Technical Problem with electronic anti-theft-device

[Irgendeiner]

My Ducato has an electronic anti-theft system consisting of a round coil wrapped around the keyhole plate and a Bosch electronics box under the steering wheel, type "wfs 125f2."

Normally, when the engine is started, this system checks whether a key with an integrated chip and a specific number is inserted and then starts the engine.

Suddenly, the system no longer recognized the correct key. A yellow "missing key" symbol appeared on the dashboard. Although the engine was running, there was no ignition, and I couldn't drive home.

Fortunately, this demon disappeared the next day, and everything seemed fine, until I drove a short distance to the shops. Then the car wouldn't start again, and I had to walk home.

The technicians I knew didn't know what to do, so I went to the car the next day, and luckily, it worked again, and I was able to drive home.

But now I don't dare driving it anymore :-(

As an experienced electronics engineer, I could install a mechanical switch to bypass the faulty system, if only I could get the circuit diagrams for this chaotic system.

a) Has anyone ever experienced a similar situation? What did they do?

b) Does anyone have any tips on how to get the circuit diagrams?

Thanks and regards!

Irgendeiner

 

[Communicator]

My Ducato has an electronic anti-theft system consisting of a round coil wrapped around the keyhole plate and a Bosch electronics box under the steering wheel, type "wfs 125f2."

Normally, when the engine is started, this system checks whether a key with an integrated chip and a specific number is inserted and then starts the engine.

Suddenly, the system no longer recognized the correct key. A yellow "missing key" symbol appeared on the dashboard. Although the engine was running, there was no ignition, and I couldn't drive home.

Fortunately, this demon disappeared the next day, and everything seemed fine, until I drove a short distance to the shops. Then the car wouldn't start again, and I had to walk home.

The technicians I knew didn't know what to do, so I went to the car the next day, and luckily, it worked again, and I was able to drive home.

But now I don't dare driving it anymore :-(

As an experienced electronics engineer, I could install a mechanical switch to bypass the faulty system, if only I could get the circuit diagrams for this chaotic system.

a) Has anyone ever experienced a similar situation? What did they do?

b) Does anyone have any tips on how to get the circuit diagrams?

Thanks and regards!

Irgendeiner

Hi,
In your distress, you have failed to state the model, or year of your Ducato. Given the Code Receiver under the steering wheel, model is probably x230, or x244.

As an electronics engineer you will appreciate that the signals involved are of a very low voltage.
This low voltage struggles with oxide films that develope on connector pins.
I fixed the problem on my x244, more than two years ago, by reseating the connectors on the code receiver, and a generous application of contact cleaner.

Also you will realise that your system may be about 20 years old. The design life is 20 of electronics is typically 20 years.
I have wondered about contact "wetting" by passing 12V through the connectors via high resistances, which is an old telecommunications technique. Some DC blocking may be necessary.

 

[Irgendeiner]

Thx @ Communicator. I will follow your advice to apply contact spray in the connectors. Of course the wfs 125f2 box could also have become unreliable.
That's why I would like to know how one can get the car starting without valid key?

 

[Communicator]

Thx @ Communicator. I will follow your advice to apply contact spray in the connectors. Of course the wfs 125f2 box could also have become unreliable.
That's why I would like to know how one can get the car starting without valid key?

Do you have a Key Code Card for the vehicle? In the UK the code cards are with at the request of our insurance companies association. In Switzerland you may be supplied with the card. The card has an emergency code for starting the vehicle, and the physical key code. The emergency procedure is in the vehicle handbook, and I could look it up if necessary.

If you confirm that the model of your vehicle, which is the first three numbers of the VIN, typically ZFA244........... I have interconnection diagram for the key code system, which I can attach.

 

[Irgendeiner]

The number is ZFA2440000.
I never got a Key Code Card and wonder how I could obtain one?
I do not have the relevant vehicle handbook because the former car owner lost it...
Many thanks for your help!

 

[Communicator]

The number is ZFA2440000.
I never got a Key Code Card and wonder how I could obtain one?
I do not have the relevant vehicle handbook because the former car owner lost it...
Many thanks for your help!

An x244 model then. Mine is one of the later specimens, as production ceased in 2006. In the early years it may would have been possible to get the codes from a Fiat dealer for a charge, but at 19 years I am doubtful. I would be interested to learn of the result if you were to succeed. I think that the handbook for the x244 is available to dowload in the "Downloads" section of the forum.

In addition to the descriptive extracts attached, I also have a more in depth description for the later x250 model. I am not sure how much applies to the x244.

