GWM Engine

Immobilizer
 Improving little by little everyday

Contents

Chapter 1 Description of Immobilizer

Chapter 2 Structure and Composition of Immobilizer

Chapter 3 Difference in Immobilizer Principles

Chapter 4 Description of Immobilizer Matching

2-44
 Improving little by little everyday

Chapter 1 Description of Immobilizer

Presently, GWM engine immobilizers adopt the products of three
manufacturers, Delphi, STEC and DIAS.

Delphi immobilizer STEC immobilizer control unit DIAS immobilizer

control unit control unit

3-44
 Improving little by little everyday

Delphi immobilizer falls into Delphi gasoline engine

immobilizer, Delphi 2.8TC diesel fuel engine
immobilizer and Delphi 4D20 diesel fuel engine
immobilizer. Delphi gasoline engine immobilizers are
used for Haval, Wingle and Cowry gasoline cars; Delphi
2.8TC diesel fuel engine immobilizers are used for
Haval and Wingle 2.8TC diesel cars. Delphi 4D20 diesel
fuel engine immobilizers are used for Haval 4D20 Delphi
diesel cars.
STEC immobilizers are used for GWM Peri, Florid Haval
M1 (mini), Phelex and Voleex C30.
DIAS immobilizers are used for Coolbear and Haval M2.
4-44
 Improving little by little everyday

GWM Engine Immobilizer

Delphi STEC DIAS

immobilizer immobilizer immobilizer

Delphi Delphi diesel Delphi 4D20

gasoline engine 2.8TC diesel engine
engine immobilizer immobilizer
immobilizer

Haval, Haval and Haval 4D20 GWM Peri, Haval M1 Coolbear, Haval
Wingle and Wingle 2.8TC Delphi diesel (mini), Florid, Phelex, M2
Cowry diesel cars engine cars Voleex C30
gasoline
cars

5-44
 Improving little by little everyday

GWM engine immobilizers must pass the encrypted authentication of key

(with immobilizer transponder), immobilizer control unit and engine ECU
before starting.
When igniting, the user must communicate the key with transponder with the
immobilizer control unit to perform key authentication.

Engine
Coil

Immobilizer control
control unit module
(ECM)

When igniting, the user must After key After ECM passes
communicate the key with authentication, the authentication, the
transponder with the immobilizer will perform
communication engine can be normally
immobilizer controller to
authentication for ECM. started.
perform key authentication.

6-44
 Improving little by little everyday

Chapter 2 Structure and Composition of Immobilizer

The three immobilizers all consist of coil, transponder, control unit,
ECU, indicator lamp and connecting harness.

Immobilizer
control unit

Coil

Mechanical key

Immobilizer Transponder
indicator lamp

7-44
 Improving little by little everyday

Immobilizer subassembly-Immobilizer control unit

Immobilizer (IMMO):
This is an electronic control module including microprocessor and
several semiconductor elements. It is the core of the entire immobilizer
and the main functions include:
(1) Operation function
To achieve various encryption and decryption algorithm and compare
the data.

8-44
 Improving little by little everyday

Immobilizer subassembly-Immobilizer control unit

(2) Communication function
Through the two-way wireless data communication with transponder to achieve
encryption authentication of key
W-Line bus communication: to achieve encryption authentication of engine
management module; R-Line bus communication: to originate request signal to
immobilizer for ECU; K-Line bus communication: to achieve communication with
fault diagnostic tester and allow the entire immobilizer system matching, learning
and fault diagnosis. (STEC and DIAS)
K-Line bus communication: to achieve encryption authentication of engine
management module and communication with diagnostic tester. (Delphi
immobilizer)

9-44
 Improving little by little everyday

Immobilizer subassembly-Immobilizer control unit

STEC and DIAS immobilizer Delphi immobilizer

W-line

Engine
Immobil Engine Immobil K-line
ECU
izer R-line ECU izer
control control
unit unit

K-line

K-line
Cautio
n

Diagno Diagno
stic The diagnostic tester of STEC and stic
tester DIAS immobilizer communicates with tester
engine ECU through immobilizer
control unit and W-line
10-44
 Improving little by little everyday

Immobilizer subassembly-Immobilizer control unit

(3) Control function

– To achieve the task scheduling of overall system and
control the communication of all levels
(4) Drive function
– To drive the coil to yield electromagnetic signal and
supply energy required for transponder operation;
– To drive the immobilizer indicator lamp to work.

11-44
 Improving little by little everyday

Immobilizer subassembly-Immobilizer control unit

Cautio
n

Peri immobilizer
control unit

Phelex immobilizer
control unit
Peri and Florid immobilizer
system has been updated. The
transponder and immobilizer
ECU are the same as those used
Florid immobilizer in Phelex models.
control unit

12-44
 Improving little by little everyday

Immobilizer subassembly- Coil

Coil
– It is mounted in the ignition lock barrel and connected to the
immobilizer control module with a conductor of certain length. As the
load of immobilizer control module, it bears the task of transmitting
signal and energy between immobilizer control module and
transponder.

