Photo 1. 2001 VW Cabrio
Photo 2. Cabrio back fender view
Photo 3. The ICU is located under the dash.
Photo 4. This logo identifies the ICU
Photo 5. The ICU circuit board
Photo 6. Another view of the ICU circuit board
Photo 7. The location of the target EEPROM chip
Photo 8. This board features a crystal oscillator which should be grounded
Photo 9. Grounding underway
Photo 10. The blue clip is used to fix the Zed-Prog device.
Photo 11. Zed-Prog device affixed to the appropriate EEPROM chip
Photo 12. EEFROM chip is connected and the Zed-Prog is properly grounded
Photo 13. Transponder located in the end of the key
When a customer has the misfortune of losing the keys to a car, he or she often calls on the services of the locksmith to help out. For the modern automotive locksmith, this process often involves not only fabricating the mechanical part of the key but also dealing with the transponder. Today we will take a look at a 2001 Volkswagen Cabrio as a case study. See photos 1 and 2.
In order to program the transponder in the key to operate this car, we have to access a particular computer chip (technically called an IC or “integrated circuit”) in the vehicle’s Instrument Cluster Unit (ICU). With access to this chip, we can use an aftermarket programming tool to download the necessary data and write it to the transponder.
This vehicle has a small ICU up under the dash (see photo 3) that contains the chip with the key data needed to program the transponder. The unit can be accessed from the right side of the steering column area with minimal fuss.
The ICU can be identified by the raised emblem in the lower right corner, which features a lightning bolt (photo 4). There really isn’t a central resource for determining the location of the ICU on different makes and models of cars—generally speaking it can be found by carefully following wires.
Next the circuit board within the ICU can be removed so the correct chip can be accessed. Photos 5 and 6 show the ICU being opened and the circuit board removed.
When removing any sensitive electronics, particularly expensive circuit boards anti-static wrist straps can be used to minimize the risk of any static discharge. These wrist wraps ground your body, hopefully dissipating any built up charge before it gets a chance to damage any circuit element.
Photo 7 shows the exact location of the chip containing the data needed on this particular board. It can be positively identified as an 8-pin chip labeled “SLA24C”. For those technically inclined, this chip is an EEPROM IC manufactured by Siemens. EEPROM chips contain a fixed amount of data stored in non-volatile memory (this particular chip has 4 Kbits of memory). Of the eight pins used, three are dummy pins, one is ground, one is voltage supply, and the other three are used for data access. By clipping onto this chip, software can access any data stored on the chip, in this case data needed to program the transponder. The vast majority of vehicles use a similar type of 8-pin serial EEPROM chip, which makes the lives of automotive locksmiths generally easier by not requiring many types of adapters and software packages.
The EEPROM chip here is a data chip containing the information formed by the use of a transponder key. When the vehicle is started, the data is compared between the EEPROM chip here and the transponder chip in the key. If the data is authenticated, e.g., the two correctly correspond with one another, the vehicle will start. Since we don’t have the correct key, we have to access the data off this chip to get the customer back on the road.
Caution: never have the Zed-Prog device turned on when attaching to the clip as it may cause the chip to become damaged. One slip might mean applying voltage somewhere where it doesn’t belong, potentially overwriting data or simply shorting an electrical component.
Now that the appropriate chip has been identified on the ICU circuit board and the Zed-Prog device has been turned off, we will be hooking up to the EEPROM chip. In this and most cases it is a good idea to ground the Zed-Prog to protect it and the board we’re connected to. This board features a crystal oscillator which should be grounded; see photos 8 and 9. Finally, the blue clip is used to fix the Zed-Prog device (photo 10) to the appropriate EEPROM chip (photos 11 and 12).
Next, use the Zedbull tool to retrieve the necessary data off of the ICU chip. First, select “Zed-Prog” from the main menu. Next, choose “EEPROM PACK,” followed by chip “24C04.” This is shown in the Zed-Prog manual that comes with the software.
Once the correct chip is selected, turn the device on and it will connect. Press enter when prompted to. It will then start to read and if successful it will begin a “Smart Recognizing” process. It will then identify the chip it is reading and ask the user to press “Enter.” It then comes up with specific information regarding the chip it finds. In this case it finds the 44 Crypto chip and asks that the user press “Enter” again.
Next, select “From EEPROM to Chip.” It will then ask that a Blank PCF7935 (44) chip is inserted into the Zedbull device. It will load the data onto the chip to start the car. It will go through the Writing process and say “Successful” when done. At this point the transponder is properly coded and can be used to start the car; the Zedbull can also be used to determine the PIN code to the vehicle by selecting “Calculate PIN Code.”
Photo 13 shows where the transponder rests in the head of the key, which needs to be removed and inserted into the Zedbull Device.
Most vehicles on the road today contain an ICU (or similar computer, also known as ECU, PCM, or SKIM depending on vehicle manufacturer) which has a similar memory chip as the one in this vehicle. By finding it and pulling the necessary data off of it, the necessary transponder can be programmed to start the car. The difficult part of this process is often simply finding the chip and putting it back again—the rest is pretty straight forward.
As time goes on there will be more and more requirements for this process. At the time of this writing the new 2011 Journey, Charger and 300C came out with Fiat 500 software. Nothing will program them at this time other than dealer equipment which is quite expensive.
Contact Jim and Stacy Hetchler, www. keypro.com or (210) 227-5397 with any questions.