When you click on links to various merchants on this site and make a purchase, this can result in this site earning a commission. Affiliate programs and affiliations include, but are not limited to, the eBay Partner Network.
I see what you are doing, creating two antennas around the key itself and the key cylinder, which allows the key to be placed far away from the cylinder. Very nice little trick, I like Have you done any tests on distance/range the key needs to be within (in normal operation) to disable the immobilizer? I want the key to be far enough away from the cylinder to prevent someone shoving a screwdriver in there and starting it up, but not so far away as to have to weak of a signal from the antenna setup.
Looks like I need to spend some time on the net looking at some of the RF setups for specs. Thanks for the idea.
I have spent some time playing with my car trying to get the remote start to work. Here's what I have learned:
1. The immobilizer system does more than just kill the fuel pump relay like the book suggests. I got the fuel pump running manually but the car will still not start. My guess is the ECU kills either spark or injectors in addition to fuel pump.
2. The immobilizer sends data, and lots of it. There is a sync pulse from the ECU, and the key responds with about 40ms worth of 20kbps data.
3. The DEI model 555H that works on some Hondas and Acuras does NOT work on the S2000. This model does not require a spare key be left in the car, it works by memorizing the code so it can play it back on demand. Too bad.
4. I cannot get the car to start by leaving a key under, behind, on top of, next to, touching, or even partway in the key cylinder. Will not start. Period. If I put the key in all the way, it starts fine.
MacGyver - if you find anything different, let me know. Right now my remote start project is on hold till I decide if I'm going to try to build my own "immobilizer code clone box" or just give up and put a key in the car. I really don't like the key in the car idea.
Here's a pic of the data (part of it) upper is data, lower is sync, though I'm used to seeing a continuous sync, not one that starts and stops like this. Almost looks like it's queing the immobilizer chip to "send another byte of the code".
This is what I was afraid of, and actually more of what I expected. Those RF chips are fairly advanced, so to merely send out a simple yay/nay decision seemed to be a waste of power. since you have spent some face time with the 555H, can you take a guess as to why it doesn't work with the S2000?
If Steve allows me to, I'll try to look more heavily into the internal workings of the cylinder. There may be a switch in there somewhere that is only tripped when the key is fully inserted (something easily remedied). I looked at the installation manual for the Concept 600 and there didn't seem to be anything special in the install that would help the remote start. In fact, that system uses the Intellistart addon, as well. I do have to wonder, however, how other people are getting their systems to work on their S2000s when you are having difficulties...yours is a 2000, right?
Are the two streams shown above roughly in sync with each other, as shown? The sync pulses seem to be happening in sets of 8, possibly to provide timing/sync for byte transfers. I think I can dig up some info on generic RF ID tags, and that might give us a quick look into basic RF tag operation and how much data we can expect them to transfer.
No matter how you do it, you're basically getting rid of the immobilizer function. Having the key or the chip in the car defeats the whole idea. What you're doing is basically bypassing the system and replacing it with another one which is only as good as your alarm but does not provide the "passive" security anymore. If you're gonna do it anyways, you might as well just take the chip out of the key and permanently place it somewhere around the ignition switch.
I don't understand why modifry is not able to start the car with the key even halfway into the key cylinder. Strange.
Personally, I'd rather get an engine block heater. I've noticed in summer it does not take a lot to warm up this car. It's one of the most "quickly warming" car that I've ever owned.
Originally posted by mas No matter how you do it, you're basically getting rid of the immobilizer function. Having the key or the chip in the car defeats the whole idea. What you're doing is basically bypassing the system and replacing it with another one which is only as good as your alarm but does not provide the "passive" security anymore.
Yes, getting remote start to work does compromise the immobilizer system, but that doesn't mean there is no passive security, or that the immobilizer is not functioning. How many car thieves will take the time to dissassemble the streering column shroud, trace out the wires to locate the bypass box, bring enough test gear with them to figure out which wires to short, ground, or hook to +12 volts, in order to activate the immobilizer bypass system. It would be far faster and easier to bring a paired ECM and ignition key with them.
Now I agree it would be simpler for a thief if a key were present in the car, especially if it's not well hidden and is part of a commercial (known) immobilizer bypass system. That's why I don't want to leave a key in the car.
Originally posted by mas I don't understand why modifry is not able to start the car with the key even halfway into the key cylinder. Strange.
I'd like to know that too. I hear about people doing this, but have not heard (directly) from anyone who has done it on an S2000. I did not have the key halfway in, just enough so it would not fall out. After having no luck with the key in other positions, I figured trying it partway in would quickly tell me if it would work at all. It could simply be as MacGyver suspects, that the ECM needs to see the "key inserted" signal, and I purposefully did not insert it far enough to trip that switch. Maybe Mac will verify that this weekend.
Originally posted by mas Personally, I'd rather get an engine block heater. I've noticed in summer it does not take a lot to warm up this car. It's one of the most "quickly warming" car that I've ever owned.
