Lexus - LS 400 - Owners Manual - 1998 - 2002

PENLOADER TOOL UserManual For Software Version: 2.10 The use of this apparatus is limited to legitimate and legal purposes for vehicle maintenance, in compliance with federal and state laws and regulations. Thumbwheel Setting Penloader Operation 00 Write from Memory Block 0 to 93C series device 01 Write from Memory Block 1 to 93C series device 02 Write from Memory Block 2 to 93C series device 03 Write from Memory Block 3 to 93C series device 04 Display keys for 3key 16 bit 05 Prog file: 3key16bit 06 Prog file: 16bit 07 Prog file: 32bit 08 Prog file: 47010 09 Prog file: 34010 10 Prog file: 50020 11 Prog file: 60330 12 Prog file: 60230 13 Prog file: 33110 14 Prog file: Aa010 15 Prog file: 35090 16 Prog file: 60220 17 Prog file: 08010 18 Prog file: 50050 19 Prog file: 48020 20 Prog file: 0e010 21 Prog file: 47020 22 Prog file: 50030 23 Prog file: 50031 24 Prog file: 24020 25 Prog file: nontrans 26 Prog file: Red_Black 27 Display Red and Black keys 28 Erase device to all FF 29 Erase device to all 00 30 Prog file: EarlyToyota 31 Prog file: FJ_S93C66 32 Prog file: SaabCIM03_09 ii 33 Not in use 34 Prog file:id box 93C86b virgin 35 Prog file: 2010Camry 36 Prog file: iSmart_Key_proxy_IDbox 37 to 83 Not in use 84 Chevrolet Cruze PIN read 85 Fiat PIN read 86 Saab PIN read 87 Toyota/Lexus 3 key read 88 Dodge Caravan PIN read 89 Jeep Liberty 95080 PIN read 90 Nissan 05 PIN read 91 Nissan 09 PIN read 92 VW Beetle PIN read 93 Isuzu PIN read 94 Chrysler PIN read 95 Restore original contents 98 Switch to THUMB 1 settings 99 Display serial number and power supply voltage THUMB 1 settings: Thumbwheel Setting Penloader Operation 00 Send Memory Block 0 to computer 01 Send Memory Block 1 to computer 02 Send Memory Block 2 to computer 03 Send Memory Block 3 to computer 04 Receive data from computer and save in Memory Block 0 05 Receive data from computer and save in Memory Block 1 06 Receive data from computer and save in Memory Block 2 07 Receive data from computer and save in Memory Block 3 iii 08 Copy from Restore Memory to Memory Block 0 09 Copy from Restore Memory to Memory Block 1 10 Copy from Restore Memory to Memory Block 2 11 Copy from Restore Memory to Memory Block 3 12 Copy from Memory Block 0 to Restore Memory 13 Copy from Memory Block 1 to Restore Memory 14 Copy from Memory Block 2 to Restore Memory 15 Copy from Memory Block 3 to Restore Memory 16 Read and save 25LC010 to Restore Memory 17 Read and save 25LC020 to Restore Memory 18 Read and save 25LC040 to Restore Memory 19 Read and save 25LC080 to Restore Memory 20 Read and save 25LC160 to Restore Memory 21 Write from Restore Memory to 25LC010 22 Write from Restore Memory to 25LC020 23 Write from Restore Memory to 25LC040 24 Write from Restore Memory to 25LC080 25 Write from Restore Memory to 25LC160 26 Read and save 24C01 to Restore Memory 27 Read and save 24C02 to Restore Memory 28 Read and save 24C04 to Restore Memory 29 Read and save 24C08 to Restore Memory 30 Read and save 24C16 to Restore Memory 31 Write from Restore Memory to 24C01 32 Write from Restore Memory to 24C02 33 Write from Restore Memory to 24C04 34 Write from Restore Memory to 24C08 35 Write from Restore Memory to 24C16 36 Read and save 93C series device to Restore Memory 37 to 98 Not in use 99 Display serial number and power supply voltage iv 1 INTRODUCTION 6 2 PRODUCT FEATURES 7 3 PENLOADER OPERATION 9 3.1 General Operation 3.2 Visual and Audible Cues 13 3.3 Memory Blocks 15 3.4 Restore Original Contents 15 3.5 THUMB 1 Settings 16 4 9 THUMBWHEEL SELECTIONS IN DETAIL 20 4.1 General Operation 20 4.2 THUMB 1 Settings 51 5 UPLOADING/DOWNLOADING SERIAL DATA 56 5.1 Introduction 56 5.2 General Setup 57 5.3 Transferring Memory Blocks Between The Penloader and the Computer 65 5.4 Troubleshooting 74 5.5 Data File 77 v 1 Introduction The Penloader was designed to provide a tool that can be used to program memory devices installed on circuit boards, as well as read existing PINs. The tool is simple to use and requires no external computers, keypad entry devices, adaptor boards or cables. Features of the tool are:  Small sized unit for hand held use  4 digit alpha-numeric display  Simple to use  Programming options selected through a 2 digit thumbwheel switch  Onboard probes with spring loaded protective cover, for programming 8 pin SOIC packages  Supports Microwire, I2C and SPI devices  Powered by rechargeable batteries or external 12V dc supply  Provides measurement of power supply voltage (battery and external supply)  Includes dual LED lamps to illuminate area around device to be programmed  Audio feedback to user  Capability to read and display PIN numbers  60 second auto power off when not in use  Software is field updateable using a Windows PC and a serial cable  4 on board Memory Blocks that can be used to save 4 unique user files.  Restore operation that can be used to restore contents of last device programmed. 