Section 9.2: Security and Keyless Entry Systems

ASE A6 Electrical/Electronic Systems Exam

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: General Electrical Diagnosis

Section 1.1: Ohm's Law and Circuit Principles Section 1.2: Wiring Schematics and Diagrams Section 1.3: Digital Multimeter (DMM) Operations 1.4 Oscilloscope Waveform Analysis 1.5 Circuit Faults Diagnosis

2 Chapter 2: Vehicle Networking & Communication

2.1 CAN Bus Network Diagnosis 2.2 LIN and MOST Bus Networks

3 Chapter 3: Batteries & Battery Management

Section 3.1: Battery Technologies Section 3.2: Battery Testing and Service

4 Chapter 4: Starting System Diagnosis & Repair

Section 4.1: Starter Circuit and Solenoid Diagnostics Section 4.2: Starter Control Circuit Diagnostics Section 4.3: Cranking System Symptoms

5 Chapter 5: Charging System Diagnosis & Repair

5.1 Alternator Principles and Output Testing 5.2 Voltage Regulation and Circuit Diagnostics 5.3 Smart Charging and Load Management

6 Chapter 6: Lighting Systems Diagnosis & Repair

6.1 Headlight Systems 6.2 Turn Signals and Hazard Systems 6.3 Interior and Accessory Lighting 6.4 Trailer Wiring and Brake Control

7 Chapter 7: Instrument Cluster & Driver Information

Section 7.1: Gauges and Sending Units Section 7.2: Warning Lamps and Prove-Out Section 7.3: Digital Displays and Driver Info

8 Chapter 8: Passenger Comfort & Convenience

8.1 HVAC Electrical Controls 8.2 Power Window, Lock, and Mirror Circuits 8.3 Power Seats and Memory Systems

9 Chapter 9: Safety & Security Systems

Section 9.1: Supplemental Restraint Systems (SRS) Section 9.2: Security and Keyless Entry Systems

Section 9.2: Security and Keyless Entry Systems

Key Takeaways Explain This Topic AI

Transponder immobilizers use low-frequency electromagnetic fields (125-134 kHz) to passively power keys and authorize starting.

Remote keyless entry (RKE) systems operate at higher frequencies (315 or 433 MHz) and utilize rolling codes to prevent replay attacks.

A dead smart key fob battery disables active entry/starting, but starting remains possible by placing the fob in the backup slot.

Testing keyless entry systems involves verifying UHF fob transmission and using sniffer loops to confirm LF exciter ring activity.

Last updated: July 2026

Security and Keyless Entry Systems
Immobilizer and Keyless Access Principles

Automotive security systems are split into two primary functions: passive theft prevention (immobilizers) and user convenience (remote keyless entry and push-button start).

Transponder Immobilizer Systems

A passive transponder immobilizer prevents engine operation unless a programmed key is detected:

Exciter Ring : An electromagnetic coil around the ignition cylinder (or start button) that emits a Low Frequency (LF) field (125–134 kHz).

Transponder Chip : Embedded in the key head. Powered inductively by the exciter ring field, it has no battery.

Data Handshake : The chip transmits its unique ID to the immobilizer module, which sends a cryptographic challenge. The key computes a response using rolling codes.

Start Authorization : If the response is verified, the immobilizer sends a CAN bus start authorization to the Engine Control Module (ECM). If invalid, the ECM disables fuel injection or ignition.

Remote Keyless Entry (RKE)

RKE systems operate at High Frequency (315 MHz in North America, 433 MHz in Europe). Pressing a fob button transmits a command containing a serial number and rolling code counter. A receiver module decodes this, validates the rolling code to block replay attacks, and commands lock actuators via the BCM.

Passive Entry Passive Start (PEPS)

PEPS systems provide keyless door entry and push-button starting:

Detection Zones : LF antennas in handles and the cabin broadcast search signals.

Fob Response : Entering a zone awakens the fob to transmit a UHF response to the vehicle receiver.

Triangulation : The BCM compares signal strengths from antennas to locate the fob (inside vs. outside), preventing vehicle start if the fob is outside, or locking keys inside.

Anti-Theft Alarm Systems

Alarms monitor perimeter security (hood, trunk, door switches). High-end systems add volumetric sensors (motion) and tilt sensors. If breached, the BCM sounds the horn/siren, flashes lights, and disables cranking.

Diagnostic and Programming Procedures
Common System Failure Modes

Dead Fob Battery : Prevents LF wake-up. Placing the fob against the backup slot or start button allows inductive powering via the exciter ring to authorize starting.

LF Antenna Faults : Water intrusion in door handle antennas can short the LF antenna bus, disabling keyless entry detection and triggering key-not-found warnings.

Radio Frequency Interference : Aftermarket chargers or electronics can block the 315/433 MHz UHF signals, preventing remote operations.

Diagnostic Flow and Sniffer Tools

Verify Fob Output : Use an RF signal detector to confirm UHF output. Replace battery if signal is weak or missing.

Test Exciter Ring : Use an LED transponder sniffer loop over the ignition switch/button during cranking. If it flashes, the LF exciter field is present.

Scan Tool Live Data : Monitor programmed key count, ignition excitation status, transponder authorization, and security lamp states.

Key Programming Requirements

Security Access : Adding keys requires a manufacturer security PIN obtained via the vehicle VIN.

Immobilizer-PCM Sync : Replacing modules requires a sync handshake. Without it, the engine cranks but will not start.

System Components & Frequencies

Component Operating Frequency Power Source Function

Exciter Ring / Antenna 125 kHz / 134 kHz Vehicle 12V (induced field) Powers passive transponders and polls for smart keys.

Passive Transponder 125 kHz / 134 kHz Induced RF energy (no battery) Emergency vehicle starting and backup authorization.

RKE/PEPS Fob Response 315 MHz / 433 MHz Internal CR2032 Battery Transmits command and authorization codes to the vehicle.

Volumetric Sensor High Frequency Ultrasound Vehicle 12V Detects interior cabin movement when armed.

Real-World Technician Scenario
Case Study: Push-Button Start Inoperative with "No Key Detected"

A hybrid SUV is towed to the shop with a no-start condition. The instrument panel displays "No Key Detected" when the power button is pressed, and the security indicator flashes rapidly.

The technician first verifies if the backup transponder works by holding the fob directly against the power button. The vehicle starts immediately. This confirms that the transponder chip inside the fob and the exciter ring around the start button are functioning, and the fault lies in the active PEPS circuit.

Using a scan tool, the technician reads live data from the PEPS system. A DTC is stored: B1A11 - LF Antenna Circuit Short to Ground . The technician checks the passenger and driver door door-handle antennas. Visual inspection of the driver's door handle reveals corrosion and green crust within the connector pins due to a torn weather seal. The technician cleans the connector, replaces the door handle antenna assembly, clears the code, and verifies that passive entry and start functions work normally without using the backup slot.

Section 9.2 Summary & Key Tips

Backup Slot Start : Always check the owner's manual for the exact backup transponder slot location when diagnosing "No Key Detected" faults.

Handshake Codes : Immobilizer modules and PCMs exchange unique rolling codes. If they fall out of sync (often due to battery drain during cranking), a key-learn or synchronization procedure is required.

RF Interference : Inform customers that mounting cell phone holders or radar detectors near the vehicle's interior RF receiver can block fob signals.