13-44
 Improving little by little everyday

Immobilizer subassembly- Coil

Immobilizer Coil resistance (Ω)

Delphi 30---32

STEC 5---30

DIAS 8---10

14-44
 Improving little by little everyday

Immobilizer subassembly-Transponder
Transponder:
– Each motor key has a transponder that contains a calculation chip
and a fine electromagnetic coil. This fine coil will complete the
transmission of signal and energy between the immobilizer control
module and transponder calculation chip together with the
immobilizer coil.
– The transponder is built in the key.

15-44
 Improving little by little everyday

Immobilizer subassembly-Transponder

– After the ignition switch is turned on, driven by immobilizer control

module, the coil will establish electromagnetic field around it. Through
the excitation of this field, the electromagnetic coil in the transponder
will supply the electric energy required for the immobilizer control unit
calculation chip operation and transmit various electronic data
information between the calculation chip and immobilizer control
module.
– In this way, the key requires no special power supply inside for the
operation of transponder and no periodic replacement of battery.
– Delphi immobilizer only allows the matching of two transponders;
STEC immobilizer allows the matching of 5 transponders; DIAS
immobilizer allows the matching of 8 transponders.

16-44
 Improving little by little everyday

Immobilizer subassembly-Transponder

Delphi
immobilizer
transponder

Delphi immobilizer transponder can match different

vehicles for many times

17-44
 Improving little by little everyday

Immobilizer subassembly-Transponder

Transponder Transponder after

before alteration alteration bears white
paint dot
Peri and Florid immobilizer system has been updated. The
transponder and immobilizer ECU are the same as those
used in Phelex models.
STEC and DIAS transponders can match in one vehicle only.
The matched transponder can perform matching with the
immobilizer control unit with the same password as that of
this transponder only.

18-44
 Improving little by little everyday

Immobilizer subassembly-Immobilizer indicator lamp

STEC immobilizer will be turned on when the ignition switch is turned off.
The indicator lamp will twinkle at a frequency of illuminating for 0.25s and
turning off for 4s.
With ignition switch in ON, if the authentication passes, the indicator lamp
will turn off; if the authentication fails, the indicator lamp will keep twinkling
while the engine service indicator lamp (the small wrench symbol) will
twinkle as well.

The immobilizer indicator lamp of Peri,

Haval M1 and Voleex C30 is integrated in
the instrument; the indicator lamp of Immobilizer indicator lamp of
Phelex is in the auxiliary instrument (at Florid is in the instrument desk
the electronic clock position).

19-44
 Improving little by little everyday

Immobilizer subassembly-Immobilizer indicator lamp

DIAS immobilizer will be turned on when the
ignition switch is turned off. The immobilizer
indicator lamp will twinkle at a frequency of
illuminating once every 5s.
With ignition switch in ON, if the authentication
passes, the indicator lamp will turn off; if the
authentication fails, the indicator lamp will keep
twinkling.
If the authentication of transponder and
immobilizer control unit fails, the immobilizer
Immobilizer
indicator lamp will illuminate once every 0.5s; if
indicator lamp
the authentication of immobilizer control unit
and engine ECU fails, the immobilizer indicator
lamp will illuminate once every 2s while the
engine service indicator lamp (the small
wrench symbol) will twinkle as well.

20-44
 Improving little by little everyday

Immobilizer subassembly-Immobilizer indicator lamp

Delphi immobilizer will be turned on when the ignition switch is turned off.
The immobilizer indicator lamp will twinkle at a frequency of illuminating
once for 50ms every 2s.
With ignition switch in ON, if the authentication passes, the indicator lamp
will turn off; if the authentication fails, the indicator lamp will keep twinkling
at a frequency of 1Hz and 50% duty ratio lamp will twinkle.

Immobilizer indicator lamp of Immobilizer indicator lamp of Cowry

Haval and Wingle is in the is in the front left windshield
instrument instrument desk
21-44
 Improving little by little everyday

Circuit diagram of Coolbear immobilizer

Ignition switch Immobilizer

A4 indicator lamp
A3
A1

A2
Battery

Diagnostic tester

A7
Key with
transponder B2

B3 A8

A5
Coil

22-44
 Improving little by little everyday

Definition of Coolbear immobilizer pins

Front view of immobilizer ECU connector A Front view of immobilizer ECU connector B
Definition of terminals:
Name of Meaning of
Terminal Name of Signal Meaning of Signal Terminal
Signal Signal
A1 Battery/KL.30 Battery positive B1 GND/KL.31 Preserved
A2 GND/KL.31 Ground B2 Coil Positive Coil positive
A3 Status LED Status LED B3 Coil Negative Coil negative
A4 Ignition/KL.15 Ignition switch B4 GND/KL.31 Ground
A5 R-Line R-line
A6 Preserved
Communication
A7 K-Line
diagnostic interface
Engine
A8 W-Line authentication
interface

