithm. Furthermore AES will also be used for authentication of modules inside the vehicle.

4.3- THE STARTING IMMOBILIZER SYSTEM

The starter immobilizer consists of an electronic passive and anti-theft security system of current vehicles. The principle of operation of the system is the reading of confidential data contained in a transponder, a central electronic system sends a magnetic signal through an antenna that reads the data contained in the transponder and compares it with the data in its internal memory, the correct data being the vehicle's starting and released, if not, blocked.

In case of failure or loss of keys, an emergency start is possible. The procedure will be described in each system and assembler in the chapters that follow. The main components of the immobilizer system are:

4.3.1- IMMOBILIZER ECU

The immobilizer system control module is programmed to send an electrical signal that energizes the antenna coil , creating a magnetic field that surrounds the transponder, thus reading its data, and later comparing this data with its internal memory, programmed with the same data as the transponder.

Once the data is correct, the immobilizer ecu sends a release message to the electronic injection ecu. Otherwise the immobilizer ecu will send an error message, and the system will enter an emergency, in some systems there is a pilot warning lamp on the condition of the immobilizer. The immobilizer module can be a separate ecu or incorporated in the instrument panel or also in the body control module.

Example of immobilizer built into the instrument panel. (fig25).

(fig25).

Example of immobilizer incorporated into the body control module (fig26).

(fig26)

4.3.2- ANTENNA

The antenna consists of a coil, which has the function of sending and receiving data from the transponder. This coil is strategically installed in the ignition contact, where upon receiving electrical impulses, it produces a magnetic field that interacts directly with the transponder. (fig27)

(fig27)

4.3.3- TRANSPONDER

Transponder is a short for . transmiter-responder. The word was invented around 1944. In basic terms a transponder is a miniaturized electronic chip that has what is called nonvolatile memory. Nonvolatile memory is the type of memory that deos not need constant energy for retention. Along with that electronic chip is a set of windings, very fine wire coiled around the tube. This widings look similar to the windings you would find in a electric motor

There are types of transponder. The first are the electric coupled transponder systems. Electric coupled transponder systems are not limited to small areas for transmissions but can transmit messages or signals for different ranges of distance including several inches to miles. As used in satellites and airplanes. This systems require constant electricity to operate.

The seconde type is what automobile manufacturer are using and they are called magnatic coupled transponder systems. Magnatic coupled transponder systems are passive in nature. This means they do not require canstant electricity and thus do not need a power source of their own. They operate in the frequency range area of 125khz, in most cases since magnatic coupled transponders do not have their own power source they are very limited to range of communication and generally operate in the range of 1cm to 15cm, since this is a radio frequency it can penetrate materials that would make the transponder not directly visible. Such as the plastic or rubber in the bow of the key.

The prrocess of identification is similar in most automotive trasponder systems. Once a key is inserted into the ignition lock and turned to one on or run position, the induction coil that is mounted around the ignition lock sends out an electromagnet field of energy. The windings in the transponder chip absorb that energy and power the electronic chip to emit a signal. The signal is usually an alphanumeric set of digits which is considered the identification code. The induction coil reads the signal and sends it to some type of computer device to recognize the signal. If the signal is recognized as bieng already in the computers memory the signal is accepted and other electronic components in the vehicle are set into motion to allow starting of the vehicle or the continuation of engine running.

Transponder can be made into several different shapes and sizes and can be used in many different types of application sach as : warehouse pallets, retail clothing, animal management, and of course electronic automobile key identification. 

4.3.4- TYPES OF TRANSPONDER

TEXAS - This is one of the two transponder chip models from TEXAS. This transponder chip can be found on the car keys of the brands Chrysler, Dodge, Infiniti, Jeep, Lexus, Mazda and Toyota. (fig29).

(fig29).

TEXAS 2 - This is another model of TEXAS transponder chip. This transponder chip can be found on Ford, Lincoln and Mercury car keys. (fig29).

(fig29). 

PHILLIPS - This is the PHILLIPS automotive transponder chip. This transponder chip can be found on the car keys of the brands BMW, Cadillac Catera and Mercedes. (fig30). 

––––––––

(fig30).

MEGAMOS - This is the MEGAMOS automotive transponder chip. This transponder chip can be found on the car keys of the brands Acura, Buick, Honda, Jaguar, Porsche and Cadillac Seville. (fig31). 

(fig31).

PHILLIPS CRYPTO GM - This transponder is used in most GM vehicles, its structure is composed of two blocks, the first one we can call it ID which is identification of the chip. Second block is encrypted and the data is transferred from the vehicle to the transponder. (fig32). 

(fig32).

PHILLIPS CRYPTO VW - This transponder is used in some VW and Seat vehicles, such as the Classic Pole, Inca, Van and its structure is composed of two blocks, the first one we can call it ID which is identification of the chip, the second block is encrypted and data is transferred from the vehicle to the transponder. (fig33). 

(fig33).

CLONING - This transponder, also called Universal, is used for cloning and receives protocols from Philips, Megamos, Motorola and Temic. (fig34). 