6 2 Product Features Figure 1 – Penloader Unit 7 Item Description 1 Thumbwheel selector 2 On/Off button 3 START buttons 4 4 character display 5 Neoprene grip 6 Spring probes 7 12V dc input connector 8 3 Penloader Operation This tool provides a set of programming and PIN read functions to help the locksmith when programming new transponder keys and proxy. General Operation 3.1 The basic operating procedure for using the Penloader is as follows: (i) (ii) (iii) (iv) (v) (vi) (vii) Remove module containing memory device to be programmed, from the vehicle, and disassemble to provide access to the memory device to be programmed or read. Set thumbwheel to the required number (refer to Table 3.1 below). Power up the Penloader (thumbwheel must not be set to 98 before power up). Position the Penloader over the 8 pin memory device ensuring that the spring probes are making good contact with the legs on the memory device. Where possible, a “Flash device identifier” is specified to help locate the correct 8 pin device on the circuit board. Figure 2 below shows how to locate pin 1 on the 8 pin memory device. It is important that the spring probe identified as “1”, is in contact with Pin 1 on the 8 pin memory device. Push the START button. The 4 character display will show status as the programming/read operation proceeds. The Penloader unit will also provide audio cues during the operation (ref section 3.2 below). On completion the display will identify whether the programming operation was successful or not. In the case of PIN reads, the display will show the 4 digit PIN (and hold it for 5 seconds) if the operation was successful. 9 Figure 2 – Locator for Pin 1 The following table shows the options that are selectable using the thumbwheel. 10 Thumbwheel Setting Penloader Function 00 Write using data from Memory Block 0 01 Write using data from Memory Block 1 02 Write using data from Memory Block 2 03 Write using data from Memory Block 3 04 Displays 2 keys for use with thumbwheel setting 05 05 Lexus or Toyota 3 key file program 06 Lexus or Toyota - 16bit file program 07 Lexus or Toyota - 32bit file program 08 Toyota Prius - 47010 file program 09 Toyota Sequoia - 34010 file program 10 Lexus LS400 - 50020 file program 11 Lexus GX470 - 60330 file program 12 Lexus LX470 - 60230 file program 13 Lexus ES330 - 33110 file program 14 Toyota Camry – aa010 file program 15 Toyota 4runner - 35090 file program 16 Toyota Landcruiser - 60220 file program 17 Toyota Sienna - 08010 file program 18 Lexus LS430 - 50050 file program 11 19 Lexus RX330 - 48020 file program 20 Lexus RX330 - 0e010 file program 21 Toyota Prius - 47020 file program 22 Lexus LS430 - 50030 file program 23 Lexus LS430 - 50031 file program 24 Lexus SC430 - 24020 file program 25 Lexus or Toyota - nontrans file program 26 Honda Red/Black keys program 27 Displays 2 keys for use with thumbwheel setting 26 28 Erase device to all FF 29 Erase device to all 00 30 Toyota – EarlyToyota file program 31 Toyota FJ Cruiser - FJ_S93C66 file program 32 Saab CIM- SaabCIM03_09 file program 33 Not used 34 Toyota - id box 93C86b virgin file program 35 Toyota Camry - 2010Camry file program 36 Toyota - iSmart_Key_proxy_IDbox file program 37 - 83 Not used 84 Chevrolet Cruze PIN read 85 Fiat Punto/500 PIN read 12 86 Saab PIN read 87 Toyota/Lexus 3 key read 88 Dodge Caravan PIN read 89 Jeep Liberty 95080 PIN read 90 Nissan 2005 PIN read 91 Nissan 2009 and up PIN read 92 VW Beetle 2000 PIN read 93 Isuzu 2003-2005 PIN read 94 Chrysler PIN read 95 Restore original contents 98 Switch to THUMB 1 settings 99 Displays unit serial number and power supply voltage Table 4.1 – Thumbwheel selection options 3.2 Visual and Audible Cues When the Penloader is used to program an update into a memory device it will provide both visual and audio cues to the user. The following table defines these cues and their definition. Note that all visual cues are displayed on the 4 character display. 13 Visual Cue Audio Cue IDNT Faint ticking sound, with ticks approximately 1 second apart PROG Machine gun type sound VRFY Same sound as used for PROG. OK Pseudo “charge” tune. FAIL Low tone held for 2 seconds. READ None SAVE None Definition The Penloader is determining what type and size device it is currently positioned over. The Penloader is programming the external memory device. The Penloader is comparing the data in the programmed part, with the data used to perform the program function. The VRFY operation was successful, and the data in the programmed part matches the data used in the program operation. An error occurred, or the Penloader could not determine the type of device. The Penloader unit is reading data from an external memory device. The Penloader unit is saving data into a memory block. Table 4.2 – Visual and audible cues 14 3.3 Memory Blocks The Penloader contains four onboard Memory Blocks, which can be used for the purpose of saving and retrieving custom data files. Each Memory Block can hold up to 2K Bytes (2048 Bytes) of data. To identify the Memory Blocks, they are numbered as 0, 1, 2 and 3. Data can be read from an external memory device and saved to any of the four Memory Blocks (THUMB 1 thumbwheel options 08 to 11 – refer to section 3.5). External memory devices can also be programmed using data sourced from any of the four Memory Blocks (thumbwheel options 00 through 03). In addition, the Penloader contains the capability to send the contents of any of the Memory Blocks to an external computer (via RS-232) for viewing and editing purposes (THUMB 1 thumbwheel options 00 to 03); and also to receive, and save to a Memory Block, data files from an external computer (THUMB 1 thumbwheel options 04 to 07). Each memory block has an associated comment field, which can be used to name or add a note for a particular Memory Block. The comment field may not exceed 58 characters in length (including spaces). To add a comment field, an external computer must be used. This procedure is described in a separate document called “Penloader Tool – Data Send and Receive Manual”. 