23-44
 Improving little by little everyday

Circuit diagram of STEC immobilizer

Ignition
end

Indicat
or lamp ON + － +
A4 A1 Battery
Ignition _
switch A2

R-line
A5
LED Engine
Immobiliz W-line management
A3
er control A8 system
unit
A
B1
Coil
B B2
K-line
B3 A7 Diagnostic
Screening tester

24-44
 Improving little by little everyday

Definition of STEC immobilizer pins

7 5 3 1
3 2 1
8 6 4 2

Immobilizer control unit interface A pins Immobilizer control unit interface B pins

25-44
 Improving little by little everyday

Definition of STEC immobilizer pins

Definition of immobilizer control unit interface A pins Definition of immobilizer control unit interface B pins

Pin Pin No. Pin definition

Rated Operating
Pin definitio
voltage current Pin1 A end of coil connector
n
Pin 1 To B+ 12V <200mA
Pin2 B end of coil connector
Pin 2 Ground 0V <200mA
Pin3 GND

Pin 3 To LED 12V <50mA

Pin 4 To ON 12V <50mA

Pin 5 To R-LINE 12V <200mA

Not
Pin 6 --- ---
connected

Pin 7 To K-LINE 12V <200mA

Pin 8 To W-LINE 12v <200mA

26-44
 Improving little by little everyday

Circuit diagram of Delphi immobilizer

Ignition switch
B3
B4

Battery B2

Immobilizer ECU
Diagnost
ic tester

Engine
ECU B7
Warning lamp
B1

+12V A1

A3
Transponder Coil

27-44
 Improving little by little everyday

Definition of Delphi
immobilizer pins

B1 Warning Lamp A1 Coil positive

B2 GND A2 N/U
B3 IGN A3 Coil negative
B4 Battery
B5 N/U
B6 N/U
B7 K-Line (Diagnose)
B8 N/U

28-44
 Improving little by little everyday

Chapter 3 Principle of Immobilizer

Immobilizer authentication process- DIAS

Wireless communications authentication
– a) When the user inserts the key in the ignition lock and turns on the
ignition switch, the immobilizer control module will first challenge key
transponder ID through the coil of ignition lock and then the transponder
will transmit the unique ID to immobilizer control module for verification.
– b) After this, the immobilizer control module will transmit a set of random
electronic data to the key transponder, the chip of which will perform
specific operation through the received data together with Password and
SK and feed back the operation result to the immobilizer control module.
The control module in turn will compare this result and that calculated by
itself; if the results coincide, the system will authorize this key.

29-44
 Improving little by little everyday

Immobilizer authentication process-DIAS

Key - immobilizer module

authentication

30-44
 Improving little by little everyday

Immobilizer authentication process- DIAS

Bus communication authentication
– a) After authorizing the key, the immobilizer control module will originate the
authentication communication of engine management system control module
through the bus.
– b) Both will perform mutual authentication similar to the above. The engine
control module will perform specific encryption operation with its own PIN
together one random number and SK. The immobilizer control module will decrypt
the received data and verify the validity of PIN. If the PIN is consistent with the
pre-stored one, the immobilizer control module will return a set of random
electronic data to the engine control module, which will compare this result with
that made by the specific encryption operation. Where the results coincide, the
engine control module will perform the further operation to allow ignition, fuel
injection, ensure start and operation.

31-44
 Improving little by little everyday

Immobilizer authentication process- DIAS

Engine - immobilizer
module authentication

32-44
 Improving little by little everyday

Immobilizer authentication process- DIAS

Transponder Immobilizer control unit Electronic

injection control
unit

Key ID A1 Random
Key ID A1 Compare A1, A2 Key ID A2 Random
Key ID A2 number B
number B

PIN Encryption algorithm

Generating PIN Encryption algorithm
Encryption algorithm Generating (random number C, PIN, SK)
Encryption algorithm random number A (random number C, PIN, SK)
(random number A, Password, SK) random number A
(random number A, Password, SK)
Encryption algorithm
Encryption algorithm
(random number C, D2) Generating result
(random number C, D2) Generating result
Encryption algorithm D2
Encryption algorithm D2
(random number A, Password, SK)
(random number A, Password, SK)
Compare PIN
Specific
Specific
encryption
Generating result B12 encryption
Generating result B12 algorithm
Random algorithm
Random
number
number Random
E1 Random
E1 number
Generating result B1 number
Generating result B1 Compare B1, B2 E2
E2
Compare E1, E2

33-44
 Improving little by little everyday

Immobilizer authentication process- STEC (before system update)