(fig34)

5- Key programming for BMW 520i E39

BMW 520i E39 1999 (manual transmission, left hand drive, EWS3). We have one working key and a key that we have to register in the car.

In order to register a key in a BMW , you will need an Abrites diagnostic tool and an Xprog-M chip programmer .

5.1- How to register a key in a BMW? Introductory information about keys and EWS3 immobilizer.

In the photo you can immediately see how the original key (on the right) differs from the non-original key (on the left).

In addition, if we disassemble the non-original key, we will see in it:

  Regular transponder PCF7935 (chip)

  Key fob board for controlling the car's central locking

  A battery that will not charge from the ignition switch antenna.

In the original BMW car key , everything is completely different.

We connect Abrites and Tag Key Programmer to the computer, read data from both keys.

This is what a dump of the original key of our BMW 5-series E39 looks like .

And here is a dump of a clean PCF7935 with which we will work.

Starting to describe the key binding procedure, I would like to mention the following point. In BMW cars , in the bodies of E38 , E39 , E46 and E53 , the EWS 3 immobilizer unit was mainly installed . So, initially, from the factory, 10 keys are included in this block, 3 of which are given to the first owner of the car. And the rest, as the first ones are lost, can be ordered through the dealer. Therefore, there is no procedure for registering a key for these cars.

The programming algorithm for new keys for BMW of these years is as follows:

  Reading firmware from the EWS 3 immobilizer unit

  Generating a key code based on data read from EWS 3

  Writing the generated code to a blank PCF7935 chip or a new key.

5.2- The procedure for recording a new key, a BMW car , into the EWS3 immobilizer unit.

The EWS 3 Immobilizer unit , for a BMW car in the 39th body, is located above the pedals, on the left.

Let's take it off.

We take the board out of the case.

Our immobilizer is assembled on a Motorola microcontroller with a 0D46J mask . We will read it using the Xprog-M programmer .

Open the program, go to Device s - Immobilizers - BMW - EWS3 .

Let's look at the connection diagram.

According to the diagram, we connect the Xprog-M programmer with the EWS 3 immobilizer unit .

Click the Read button ...

...And the Motorola 0D46J firmware is read.

If you click Tools , you can see a lot of interesting information. For example, the real (if there were no traces of connection on the EWS ) mileage of the car, VIN , ten registered keys, etc.

Now that we have the firmware, launch the Abrites program .

Select the Tag Key Tool utility and select BMW EWS3 in it. 68HC911EA9. PCF7935 or EML .

Click the Load Dump button . Select the firmware read from the immobilizer and select Key 4 PCF7935/EML unused (not in use).

Click the Prepare Key button . The program will ask us: "Do you want to program the original BMW key (EML)? Press NO if you are using a PIT (PCF793x) transponder."

We are writing to a regular 7935 chip, so we click No and the writing process begins.

If the process of writing the key code into the transponder goes well, a window will first appear: “Transponder programmed.”

And then: "Programming is complete. You can use the key."

For fun, we read what data was written to the chip.

And so, after this we have a registered transponder and  a dump of the EWS block modified by the Abrites program . In order for our new key to work, we need to write this dump back to the immobilizer unit.

The new key is registered in the BMW5 5-series E39 , the car starts. It remains to register the radio channel so that the key buttons can control the central locking of the car.

5.3- How to register key buttons on a BMW car to control the central locking?

The procedure described below is relevant for BMW cars in E38 , E39 , E46 and E53 bodies . It needs to be done, for example, when the key fob battery is low or to bind the buttons of a new key.

Option 1 - There is one working key available.

To perform this procedure, we need a key that is already registered in the car, and a key that needs to be programmed.

1.  We get into the car, close all the doors and windows.

2.  Insert the working key into the ignition switch and turn it to position “1”.

3.  Turn the key to position “0” and remove the key from the ignition switch.

4.  On the working key, press the “Open” button and holding it down, press the “Close” button 3 times.

5.  Release the "Open" button. After this, the doors will close and immediately open.

6.  Now, on the new (non-working) key, we also press the “Open” button and, while holding it down 3 times, press the “Close” button.

7.  Release the "Open" button. The car doors should close and open again.

After these steps, both key fobs will control the central locking of the car.

Option 2 - There is no working key, there is only a new (not working) key.

To perform this procedure, we only need the key that needs to be registered in the car.

1.  We insert the key into the ignition switch and quickly turn it 5 times from position “0” to position “1”.

2.  Remove the key from the ignition switch.

3.  Press the "Open" button and hold it down, press the "Close" button 3 times.

4.  Release the "Open" button.

5.  If there is another unprogrammed key, then you must repeat step 3 within 30 seconds.

6.  We insert the key into the lock and turn on the ignition.

The procedure for programming the car's central locking key fob is completed.

5.4- Additional information on keys for BMW cars, E38, E39, E46 and E53.

Below you can see the electrical circuit diagram of the original BMW key. Location on the printed circuit board and voltage values, test points, original BMW car key.