3.4 Restore Original Contents The Penloader also contains a reserved “Restore” Memory Block which is used by the Penloader to save the contents of an external memory device before it overwrites it with new data. When programming an external memory device, and after the START button is pressed, and the Penloader has 15 identified the external device to be programmed, the Penloader reads the contents of the external memory device, and saves it to the “Restore” Memory Block. Should the user desire to restore the original contents of the external memory device after programming, this is made possible through the use of the thumbwheel 95 setting. It is important to note that the “Restore” Memory Block is overwritten by each subsequent programming of an external device. As a consequence, it is only possible to restore the last contents of the last external memory device programmed. It is possible to permanently save the contents of the “Restore” Memory Block, as described in section 4.2.6. 3.5 THUMB 1 Settings The Penloader contains a second bank of thumbwheel settings, referred to as the THUMB 1 settings. These settings are invoked by setting the thumbwheel to 98 prior to powering on the Penloader. When this is done, the display will indicate “THUMB 1 active”, and the thumbwheel selections will switch over to the THUMB 1 settings table, as follows: Thumbwheel Setting Operation 00 Send Memory Block 0 to an external computer 01 Send Memory Block 1 to an external computer 02 Send Memory Block 2 to an external computer 03 Send Memory Block 3 to an external computer 16 04 Receive data from computer and save in Memory Block 0 05 Receive data from computer and save in Memory Block 1 06 Receive data from computer and save in Memory Block 2 07 Receive data from computer and save in Memory Block 3 08 Copy from Restore Memory to Memory block 0 09 Copy from Restore Memory to memory block 1 10 Copy from Restore Memory to memory block 2 11 Copy from Restore Memory to memory block 3 12 Copy from memory block 0 to Restore Memory 13 Copy from memory block 1 to Restore Memory 14 Copy from memory block 2 to Restore Memory 15 Copy from memory block 3 to Restore Memory 16 Read and save 25LC010 to Restore Memory 17 Read and save 25LC020 to Restore Memory 18 Read and save 25LC040 to Restore Memory 19 Read and save 25LC080 to Restore Memory 20 Read and save 25LC160 to Restore Memory 21 Write from Restore Memory to 17 25LC010 22 Write from Restore Memory to 25LC020 23 Write from Restore Memory to 25LC040 24 Write from Restore Memory to 25LC080 25 Write from Restore Memory to 25LC160 26 Read and save 24C01 to Restore Memory 27 Read and save 24C02 to Restore Memory 28 Read and save 24C04 to Restore Memory 29 Read and save 24C08 to Restore Memory 30 Read and save 24C16 to Restore Memory 31 Write from Restore Memory to 24C01 32 Write from Restore Memory to 24C02 33 Write from Restore Memory to 24C04 34 Write from Restore Memory to 24C08 35 Write from Restore Memory to 24C16 36 Read and save 93C series device to Restore Memory 37 to 98 Unused 99 Display serial number and power supply voltage 18 These thumbwheel settings will remain in place until the power is cycled, with the thumbwheel set to some setting other than 98. 19 4 Thumbwheel Selections In Detail 4.1 General Operation The following sections describe the operation of the Penloader under the general thumbwheel settings. 4.1.1 Thumbwheel Settings 00 through 03 File: Sourced from Memory Block (0,1,2 or 3) Flash device identifier: Depends on manufacturer Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Any These thumbwheel setting are used to program a 93C series [microwire] memory device using the contents of one of the four memory blocks provided. Set thumbwheel to 00, 01, 02, or 03 depending on which memory block (1, 2, 3, or 4) should source the data to be programmed into to the external device. Note that the contents of the comment field will scroll on the display when the thumbwheel is set to one of these selections. To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. 20 4.1.2 Thumbwheel Setting 04 This thumbwheel setting is used to display the 2 keys programmed into a memory device using Thumbwheel setting 05. The keys are displayed in 4 character increments, as follows: (i) (ii) (iii) (iv) (v) Before starting, perform the programming procedure as described in section 4.1.3 below. Set thumbwheel to 28. Press the START button. The display will scroll until “KEY1” is displayed, then the scroll operation will pause. KEY1 is the first Key, and KEY2 is the second Key. Press the START button again to continue the display scroll to the next 4 digits of the key value. Continue step (iv) until all 28 digits of both keys have been displayed. Pressing START again will scroll the data from the beginning again. 21 4.1.3 Thumbwheel Setting 05 File: 3 key16bit Flash device identifier: IC900 Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Toyota, Lexus – Type 1 ECU (models specified in the following table). Model Year ECU Location 4Runner 1998-2001 Avalon 1998-2003 Behind glove box Behind glove box Camry 1998-2000 Behind glove box Solara 1998-2000 Behind glove box Highlander 2001-2003 Behind glove box Landcruiser 1998-2000 Behind glove box MR2 2001-2003 Rav 4 2002-2003 Behind driver seat Behind glove box Sienna 1998-2003 Behind glove box ES 300 1998-2001 Behind glove box GS 300 1998-2000 Under hood, driver’s side GS 400 1998-2000 Under hood, driver’s side LS 400 1998-2000 LX 470 1998-2000 Behind glove box Under hood RX 300 1999-2003 Under hood SC 300 1998-2000 Below glove box, under carpet SC 400 1998-2000 Below glove box, under carpet Note: Use this option if the immobilizer will not enter “Learn” mode after re-programming using Thumbwheel selection 30. 22 To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. After the programming procedure successfully completes, set Thumbwheel to 04 to display the two Key values programmed. 