Smart Key Hi-Tech Update 973B Technician Handbook © 2009 Toyota Motor Sales, U.S.A., Inc All rights reserved This book may not be reproduced or copied, in whole or in part by any means, without the written permission of Toyota Motor Sales, U.S.A., Inc Hi-Tech Update - Smart Key Technician Handbook Table of Contents Section .1 Objectives Parts Catalog Identification Definitions Entry to Start Steps 2007 Camry System Diagram: Overview Entry to Start –Group Entry to Start -Step Entry to Start -Step 2005 CY Smart Entry & Start System: Door Unlock Signal Sequence 10 Entry to Start – Groups & 11 Entry to Start – Group 12 Entry to Start – Group 13 Entry to Start – Step 11 14 Entry to Start – Step 16 15 Entry to Start – Group 16 Entry to Start – Group 17 Smart Entry & Start System Overview of Engine Start Process .18 Entry to Start – Groups & 20 Smart Entry & Start: Engine Start .21 Entry to Start – Group 22 Smart Entry & Start System: Engine Start 23 Entry to Start – Group 24 Smart Key Operation Summary .25 Starting Questions 26 Smart Entry & Start System: Immobilizer Override 27 Case Example: Smart Key Battery Life 28 Case Example: Electromagnetic Interference and System Malfunctions 29 Technical Training Hi-Tech Update - Smart Key Technician Handbook Section 30 Objectives 30 ID Code Registration 31 Registration Procedure: Lost key 32 If Key Registration Fails 34 Use Remaining Key to Register 35 Replace Certification ECU: Key Available 36 Replace Certification ECU 37 Automatic/Manual Registration Process 38 Automatic/Manual Registration Process 39 New ECU/ECM Registration 40 Lost All Keys 41 Unmatched S Codes 42 Some Keys Lost, Key ID Codes cannot be erased 43 Replace Steering Lock Actuator 44 Replacing with a Previously Registered Engine ECM 45 Communication Check Utility 46 Section 47 Objectives 47 Techstream Data List Screen Shot 48 Data List Definitions 49 Technical Training Technician Handbook Hi-Tech Update - Smart Key Section Objectives Technical Training Smart Key System Operation • Identify sequential system operation of Smart entry and Smart start • Verify normal and abnormal Smart Key System operation • Locate key information in Repair Manual and EWD • Interpret smart key system signal patterns Technician Handbook Hi-Tech Update - Smart Key Part Name Certification ECU ID Code Box Steering Lock ECU Tuner Door Lock Control Receiver Electrical Key Antenna Oscillator (Exterior) Front Room Oscillator (Interior) Parts Catalog Identification Technical Training Parts Catalog Terminology Computer Assy, Smart Key Computer, Immobilizer Code Actuator Assy, Steering Lock Receiver, Door Control Receiver, Door Control Antenna, Electrical Key Oscillator, Door Electrical Key Oscillator, Indoor Electrical Key • Certification ECU manages the Smart Key system • ID Code Box is considered the Immobilizer ECU for the System • Tuner name is used in the NCF to indicate a Door Lock Control Receiver with the Antenna inside the box • Door Lock Control Receiver name will be used in other service publications Technician Handbook Hi-Tech Update - Smart Key Electronic Key Sometimes called the Fob, this key allows access for entry and start functions without the use of a mechanical key Vehicle ID Code and Key ID Code are stored in this component Vehicle ID Code A code in each Certification ECU Written to the electronic key during the 1ststep of key registration Key ID Code Unique code in each electronic key This code is written into the Certification ECU during key registration S Code Commonly called the Security Code This code is stored in the Certification ECU and ID Code Box and is used in theft prevention L Code Commonly called the Lock Code This code is stored in the ID Code Box and the Steering Lock ECU This code must be verified before the steering will unlock Bit Code A temporary fuel and spark allow command from the ID Code Box to the Engine ECM This is a strategy used to reduce cranking time and to allow the vehicle to start more quickly G Code Commonly called the Go Code This Code allows spark and fuel to the engine after an NE signal is generated by the crank sensor Definitions Vehicle ID Code – Hard code in the Certification ECU Used as the 1st layer of security to verify that the key is registered to this vehicle Written to the electronic