  Schematic diagram of the original BMW key

  Location of control points on the key fob printed circuit board

  Voltage values ​​at test points, BMW key fob

This information was found on the Internet and may be useful to those who have unsuccessfully opened the key body by knocking off elements or drowning the key of their car.

6- Key programming for BMW X3 E83 (EWS4.4)

BMW X3 E83 2006 (automatic transmission, left hand drive, USA, EWS4.4). We have one working key and a key that we have to register in the car.

In order to register a key or chip in this car, we used the Xprog-M programmer , with the BDM 1-002-0017 adapter and the Abrites diagnostic device (hereinafter referred to as AVDI).

At the first stage, using the programmer, we read the firmware from EWS4.4. And on the second, using AVDI, we will program the chip (transponder).

We wrote in detail about the differences between the original BMW key and the Chinese one and about their structure in the previous article -  Programming a key/transponder for the BMW 520i E39 . So here it is more brief.

In the image above, on the left is the original car key, and on the right is the key brought from the People's Republic of China.

If anyone is interested in the order (purchase) number, it is as follows: 6955750 (315MHz). 

In the body of such a key, there is a PCF7935 transponder and a transceiver for remote control of the car’s central locking. By the way, the radio channel works fine, the key is installed and removed from the standard alarm system without any complaints.

6.1- Reading the firmware from the EWS4.4 immobilizer unit

So, we take the immobilizer unit out of the car...

To do this, remove the plastic protection over the gas and brake pedals.

We lie down on the threshold, look up and see a white box, this is  EWS4.4 . We unscrew the nut on the right, loosen the nut on the left, remove the connector and take out the block.

This immobilizer unit is assembled on a Motorola MC9S12D64 microcontroller , with a 2L86D mask .

Since we registered the key on the BMW X3 E83 for the first time, we first mistakenly assumed that six dots to the right of the processor would be enough for us to read the firmware.

However, Xprog-M , when reading eeprom 2L86D , produced an error: Bootloader initializing error. Can't access BDM. Check BDM connection.

It became clear that the processor is “closed” and to read its firmware you will need a BDM adapter  1-002-0017 and, accordingly, a different connection diagram.

And here, in fact, is this circuit MC9S12D64 (2L86D) + Xprog-M (BDM 1-002-0017) .

Let's solder to the block...

... and read the firmware.

6.2- programming the key for EWS4.4 of the BMW X3 E83

So, we have a dump, which means that the only thing left to do is program the chip that is in our key.

To do this, take out AVDI (ABRITES Vehicle Diagnostic Interface)  and connect  Tag Key Programmer to it .

We launch the Tag Key Tool utility , select the Key Tool item in it and in the Vehicle Model field , select our option - BMW EWS4. PCF7935 or EML . As you can see, you can only register 4 keys, or chips, into a car.

Click on the Load Dump button and select the dump that we read from the processor. Check the box next to Key 3 PCF7935 / EML used and click the Prepare Key button . After which, the program asked:

  Do you program original BMW key (EML)? Press NO if you use PIT (PCF793x) transponder.

  Translation: Do you want to program the original BMW key (EML)? Click NO if you are using a PIT (PCF793x) transponder."

   Click the No button .

The transponder programming process begins, upon completion of which a window pops up:

  Transponder programmed

  Translation: Transponder programmed

Well, this is what this programmed transponder looks like.

That's it, the key is registered in the car. We checked that EWS4.4 gives permission to start the engine and programmed the radio channel as described in this article.

7- transponder programming for BMW X5 E70

The mid-size crossover BMW X5 E70 XDrive 4.8i,  produced in 2009 (automatic transmission, Left hand drive, CAS3), came to us to register another, additional, ignition key in the immobilizer system.

The owner of the car lost one ignition key. There was one working key and one key for another car (BMW 325i E90) - used. Our task was to make a used key new (do a “reset”) and register it in the car.

Initially, from the factory, these cars are equipped with two keys, which can be seen by looking at the CAS (Car Access System) unit with a diagnostic tool. By the way, you can immediately see that the owner, after losing the key, was not lazy and disabled access to the car with the lost key. The inscription "Key 1 is DISABLED. Remote Control Key" indicates this. And then we see that the keys of this BMW X5 E70 should operate at a frequency of 868 MHz.

This is exactly the key the owner of the car brought to replace the lost one: 868MHz , Siemens VDO 5WK49125 , BMW 6986585-03 .

7.1- How to disassemble the ignition key of a BMW E70?

The key is easily disassembled - cut into two halves using a utility knife. You can find many videos on the Internet and FOR : Replacing the battery in a smart key BMW E60 E90 E70...

––––––––

––––––––

––––––––

Everything turns out quite neatly, the “presentation” of the key does not deteriorate, but you should know that reassembling a disassembled key can only be done with the help of glue.

7.2- BMW E-Series. How to make a new one from a used key?

Today, quite a few devices are able to reset a smart key, after which it can be re-registered in another car. In our car service, AVDI (Abrites Vehicle Diagnostic Interface) is responsible for this procedure. Equipment you will need:

  Abrites diagnostic interface

  ABProg programmer

  Adapter ZN046 - PCF for ABProg

We didn’t have the ZN046 adapter , but after googling the Internet a little, we found a solution:

... in the photo above, all its contents.