23 4.1.4 Thumbwheel Setting 06 File: 16bit Flash device identifier: IC900 Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Toyota, Lexus – Type 1 ECU (models specified in the following table). Model Year ECU Location 4Runner 1998-2001 Avalon 1998-2003 Behind glove box Behind glove box Camry 1998-2000 Behind glove box Solara 1998-2000 Behind glove box Highlander 2001-2003 Behind glove box Landcruiser 1998-2000 Behind glove box MR2 2001-2003 RAV 4 2002-2003 Behind driver seat Behind glove box Sienna 1998-2003 Behind glove box ES 300 1998-2001 Behind glove box GS 300 1998-2000 Under hood, driver’s side GS 400 1998-2000 Under hood, driver’s side LS 400 1998-2000 LX 470 1998-2000 Behind glove box Under hood RX 300 1999-2003 Under hood SC 300 1998-2000 Below glove box, under carpet SC 400 1998-2000 Below glove box, under carpet To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the 24 end of the procedure, else the programming operation failed. After programming is successfully completed, follow the procedure described in Appendix A, section A.1.1 to register keys into the ECU. If the immobilizer will not enter “Learn” mode after reprogramming, reprogram using Thumbwheel setting 29. Note: If vehicle will only register 1 key after programming this is an indication that it probably uses a Type 2 ECU, and was programmed with the wrong file. Reflash with the correct file. 4.1.5 Thumbwheel Setting 07 File: 32bit Flash device identifier: IC900 Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Toyota, Lexus – Type 2 ECU (models specified in the following table). Model Year ECU Location 4Runner 2002 Behind glove box Camry 2001-2009 Behind glove box Solara 2001-2004 Behind glove box LandCruiser 2001-2002 Behind glove box Sequoia 2001-2002 Behind glove box ES 300 2002-2003 Behind glove box GS 300 2001-2003 Under hood, driver’s side GS 430 2001-2003 Under hood, driver’s side IS 300 2001-2003 Under hood, driver’s side LX 470 2001-2002 Behind glove box 25 To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. After programming is successfully completed, follow the procedure described in Appendix A, section A.1.1 to register keys into the ECU. Note: If vehicle will only register 1 key after programming this is an indication that it probably uses a Type 1 ECU, and was programmed with the wrong file. Reprogram with the correct file. 4.1.6 Thumbwheel Setting 08 File: 47010 Flash device identifier: IC Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Toyota (models specified in the following table). Model Prius Year Immo Location 2001-2003 Under dash board, above steering column. Must drop the column – 10mm bolt to release the bracket located in left corner behind roll bar. To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. After programming is successfully completed, follow the procedure described in Appendix A, section A.4.1 to register keys into the Immobilizer. 26 After programming all modules must be resynchronized by performing the following procedure: 4.1.7 Thumbwheel Setting 09 File: 34010 Flash device identifier: IC2 Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Toyota (models specified in the following table). Model Year Immo Location Sequoia 2003 and newer Behind cluster. Must be a 4D-67 transponder. To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. Important: One of the pins of the blue colored component in the corner of the board next to IC1, must be connected to GND before trying to program IC2 (refer to photo in Appendix B). After programming is successfully completed, follow the procedure described in Appendix A, section A.6.1 to register keys into the Immobilizer. 27 4.1.8 Thumbwheel Setting 10 File: 50020 Flash device identifier: IC2 Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Lexus (models specified in the following table). Model Year ECU Location LS 400 1997 Behind glove box To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. After programming is successfully completed, follow the procedure described in Appendix A, section A.3.1 to register keys into the ECU. 4.1.9 Thumbwheel Setting 11 File: 60330 Flash device identifier: Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Lexus (models specified in the following table). Model Year Immo Location GX 470 2003-2004 Behind instrument cluster To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. 28 After programming is successfully completed, follow the procedure described in Appendix A, section A.5.1 to register keys into the Immobilizer. 4.1.10 Thumbwheel Setting 12 File: 60230 Flash device identifier: Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Lexus (models specified in the following table). Model Year Immo Location LX 470 2003-2004 Behind glove box To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. After programming is successfully completed, follow the procedure described in Appendix A, section A.5.1 to register keys into the Immobilizer. 4.1.11 Thumbwheel Setting 13 File: 33110 Flash device identifier: Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Lexus (models specified in the following table). Model Year Immo Location ES 330 2004 Behind glove box 29 To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. After programming is successfully completed, follow the procedure described in Appendix A, section A.6.1 to register keys into the Immobilizer. 4.1.12 Thumbwheel Setting 14 File: aa010 Flash device identifier: Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Toyota (models specified in the following table). Model Year Immo Location Camry 2001-2004 Behind glove box Solara 2003-2004 Behind glove box To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. After programming is successfully completed, follow the procedure described in Appendix A, section A.6.1 to register keys into the Immobilizer. 