key during the 1st step of key registration Key ID Code – Part of the key software that is programmed in the key during manufacturing Unique code for each key This code is linked to the S code Written into the Certification ECU during the 1st step of key registration Infinite number of codes S Code – Generated by the Certification ECU when the Key ID Code for each key is registered in the ID Code Box and the Certification ECU This code is registered during the 2nd part of key registration L Code – Generated by the Certification ECU but stored in the ID Code Box and Steering Lock ECUs The L code verification and Unlock confirmation information must be received by the Certification ECU before a 3-bit code command will be sent Bit Code – Temporary fuel and spark allow to shorten crank to start time and improve customer satisfaction When this code is sent the Security light turns off Only 1, 3-bit code is sent per key cycle G Code – Allows fuel and spark to the engine after the 3-bit code If the G code fails the engine will crank, start and stall If G code fails the security light will turn back on Technical Training Technician Handbook Hi-Tech Update - Smart Key There are 30 Steps from Entry to Start These are broken down into groups Groups Entry to Start Steps Technical Training Steps 1-4 6-9 10 - 13 14 - 19 20 - 25 26 - 27 28 - 30 Each group will lead to a diagnostic conclusion Technician Handbook Hi-Tech Update - Smart Key ACC Relay Main Body ECU IG Relay Output ECM (Engine ECU) CAN ID-Code Box LIN Steering Lock ECU Certification ECU Outside Handle Antenna Door Oscillator Touch Sensor Front Room Oscillator (Console) Rear Room Oscillator (Rear Seat) Lock Switch LF LF RF 2007 Camry System Diagram: Overview Technical Training Tuner & Electrical Key Antenna RF Main Smart Key components (i.e Certification ECU or ID Code Box) and their functions are consistent between most models • Oscillators only transmit to the Keys • The Tuner only receives from the Keys Technician Handbook Hi-Tech Update - Smart Key Step Action Car is locked Certification ECU is pulsing Exterior Oscillators, looking for a key Driver brings a registered key within the detection area of a door oscillator The Certification ECU uses oscillator broadcast signals to command the key: A Transmit the Vehicle ID Code, then B Transmit the Key ID Code to tuner Key transmits “Key ID Code” to the tuner Entry to Start – Group Verification Data List Red LED on key flashes The Certification ECU will not ask for the Key ID Code until the Vehicle ID Code is verified If the Red LED on the key flashes the following components are operating: Certification ECU Door Oscillator Electronic Key (including battery) – battery must have at least 2.2V in order to flash the LED The key will operate between 2.0V & 2.2V but the LED will not flash Below 2.0V the electronic key will not respond properly Wireless Door Lock Receiver/Tuner Component circuitry Vehicle battery Also you know the key has been at least partially registered to this vehicle Key transmits using RF Use SST 00002-09001-01 RF reader to verify transmission All oscillators transmit using LF Aftermarket LF readers are available but no Toyota/Lexus SST is available at this time Currently, TMC is testing a LF/RF combined reader Service tip: Key LED flash is usually a single flash Sometimes the LED may flash more than once The multiple flashes are a result of the Certification ECU requesting that the Key ID Code be transmitted again Technical Training Technician Handbook Hi-Tech Update - Smart Key Entry to Start Step Channel A (blue) CLG1-LF door oscillator command from the Certification ECU Channel B (red) CLG2-RF door oscillator command from the Certification ECU Channel C (green) RSSI, command from Certification ECU to Tuner to listen for a Key reply through the antenna Channel D (yellow) RDA, data reply from the Tuner to the Certification ECU with the Key reply data Certification ECU door oscillator command (CLG1/CLG2) occurs every 250 ms • All door oscillators broadcast at the same time • Channels A thru D occur in this order: C A and B D Technical Training Technician Handbook Hi-Tech Update - Smart Key Section Objectives Data List • • • Technical Training Interpret key Data List parameters • 3bit Code Request • S Code