DB25 connector of ZN046 adapter:

  1,2,3,4 - Red

  5 - Green

  6 - White

  14 - Black

  Between 6 and 14, the nominal resistance is 47 kOhm.

Information on connecting ABProg to the keys of BMW E-Series cars, from the Abrites manual:

The first thing you need to do is unsolder the battery...

Then, we connect to our key, according to the instructions...

In the Abrites ABProg program window, select our PCF key option - BMW E 5WK49125 868MHz Remote ...

... and press the Program button .

If after some time you see the message Key write finished successfully , it means that you now have a new key for BMW E-Series , ready for registration of the car.

7.3- Are we registering the ignition key for a BMW X5 E70 with a CAS3 system?

So, we have one working key and one key that we will program into the CAS system. We start the engine using the working key, then turn it off and remove the working key from the car.

In the Abrites BMW program , on the Special Functions tab , select  CAS Keys .

––––––––

If the vehicle has CAS3 with ISTAP firmware version 45 or later, you will see the following message:

  The firmware version of CAS is ISTA-P 45. Change of flash data is required. The software version will be preserved. Do you wish to continue?

  CAS firmware version is ISTA-P 45. Flash data needs to be changed. The current software version will be retained. Do you want to continue?

Click Yes and the procedure will begin, which takes about 10 minutes and upon successful completion you will see the inscription Signature OK. Programming status OK .

Next we see this dialog box:

  Entering CAS special mode. The key should be outside the car! Do you want to proceed?

  Entering special CAS mode. The key must be outside the car! Do you want to continue?

The process of entering the CAS into programming mode begins.

The following dialog box reports:

  Please remove key from the ignition lock! If car has keyless, it should be outside the car!

  Please remove the key from the ignition! If the car has a Keyless system, the key must be outside the car!

The key has been missing from the car for a long time, but the program constantly reminds you that it needs to be removed from the car. Apparently this is very important))

After we clicked OK , a window appears in which we select under which number the new key will be programmed - Key 3 and press the Program in CAS only button .

A new dialog box tells us:

  Put the EMPTY key ignition. Press OK ready when.

  Insert a blank ignition key. Click OK when you're ready.

We insert our new key into the slot and press the OK button .

We read:

  This will program the key and after that will write the modified dump into the CAS. Do you want to continue?

  Now the key will be programmed and the dump in CAS will be changed. Do you want to continue?

Click YES , after which, in the window that appears, select the key type - BMW Key and click OK .

After a short wait, if everything went well, the program will write:

  Key programmed successfully.

  The key has been successfully programmed.

Let's look again at the information about the keys in the CAS block - now we have three keys programmed, one key is inactive, disabled and two are working.

8- Car key programming - Honda CR-V RD1

Honda CR-V 1997 (RD1 body), came to install a car alarm. To implement the autostart function, a chip (transponder) was required, registered in the car's immobilizer system.

To register the key (chip), we used the XPROG-M programmer and the AVDI (Abrites Vehicle Diagnostic Interface) diagnostic device, with the Abrites TAG Programmer key programmer .

8.2- Honda CR-V RD1. Megamos ID13. ImmoBox 93c46

The original car key contains a Megamos ID13 transponder.

The read data of the original key (Megamos ID13) for the Honda CR-V RD1 is shown in the picture above.

However, Abrites suggested that we use transponders with the following markings: T5, PCF7935 and TK5551. Our choice fell on the second option - PCF7935 . But in addition to a clean chip, we need a dump (data from the eeprom memory chip) from the car immobilizer unit - ImmoBox . We remove the “box” and put it on the table...

- Type No.: HLI 502

- BAKOM 95.0326.GP

- f+g megamos

- HM: 3930-SX0-G01

- HL: SX0-8A000-000

Inside the block there is an eeprom memory chip  93c46 ...

... using the XPROG-M programmer , we read the firmware from it.

8.2- Honda CR-V RD1. We make a chip for autorun, using an ImmoBox dump

In the 'AVDI' software shell, launch the 'TAG Key Tool' and select the 'Key Tool' utility, which is designed specifically for programming new keys using data from the immobilizer blocks.

In the 'Vehicle' field, select our car 'Honda CR-V (-2000). Megamos 93C46. T5/TK5551 or PCF7935'. Using the 'Load Dump' button, load the read dump 93с46. Next, we select which key data will be written to our transponder - 'Key 1'. And press the 'Prepare Key' button - prepare the key.

After a while, if everything went well, a window will appear with the inscription 'Programming done. You can use the key' - Programming is complete. You can use the key.

Let's see what happened. In the picture above, a blank PCF7935 transponder. And in the picture below, the same transponder after programming and allowing the engine to start.

9- transponder programming for Infiniti QX70 S51

A 2013 Infiniti QX70 (S51 body), equipped with the  Intelligent Key system , arrived to register the second key. By the way, the maximum number of keys registered in a car is limited by the number 4.