 

[Irgendeiner]

Thank you very much for these documents. "eLearn E7010 Key Code.pdf" might be correct for my camper
"Key Code Receiver M020" obviously is the magic box mounted under the steering wheel.
I do understand the working with the attached "Warning light E050", but I have no idea what "Pin V" connected to a symbol R010B does?
B001 Main Injector Relay is also a mistery for me :-(
Could you please help with these 2 points?

Thanks and regards: Ivo

 

[Communicator]

Thank you very much for these documents. "eLearn E7010 Key Code.pdf" might be correct for my camper
"Key Code Receiver M020" obviously is the magic box mounted under the steering wheel.
I do understand the working with the attached "Warning light E050", but I have no idea what "Pin V" connected to a symbol R010B does?
B001 Main Injector Relay is also a mistery for me :-(
Could you please help with these 2 points?

Thanks and regards: Ivo

The English annotations are mine, so apologies for any confusion, but you also had me confused. Not "Pin V ", Pin 5 , wire colour "V", which translates to green. E8010 is the EOBD socket. So the code receiver can be interrogated/programmed via Pin 8 of the EOBD socket.

Relay T09 is located in the engine bay fusebox, and controls supply to part of the engine computer. T09 is operated only when the key has been recognised, and controls the injection function.

Which engine is fitted in your Ducato? In particular the 2.8jtd, has several variants, due to different types of fuel filter.. EGR option, and type of cold starting. Mine is without EGR, has plastic, not metal bodied fuel filter, and has flame starter. So I would need full details to send correct engine wiring diagrams for 2.8jtd.

The diagrams are derived from Fiat eLearn, which runs on a Windows computer. It is available in the forum downloads section, but some of it including the 2.8jtd engine can be viewed here, but be warned longer texts are cropped, and some diagrams cannot be read. Also eLearn diagrams have errors, which I hve tried to correct on those that I hold.

If viewing eLearn, scrolling down from a diagram leads to a device list, with links to individual connector details.

Engine bay fusebox diagram is mine, and is specific to my vehicle options, but should give general idea.

 

[Irgendeiner]

Life is hard, especially for electronics engineers trying to understand that camper ;-)
Those 2 additional pdf's you gave me did not really inspire me.
Maybe I try with a more precise version of my two questions:

a) The Key Code Receiver M020 has pin #5 going to R010/B. Am I correctly guessing that R010/B is a light in the dashboard? When OK, what color, what symbol and what does it mean? When not a light, what function does it have and where is it located?

b) Pin #3 goes to C5050 Major Injector Relay. Is my guess correct that this relay must be activated in order to get the engine starting? If correct, I assume that interrupting this connection would prevent the engine from starting?
(If not as assumed, how is that relay working?)

Many thanks again!

 

[Communicator]

Life is hard, especially for electronics engineers trying to understand that camper ;-)
Those 2 additional pdf's you gave me did not really inspire me.
Maybe I try with a more precise version of my two questions:

a) The Key Code Receiver M020 has pin #5 going to R010/B. Am I correctly guessing that R010/B is a light in the dashboard? When OK, what color, what symbol and what does it mean? When not a light, what function does it have and where is it located?

b) Pin #3 goes to C5050 Major Injector Relay. Is my guess correct that this relay must be activated in order to get the engine starting? If correct, I assume that interrupting this connection would prevent the engine from starting?
(If not as assumed, how is that relay working?)

Many thanks again!

a. Sorry for any misunderstanding, but R010 is the designation of the EOBD diagnostic socket see diagram E8010. The /8 is my shorthand for pin 8,
So R010/8 refers to pin 8 of the diagnostic socket. See diagram E8010.

b. No! Pin 3 is the 12V supply for the code receiver, from fuse F18 in engine bay fusebox (B001). The same fuse also provides a supply for the "Main Injection Relay T08"
Interrupting the supply to T08 would prevent the engine from starting, but it would also raise a fault code. The control of T08 is from the ECU, and it is only operated when the key has been recognised. (There is an exchange of coded messages between ECU, and Code Receiver.)

 

[Irgendeiner]

Ad a) My car does not have a diagnostic socket and this kind of electronics, so that schematics applies only partially.

Ad b) Understood, your explanation makes sense.

Further analyzing the schematics I came to the conviction that the scan is misleading/unclear at the two places marked by red. IMHO both should not show black dots meaning interconnection of horizontal and vertical wires?