4.1.13 Thumbwheel Setting 15 File: 35090 Flash device identifier: Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Toyota (models specified in the following table). 30 Model Year Immo Location 4Runner 2003-2004 Behind glove box To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. After programming is successfully completed, follow the procedure described in Appendix A, section A.7.1 to register keys into the Immobilizer. 4.1.14 Thumbwheel Setting 16 File: 60220 Flash device identifier: IC900 Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Toyota (models specified in the following table). Model Year Immo Location LandCruiser 2003-2004 Behind glove box To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. After programming is successfully completed, follow the procedure described in Appendix A, section A.7.1 to register keys into the Immobilizer. 31 4.1.15 Thumbwheel Setting 17 File: 08010 Flash device identifier: IC900 Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Toyota (models specified in the following table). Model Year Immo Location Sienna 2004 Above center dash To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. After programming is successfully completed, follow the procedure described in Appendix A, section A.7.1 to register keys into the Immobilizer. 4.1.16 Thumbwheel Setting 18 File: 50050 Flash device identifier: Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Lexus (models specified in the following table). Model Year Immo Location LS 430 2004 Above navigation system To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. 32 After programming is successfully completed, follow the procedure described in Appendix A, section A.6.1 to register keys into the Immobilizer. 4.1.17 Thumbwheel Setting 19 File: 48020 Flash device identifier: Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Lexus (models specified in the following table). Model Year Immo Location RX 330 2004 (VIN starts with “J”) Above center dash To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. After programming is successfully completed, follow the procedure described in Appendix A, section A.6.1 to register keys into the Immobilizer. 4.1.18 Thumbwheel Setting 20 File: 0e010 Flash device identifier: Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Lexus (models specified in the following table). Model Year Immo Location RX 330 2004 (VIN starts with “2”) Above center dash 33 To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. After programming is successfully completed, follow the procedure described in Appendix A, section A.6.1 to register keys into the Immobilizer. 4.1.19 Thumbwheel Setting 21 File: 47020 Flash device identifier: Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Toyota (models specified in the following table). Model Year Prius 2004 Immo Location Under dash board, above steering column. To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. After programming is successfully completed, follow the procedure described in Appendix A, section A.6.1 to register keys into the Immobilizer. 34 4.1.20 Thumbwheel Setting 22 File: 50030 Flash device identifier: Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Lexus (models specified in the following table). Model Year Immo Location LS 430 2001-2002 Above navigation system To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. After programming is successfully completed, follow the procedure described in Appendix A, section A.5.1 to register keys into the Immobilizer. 4.1.21 Thumbwheel Setting 23 File: 50031 Flash device identifier: Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Lexus (models specified in the following table). Model Year Immo Location LS 430 2003 Above navigation system To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. 35 After programming is successfully completed, follow the procedure described in Appendix A, section A.5.1 to register keys into the Immobilizer. 4.1.22 Thumbwheel Setting 24 File: 24020 Flash device identifier: Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Lexus (models specified in the following table). Model Year Immo Location SC 430 2002-2003 Behind instrument cluster To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. After programming is successfully completed, follow the procedure described in Appendix A, section A.5.1 to register keys into the Immobilizer. 4.1.23 Thumbwheel Setting 25 File: nontrans Flash device identifier: IC900 Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Toyota, Lexus (models specified in the following table). 36 Model Year VIN All models not equipped with a separate transponder/immobilizer unit. Must use a Type 1 ECU. Camry Sept 2002 - Jan 2003 1 or 4 (4 or 6 cyl) Camry Sept 2002 - 2005 1 or 4 (4 cyl only) Camry Sept 2002 - Jan 2003 1 or 4 (6 cyl only) Camry Sept 2002 - 2005 J (4 cyl only) Camry Sept 2002 - Jan 2003 J (6 cyl only) Camry Sept 2002 - July 2003 J (4 cyl only) Camry Sept 2002 - Jan 2003 J (6 cyl only) Normally, Type 1 ECU vehicles would be programmed using the “16bit” file (ref sections 4.1.3 and 4.1.4), however if no transponder keys are available, the ECU unit can be programmed using the ”nontrans” file. In this case a standard metal key should be used after programming. To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. After performing the programming operation, do not install the center plug when reinstalling the ECU. 37 4.1.24 Thumbwheel Setting 26 File: Red/Black Keys Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Honda (models specified in the following table). Model Year Immo Location NSX 1997 - 2004 Prelude 1997 - 2002 RL 1996 - 2004 Attached to steering