To carry out this procedure, we used the  AVDI  (Abrites Vehicle Diagnostic Interface) diagnostic tool.

9.1- We calculate PIN Code by BCM number

So, the owner purchased a new key...

...its number is  H0564-EG010  and it was slightly different from the one that was already in hand.

However, this did not interfere with his programming at all. In the photo, on the left is the original key with four buttons, on the right is the new one.

To register a car key, you need to know the access code, also known as PIN. The PIN code for our Infiniti QX70 is calculated by the number on the body sticker (BCM). And this number (BCM Number) can be read using diagnostics, through the OBDII connector. To do this, connect 'Abrites' to the car, launch 'Nissan Commander', launch the 'PIN Code Tool' utility. Next, press the BCM Number 'Read OBDII' button - we get the sticker code 32F9A and click PIN Code 'Calculate' - in the New window our code for registering the key is 6035.

9.2- Training a new Intelligent Key

In the 'Nissan Commander' application, launch the 'Key Learning' utility.

On the left, select our car, on the right, enter the calculated PIN Code and the number of keys that we will register.

IMPORTANT!!! When programming even one new key or chip, you will need all the ones registered! During the learning procedure, all keys are “set” again. We have only two keys, one working and one new, so in the 'Number of keys for' field we put the number 2. Click the 'Learn Keys' button.

The program will ask you to turn the ignition on and off with each key. In this case, the keys will need to be inserted into the slot, which is located near the driver’s left knee in the Infiniti QX70 . At the end of the programming procedure, you will need to start the engine, which the program will also ask you to do. That's all, actually!

10- Key programming for Kia Rio

Kia Rio 2014 release. There are two working keys, you need to add a chip for autostart.

To program the transponder (chip), the ABRITES Vehicle Diagnostic Interface diagnostic device is used .

To carry out this procedure, we will need:

  Blank HITAG 2 transponder - PCF7936.

  Foil in which you will need to wrap the key when registering a new transponder.

10.1- How to register a key/chip in a Kia Rio car using Abrites?

1. Connect the Abrites diagnostic tool to the car and turn on the ignition.

2. Select the special function  Read PIN Code .

3. This window lists the types of engine ECUs from which it is possible to read the PIN code using the Read PIN Code function . Click Yes .

4. After the process is completed, a window appears with the calculated PIN code.

––––––––

5. Launch the special function Key Programming .

6. Enter the previously calculated PIN and press the Teach button .

7. A dialog box appears asking if we want to start the key programming procedure, click Yes .

8. Next dialog box: "Do you want to program key No. 1?" Click the Yes button .

9. As soon as the first key is registered, a window will appear: “Do you want to program key No. 2? Press the Yes button . The program will ask you to turn off the ignition and turn on the ignition with the second key. We do this. And we repeat the same for the new chip.

10. After these steps we see this window: “Key programming completed successfully.”. Click the OK button . We start the car engine.

11- Key programming for Mercedes M-Class W163

Mercedes ML320 2000  (automatic transmission, left hand drive, DAS). All keys were lost. There is a PCF7935 chip that we have to install in the car.

The Mercedes M-Class in the W163 body has problems with the keys falling off. The car stops starting (the starter does not turn) and on the instrument panel, when the ignition is turned on, the message Start Error appears .

11.1- How to prepare a blank PCF7935 chip for programming it in a Mercedes W163

To program a new chip into the DAS (Drive Authorization System) immobilizer system, we use the  Abrites diagnostic tool  and  Tag Key Programmer .

We place our transponder chip (PCF7935) in the  Tag Key Programmer 's antenna frame.

We read data from a clean chip.

Next we need to prepare our PCF7935 transponder for registration in the car. Select in the Abrites TAG Key Tool utility  and select the item Production .

In the Transponder Type field  , select TA1 Mercedes ML W163. PCF7935.

Press the Program button .

Chip preparation completed Transponder Programmed .

The data was read from the prepared chip.

11.2- How to register a prepared chip in the DAS system of a Mercedes ML320 W163?

Turn on the ignition using the key with the new (prepared) transponder. Next, in the Abrites Diagnostics for Mercedes utility, select DAS 2b (W163) .

In the window that opens, select Type : DAS  and click the Read ConfData button .

The eeprom dump has been read, save it.

Now in the Key number field , set what number our new key will be. Number from 1 to 8. And press the button Learn ML Transponder .

A window appears with the inscription Transponder successfully learned , which means the recording of the chip has been successfully completed.

We read the data from the chip registered in the car.

We turn on the ignition with the key with the new chip, the Start Error message has disappeared. The new key is registered in the sixth cell.

12- transponder programming for Nissan Note

Nissan Note 2007 (automatic transmission, right hand drive, Intelligent Key). There is one working key, you need to add a chip for autostart.

12.1- How to register a key/chip in a Nissan Note car?

Diagnostic tool ABRITES Vehicle Diagnostic Interface , when selected (Nissan Note 2006+), requires entering a 12-digit PIN code, which is presumably calculated from a sticker located behind the glove box (glove compartment).

