Hyundai Elantra CN7: Immobilizer System

Seventh generation (CN7; 2021–2024) / Hyundai Elantra CN7 2021-2024 Workshop Manual / Body Electrical System / Immobilizer System

Description and operation

Description

The immobilizer system will disable the vehicle unless the proper ignition key is used, in addition to the currently available anti-theft systems such as car alarms, the immobilizer system aims to drastically reduce the rate of auto theft.

Transponder (TP) – IMMO ECU Communication

TP Read Protocol

(1)	IMMO_ECU after IGN on(or CPU Reset cancellation) is sent Challenge to TP and confirmed Serial Number and Signature.

(2)	When response of input transponder is not correct, input is retry.

(3)	When response of input transponder is correct, The data that calculate Encryption operation in the EEPROM program compared with received data from TP. When Codes is same, input is finished. If the codes are not same, input are continued until when codes are same.

(4)	If IMMO_ECU EEPROM code is not programming, when correct transponder is inputted (CRC Check OK), input is finished.

(5)	After IGN1 on(CPU Reset cancellation), IMMO_ECU is reading the maximum 5times Transponder Code

(6)	In the IGN1 ON&EMS_state=Lock state, when received ANKNOWLEDGE, TP is re-authenticated

2.	Transponder / IMMO ECU / EMS authentication

Components Operations

PCM (Power Train Control Module)

The PCM (ECM) carries out a check of the ignition key using a special encryption algorithm, which is programmed into the transponder as well as the PCM (ECM) simultaneously. Only if the results are equal, the engine can be started. The data of all transponders, which are valid for the vehicle, are stored in the PCM (ECM).

ERN (Encrypted Randorm Number) value between EMS and encrypted smartra unit is checked and the validity of coded key is decided by EMS.

Encrypted Immobilizer Unit

The IMMOBILIZER carries out communication with the built-in transponder in the ignition key. This wireless communication runs on RF (Radio frequency of 125 kHz). The IMMOBILIZER is mounted behind of the crash pad close to center cross bar.

The RF signal from the transponder, received by the antenna coil, is converted into messages for serial communication by the IMMOBILIZER device. And, the received messages from the PCM (ECM) are converted into an RF signal, which is transmitted to the transponder by the antenna.

The IMMOBILIZER does not carry out the validity check of the transponder or the calculation of encryption algorithm. This device is only an advanced interface, which converts the RF data flow of the transponder into serial communication to the PCM (ECM) and vice versa.

Antenna Coil

The antenna coil (A) has the following functions.

–	The antenna coil supplies energy to the transponder.

–	The antenna coil receives signal from the transponder.

–	The antenna coil sends transponder signal to the IMMOBILIZER. It is located directly in front of the steering handle lock.

Repair procedures

Diagnosis with Diagnostic tool

In the body electrical system, failure can be quickly diagnosed by using the vehicle diagnostic system (Diagnostic tool).

The diagnostic system (Diagnostic tool) provides the following information.

(1)	Fault Code Searching : Checking failure and code number (DTC)

(2)	Data Analysis : Checking the system input/output data state

(3)	Actuation test : Checking the system operation condition

(4)	S/W Management : Controlling other features including system option setting and zero point adjustment

Data Analysis

1.	Select the 'Data Analysis' and 'Car model'.

2.	Select the 'IMMO' to search the current state of the input/output data.

Key Teaching Procedure

Key teaching must be done after replacing a defective PCM(ECM) or when providing additional keys to the vehicle owner.

The procedure starts with an PCM(ECM) request for vehicle specific data (PIN code: 6digits) from the tester. The "virgin" PCM(ECM) stores the vehicle specific data and the key teaching can be started. The "learnt" PCM(ECM) compares the vehicle specific data from the tester with the stored data. If the data are correct, the teaching can proceed.

If incorrect vehicle specific data have been sent to the PCM(ECM) three times, the PCM(ECM) will reject the request of key teaching for one hour. This time cannot be reduced by disconnecting the battery or any other manipulation. After reconnecting the battery, the timer starts again for one hour.