Check • L Code Check • EFI Code Receive Identify Data Lists limitations • Refresh rate • Unused parameters Interpret key Customization features 47 Hi-Tech Update - Smart Key Technician Handbook Techstream Data List Screen Shot Technical Training 48 Technician Handbook Hi-Tech Update - Smart Key Parameter Value Description D-Door Touch Sensor OFF / ON ? Indicates that Touch Sensor has been pressed Depending on CBEST settings only the touch sensor for the door that detected a registered key will be enabled.? RM Smart Access Data List item D Touch Sensor ON: Sensor is touched OFF: Sensor is not touched P-Door Touch Sensor OFF / ON See D-Door Touch Sensor RM Smart Access Data List item P Touch Sensor ON: Sensor is touched OFF: Sensor is not touched Dr-Door Touch Sensor OFF / ON See D-Door Touch Sensor RM Smart Access Data List item DR Touch Sensor ON: Sensor is touched OFF: Sensor is not touched Pr-Door Touch Sensor OFF / ON See D-Door Touch Sensor RM Smart Access Data List item PR Touch Sensor ON: Sensor is touched OFF: Sensor is not touched D-Door Trigger Switch (lock button on handle) OFF / ON ? Indicates that Trigger Switch (Lock Button) has been Pressed Only the Trigger Switch for the door that detected a registered key will be enabled ? RM Smart Access Data List item D Trigger SW ON: Switch is touched OFF: Switch is not touched P-Door Trigger Switch OFF / ON See D-Door Trigger Switch RM Smart Access Data List item P Trigger SW ON: Switch is touched OFF: Switch is not touched Data List Definitions Technical Training In the description column, information between the question marks (?) has not been verified by TMC This data was pulled from various sources, including NCF, Repair Manuals, etc 49 Technician Handbook Hi-Tech Update - Smart Key Parameter Value Description Dr-Door Trigger Switch OFF / ON See D-Door Trigger Switch RM Smart Access Data List item DR Trigger SW ON: Switch is touched OFF: Switch is not touched Pr-Door Trigger Switch OFF / ON See D-Door Trigger Switch RM Smart Access Data List item PR Trigger SW ON: Switch is touched OFF: Switch is not touched Tr/B-Door Unlock SW OFF / ON ? Indicates operation of the Trunk / Back Door Unlock Switch ? RM Smart Access Data List item TR? Bdoor Unlk ON: Switch is pushed OFF: Switch is not pushed Ignition Switch OFF / ON RM Smart Access Data List item IG SW: ON: Engine Switch is on (IG) OFF: Engine switch is off RM Immobiliser Data List item IG SW -ON: Engine switch on (ACC, IG) or start OFF: engine switch off Unmatched Vehicle-ID Yes / No RM Smart Access Data List item Unmatch V-ID -YES: Key ID matches vehicle NO: Key ID does not match vehicle No Response Yes / No ? Counter Intuitive data line No Response = Yes means that a Key ID signal was received, but did not match No Response = No means that a Key ID signal was received and the Key ID was verified.? RM Smart Access Data List item No Response -YES: Response from key NO: No response from key Data List Definitions Technical Training 50 Technician Handbook Hi-Tech Update - Smart Key Parameter Value Description Unmatch Code or Form Yes / No RM Smart Access Data List item Unmatch Format YES: Key ID Code matches NO: Key ID Code does not match Key Low Battery Yes / No Smart Key Low Battery indication Power Save Cnt 10 Minutes Count of how many times power save mode has been activated Min: Max: 255 Per NCF: If a Smart Key is in the exterior oscillator activation area for more than 10 minutes the system shut down to prevent draining the key and the car batteries To reinstate operation: Wireless signal, push lock switch, unlock with mechanical key RM Smart Access Data List item P/S 10-MIN description Power save counter -10 minutes Normal condition listed as “Power save counter after door LOCK?UNLOCK -10 minutes” Power Save Cnt Days Count of how many times power save mode has been activated Min: Max: 255 Per NCF: No response from key for more than days - Signal Transmission (outside oscillators) interval is extended from 250ms to 750ms RM Smart Access Data List item P/S 5-DAY description Power save counter -5 days Normal condition listed as “Power save counter after door LOCK?UNLOCK -5 days” Data List Definitions Technical Training 51 Technician Handbook Hi-Tech Update - Smart Key Parameter Value Description Power Save Cnt 14 