But the car did not have such a sticker, so we will register the chip using the SBB Key Programmer device .

12.2- How to calculate the PIN code for registering a key/chip in a car?

We will calculate the PIN from the BCM sticker using the AD600 Code Wizard Pro (Demo Version) program , which can be downloaded from INTERNET. In the demo version of this program, this function is open.

To carry out this procedure, we will need:

  Blank HITAG 2 transponder - PCF7936.

  Wires (jumpers) to supply power to the ignition switch contacts.

12.3- How to register a key/chip in a Nissan Note using SBB Key Programmer?

1. Insert the connector of the SBB Key Programmer device into the OBDII of the car.

2. In the device select NISSAN JAPAN - MICRA MARCH 00- - Gasoline

3. Insert a key and turn on the console - Insert the key blade into the lock and turn on the ignition.

––––––––

4. In the device, select NATS 5 - PROG. NEW KEYS .

5. Without PIN CODE you cannot program new keys - Without a PIN code you cannot program new keys.

6. Enter the 4-digit PIN code calculated from the BCM sticker.

7. Insert keys to be programmed in sequence and turn them on and off for 5 sec respectively. In the end start the engine for some sec. Press any key... - Insert the keys that need to be programmed sequentially, one after another, turning the ignition on and off within 5 seconds. After programming is completed, start the engine.

8. After pressing the button everything quickly, but without errors:

  The standard alarm LED in the right corner near the windshield will start blinking.

  Turn off the ignition and remove the sting from the ignition switch.

  We insert the tip into the ignition switch and turn on the ignition.

  Turn off the ignition and remove the sting from the ignition switch.

  We place the transponder on the ignition switch antenna.

  We supply +12V to the KEY IN and KEY PUSH wires (red-blue and red-white, respectively).

  Turn on the ignition by supplying +12V power to the corresponding contacts of the ignition switch.

  Turn off the ignition.

  We start the engine.

9. The autostart chip is programmed. We check the functionality of the chip and key.

13- transponder programming for Peugeot 206

A 2002 Peugeot 206 , on a tow truck, came to us to register the key. The number of keys programmed into the car was two, but both of them were lost.

In the auto electrician community, this is called a Total Loss . Well, in order to restore the functionality of the immobilizer system of this Peugeot, we needed almost the entire arsenal of “Chinese” equipment and “broken” software; none of the available devices wanted to do the job from start to finish. Go...

13.1 Peugeot 206. Algorithm of action in case of complete loss of keys

So, in order for the car to start again, we need:

  A blank for the ignition key, from which the master will carve a key according to the cylinder of the ignition lock

  Chip, also known as transponder, PCF7936 - prepared for registration in Peugeot

  A programmer with which we read the dump (firmware) from BSI

  A program that will find (count) PIN in a BSI dump

  Well, a key programmer that will register the chip in the car

If you don’t have everything from the list above, then there is another option - buy a kit (key, ignition switch, BSI, engine ECU).

13.2- Peugeot 206. Prepare the chip and calculate the pin

The owner of the car provided us with a machined key. We had a blank ID46 PCF7936 transponder .

Using  AVDI  (Abrites Vehicle Diagnostic Interface), we prepared a chip for registration in the car...

Now I needed to find out the PIN code to access the immobilizer system. To do this, we remove the BSI from the car - the body electronics control unit, located in the area of ​​the driver's left knee and disassemble it, having previously memorized the location of the fuses.

On the back of the board we find the eeprom 95160 chip and use the XPROG-M programmer to read the dump from it.

We load the read dump into the ImmoKiller program (easily searched on the Internet) and get a PIN code for programming the key.

13.3- Peugeot 206. How to register the ignition key

Well, we have a key with a prepared chip, we know the PIN code, now we uncover the Chinese SBB Key Programmer - a key programmer, which has already helped us out more than once when no one could do it, as in fact, this time too .

We connect to the car via the OBDII diagnostic connector and follow the steps that the device suggests:

Choosing our car...

We turn on the ignition with our new key, with a clean chip...

Turn off the ignition and close all doors and trunk...

Choosing to program new keys...

Enter the PIN code and the number of keys that we will register...

The device writes: "The inserted key has been programmed." Turn on the ignition and wait 5 seconds...

That's it, the key is programmed, turn off the ignition.

This may not be the easiest method to register a key in a Peugeot 206, but it is a 100% working option!

14- Key programming for Renault Duster Ph2

The compact crossover  Renault Duster  Phase-2 (restyling), produced in 2016, with a 2-liter F4R.410 engine, came to us to register/program another ignition key.

The client purchased a non-original key in one of the Celestial Empire stores. In the photo above, below is the original key, in a case, above is a key from China, of very decent quality.

Two devices were used in the work:

  Xhorse VVDI Mini Key Tool - for reading key parameters (transponder type and radio channel frequency)

  Renolink ver.1.87 - for reading programming access codes and programming the key

14.1- Original key for Renault Duster Phase 2

This is what the original key looks like from the inside. In addition to a handful of resistors and capacitors, there are three buttons, an antenna, a microcircuit - a transponder and a radio channel in one housing, and a quartz with a frequency of 13560 MHz. In addition, on the board you can see the key model number and the FCC (Federal Communications Commission) identifier - this indicates that the device has been approved by the US Federal Communications Commission and is completely ready for industrial production and sale in retail networks.