The key teaching is done by ignition on with the key and additional tester commands. The PCM(ECM) stores the relevant data in the EEPROM and in the transponder. Then the PCM(ECM) runs the authentication required for confirmation of the teaching process. The successful programming is then confirmed by a message to the tester.

If the key is already known to the PCM(ECM) from a previous teaching, the authentication will be accepted and the EEPROM data are updated. There is no changed transponder content (this is impossible for a learnt transponder).

The attempt to repeatedly teach a key, which has been taught already during the same teaching cycle, is recognized by the PCM(ECM). This rejects the key and a message is sent to the tester.

The PCM(ECM) rejects invalid keys, which are presented for teaching. A message is sent to the tester. The key can be invalid due to faults in the transponder or other reasons, which result from unsuccessful programming of data. If the PCM(ECM) detects different authenticators of a transponder and an PCM(ECM), the key is considered to be invalid.

The maximum number of taught keys is 4.

If an error occurs during the Immobilizer Service Menu, the PCM(ECM) status remains unchanged and a specific fault code is stored.

If the PCM(ECM) status and the key status do not match for teaching of keys, the tester procedure will be stopped and a specific fault code will be stored at PCM(ECM).

•	When teaching the 1st key, Smartra regists at the same time.

The following section describes how to diagnose faults using a diagnostic instrument.

1.	Connect the cable of Diagnostic tool to the data link connector in driver side crash pad lower panel, and turn on the Diagnostic tool.

2.	Select the 'S/W Management' and 'Car model'.

3.	Select "Imoobilizer" and "LEARNT KEYS".

4.	Perform the "LEARNT KEYS" procedure according to the Diagnostic tool screen message.

Password Teaching / Changing

The user password for limp home is taught at the service station. The owner of the vehicle can select a number with four digits.

The user password teaching is only accepted by a "learnt" PCM(ECM). Before first teaching of user password to an PCM(ECM), the status of the password is "virgin" No limp home function is possible.

The teaching is started by ignition on, with a valid key(learnt key) and sending the user password by tester. After successful teaching, the status of the user password changes from "virgin" to "learnt".

The learnt user password can also be changed. This can be done if the user password status is "learnt" and the tester sends authorization of access, either the old user password or the vehicle specific data. After correct authorization, the PCM(ECM) requests the new user password. The status remains "learnt" and the new user password will be valid for the next limp home mode.

If wrong user passwords or wrong vehicle specific data have been sent to the PCM(ECM) three times continuously or intermittently, the PCM(ECM) will reject the request to change the password for one hour. This time cannot be reduced by disconnecting the battery or any other actions. After reconnecting the battery, the timer starts again for one hour.

The following section describes how to diagnose faults using a diagnostic instrument.

1.	Connect the cable of Diagnostic tool to the data link connector in driver side crash pad lower panel, and turn on the Diagnostic tool.

2.	Select the 'S/W Management' and 'Car model'.

3.	Select "Imoobilizer" and "Password Teaching / Changing".

4.	Perform the "Password Teaching / Changing" procedure according to the Diagnostic tool screen message.

Limp Home Function

If the PCM(ECM) detects the fault of the SMARTRA or transponder, the PCM(ECM) will allow limp home function of the immobilizer. Limp home is only possible if the user password (4 digits) has been given to the PCM(ECM) before. This password can be selected by the vehicle owner and is programmed at the service station.

The user password can be sent to the PCM(ECM) via the special tester menu.

Only if the PCM(ECM) is in status "learnt" and the user password status is "learnt" and the user password is correct, the PCM(ECM) will be unlocked for a period of time (30 sec.). The engine can only be started during this time. After the time has elapsed, engine start is not possible.

If the wrong user password is sent, the PCM(ECM) will reject the request of limp home for one hour. Disconnecting the battery or any other action cannot reduce this time. After connecting the battery to the PCM(ECM), the timer starts again for one hour.

1.	Connect the cable of Diagnostic tool to the data link connector in driver side crash pad lower panel, and turn on the Diagnostic tool.