Days Count of how many times power save mode has been activated Min: Max: 255 Per NCF: No response from key for more than 14 days -Automatically deactivates the smart access system To reinstate operation: Wireless signal, push lock switch, unlock with mechanical key RM Smart Access Data List item P/S 14-DAY description Power save counter -14 days Normal condition listed as “Power save counter after door LOCK?UNLOCK -14 days” # Codes Min: Max: 255 ? Number of DTCs stored.? RM Smart Access Data List item #CODES description Diagnostic trouble code / Min: 0, Max: 255 ACC Switch OFF / ON RM Smart Access Data List item ACC SW -ON: Engine Switch is on (ACC) OFF: Engine switch is off RM Immobiliser Data List item ACC SW -ON: Engine switch on (ACC, IG) or start OFF: engine switch off ID Code Difference (Resp) Yes / No C Code Difference Yes / No Challenge Code per RM Smart Access Data list item wrong C Code Data List Definitions Technical Training 52 Technician Handbook Hi-Tech Update - Smart Key Parameter Value Description ID Code Difference Yes / No Per TMC response the vehicle received a Key ID Code that did not match A non registered key transmitted an ID Code, the wireless tuner received it and relayed it to the Cert ECU, but the code did not match a registered code RM Smart Access Data list has data lines Wrong Code and Wrong ID Code -both say YES: Key ID Code matches NO: Key ID Code does not match.? Immobiliser Set / Unset RM Immobiliser Data List -description Immobiliser system status SET: Key is not in cabin UNSET: Key is in cabin Master Key Match / NoMatch ? Signal received from a registered Master Key.? RM Smart Access Data List -MATCH: Key code is sent NO: Unmatched key code RM Immobiliser Data List -description Master key code signal MATCH: Master key code is sent NO: Unmatched master key code is sent Sub Key Match / NoMatch ? Signal received from a registered Sub Key.? RM Smart Access Data List -MATCH: Key code is sent NO: Unmatched key code RM Immobiliser Data List -description Sub-key (Master key) code signal MATCH: Sub-key (master key) code is sent NO: Unmatched Subkey (master key) code is sent Data List Definitions Technical Training 53 Technician Handbook Hi-Tech Update - Smart Key Parameter Value Description BCC Malfunction OK / NG RM Smart Access Data List -description Transponder chip data OK: Correct data sensing NG: Incorrect data sensing RM Immobiliser Data List -description Transponder chip signal OK: Correct data sent NG: Incorrect data sent Abnormal Status OK / NG RM Smart Access Data List item Status -description Transponder chip data OK: Data OK NG: Data error RM Immobiliser Data List item Status -description Transponder chip data OK: Data OK NG: Data error Different Encrypt Code OK / NG RM Smart Access Data List item Encrypt Code -description Transponder chip data OK: Data OK NG: Data error RM Immobiliser Data List item Encrypt Code -description Transponder chip signal OK: Correct data sent NG: Incorrect data sent Different Serial Number OK / NG RM Smart Access Data List item Serial Number -description Transponder chip data OK: Data OK NG: Data error RM Immobiliser Data List item Serial Number -description Transponder chip signal OK: Correct data sent NG: Incorrect data sent Frame Error OK / NG RM Smart Access Data List item Frame -description Transponder chip data OK: Data OK NG: Data error RM Immobiliser Data List item Frame -description Transponder chip signal OK: Correct data sent NG: Incorrect data sent Data List Definitions Technical Training 54 Technician Handbook Hi-Tech Update - Smart Key Parameter Value Description Response OK / NG RM Smart Access Data List item Response -description Transponder chip data OK: With no response NG: With a response RM Immobiliser Data List -description Transponder chip signal OK: Correct data sent NG: Incorrect data sent Wireless Starter Com ID Regd / No Regd Wireless C Code OK / NG Different Rolling Code Yes / No RM Smart Access Data List item Wrong Rol Code -Yes: Key rolling code matches NO: Key rolling code does not match Auto Entry Cancel Switch OFF / ON Revised NCF procedure Key Cancel: starting conditions : Ignition off, Driver door closed and unlocked Procedure: Press the UNLOCK key button once Open the driver door within seconds Press the UNLOCK key button