Content brought to you by Motor Age. To subscribe, click here.
What You Will Learn:
• Immobilizers function only a few different ways
• Known-good waveforms can often be found in the service information
• Networking is what takes to solve the most complex issues experienced today
I’m a pretty decent diagnostic tech. But like many of us, there are certain things that I cannot seem to get my head around. For me, it’s immobilizer systems on Asian vehicles. Yes, laugh and giggle; I don’t understand it myself. Immobilizer systems on German vehicles are far more complex and convoluted, but for whatever reason, I just understand them.
I operate an ADAS, diagnostic, and programming shop with a mobile service. I cater to collision repair shops and try to be the complete answer to their needs. My usual day-to-day consists of finding the broken wires, programming new modules, and explaining to body shops that the radar in the front of their vehicle does indeed need to be calibrated – even though the light isn’t on. But occasionally, something truly “fun” drives through the door.
The problem child
The “fun” vehicle was a 2005 Toyota Highlander. I was called to diagnose a crank/no-start condition. The shop already threw plugs, coils and a MAF at the vehicle and then decided to call me.
I started by cranking the vehicle over. It started for a split second and died. It then just cranked and cranked. This sounded like a security/alarm type issue to me. I hooked up my scan tool and performed a vehicle scan. The only code that showed was B2799 – “Immobilizer ("immo") system malfunction.”
When scanning the vehicle, I noticed that the immobilizer module stopped communicating after a few minutes. That made me curious, but I was trying not to “get lost in the sauce.” So, I thought, what does a module need for communication? Voltage, ground, and a proper infrastructure. So, I figured let’s start with something simple. According to the diagram for the immobilizer system, the transponder key ECU (immo box) is powered by the 10A IGN fuse and the ECU-B fuse (Figure 1).
Slow down to speed up
I sensed myself going a little too far without enough background information. Why was the computer flagging this DTC? According to code-setting criteria, this DTC sets when the ECM detects an error in communication with the immo box (Figure 2). Armed with this info and the no-comms issue that I was experiencing, I needed to get access to this box. This immo box is located “conveniently” up in the dash, mounted upside-down and backward, right under the windshield (Figure 3). I had the shop remove the glove box so I could access the wiring. Once I had access, I was able to inspect the wiring. I pulled the immo box down and was able to see the issue; it was full of water (Figure 4). I made the call to replace the immo box after confirming good voltage and ground supply to it.
It’s fixed, right?
The customer called back two days later with the new immo box installed. This is where my palms began to sweat. Like I mentioned before, Asian immobilizers and I do not get along. The service information outlines the registration procedure for the immo box and the keys. It involves putting the vehicle in registration mode and following the prompts on the scan tool. After the registration process is over, you “handshake” the modules by jumping DLC pins 4 and 13 for 30 minutes (Figure 5). After this, the vehicle should start.
I started the procedure and was quickly booted from it, as the keys were already registered. The Toyota dealer was down the street, and the keys were cheap, so I had the customer get me a new key. With the new key in hand, I was able to complete the registration process. Next came the handshake. So, I jumped DLC pins 4 and 13 for 30 minutes. However, the vehicle did not start. I scanned for codes and saw the ECM still had the B2799 code stored.
Research, research, research...
One of the great things about Toyota service information is they give you pinout values and known-good scope patterns when applicable.
Going back to the immobilizer system diagram, the code refers to an issue on the EFIO and EFII lines between the ECM and the immo box. A deeper dive into service information showed us known-good waveforms for these signals (Figure 6).
These two signals go between the ECM and immo box to communicate that a valid key has been inserted to allow the vehicle to start. It sounded simple enough, so I hooked up my scope to the EFIO and EFII wires and got a pattern (Figure 7). This pattern told me the communication lines were up and working and were not shorted.
According to this, it looked like the ECM did not like what the immo box was saying. I knew I had good keys; they took the registration, and I knew the immo box was talking and sending a signal to the ECM. I had no other choice than to condemn the ECM. The ECM is bolted directly under the immo box, so it is feasible that it could have gotten wet. I told the customer to get another ECM and I would be back to marry it to the vehicle. The customer called me back the next day when the used replacement ECM arrived. I hooked it up, performed the registration process, and I still got the B2799 in the ECM. I went through all the data; the keys were registered and there were no inhibitors preventing the engine from starting. I asked the customer to have it brought to my facility, where I could spend all the time I needed with it, without having to keep an eye on the clock.