Xhorse VVDI Mini Key Tool determined that there is a type 4A transponder inside the key , aka  HITAG AES , aka PCF7952E . Transponder ID: C2FEDB40. Statuses: Blocked, Unclonable.

The frequency of the radio channel for the car's central locking control buttons is 434.36 MHz.

14.2- Chinese key for Renault Duster Phase 2

Essentially everything is the same, but the arrangement of the elements is slightly different. The quartz responsible for the frequency at the output of the radio channel is the same. Well, of course, there are no numbers or identifiers here.

Xhorse VVDI Mini Key Tool  determined that inside the key there is the same transponder as in the original key: type  4A , also known as  HITAG AES , also known as  PCF7952E . Transponder ID: D7DBAD43. Statuses: Unlocked (can be registered in the car), Unclonable.

The frequency of the radio channel for the car's central locking control buttons is 433.99 MHz.

By the way, if you look at the documentation for the key model TWE1G0003 , for Renault Duster Phase 2, the Chinese key showed better parameters of the radio frequency module than the original one)) Although, perhaps these are measurement errors of the device.

I would also like to note the difference in antenna resistance in the original and Chinese dongles: the original is 26 Ohms, and the Chinese is 92 Ohms.

14.3- Key programming for Renault Duster Phase 2 using Autel MS919

First we tried to program the new key using the Autel MaxiSys MS919 diagnostic tool ...

The device briefly explained the programming steps. He warned that all the keys need to be programmed at once, that is, those keys that were missing during the programming process will be removed from the immobilizer system.

At one of the steps, it was even suggested to enter a certain code, probably calculated from the car’s VIN, but in the end the procedure ended with an error - the new key was not registered and the already registered keys were not deleted. In general, the device did nothing, it just wasted our time))

14.4- Key programming for Renault Duster Phase 2 using Renolink 1.87

After an unsuccessful attempt at programming by Autel , it was decided to try the Chinese cord Renolink ver.1.87 .

We took out the third key, which was located in the car alarm immobilizer bypass and in order...

The cord is connected to the car, the ignition is turned on. Launch the key programming utility KEYS . In the UCH field , select our type of body electronics unit: UCH T4 - Logan 2, Sandero 2, Duster Ph2, Lodgy, Dokker and press the READ PIN button  - the program reads the  PIN  and  ISK codes  - copy them.

We restart the key programming utility  KEYS , again select our type of body electronics unit, the ignition is on, press the CONNECT button .

After establishing the connection, insert the PIN and ISK codes into the appropriate fields and press the  LEARN KEY button ...

...the first key is programmed. Turn off the ignition, insert the second key, turn on the ignition and press the  LEARN KEY button ...

... the second key is programmed. Turn off the ignition, insert the third key, turn on the ignition and press the  LEARN KEY button ...

That's all, all three keys are registered. Unfortunately, the radio channel of the Chinese key was not registered, the buttons did not work - in principle, this was expected. The situation was resolved by placing this key in the immobilizer bypass.

15- Key programming for Renault Fluence

Renault Fluence 2013 (manual transmission, left hand drive). There is a key that we have to register in the car.

If the original key is missing, you can use a prepared transponder PCF7936 . This chip can only be used on cars with a regular key. On cars with key cards, the PCF7936 transponder will not register.

15.1- How to read the firmware from the BCM of a Renault Fluence car

To register a key in Renault Fluence , we need a dump (firmware) from the BCM , which is assembled on a NEC D76F0115GM processor . Let's take it off.

We connect the ABProg programmer to the Abrites diagnostic device . And solder the ABProg wires to the BCM connection points, according to the Abrites user manual . By the way, the manual shows a slightly different unit - BCM (X95) . For us, if you look at the sticker, BCM (L38) .

Open the ABRITES Programmer for AVDI utility , select MCU - Renault BCM (X95) and press the Read button .

We wait a few seconds...

... until a window appears with the inscription FLASH read finished successfully! [Flash reading completed successfully!] and save the read dump.

15.2- How to register a key/key card/chip in a Renault Fluence car

Open the ABRITES Diagnostics for Renault utility and select the Key Learning function .

Turn on the ignition and press the Start button in the utility. If the car is equipped with a key card, then insert the card into the card reader and press the Start-Stop button for 10 seconds.

After a few seconds, a window will appear showing how many keys are registered in the car. As you can see, in our car there are two keys and both with identifiers 09090909 . What does it mean?

"Starting from about 2011 these cars have updated software in the immobilizer and it is no more possible to make them by OBDII. Starting with V5.2 of the ABRITES Command for Renault, it is possible to make cards for them, but you should first read them with the ABPROG. You can easily recognize these immobilizers since they are showing “09090909” for the existing key-IDs.