twice within seconds Driver door close, open, close, open within 30 seconds Press the UNLOCK key button twice within 30 seconds Driver door close, open, close within 30 second Wireless door lock buzzer sounds twice when key cancel is activated (Smart System off) To reactivate -repeat procedure Wireless Door Lock Buzzer sounds once when key cancel is turned off (Smart System on) RM Smart Access Data List item Function Cancel description Entry door lock function cancel ON or OFF Mode status is displayed Data List Definitions Technical Training 55 Technician Handbook Hi-Tech Update - Smart Key Parameter Value Description Steering Lock Sleep Cond Yes / No ? Certification ECU indicating that the Steering Lock ECU is in power saving sleep condition The Steering Lock ECU must wake up as the first operation in L Code verification and steering unlock operation The data line confirms that the Certification ECU has commanded the Steering Lock ECU to wake up and has received a confirmation back from the SL ECU that it is now awake.? RM Steering Column Data List -YES: Steering lock ECU sleep mode can be entered NO: Steering lock ECU sleep mode can not be entered? Steering Lock Start Cond Yes / No ? Certification ECU indicating that the Steering Lock ECU has unlocked the steering wheel and confirmed this action to the CERT ECU and that the process can proceed to the Bit Code Request stage.? RM Steering Column Data List -YES: Steering lock ECU sent a start signal NO: Steering lock ECU did not send a start signal? Engine Start Condition OK / NG RM Steering Column Data List -OK: Engine is allowed to start NG: Engine is not allowed to start Sensor Value OK / NG ? Per TMC response “indicates a history of steering lock sensor malfunction” NG = malfunction in steering lock position sensor circuit.? RM Steering Column Data List -NG (PAST): Sensor malfunction OK: No malfunction? Data List Definitions Technical Training 56 Technician Handbook Hi-Tech Update - Smart Key Parameter Value Description Power Supply Short OK / NG RM Steering Column Data List -description Short in ECU NG (PAST): Short in ECU OK: No malfunction Power Supply Open OK / NG RM Steering Column Data List -description Open in ECU NG (PAST): Open in ECU OK: No malfunction Motor Driver Short OK / NG RM Steering Column Data List -description Short in driver ECU NG (PAST): Short in driver ECU OK: No malfunction Motor Driver Open OK / NG RM Steering Column Data List -description Open driver in ECU NG (PAST): Open in driver ECU OK: No malfunction Lock/Unlock Receive OK / NG ? Cert ECU indication that it has received confirmation from the SL ECU that a lock or unlock command has been executed.? RM Steering Column Data List -description Steering lock command reception record YES: Steering lock / unlock signal received NO: Steering lock / unlock signal no received Lock Bar Stuck Error OK / NG RM Steering Column Data List -description Lock Bar Stuck malfunction NG (PAST): Lock bar stuck malfunction OK: no malfunction Push Start Error OK / NG ? Per TMC response “indicates a history of impossible to start”? RM Steering Column Data List -description Push button start function malfunction NG (PAST): Malfunction in push button start OK: no malfunction Data List Definitions Technical Training 57 Technician Handbook Hi-Tech Update - Smart Key Parameter Value Description IG2 Status OFF / ON ? Cert ECU confirmation that the Main Body ECU / Power Source ECU has turned on the IG2 relay? RM Steering Column Data List -description IG@ voltage ON: 10 -14 V OFF: Below V IG(Lin) OFF / ON ? Cert ECU confirmation that it has started transmitting on the LIN communication line and has received responses from other LIN ECUs? RM Steering Column Data List -description LIN bus IG status ON: LIN bus IG ON status OFF: LIN bus OG OFF status ID-BOX Sleep Condition Yes / No ? Certification ECU indicating that the ID Code Box is in power saving sleep condition The ID Code Box must wake up as the first operation in S Code verification The data line confirms that the Certification ECU has commanded the ID Code Box to wake up and has received a confirmation back from the ID Code Box that it is now awake? ID-BOX Start Condition Yes / No ? Cert ECU confirmation that the ID Code Box has issued a Bit Code Request to the