column. To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. The Red Key, and one Black Key, for use with this programming operation is displayed using thumbwheel setting 27. Use a T Code Pro, SDD or CodeSeeker programmer to initialize a Black Key. 4.1.25 Thumbwheel Setting 27 This thumbwheel setting is used to display the Red Key and one Black Key programmed into a memory device using Thumbwheel setting 26. The keys are displayed in 4 character increments, as follows: (i) Before starting, perform the programming procedure as described in section 4.1.24 above. (ii) Set thumbwheel to 27. (iii) Press the START button. The display will scroll until “Red” is displayed, then the scroll operation will pause. “Red” identifies the start of the Red Key, and “Blck” identifies the start of the Black Key. 38 (iv) (v) Press the START button again to continue the display scroll to the next 4 digits of the key value. Continue step (iv) until all 16 digits of each key has been displayed. Pressing START again will scroll the data from the beginning again. 4.1.26 Thumbwheel Setting 28 File: Erase_to_FFs Flash device identifier: Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Any. This programming operation will erase the flash device to all FFs (which is the normal erased state for flash memory). 4.1.27 Thumbwheel Setting 29 File: Erase_to_00s Flash device identifier: Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Any. This programming operation will erase the flash device to all 00s and is included in case it is needed for experimentation. 4.1.28 Thumbwheel Setting 30 File: EarlyToyota Flash device identifier: Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Toyota (models specified in the following table). 39 Model Year Immo Location To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. 4.1.29 Thumbwheel Setting 31 File: FJ_S93C66 Flash device identifier: Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Toyota (models specified in the following table). Model Year Immo Location FJ Cruiser Above glove box. To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. Use the procedure described in Appendix A, section A.8.1 to register keys in the immobilizer. 4.1.30 Thumbwheel Setting 32 File: SaabCIM03_09 Flash device identifier: Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Saab (models specified in the following table). Model Year Immo Location 93 2003-2009 Behind steering wheel. 40 To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. After programming is successfully completed a GM tech2 dealer programmer with online subscription is required for key registration. Therefore it is recommended that the car be towed to a dealer, the CEM be reflashed at the dealer, then the dealer perform the key registration. 4.1.31 Thumbwheel Setting 33 Not in use at this time. 4.1.32 Thumbwheel Setting 34 File: id box 93C86b virgin Flash device identifier: Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Toyota (models specified in the following table). Model Year Immo Location To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. 4.1.33 Thumbwheel Setting 35 File: 2010Camry Flash device identifier: Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Toyota (models specified in the following table). 41 Model Year Camry 2010 Immo Location To perform the programming function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the programming operation failed. 4.1.34 Thumbwheel Setting 36 File: Smart_Key_proxy_IDbox Flash device identifier: Device type: 93C series (93C01, 93C02, etc…) Type of operation: Programming Manufacturer(s): Toyota and Lexus. File is used to update the smart key proxy id box when it is locked up. 4.1.35 Thumbwheel Setting 37 through 83 These thumbwheel selection options are not in use at this time. 42 4.1.36 Thumbwheel Setting 84 File: N/A Device type: 24C16 Type of operation: PIN read Manufacturer(s): Chevrolet (models specified in the following table). Model Year BCM Location Cruze This thumbwheel selection can be used to read the 4 digit PIN for the vehicle(s) specified. To perform the PIN read function use the procedure described in section 3.1. At the end of the operation the display will display the 4 digits of the PIN. 4.1.37 Thumbwheel Setting 85 File: N/A Device type: 93C66 Type of operation: PIN read Manufacturer(s): Fiat (models specified in the following table). Model Year Punto 2009 Immo Location 500 This thumbwheel selection can be used to read the 5 digit PIN for the vehicle(s) specified. To perform the PIN read function use the procedure described in section 3.1. At the end of the operation the display will display the PIN (scrolling display). 43 4.1.38 Thumbwheel Setting 86 File: N/A Device type: 93C66 Type of operation: PIN read Manufacturer(s): Saab (models specified in the following table). Model Year Immo Location All This thumbwheel selection can be used to read the 4 digit PIN for the vehicle(s) specified. To perform the PIN read function use the procedure described in section 3.1. At the end of the operation the display will display the 4 digits of the PIN. 4.1.39 Thumbwheel Setting 87 File: N/A Device type: 93C56 Type of operation: Key read Manufacturer(s): Toyota and Lexus (models specified in the following table). Model Year Immo Location Same as Thumbwheel setting 05 This thumbwheel selection can be used to read the 3 keys from the vehicle. The display will pause for ease of viewing – use the START button to continue scrolling through the digits. 