5008 (P87C) - D4EA08GSP0 - 22 - 18/01/2022 - Operation : Immobiliser (With keyle...

Page 1 of 3

OPERATION : IMMOBILISER (WITH KEYLESS ACCESS AND STARTING)

Figure : D4EAF84D

BSI1 : Built-in systems interface.

1320 : Engine management ECU.
"A" : The following steps are carried out in succession to identify and authenticate the hands-free identifier transponder :
• Request for identification of the hands-free identifier transponder
• Hands-free identifier transponder identifier recognised by the built-in systems interface
• Hands-free identifier transponder authentication request
• Authentication of the hands-free identifier transponder confirmed by the built-in systems interface
• Generation of the random "SEED" number by the engine ECU and sending of the number to the BSI
• Calculation of the "engine ECU key" by the engine ECU as a function of the random "SEED" number
• Calculation of the "built-in systems interface key" by the built-in systems interface in accordance with the random
"SEED" number and sending of the "built-in systems interface key" to the engine management ECU

"B" : Calculation of the "engine ECU key" by the engine ECU as a function of the random "SEED" number. Calculation of
the "built-in systems interface key" by the built-in systems interface in accordance with the random "SEED" number and
sending of the "built-in systems interface key" to the engine management ECU.
"C" : Comparison of the "built-in systems interface key" and "engine management ECU key".
"D" : The "built-in systems interface key" and the "engine management ECU key" are identical : The engine ECU is
unlocked, the unlocking status is transmitted every 100 milliseconds.
"E" : Starting of the engine is authorised.
The engine ECU remains locked and prohibits the starting of the engine in the following instances :
• The identification of the hands-free identifier transponder has not been recognised by the built-in systems interface
• The authentication of the hands-free identifier transponder is not validated by the built-in systems interface
• The "built-in systems interface key" is different from the "engine management ECU key"

1. Request for identification of the hands-free identifier transponder

The identification procedure consists of interrogating the hands-free identifier transponder via the vehicle’s interior aerials to
obtain the hands-free identifier transponder identifier.
The built-in systems interface controls the vehicle’s interior aerials.
The interior aerials generate a low frequency signal (125 kHz) towards the hands-free identifier.

https://servicebox.peugeot.com/docapvpr/affiche.do?ref=D4EA08GSP0&refaff=D4E... 22/04/2022
5008 (P87C) - D4EA08GSP0 - 22 - 18/01/2022 - Operation : Immobiliser (With keyle... Page 2 of 3

The hands-free identifier transponder responds by sending its own transponder identifier, by high frequency (433, 92 MHz),
to the built-in systems interface.
The hands-free identifier transponder identifier is compared with the hands-free identifier identifiers memorised in the built-
in systems interface : The authentication procedure for the hands-free identifier transponder can begin.
If the hands-free identifier transponder identifier is not memorised in the built-in systems interface : The procedure is
repeated every 700 ms.
Otherwise the system remains locked.
The hands-free identifier transponder identification procedure is triggered in the following cases :
• Each time the built-in systems interface is triggered, every 100 ms for 2 minutes (opening of the driver’s door or a
hands-free opening for example)
• When the ignition appears, if no response is transmitted before the end of the 2 minutes

N.B. : The built-in systems interface can memorise a maximum of 5 different hands-free identifiers.

2. Hands-free identifier transponder authentication request

Once the hands-free identifier transponder has been identified, the built-in systems interface sends a request for
authentication of the hands-free identifier transponder via the vehicle’s interior aerials.
The hands-free identifier authentication request sent by the built-in systems interface contains the following elements :
• A "RANDOM" variable determined by the built-in systems interface
• A transponder password encrypted using an encrypting function

The transponder password and the "RANDOM" variable are determined from the "built-in systems interface code" and the
hands-free identifier transponder identifier.

N.B. : The "built-in systems interface code" is identical to the confidential code indicated on the customer card but coded
in another form.

