Limp Home Function

Limp home mode allows the driver to start a car when the immobilizer system has failed but the BCM is still able to communicate with the ECM. When the limp home mode is activated, the BCM will send the data back to the ECM. This is regardless of the values of the VIN, MIN, Transponder or Random number stored within the BCM. Limp home mode is activated by "entering" the limp home password of the system via activations of the ignition key. The timing for entering the password are shown below in timing chart.

The password is stored in EEPROM. The password is also stored in RAM. If both the EEPROM and RAM copy match then the vehicle is allowed to start once upon the next cycle of ignition. After the vehicle has been allowed to start once, the RAM copy is cleared thus preventing further starting.

At the dealer, the new owner is asked to choose a password which is 4 digit (2 bytes) in length. All digits chosen by the user must be between zero and nine. This password is placed within the BCM EEPROM using the Hi scan command.

If limp home mode is required, the owner enters the password via the ignition key. The password is decoded by the BCM then placed in RAM for comparison with the EEPROM copy. The password may also be placed directly in RAM using the Hi Scan. However, the tester must be still connected at the time of starting.

If the user forgets the password, the dealer shall use the forgotten password menu on the HiScan. The HiScan will prompt the dealer to enter the pin code as obtained from the HMC database for the vehicle in question.

NOTE: The password and the pin code are not the same. Pin code is scanned from a bar code at the End Of Line (EOL). The password is a number chosen by the owner for the purposes of limp starting.

Fig 1: Immobilizer Control System Timing Chart

Courtesy of HYUNDAI MOTOR CO.

By tester
If the ECM detects the fault of the BCM or transponder, the ECM will allow limp home function of the immobilizer. Limp home is only possible if the user password (4 digits) has been given to the ECM before. This password can be selected by the vehicle owner and is programmed at the service station.

The user password can be sent to the ECM via the hi-scan menu.

In case of "SMARTRA" type immobilizer system, only if the ECM is in status "learnt" and the user password status is "learnt" and the user password is correct, will the ECM be unlocked for a period of time (30 sec.). The engine can only be started during this time. After the time has elapsed, engine start is not possible.

But the ECM unlock timer (30 sec.) is not necessary in the "Stand alone" type immobilizer system.

If the wrong user password is sent, the ECM will reject the request of limp home for one hour. Disconnecting the battery or any other action cannot reduce this time. After reconnecting the battery to the ECM, the timer starts again for one hour.
By ignition key
The limp home can be activated also by the ignition key. The user password can be input to the ECM by a special sequence of ignition on/off.

Limp home code entry is enabled after the key has been in the ignition position for greater than 5 seconds. If the ignition is turned on for longer than five seconds during the sequence, the sequence is then restarted and all timers cleared. If the ignition is off for longer than three seconds during the entry, the code number for that digit of the limp home password is determined. If the ignition is turned off for longer than 10 seconds at any time before during or after code entry, all timers are cleared and limp home mode is deactivated. The number "0" is represented by 10 cycles of the ignition key.

Only if the ECM is in status "learnt" and the user password status is "learnt" and the user password is correct, will the ECM be unlocked for a period of time (30 sec.). The engine can be started during this time. After the time has elapsed, engine start is not possible. After a new password has been input, the timer (30 sec.) will start again.

But in case of "Standard alone" type immobilizer system, the engine start is possible after the time (30 sec.) has elapsed.

After ignition off, the ECM is locked if the timer has elapsed 8 seconds. For the next start, the input of the user password is requested again.

But in case of "Standard alone" type immobilizer system, the ECM is locked instantly after ignition off.