2.	Select the 'S/W Management' and 'Car model'.

3.	Select "Imoobilizer" and "Limp Home Mode".

4.	Perform the "Limp Home Mode" procedure according to the Diagnostic tool screen message.

Neutralizing Of ECM

The PCM(ECM) can be set to the "neutral" status by a tester.

A valid ignition key is inserted and after ignition on is recorded, the PCM(ECM) requests the vehicle specific data from the tester. The communication messages are described at "Neutral Mode" After successfully receiving the data, the PCM(ECM) is neutralized.

The ECM remains locked. Neither the limp home mode nor the "twice ignition on" function, is accepted by the PCM(ECM).

The teaching of keys follows the procedure described for the virgin PCM(ECM). The vehicle specific data have to be unchanged due to the unique programming of the transponder. If data should be changed, new keys with a virgin transponder are requested.

This function is for neutralizing the PCM(ECM) and Key. Ex) when lost key, Neutralize the PCM(ECM) then teach keys.

(Refer to the Things to do when Key & PIN Code the PCM(ECM) can be set to the "neutral" status by a scanner. If wrong vehicle specific data have been sent to SMATRA three times continuously or intermittently, the SMATRA will reject the request to enter neutral mode for one hour. Disconnecting the battery or other manipulation cannot reduce this time. After connecting the battery the timer starts again for one hour.

•	Neutralizing setting condition - In case of PCM(ECM) status "Learnt" regardless of user password "Virgin or Learnt" - Input correct PIN code by scanner. - Neutralizing meaning . : PIN code (6) & user password (4) deletion. : Locking of ECM (except key teaching permission)

•	Neutralizing meaning: - PIN Code(6) & User P/Word(4) deletion - Locking of EMS(except Key Learning permission)

1.	Connect the cable of Diagnostic tool to the data link connector in driver side crash pad lower panel, and turn on the Diagnostic tool.

2.	Select the 'S/W Management' and 'Car model'.

3.	Select "Imoobilizer" and "Limp Home Mode".

4.	Perform the "Limp Home Mode" procedure according to the Diagnostic tool screen message.

Immobilizer Control Unit

Components and components location

Components (1)

With Smart Key

Connector Pin Information

Pin no	Connector A	Connector B	Connector C	Connector D	Connector E
1	ESCL (+)_output	-	-	-	-
2	Front heated nozzle_output	-	-	-	-
3	-	Puddle pocket lamp_output	-	Mirror folding_output	-
4	Front washer switch _Input	-	-	-
5	-	LIN(PDW)	-	-	ESCL enable_output
6	Ground_Power	R-PDW power_input	-	-	RPM_input
7	Ground_ECU	R-PDW power_output	-	-	Start relay_output
8	ESCL (-)_output	F-PDW power_output	-	-	ACC relay_output
9	Battery (+) ECU	ATM solenoid_output	-	Auto light sensor ground_output	Start feedback_input
10	Battery (+) Power	Head lamp high beam switch_input	-	Rear view camera switch_input	SSB switch2_input
11	IGN_Input	Front washer switch _Input	-	R-PDW switch_input	Trunk antenna (-)_output
12	Kiline_IMMO	Front wiper INT volume switch_input	-	P-Position_input	Interior2 antenna power(-)_output
13	-	Wiper parking switch_input	-	Passenger outside handle switch_input	-
14	-	External buzzer_output	-	Multifunction Switch ground _Input	Passenger outside handle antenna (-)_output
15	-	R-PDW switch IND_output	-	ACC_input	-
16	-	-	-	IGN2_input	-
17		-	-	Front wiper low back up switch_input	-
18		-	-	Brake switch_input	Driver outside handle antenna (-)_output
19		-	-	-	Immobilizer antenna ground_output
20		-	-	-	-
21		-	-	-	-
22		LIN 3(Rain sensor)	-	PDW option_input	-
23		Wiper power relay_output		Mirror unfolding_output	-
24		-		-	-
25		Wiper low relay_output		-	-
26		Wiper high relay_output		-	Wheel speed sensor_input
27		-		-	IGN2 relay_output
28		Fog lamp switch_input		-	IGN1 relay_output
29		Light switch_input		Auto light sensor power_output	SSB symbol illumination(+)_output
30		-		Auto light sensor signal_input	SSB switch1_input
31		-		Sunroof status_input	Trunk antenna (+)_output
32		-		ESCL unlock switch_input	Interior2 antenna power(+)_output
33		ESCL_COM		Clutch lock switch_input (MT)	-
34		EMS ECU wake up_output/Dood unlock signal_output		Driver outside handle switch_input	Passenger outside handle antenna (+)_output
35		-		B-CAN High	-
36		-		B-CAN Low	-
37				P-CAN High	-
38				P-CAN Low	Driver outside handle antenna (+)_output
39				-	Immobilizer antenna power_output
40				-	-