I agree, the car warms up pretty quick in the summer, but at 20 degrees, it's a little slow. And I can't use an engine block heater at the hotel, or work, which is where the car is 80% of the time. And the block heater won't do much good to warm up the insides and defrost the windows either, or cool it down in the summer.
I do frequently use the "quick-stop" feature where once the car is started you can remove the ignition key, lock the car, and have it still running. I would use it less if I had remote start working, it would save me the trip to the car.
MacGyver - Mine is a MY 2000. Since the 555H is supposed to work with other Honda and Acura vehicles (99-01 Accord, Odyssey, and 01 Acura MDX, Integra, TL) but is such a limited list of models and years, I suspect the S2000 may either send more data or the data rate is different. Or, it's a rolling code. The 555H is supposed to learn your code during a remote start when the key is left in the cylinder, and it blinks an LED to indicate a successful learning process. My LED does not blink the correct code, and it will not start after the learning sequence. I figured I'd speak to DEI about it so I went to their web site, but they tell you right there they won't talk to you, you have to go through a dealer, and I knew that would be a waste of time.
The traces I posted are from an excel spreadsheet made from the data export of my PC scope, so what you see is exactly what got captured. Bear in mind it's a cheap scope and I've learned that it's limited bandwidth and sampling rate causes glitches in the trace that do not exist in real life, but the general wave form and timing is correct.
I just got a new PC scope today with better bandwidth, higher sampling rate, and a crap-load of memory, so I plan on getting some more traces. The fact that the sync pulses are not a simple square wave bothers me, and suggests 2-way communication to the key chip, which I suspect means either a rolling code or encryption. Phooey.
[QUOTE]Originally posted by modifry
[B]Yes, getting remote start to work does compromise the immobilizer system, but that doesn't mean there is no passive security, or that the immobilizer is not functioning.
Originally posted by funkylemons
Dont mean to dice up your post but I disagree with you on some things..
No problem, that's what this board is for, discussion and dissemination of facts and opinions. Your opinions on this subject are worthwhile because you are an experienced auto installer.
Originally posted by funkylemons If the theif knows what hes doing, he knows all about 555 modules from DEI.. they are EASY to find.. rip off the stearing column shroud, no thief would ever dissassemble it.. much easier to break it.. the price of a new shroud is pretty small compaired to the nice new car he just scored... find the ring around the key cyl... usually well.. around the key cyl.. so thats pretty easy to locate.. and follow the wire to the module.. then off the module.. there should be 2 wires coming out.. aside from the key cyl ring.. a power and a ground.. the ground should be blue/black(this would connnect to the active out on the starter) and the power might be red?(usually either connects to constant 12 or ignition) it doesnt matter, ground the blue black and supply a constant 12V to the other while you start the car, that will activate the relay within the 555 module and the car will start.. after that you can let go of the wires.. the transponder is not needed to keep the car running.. its only needed to start the car...
For my purposes, I'm not talking about the 555U, only the 555H or another unit like it. That means I can hide it anywhere, and it won't be within easy reach of the would-be-thief. If you saw the wires going into the transmission tunnel under the radio, where would you look for the module?
What if I put the module inside another box? What if I took the PC board out and mounted it inside my power amp? What if I changed all the wire colors on the unit, and changed colors in mid-harness? What if you have to first lock the doors, then activate the auxiliary function on the alarm, before the 555H is enabled? Any of these things are possible, and some of them will be done on my car, no matter which device I use as a work-around for the immobilizer function.
I think my advantage here is that I'm NOT an auto alarm installer, and I won't do things like "normal". My real hope is that I make my own immobilizer clone box, which can be reasonably difficult to compromise since it's non-standard.
And while everything you put in your post can be found out elsewhere, I'm not sure that telling the world in step-by-step detail how to steal a car with a remote start system is in everyone's best interests.
For those interested in updates...there are none Due to scheduling conflicts, I won't have access to Steve's car for another week and a half. I will most likely install the alarm first to make sure he's partially happy, then play around with the immobilizer as time permits.
spend the extra money and fork out for a 555u. It will save you time, and be more reliable. When installing my dei viper 790 remote start i had problemsfinding a acc. wire on any tech sheets. Has anyone installed their RS and found the acc. wire allowing your heater to work while car is remote started?( sory to get off topic but i just can't seem to find a solution.
01-31-2003, 12:24 PM
Have you done any tests on distance/range the key needs to be within (in normal operation) to disable the immobilizer? I want the key to be far enough away from the cylinder to prevent someone shoving a screwdriver in there and starting it up, but not so far away as to have to weak of a signal from the antenna setup.
Due to scheduling conflicts, I won't have access to Steve's car for another week and a half. I will most likely install the alarm first to make sure he's partially happy, then play around with the immobilizer as time permits.