If you press “Learn” or “Read PIN Code” for such immobilizer, there will be a warning that first you need to read the immobilizer with the ABPROG. You should press here “Yes” after you already read the immobilizer dump."

[Starting around 2011, Renault cars have updated the software in the immobilizer module and now they cannot be done via OBDII, but it is possible to work with BCM units by first reading a dump from it. You can easily recognize these immobilizers as they show "09090909" for the key IDs.

If you click “Train” or “Read PIN code” for such an immobilizer, then first there will be a warning that you need to read the immobilizer firmware using ABProg.]

Click the Learn button in the utility and indicate the number of keys that we want to register in the car. If, for example, there are two keys and you need to add a chip for autostart, then enter the number 3 .

A window appears saying:

Please remove the key/card before the learning procedure is started.

Important: If car is Megane 3/Scennic3/Fluence:

- if you will learn virgin key/card - Put this card in ignition lock (without giving ignition)

- if the card is working or already precoded - remove the card from the ignition lock at all

[Please remove the key card before starting the training procedure.

Important: If the car is Megane 3 / Scennic3 / Fluence:

- If you are registering a new key card - Insert this card into the receiver (without turning on the ignition)

- If the card is already programmed into the car - Remove the card from the receiver]

––––––––

In general, turn off the ignition and press OK .

The following window appears:

Attention: This is an updated SW version of the BCM!

Do you want to read the PIN directly from the BCM?

[Note: This is an updated version of BCM software!

Do you want to read the PIN directly from the BCM?]

Click YES .

The following inscription:

To make key you need to read first the BCM module with the ABPROG. Wiring diagram for the ABPROG is found in the user manual.

Do you want to continue by selecting BCM dump?

[In order to program the key you need to read the firmware from the BCM using ABProg. The diagram for ABProg is in the user manual.

Do you want to continue by selecting BCM dump?]

Click YES .

Select the previously read BCM dump .

Please insert key 1 and give on ignition and press OK

[Please insert key 1, turn on the ignition and press the OK button]

Make ignition OFF and again ON

[Turn the ignition off and on again]

That's it, our key is registered.

16- Key programming for VW Touareg

VW Touareg 2004 (USA). There is one working key, you need to add a chip for autostart.

To program the key, use the ABRITES Vehicle Diagnostic Interface diagnostic tool .

All further actions can be divided into two stages:

  Preparing a dealer key.

  Recording a dealer key into a car

16.1- How to register a key/chip in a Volkswagen Touareg using Abrites?

1. So, connect the Abrites diagnostic tool (with the connected TagKey Programmer ) to the car and turn on the ignition.

2. Select the special Key Learning function

3. Select Standard Mode

4. In the Vehicle model field , select VW Touareg/Phaeton/Bentley/Cayenne K (KW2000)

5. The device will connect to the car. It can be seen that two keys have already been registered (see Key Count field ). There is one in stock.

6. Click the Autodetect Login/Security Code button

7. Login and CS (Component Security) have been calculated and can be written down or remembered. To record a chip, you need a two-digit Login. And in order to prepare a clean PCF7936 chip as a dealer key, you need CS

8. Click the Prepare Dealer Key button

9. Press the Autodetect From ECU button . In the All 7 Bytes Of The Component Protection Data (Component Security) Are Know field , the previously calculated CS will appear

10. We bring the clean PCF7936 chip to the TagKey Programmer antenna and press the Prepare button

11. Click  OK

12. Click Yes

13. Click  OK . Chip prepared

14. We go to the first window of the special function Key Learning . Car ignition is on

15. In the New Key Count field , set the number of keys (chips) that need to be written to the car. We also take into account the working key, that is. if there is one working key and you need to register one chip, then put the number 2 in the field

16. Click the Learn button

17. Turn off the ignition and take out the working key. Insert the working key and turn on the ignition. Click OK

18. The program will display a message something like this: "Please turn off the ignition and insert each key that needs to be learned. Hold it until the steering wheel latch is unlocked." At this time, the message Immobilizer Learning will appear on the instrument panel display.

19. Turn off the ignition and take out the working key. Insert the key with the prepared chip and turn on the ignition. The latch is unlocked

20. Turn off the ignition, take out the key with the prepared chip. We insert the worker and turn on the ignition. The latch is unlocked

21. Click OK . We wait five minutes and start the car.

16.2- A few additions:

  You can find out the login from the ECU, device, OBDII or KESSY dump using the special Dump Tool function .

  Another way is to retrieve the login via OBDII while reading the ConfData of the engine ECU - using a special function Engine Control Unit .

  If you have one working key, but there is no blank without a chip, and you need to register a chip for autostart. Then, during the process of recording the chip, point 19, the working key can be wrapped in pre-prepared foil.

16.3- What to do if your keys are completely lost?

In order for the device to connect to the car when you launch the special Key Learning function , you need to:

  Or apply a plus to fuse number 26 or 36 - the fuse box in the passenger compartment, on the left (fuse number 26, there is no fuse in the VW Touareg 2004).

  Or hold down the door unlock button with the brake pedal pressed.