Engine ECU, the request has been approved, and as soon as a Engine Start Request is received cranking can begin? Engine Start Request OK / NG ? Cert ECU confirmation that an Engine Start request has been ? Sent or possibly confirmed? And it is OK for the Engine ECM to crank the engine? Data List Definitions Technical Training 58 Technician Handbook Hi-Tech Update - Smart Key Parameter Value Description 3bit Code Request OK / NG Temporary permission to allow rapid engine start while G Code verification is pending If G code verification fails, engine will start and stall S Code Check OK / NG Cert ECU Indication that the S Code verification has been received from the ID Code Box L Code Check OK / NG Cert ECU Indication that the L Code verification has been received from the ID Code Box Unlock Request Receive OK / NG ? Cert ECU indication that the SL ECU has received an unlock request.? Lock Request Receive OK / NG ? Cert ECU indication that the SL ECU has received a lock request.? Engine Start Request (Past) OK / NG ? Data for the smart key operation immediately preceding the current cycle? S Code Check (Past) OK / NG Data for the smart key operation immediately preceding the current cycle L Code Check (Past) OK / NG Data for the smart key operation immediately preceding the current cycle Steering Lock Set / Unset Steering lock bar position Data List Definitions Technical Training 59 Technician Handbook Hi-Tech Update - Smart Key Parameter Value Description Steering Unlock Set / Unset Steering unlock detection EFI Code Receive OK / NG ID Code Box reply that G code is verified EFI Communication OK / NG ECM request to ID Code Box for G Code confirmation Hood Courtesy Switch OFF / ON Position of hood courtesy switch D_DOOR NCF Entry Unlock Mode Switching -Procedure: Ignition off, Press the Lock Button and any other button on the key fob for seconds while the key is in range of the tuner Unlock mode toggles between Driver Door (Default) and All Doors The wireless door lock sounds a double beep pattern -3 time for Driver Door and twice for All Doors RM Smart Access Data List item Door Unlock Mod -Mode status is displayed Options listed ALL, EACH, D_DOOR ALL / FRONT Per NCF: Function to choose the available area for the key to start E/G and cancel the Steering Lock CBEST adjustable, listed under Smart Access System as WARNING RM Smart Access Data List item Ignition Area -FRONT or ALL Door Unlock Mode Ignition Available Area ALL_DOORS? Data List Definitions Technical Training 60 Technician Handbook Hi-Tech Update - Smart Key Parameter Value Description Parking Wait Time 1.0s 2.0s 3.0s 5.5s Per NCF: Wait time to permit opening a door after locking Data list says 2.5s -this interval not listed in NCF CBEST adjustable, listed under Smart Access System as PARK WAIT TIME RM Smart Access Data List -0.5s, 1.5s, 2.5s, 5s Trunk Open Mode OFF / ON Per NCF: Function to permit opening a trunk with the key CBEST adjustable, listed under Smart Access System as TRUNK OPEN MODE RM Smart Access Data List -ON or OFF Key Low Battery Warning OFF / ON Per NCF: Setting a warning function for the first time when a key battery becomes weak CBEST adjustable, listed under Warning as KEY LOW-BATT WRN RM Smart Access Data List item Key Lo-Batt WRN -ON or OFF Panic Alarm Function OFF / ON ? Possible CBEST function not listed in NCF? Wireless Buzzer Volume Level7 RM Smart Access Data List -LEVEL 0, 1, 2, 3, 4, 5, 6, Passive Mode OFF / ON ? Possible CBEST function not listed in NCF? Warning By Horn OFF / ON ? Possible CBEST function not listed in NCF? Entry Delay Time 14s and others? ? Possible CBEST function not listed in NCF? Data List Definitions Technical Training 61 ... Technician Handbook Hi- Tech Update - Smart Key Step Event Conclusions When approaching a vehicle the LED on the Electronic Key flashes • Key is partially registered (Vehicle ID Code) to this vehicle... verified Smart Key Operation Summary Technical Training 25 Hi- Tech Update - Smart Key Technician Handbook What is the vehicle battery voltage? Was the car jumped, or did the battery go flat? Is the Smart. .. and ID Code box which allows permanent Immobilizer disable for this key cycle continued on next page Technical Training 18 Hi- Tech Update - Smart Key continued Technician Handbook Protect