44 4.1.40 Thumbwheel Setting 88 File: N/A Device type: 95040 Type of operation: PIN read Manufacturer(s): Dodge (models specified in the following table). Model Year Immo Location Caravan This thumbwheel selection can be used to read the 4 digit PIN for the vehicle(s) specified. To perform the PIN read function use the procedure described in section 3.1. At the end of the operation the display will display the 4 digits of the PIN. 4.1.41 Thumbwheel Setting 89 File: N/A Device type: 95080 Type of operation: PIN read Manufacturer(s): Jeep (models specified in the following table). Model Year Immo Location Liberty 2006 Steering column This thumbwheel selection can be used to read the 4 digit PIN for the vehicle(s) specified. To perform the PIN read function use the procedure described in section 3.1. At the end of the operation the display will display the 4 digits of the PIN. 45 4.1.42 Thumbwheel Setting 90 File: N/A Device type: 93C56 Type of operation: PIN read Manufacturer(s): 2005 Nissan (models specified in the following table). Model Year All 2005 BCM Location Consult Tcode manual. This thumbwheel selection can be used to read the 4 digit PIN for the vehicle(s) specified. To perform the PIN read function use the procedure described in section 3.1. At the end of the operation the display will display the 4 digits of the PIN. 4.1.43 Thumbwheel Setting 91 File: N/A Device type: 93C66 Type of operation: PIN read Manufacturer(s): 2009 Nissan (models specified in the following table). 46 Model Year BCM Location Altima 2009 and up Pathfinder 2009 and up Frontier 2009 and up XTerra 2009 and up Armada 2009 and up Titan 2009 and up Rogue 2009 and up Under dashboard, passenger side, near glove box. Murano 2009 and up Driver’s side, behind combination meter. Quest 2009 and up Near parking brake pedal assembly. Versa 2009 and up Behind glove box. Sentra 2009 and up Behind glove box. Maxima 2009 and up Under instrument panel, attached to steering member. 350Z 2009 and up Driver’s side, adjacent to fuse block. 370Z 2009 and up Under dashboard, passenger side. Z12 2009 and up Left driver’s side, under instrument lower panel. GT-R 2009 and up Under dashboard, passenger side. Driver’s side, under instrument panel. Driver’s side, under steering column. Remove lower knee protector to access. This thumbwheel selection can be used to read the 4 digit PIN for the vehicle(s) specified. To perform the PIN read function use the procedure described in section 3.1. At the end of the operation the display will display the 4 digits of the PIN. 47 4.1.44 Thumbwheel Setting 92 File: N/A Device type: 93C76 ? Type of operation: PIN read Manufacturer(s): Volkswagen (VW) (models specified in the following table). Model Year Immo Location Beetle 2000 and up In cluster, under dash board This thumbwheel selection can be used to read the 4 digit PIN for the vehicle(s) specified. To perform the PIN read function use the procedure described in section 3.1. At the end of the operation the display will display the 4 digits of the PIN. 4.1.45 Thumbwheel Setting 93 File: N/A Device type: 93LC46 Type of operation: PIN read Manufacturer(s): Isuzu (models specified in the following table). Model Year Immo\ECU\BCM Location Axiom 2003 - 2005 Below steering column Rodeo 2003 - 2005 Below steering column This thumbwheel selection can be used to read the 4 digit PIN for the vehicle(s) specified. To perform the PIN read function use the procedure described in section 3.1. At the end of the operation the display will display the 4 digits of the PIN. 48 4.1.46 Thumbwheel Setting 94 File: N/A Device type: 24LC02 Type of operation: PIN read Manufacturer(s): Chrysler (models specified in the following table). Model Year Immo Location All Type 1 Chryslers 1998 and up On steering column at ignition switch. This thumbwheel selection can be used to read the 4 digit PIN for the vehicle(s) specified. To perform the PIN read function use the procedure described in section 3.1. At the end of the operation the display will display the 4 digits of the PIN. Important: One of the pads on the board must be connected to GND before trying to program the board (refer to photo in Appendix B). 4.1.47 Thumbwheel Setting 95 File: Data from “Restore” Memory Block. Flash device identifier: Depends on manufacturer Type of operation: Programming Manufacturer(s): Any This thumbwheel setting is used to restore the contents of a memory device to it’s value prior to programming. Anytime the Penloader is used to program a device, it reads the device and saves the contents into a “Restore” memory block (contained in the Penloader) prior to overwriting the device with new data. If there is a desire to restore the original contents of the device after programming, this can be achieved using thumbwheel setting 95. 49 It is important to note that the contents of the “Restore” Memory Block are overwritten with each subsequent programming operation. Thus a function is also provided to save the contents of the “Restore” memory bank to one of the other 4 Memory Blocks provided (ref section 4.2.6). (i) (ii) (iii) (iv) Set thumbwheel to 95. Position the Penloader over the 8 pin memory device. Press the START button. If successful, the original contents of the memory device will be restored and the display will indicate “OK”. 4.1.48 Thumbwheel Setting 96 through 97 These thumbwheel selection options are not in use. 4.1.49 Thumbwheel Setting 98 Switch to THUMB 1. 4.1.50 Thumbwheel Setting 99 This thumbwheel selection will display the serial number of the Penloader, plus the voltage of either rechargeable batteries, if an external dc supply is not connected to the unit; else the voltage of the external dc supply. To display these 2 parameters the thumbwheel switch should be set to 99, and the START button pressed. The unit will display a WAIT message, then continually scroll through a message that shows the serial number and the supply voltage. 