Without Smart Key

Connector Pin Information

Pin no	Connector A	Connector B	Connector C	Connector D
1	-	-	-	-
2	Front heated nozzle_output	-	-	-
3	-	-	-	Mirror folding_output
4	Front washer switch _Input	-	-	PDW option_input
5	-	LIN(PDW)	-	-
6	Ground_Power	R-PDW power_input	-	-
7	Ground_ECU	R-PDW power_output	-	-
8	-	F-PDW power_output	-	-
9	Battery (+) ECU	ATM solenoid_output	-	Auto light sensor ground_output
10	Battery (+) Power	Head lamp high beam switch_input	-	Rear view camera switch_input
11	IGN_Input	Front washer switch _Input	-	R-PDW switch_input
12	Kiline_IMMO	Front wiper INT volume switch_input	-	P-Position_input
13	-	Wiper parking switch_input	-	-
14	-	-	-	Multifunction Switch ground _Input
15	-	R-PDW switch IND_output	-	ACC_input
16	-	-	-	IGN2_input
17		-	-	Front wiper low back up switch_input
18		-	-	Brake switch_input
19		-	-	-
20		-	-	-
21		-	-	-
22		LIN 3(Rain sensor)	-	-
23		Wiper power relay_output		Mirror unfolding_output
24		-		-
25		Wiper low relay_output		B-CAN High
26		Wiper high relay_output		B-CAN Low
27		-		P-CAN High
28		Fog lamp switch_input		P-CAN Low
29		Light switch_input		Auto light sensor power_output
30		-		Auto light sensor signal_input
31		-		Sunroof status_input
32		-		Key solenoid_output
33		Key hall illumination_output		Start inhibit relay_output
34		EMS ECU wake up_output/Dood unlock signal_output		key in switch_input
35		-		-
36		-		-
37				Immobilizer antenna power_output
38				Immobilizer antenna ground_output
39				-
40				-

Repair procedures

Removal

1.	Disconnect the negative (-) battery terminal.

2.	Remove the glove box housing cover. (Refer to Body - "Glove Box Housing Cover")

3.	Loosen the mounting bolts, nuts and remove the immobilizer unit (A).

4.	Press the lock pin and disconnect the immobilizer unit connectors (A).

Installation

1.	Install the immobilizer control unit after connecting the unit connector.

2.	Install the glove box housing cover.

3.	Connect the negative (-) battery terminal.

Antenna Coil

Repair procedures

Removal

1.	Disconnect the negative (-) battery terminal.

2.	Remove the crash pad lower panel. (Refer to Body - "Crash Pad Lower Panel")

3.	Remove the steering column shroud panel. (Refer to Body - "Steering Column Shroud Panel")

4.	Disconnect the immobilizer connector (A) and press the locking pin (B) using an awl.

5.	Loosen the mounting screws and remove the antenna coil.

Installation

1.	Install the antenna coil.

2.	Connect the antenna coil connector.

3.	Install the crash pad lower panel.

4.	Connect the negative (-) battery terminal.

Button Engine Start System

Description and operation DescriptionSystem OverviewThe System offers the following features:– Human / machine interface through a 1-stage button, for terminal switching and ...

Ignition Switch Assembly

Repair procedures Replacement1.Disconnect the negative (-) battery terminal.2.Remove the crash pad lower panel.(Refer to Body - "Crash Pad")3.Remove the steering column upper & Lower shroud.4. ...