Mercedes DAS3 Drive Authorization Immobilizer
Time for a crash course on MB Immobilization issues. You're most likely to work on "DAS3" systems which were phased in in the early 2000s. DAS3 keys are easy to recognize, they don't use a blade to turn the ignition. There's also an infrared port on the tip of the key.
So, some important notes about those keys. They have a battery inside but that battery is only for the remote locking functions, it will never prevent the car from cranking. Take the battery out and try starting the car if you're a "seeing is believing" type of person like me. There's an inductive coil inside the ignition switch that turns on when it detects the key is inserted. It pulses at 125khz.
The keys are NOT serviceable. They're programmed ONCE at the factory in Germany using the vehicle production data record, probably "FDOK" where the SA codes (option codes) are stored. When you get a new key from the dealer (3 days turn around from Germany is typical), it should stick right into the car and fire it up if the problem was only a bad key. There are no adaptations or programming procedures for any of these vehicles for the last 20 years or so. Don't try to buy ebay keys, don't try to buy used keys, don't buy them anywhere but the dealer.
Caveat: if you know MB well, you may know some of the very latest cars use DAS4 with keys that can be programmed at the dealer only. They're not failing in the aftermarket much yet so I'm glossing over it. Be advised, even if you can't program the keys, some dealers have still sold them to people.
A really common issue is that the key will not turn on older vehicles with steering locks, so 202, 208 210, 203, 209. In general newer vehicles like the 204 C-Class will allow you to turn the key even if they are equipped with a steering lock, but the electrical power will not switch on.
So, how do you diagnose it, in general? Does the customer have a second key? No? BUY A KEY! No really, buy a second key. The other drive authorization components are substantially more expensive, and it is very difficult on the older cars to determine whether a key-won't-turn issue is a steering lock, EIS, or key. Keep in mind an ignition switch also has a fair amount of labor involved in R&R. I recommend that you do not reassemble the vehicle until you have verified that it works. Besides being cheaper to start with a key and more effective diagnostically, the customer also really needs to have a second key for the car!!! So typically there is about a 3-day out-lay from when you order a key to when you actually get one, but in the past week I've heard two customers report that the DAS3 keys are back ordered, one customer waited 2 weeks. One other note; our experiences vary but none of these parts - key, ignition switch, or steering lock are reliable components. The other modules in the system are considerably rarer to cause drive authorization problems.
Speaking of buying keys - you will need a locksmith ID (NASTF LSID) to purchase them from the dealer and documentation proving identity and ownership of the vehicle from the customer. Some dealers are refusing to sell keys but if you have all your ducks in a row they are (legally?) required to do so and you can try filing a complaint with NASTF. The issue is that there are extremely extremely strict policies in place by Mercedes at the dealer level. If a dealer gets audited and failed they could be fined very large amounts and lose their ability to obtain DAS3 keys! This makes the parts guys sweat. It's probably why they try to avoid selling keys to the A/M in some areas.
If you go on Startekinfo.com even without an account you can view Mercedes' Theft Relevant Parts policy and ordering information.
So what defines a theft relevant part? On any given car there are generally 3 systems that are affected: power distribution and starter, engine management, and transmission shifting/function.
Vehicles without a steering lock generally have a * high security * shifter instead. So 220, 215, and 230 for example. On these particular cars if the vehicle is immobilized you can turn the key on, depress the brake, remove the shifter knob, and give it a light tap with a deadblow. Normally the shifter will pop free and you can put it into neutral. Just to be safe You might want to disconnect the battery. We have heard of a few cases where the airbags went off because the blow triggered the SRS system.
Many newer vehicles (only with 722.9 transmission) have a shifter mounted on the steering column, a shift by wire system. These vehicles such as the 221, 164, 251 and others have a shifter-module on the side of the transmission called the ISM. All the ISM does is manually move the linkage in the transmission to place the vehicle in gear, neutral, and park. The ISM is a theft relevant part and stores drive authorization information, if it fails the vehicle can not be shifted, driven, or pushed around the parking lot. It locks the vehicle in park. This is a headache!
Mercedes has a Special Service Tool which is a free-wheeling hub, you remove a wheel, mount it on the car, then install the wheel. It allows the wheel to rotate even with the drivetrain locked, and the vehicle can be pushed. So, what if you don't have the dealer tool? Well, you can try using a floor jack, you can ask your friendly tow truck operator to drop it in a convenient spot, or you can try crawling under the vehicle and removing the ISM. I think MB originally intended to use tamper proof bolts on it but they probably decided crawling under the car was difficult enough. Once removed, you can stick something in there and manually shift it. (might want to chock the wheels so the vehicle doesn't roll away). If you know for sure the ISM is bad you can try to break it off and use the lever from it to shift it. If you replace an ISM, break it and keep the lever, there is an SST which is the same thing.