 

[Irgendeiner]

Further analyzing without connections at the red circles my conclusions:

c) The wire going from Yellow LED E050 via D001 to Pin #2 of M020 is pulled by M020 towards ground in case of missing key.

d) In that situation M020 also signals it at Pin #6 to ECU M010 Pin #11 and this is how ignition is prevented.

e) My guess: Cutting this wire and and connecting M010 Pin # 11 to ground or eventually +12V or eventually keeping it unconnected would allow to start the engine without valid key number inserted?

 

[Communicator]

Further analyzing without connections at the red circles my conclusions:

c) The wire going from Yellow LED E050 via D001 to Pin #2 of M020 is pulled by M020 towards ground in case of missing key.

d) In that situation M020 also signals it at Pin #6 to ECU M010 Pin #11 and this is how ignition is prevented.

e) My guess: Cutting this wire and and connecting M010 Pin # 11 to ground or eventually +12V or eventually keeping it unconnected would allow to start the engine without valid key number inserted?

You are grossly over simplifying the system. Please read the second paragraph of the descriptions that I attached to post #6. From this I infer that the communication between the code receiver, and the ECU is by encoded digital messages.

 

[Communicator]

Ad a) My car does not have a diagnostic socket and this kind of electronics, so that schematics applies only partially.

Ad b) Understood, your explanation makes sense.

Further analyzing the schematics I came to the conviction that the scan is misleading/unclear at the two places marked by red. IMHO both should not show black dots meaning interconnection of horizontal and vertical wires?

My pdf does not show black dots at the locations indicated. Fiat eLearn dos not use black dots to indicate a connection, and they should not be used at an "X" point, as wires should be offset to make two "T"s instead. For in harness connecions eLearn use an open diamond shape. For an example see the 5 wires joining near ECU (M10) at bottom RHS of same diagram.
I woould however agree that the diagrams could have been drawn more clearly, by removing unnecessary crossing of wires (lines). I have modified some drawings to achieve this, but it takes some time to do this.

 

[Irgendeiner]

@Communicator: Many thanks for all your help. If you tell me your Paypal account I'd like to spend you a big box of beer

Do you have any comments to my items d) & e)?

 

[Communicator]

@Communicator: Many thanks for all your help. If you tell me your Paypal at irgendeiner at gmx.ch I'd like to spend you a big box of beer

Do you have any comments to my items d) & e)?

Thank you for the offer of beer, but I am not an alcohol consuming person.

From reading the documentation, my understanding is that part of the ECU is activated when the ignition is switched on. This wakes up the code receiver (I doubt that the code receiver looks for the key code on a 24/7 basis.). A secure (rolling code) is sent to the code receiver via the connection M10/11 to M20/6. This code is returned back to the ECU, only if the key has been recognised. Receipt of the correct code allows injection to proceed, by operating T09.

 

[Irgendeiner]

Well, the crate of beer is meant symbolically for whatever you would like to have...

f) The ECU gets +12V on Pin #58 when the key is turned into 1st. position.

g) The Code Receiver M020 permanently gets +12V on pin #3 whenever Pin #2 of "C5050 Main Injector Relay" is activated. Unfortunately I do not understand the Symbol drawn for C5050. For my understanding the drawing of a relay should show two pins of the coil and pins for the mechanical contacts?

h) Pin #11 of the ECU is connected to pin #6 of M020 and IMHO used to signal presence of a valid key to the ECU,

 

[Communicator]

f) Yes.
g) The Code Receiver (M20) is permanantly supplied at +12V on Pin 3, via fuse F18, which also supplies relay T09 coil. E5050 is a reference to the engine control diagram. The extra connection and annotation are mine. Fiat never indicate other circuits supplied from same fuse. Confusing. I have added "To " in front of E5050, for further explanation. There is supposed to be an arrow below the "R" in the word Relay, but it does not show up very well.
I have not attached diagram E5050, as the diagram is engine specific, and you have not posted your engine type as previously suggested by me. Relay T09 appears on diagram E5050. Fuse F18 is also shown on E5050, but without reference to the connection to the Code Receiver.

h) Yes as regards the connection, but commuication is an exchange of digital code. See post #16.

 

[Irgendeiner]

Regarding "relay" I have attached the relevant symbols, a similar one is also in Wikipedia.

 

[Communicator]

Regarding "relay" I have attached the relevant symbols, a similar one is also in Wikipedia.

@Irgendeiner your English is excellent, but perhaps we are losing something in translation. I have not tried to show a relay, but only indicate a connection to one on another diagram.

For explanation I am attaching diagram E1010-2, which includes the Engine Bay Fusebox (B001). Trace the wire cnnecting to terminal 85, of T09. That is the connection that I was indicating.

I await your engine details.