The authentication differs from the identification by the fact that the built-in systems interface and the hands-free identifier
transponder perform a calculation using variables which depend on the built-in systems interface (built-in systems interface
code) and the hands-free identifier.
When the hands-free identifier transponder receives the authentication request, it performs a calculation.
The hands-free identifier transponder performs a calculation when it receives an authentication request from the following
components :
• Built-in systems interface
• Backup transponder aerial (*)

The hands-free identifier transponder sends the result of the authentication calculation to the following components :
• Backup transponder aerial (*)
• Built-in systems interface

N.B. : (*) Applicable in backup mode only.

The results calculated by the hands-free identifier transponder and by the built-in systems interface are compared.
If the results are identical, the authentication request is validated, if not then the system remains locked.
If the results are not identical :
• The built-in systems interface re-sends a random variable a maximum of 2 times
• At the third invalid attempt, 1 minute must elapse before a further authentication request is permitted (anti-scanning
function)

3. Request for authentication : Built-in systems interface / Engine management ECU

3.1. Unlocking of the engine management ECU
The engine management ECU sends a request for confirmation of unlocking every 2 minutes once the engine speed and the
vehicle speed are zero. In the event of a failure, the engine ECU locks after one minute.
The engine management ECU unlocking status is transmitted every 100 milliseconds via the CAN to the remote controlled
triggering system.
The built-in systems interface sends an anticipated triggering signal to the engine management ECU via the remote
controlled triggering line associated with a message in the CAN bus partial triggering datastream.
The engine management ECU sends an unlocking request to the built-in systems interface in the form of a random "SEED"
number.
When the random "SEED" number is received, the built-in systems interface performs a mathematical calculation using the
random "SEED" number with its own encryption functions and the programmed coded immobiliser code.

https://servicebox.peugeot.com/docapvpr/affiche.do?ref=D4EA08GSP0&refaff=D4E... 22/04/2022
5008 (P87C) - D4EA08GSP0 - 22 - 18/01/2022 - Operation : Immobiliser (With keyle... Page 3 of 3

The programming of a coded immobiliser code is only possible if the non-volatile memory has a fixed initial coded
immobiliser code programmed on leaving the parts manufacturer’s factory.

N.B. : The result is called the "built-in systems interface key".

During this time, the engine management ECU performs the same calculation (using the programmed coded immobiliser
code and its own encrypting functions) the result of which is called the "engine management ECU key".
The "built-in systems interface key" is transmitted to the engine management ECU :
• If the "built-in systems interface key" is equal to the "engine management ECU key", the engine management ECU
unlocks and the engine management functions are rendered active, meaning that the built-in systems interface and the
engine management ECU have an identical programmed coded immobiliser code
• If the "built-in systems interface key" is different from the "engine management ECU key", the engine management
ECU remains locked and sends the built-in systems interface another random "SEED" number, meaning that the
built-in systems interface and the engine management ECU have a different programmed coded immobiliser code
• If the engine management ECU does not receive a "built-in systems interface key" response, the engine management
ECU remains locked and sends the built-in systems the same random "SEED" number

N.B. : The engine management ECU unlocking sequence is deactivated for 1 minute after 4 unsuccessful engine
management ECU unlocking procedures.

N.B. : If no random number is received during the first 10 seconds after the ignition is switched on, a message is displayed
on the instrument panel and/or on the multifunction screen.

3.2. Locking of the engine management ECU

The engine management ECU is locked in the following cases :
• Following an engine management ECU supply cut-off
• Following a locking request, when the ignition is switched off

The engine management ECU locking sequence when the ignition is switched off is broken down as follows :
• The engine management ECU receives a locking request
• The engine management ECU starts a timed period of 6 seconds
• At the end of the timed period, the engine management ECU locks
• The engine cannot be started

https://servicebox.peugeot.com/docapvpr/affiche.do?ref=D4EA08GSP0&refaff=D4E... 22/04/2022