If you replace a transmission (722.9) you will need to program the trans module (conductor plate) and it has drive authorization data. If you put a used trans in with a used plate you will be able to start the vehicle but it will not shift. Some vehicles might require all modules to positively verify the key (OK!) to start the engine, but with this trans you can still start it you just can't shift. The trans module even without belonging to the car will send the Park/Neutral status out on the CAN.
If you buy a transmission from Mercedes it will generally come with a new ISM, which kind of unnecessarily complicates things. In that case the TCM and the ISM will both need to be programmed, and the ISM needs to go through a calibration. Any time the TCM is replaced the shifter needs to be taught in, if this isn't performed the engine won't crank. Note: you can not use a used TCM/conductor plate in another car. It will never work! Once the drive authorization is learned to the module it is permanently stored and this is the most commonly failed aspect of an aftermarket unit! Only if the module was professionally and completely unlocked could it be used (good luck).
When you get that vehicle that won't crank and won't start it's a good idea to make a fork in the road between an engine system problem and an immobilizer problem. The way we do this is by going into the EIS actual values and status of circuits, check Circuit 50. Key on it should be OFF, when the key is in the crank position, it should come ON. If it does not come on there could be a P/N problem, or a key verification issue. Check P/N status in the transmission module. Otherwise, move to the Drive Authorization actual values and check "Start Enable" status for each module listed.
As far as I know the engine modules whether gasoline or diesel all function the same way. Note that the engine modules don't get real power until the key is in the run position and circuits 15, 15R, and 87 turn ON. If you can't turn the key or the key turns but the cluster doesn't light up, don't expect to have "Start Enable" from the Transmission or Engine modules to be "YES". They won't even be awake. Like many vehicles with Immobilizer problems, you may not get power distribution to activate at all when there is a problem with recognizing the key.
If Circuit 50 does come on, you need to troubleshoot the starter circuit. Make sure the fuse is not blown, the relay is working, the starter will work. If circuit 50 comes on but the starter doesn't operate you can jump power to the starter solenoid circuit with the key on. Set the parking brake, chock the wheels, or have the vehicle on the lift off the ground. Make sure it's not going anywhere. In some cases problems with the shifter or shift linkage have caused the vehicle to take off after jumping the starter. A bit of advice, the starter relay circuit is (I believe always) controlled directly by the engine module via a hard wire (no CAN message) but this circuit is often poorly documented in the schematics.
IMPORTANT: If you replace the EIS you must get the "Workshop Key" from the dealer, it will probably be blue but there were orange and green ones in the past. It's about 4mm thick, the dealer should have the sense to order it and supply it when ordering the EIS. Don't leave without it. The EIS does not require programming. It comes blank. Once it is installed you insert the workshop key. An LED in the key will come on solid for about 5-10 seconds while the immobilizer data is transferred to the EIS and then go out. If there is a problem it will blink and go out. Pay attention. Often a blinking LED is caused by a defective key and a new one has to be ordered. Now write the VIN. There are instructions in our tool. If the EIS is the gateway and there is no CGW, the EIS must be manually coded because it is kind of a global master of the vehicle options and configurations data. The easiest way to do this is to take notes of the coding on the old one and manually enter the same information. If you're lucky and you have a similar vehicle you can copy it. We sometimes help customers code them manually when the old one will not communicate. DO NOT INSERT THE WORKSHOP KEY REPEATEDLY IF IT DOES NOT WORK YOU MAY CAUSE A PROBLEM IN THE EIS.
ONLY AFTER YOU HAVE INSTALLED THE EIS, PERSONALIZED IT WITH THE WORKSHOP KEY, AND WRITTEN THE VIN SHOULD YOU INSERT THE CUSTOMER'S KEY. PLEASE DO NOT INSERT THE CUSTOMER'S KEY BEFORE THAT IS DONE. On some vehicles when the key is turned on, a module might ask the EIS what the VIN of the vehicle is and compare it to the VIN stored in its memory. When the EIS has no VIN, that comparison sets a fault code that can't be cleared without reprogramming the module, an ESP module comes to mind. This can be a very difficult situation to get out of. Depending on whether the key is a replacement for an existing key or a new key on its own track the key may need to synchronize the immobilizer codes with the vehicle. So if it is a replacement it may have to catch up to where the key that was lost was at in the list of codes. This is done by computing the key verification math once for every time the original key was ever used. You will see a message saying something like "Computing" or something. The key may have to do that in the inserted position and then do it again when turned (the engine/trans modules come online).
If the installation of the EIS worked correctly you can go into the actual values "Operating State" and check that "transport protection" "initialized" "personalized and "activated" are YES for all drive auth modules listed. If you have a hard to diagnose problem with drive authorization, go there and check that everything is YES. In some rare cases a component is corrupted or was not installed correctly.
If you choose to replace the EIS and ESL (Steering lock) at the same time, MAKE SURE THE DEALER GIVES YOU TWO WORKSHOP KEYS THAT ARE LABELED FOR WHICH PART THEY BELONG TO. Install the EIS first like I have written, make sure everything went correctly, THEN install the ESL and activate it with the key. Don't physically install the steering lock until you have verified it is working.