Calling in the reinforcements
Once it was at my location, I decided to use one of my lifelines; I needed to make sure I was not missing something. My good friend Tomi Oliva is my go-to guy for all things immobilizer and EEPROM. He owns SJ Auto Solutions in Chicago and has gotten me out of many jams. I had him walk me through the registration process to make sure I was not missing anything, but it turned out I wasn’t. He went through the data PIDS with me and observed that this vehicle should start. He waited on the phone with me while we did the module handshake multiple times, and still nothing.
He then offered to marry the modules on the bench. He told me that sometimes these older Toyota immo systems need a little help. I gladly packed up both ECMs, all the keys, and the new immo box and sent the package to him He called me after a few days and informed me that my original ECM was corrupted and would not read any immo data, but he was able to read and input data into the used replacement. A few days later, I got the modules back. Tomi said they were married on the bench and should start right up. I installed all the modules, but this B2799 code would not go away.
In oversight, perhaps?
I had to be missing something. According to service info, this vehicle should start. I decided to use another phone-a-friend lifeline to P.J. Walter, a former Toyota dealer tech who just left the dealership and opened his own mobile ADAS, programming, and diagnostic company in Pittsburgh. He is awesome for helping me out when any kind of Toyota rears its ugly head. P.J. went through the registration process and module handshake with me, and all seemed fine. He kept returning his attention to the EFIO and EFII wires, because that was what the ECM was “complaining about.” He went through his collection of service information, and it showed the same results I had: there should be a square wave signal riding on those two wires, and it should look like the known-good examples in the service info.
We did notice an issue, though. The known-good patterns did not have a usable voltage scale on them. Luckily, P.J. (being the amazing tech that he is) had a known-good scope capture from Toyota with real values in it. IMO and IMI are the same lines as EFIO and EFII, just at the ECM.
This is where we noticed a discrepancy. The known good values for these signals were all at 12V. One of my signals was at 5V; this made no sense. I went up and down a bunch of years in service info. and saw no change in patterns, and P.J. did the same on his side. There was no change in information. The part numbers on the ECM and immo box were the same as well, but I had a theory.
That ‘lightbulb’ moment
The computer was flagging a B2799 because it did not like what it saw coming from the immo box. What if the ECM was expecting a 12V signal and the immo box was only producing a 5V signal? If this was the case, the ECM would never see the signal because it was looking for a much higher voltage.
Computers must see a voltage cross a threshold. If the voltage never reaches a threshold, it never happened. Therefore, its only recourse is to flag a B2799 and not allow the vehicle to start. Unplugging the modules and reading what came out of them was inconclusive. The only answer we could come up with is we needed a known-good same vehicle. This is where P.J. had to use one of his lifelines.
He had a friend who just so happened to have the same year Highlander. He asked him to scope his EFIO and EFII lines. I got the text the next day that the 05 had a 5V pattern on both lines (Figure 8). That was enough to confirm the diagnosis for me. P.J. and I talked it out and realized that the EFIO and EFII lines are only between the ECM and immo box. If I were able to get a matching set of computers out of a running vehicle, it wouldn’t matter if it were 12v or 5v; the modules were already matched and would work fine.
He shoots, he scores
I happened to find a pair of modules in a salvage yard from a known-good running vehicle. I bought them, installed them, registered the keys, wrote the VIN into the ECM, and successfully started the vehicle with no DTCs stored (Figure 9).
What is the moral of the story? Well, there could be a couple. One could be that you should not be afraid to try new things; just do your research and go over all the steps. The second thing, and what I would call most important, is no one person is an island. There is help out there. We all have friends. There is always a chance that they or someone they know may have information that you are lacking to get to the next step in a diagnosis. Use all the tools available to you, even some unconventional ones. There is a meme out there that says, “Is it stupid if it worked?” Sometimes that rings true.