Transponder Immobilizer control unit Electronic injection

control unit

Compare A1, A2 Key ID A2

Key ID A1 Key ID A2
Key ID A1

Random number B
Encryption algorithm Random number B
Encryption algorithm
(random number B, key C)
(random number B, key C)

Encryption algorithm
Encryption algorithm
(random number B, key C)
(random number B, key C)

Generating result D2
Generating result D2

Generating result D1 Compare D1, D2

Generating result D1

34-44
 Improving little by little everyday

Immobilizer authentication process- STEC (after system update)

Transponder Immobilizer control unit Electronic injection

control unit

Key ID A1 Compare
Key ID A1 A1, A2 Key ID A2
Key ID A2

Decryption algorithm Random number Encryption

Decryption algorithm Random number Encryption
(random number A, D1) A + transponder algorithm Transponder
(random number A, D1) A + transponder algorithm
password D1 after (random number password
password D1 after (random number
encryption A,
encryption A,
transponder
Transpo transponder
password) Encryption algorithm Random number B
nder Compare password) Encryption algorithm Random number B
password (random number B, key C)
passwor (random number B, key C)
Generating
d Generating
random
random
number A Encryption algorithm
number A Encryption algorithm
Recei Encryption algorithm (random number B, key C)
Encryption algorithm Receiver Generating result (random number B, key C)
ver (random number, Generating result
(random number, password D1
passw receiver password) D1
ord receiver password)
Generating result
Generating result
Decryption D2
Decryption D2
algorithm
Receiver password D2 algorithm Compare
Receiver password D2 (random
after encryption (random receiver
after encryption numbers, D2) Compare
numbers, D2) password
D1, D2

35-44
 Improving little by little everyday

Immobilizer authentication process- Delphi

Condition: the engine can be started only Transponder

after #1 and #2 password authentication The protocol of transponder and
passes! immobilizer control unit + enciphering
function form the front end encryption.

#1 password authentication Front end encryption

#2 password Password

authentication authentication
ECM Immobilizer Diagnostic
control unit tester

Terminal encryption
Service end encryption

The communication protocol of immobilizer control

The specific communication protocol of unit and diagnostic tester often follows some open
engine ECM and immobilizer ECU + entire vehicle protocols, therefore, it adopts some
enciphering function in the ECM and ECU strategies to effectively protect the vehicles against
form the terminal encryption. hostile attack of professional thieves.

36-44
 Improving little by little everyday

Chapter 4 Description of Immobilizer Matching

Immobilizer enciphered data

• The off-line matching process is one process of cryptographic data

generation and mutual transmission of immobilizer parts. Below is
the three main cryptographic data required for authentication of
immobilizer.

Key ID
Each transponder has the unique built-in feature code.

37-44
 Improving little by little everyday

Immobilizer enciphered data

Key code (SK)

The immobilizer control unit has built-in fixed number
or random number generated by immobilizer module
used for the key of immobilizer data encryption.

The key codes of Delphi and STEC immobilizer control units are built-in.
During immobilizer control unit learning, the key codes will become
consistent with those of current engine ECU.

New DIAS immobilizer control unit does not have built-in key code and the
codes will be generated randomly during system matching or written in
when learning immobilizer control unit.

38-44
 Improving little by little everyday

Immobilizer enciphered data

Personal identification number (PIN)

PIN is the authorization code to access diagnostic system

PIN of Delphi and STEC immobilizers is 4-bit consisting of hexadecimal figures

and letters.
PIN of DIAS immobilizer is 8-bit consisting of hexadecimal figures and letters.

Caution: PIN (user authorization code) should be provided by the user and
there security envelop for engine electronic immobilizer PIN in the
attached documents; where the user losses the password, he can apply in
"small wrench"- - - "information management"- - - -"engine electronic
immobilizer code read application sheet" and the After-Service Department
will handle the application. (refer to the figure in the next page)

39-44
 Improving little by little everyday

Immobilizer enciphered data

40-44
 Improving little by little everyday

Initial state
• During off-line matching or replacing new key, new engine ECU or
immobilizer control unit, ensure the standard immobilizer module (SIM),
key (transponder) and engine ECU are under initial state, as show in below
figure. Note: DIAS immobilizer new part does not have SK.

Key Immobilizer ECM

Initial state

41-44
 Improving little by little everyday

Matching state
• During off-line matching, ensure the standard immobilizer module (SIM),
key (transponder) and engine control module (ECM) are under initial state

Key Immobilizer ECM

Matching state

42-44
 Improving little by little everyday

Review of Course

Chapter 1 Description of Immobilizer

Chapter 2 Structure and Composition of Immobilizer

Chapter 3 Difference in Immobilizer Principles

Chapter 4 Description of Immobilizer Matching

43-44
 Improving little by little everyday

44-44