That's all that comes to mind I'll try to add amendments and corrections as necessary. Questions? Comments? Thanks.
Keys are not on the drop down menu for TRP parts ordering. Technically their purchase is not allowed under TRP. Some dealers will bypass that arrangement.
Good point Steve. Those documents also kind of vaguely specify what types of things are considered theft relevant, but it seems more or less anything that could be used to bypass the immobilization system or aid in stealing the vehicle or its contents are on the list. This includes some odd things like I think the vehicle's VIN sticker.
One note I forgot is that many TRP items have a note in EPC stating that they are TRP.
When TRP first came out, the standard for TRP exclusion was any part that carried the VIN. That even included fenders as the original car had the VIN number on them. Generally now it is any part VIN locked to the car. But, it turns out that the real exclusions are the parts listed in that dropdown menu on the TRP purchasing page. Except for keys. There is a spot for the DAS4 keys and I believe the reason we can't do them is somewhat like access to SCN. If we had it we could do it.
Thanks for the Information Andrew, it really helps us techs out here to understand the ins and outs of a system to better diagnose these issues.
Some other notes: only the EIS and the ESL (Electronic Ignition Switch and Electronic Steering Lock) are brought into service using workshop keys. All other modules which store immobilizer codes are learned in a different way. During programming the scantool "detaches transport protection" and "initializes" the module. The next step is "Personalization" Personalization always refers to the transfer of immobilizer codes to a module. When an engine module or transmission module is programmed, the drive authorization is taught in. The module learns the immobilizer data from the other modules on the vehicle, not from a workshop key. If the CAN has problems this can prevent personalization from working. I had one odd case where a new conductor plate was installed and programmed properly but personalization failed. The conductor plate itself was sabotaging the CAN network.
Speaking of adaptation - Transport/Init/Personalization, the final step is Activation. Activation permanently binds the component to the car. Activation can be done by default during programming of a module or it can be skipped. Generally a personalized module will self-activate after something like 40 engine starts. The advantage of not activating drive authorization parts is that you can use it to trial fit a part to see if it fixes a car. This might only be useful at a dealer where you can put an ECM back on the shelf if it doesn't fix the car, in theory. Not quite as useful to us in the aftermarket.
Aftermarket locksmithing - where there's a will there's a way. Some entities so to speak have hacked Mercedes's drive authorization systems, as well as the door locks. They've found weaknesses and exploits and stolen data and can make new keys at will. They do things like reflash the ROM to read and transfer immobilizer data, or desolder and resolder chips. A common one is the 204 steering lock, there is a motor in it that goes bad and the motor can be replaced individually. There are steering lock emulators which can help diagnose whether a steering lock is blocking key rotation. They accept any key code and return a "steering lock released" message. There are tools that you can insert the keys into that will read the key identification, keytrack, and verify the operational status. All of these things are essentially hack-tools and we don't get involved with them here professionally. Some people like to get into that kind of thing and tinker, so I mention it.
Speaking of that 204, it's extremely common for the steering lock to fail. Symptoms are: key turns but cluster does not activate, engine does not start. In the actual values "valid key is inserted" will say YES. 15C will be on, no 50 in crank position. It is an extremely common failure but there are other failures that are similar but NOT the steering lock. Usually it will fail with steering wheel locked, once in awhile with steering unlocked. The vehicle won't be permitted to drive unless the steering lock is verified to have released and successfully arrested in the unlocked position. This is for safety reasons, the engineers want to be extremely certain the steering lock is working correctly and will not slip out and jam the steering while the vehicle is driving! Once the key turns, power to the steering lock is switched off completely, so that not even a short circuit can move it. There's a lot of safety, reliability, and liability considerations at work here.
One other common failure is the 215 / 220 chassis, later model years, about 2003 and up. The fuse that provides power to the EIS also provides power to the alarm siren. The alarm siren commonly shorts out, blows the fuse, and renders the car a no start. I believe it is fuse F78 in the box on the right side of the dashboard, it's commonly overlooked because of the remote location.
Speaking of fuses that blow and cause no starts, a big one is the sprinters. A very large number of sprinters were made with a faulty exhaust pipe flex joint, after the DPF. The joint breaks and exhaust leaks out, melts the insulation off of the adjacent wiring, and shorts, blows a fuse. The fuse is in the front SAM under the left side of the dash. F16, 10 amps. The wiring often doesn't look torched on the outside; appearances can be deceiving. The fuse provides power to the NOx sensors and also to the control side of the starter and fuel pump relays. So if it blows, it's a no crank.
On the subject of sprinters - a very odd issue once in awhile causes a no-start. The backpressure sensor fails, if the reading is bad enough, the vehicle will not start. Also on the subject of sprinters - last I checked they aren't using DAS3 yet, they use a modified version of DAS2 with a bladed ignition key. The ignition switches on these vehicles require some very special procedures which can only be performed by the dealer. There's some kind of secret code request and response system with a timer and special credentials.