50 4.2 THUMB 1 Settings The following sections describe the operation of the Penloader under the THUMB1 thumbwheel settings. To invoke these thumbwheel settings, set the thumbwheel to 98 before powering on the Penloader. These settings are only valid until the Penloader is powered off. Anytime the Penloader is used to program a device, it reads the device and saves the contents into a “Restore” memory block (contained in the Penloader) prior to overwriting the device with new data. If there is a desire to restore the original contents of the device after programming, this can be achieved using thumbwheel setting 95 (ref section 4.1.47). It is important to note that the contents of the “Restore” memory block are overwritten with each subsequent programming operation. Thus functions are provided to save the contents of the “Restore” memory Block to one of the other 4 Memory Blocks provided. The THUMB 1 settings include all of the save operations to the Restore Memory, and the copy of the Restore Memory to and from one of the onboard 4 memory blocks (0, 1, 2, or 3). Note that the write function to these memory blocks can take a while, depending on the amount of data to be written. In some instances, this save operation may take 30 seconds or more. In all cases audio cues are used to define the end of the operation, and status is shown on the display. 4.2.1 Thumbwheel Settings 00 through 03 These thumbwheel settings are used to transfer the contents of a memory block up to a computer. This procedure is described in section 5. Set thumbwheel to 01, 02, 03, or 04 depending on which memory block (0, 1, 2, or 3) should source the data to be sent to the computer. 51 4.2.2 Thumbwheel Settings 04 through 07 These thumbwheel settings are used to transfer the contents of a data file from a computer to a Memory Block. This procedure is described in section 5. Set thumbwheel to 04, 05, 06, or 07 depending on which Memory Block (0, 1, 2, or 3) the data received should be saved to. 4.2.3 Thumbwheel Settings 08 through 11 These thumbwheel settings are used to copy the data saved in the Restore Memory Block to one of the four permanent storage Memory Blocks (0, 1, 2, or 3). Set thumbwheel to 08, 09, 10, or 11 depending on which Memory Block (0, 1, 2, or 3) the data should be saved to. 4.2.4 Thumbwheel Settings 12 through 15 These thumbwheel settings are used to copy the data saved in one of the four permanent storage Memory Blocks (0, 1, 2, or 3) to the Restore Memory Block . Set thumbwheel to 12, 13, 14, or 15 depending on which memory block (0, 1, 2, or 3) the data should be copies from. 4.2.5 Thumbwheel Settings 16 through 20 These thumbwheel settings are used to read the contents of an external 25LC series [SPI] device, and save the contents to the Restore Memory Block. Set thumbwheel to 16, 17, 18, 19 or 20 depending on the device type to be read. To perform the read and save function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the operation failed. Note that the “LC” in the device part number is not significant – devices may have variations on parts numbers such as 25AA040, or 95C020. 52 Thumbwheel Setting 16 17 18 19 20 Device 25LC010 or 95010 25LC020 or 95020 25LC040 or 95040 25LC080 or 95080 25LC160 or 95160 4.2.6 Thumbwheel Settings 21 through 25 These thumbwheel settings are used to write the contents of the Restore Memory Block to an external 25LC series [SPI] device. Set thumbwheel to 21, 22, 23, 24 or 25 depending on the device type to be read. To perform the read and save function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the operation failed. Note that the “LC” in the device part number is not significant – devices may have variations on parts numbers such as 25AA040, or 95C020. Thumbwheel Setting 21 22 23 24 25 Device 25LC010 or 95010 25LC020 or 95020 25LC040 or 95040 25LC080 or 95080 25LC160 or 95160 4.2.7 Thumbwheel Settings 26 through 30 These thumbwheel settings are used to read the contents of an external 24C series [I2C] device, and save the contents to the Restore Memory Block. Set thumbwheel to 26, 27, 28, 29 or 30 depending on the device type to be read. To perform the read and save 53 function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the operation failed. Note that the “C” in the device part number is not significant. Some parts may use the “LC” or “AA” alternatives. Thumbwheel Setting 26 27 28 29 30 Device 24C01 24C02 24C04 24C08 24C16 4.2.8 Thumbwheel Settings 31 through 35 These thumbwheel settings are used to write the contents of the Restore Memory Block to an external 24C series [SPI] device. Set thumbwheel to 31, 32, 33, 34 or 35 depending on the device type to be read. To perform the read and save function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the operation failed. Note that the “C” in the device part number is not significant. Some parts may use the “LC” or “AA” alternatives. Thumbwheel Setting 31 32 33 34 35 Device 24C01 24C02 24C04 24C08 24C16 54 4.2.9 Thumbwheel Setting 36 This thumbwheel setting is used to read the contents of an external 93C series [Microwire] device, and save the contents to the Restore Memory Block. It is not necessary to select the actual 93C series device type as the Penloader will determine which type it is reading from. To perform the read and save function use the procedure described in section 3.1. Display must display “OK” at the end of the procedure, else the operation failed. Note that the “C” in the device part number is not significant. Some parts may use the “LC” alternative. 4.2.10 Thumbwheel Setting 99 This thumbwheel selection will display the serial number of the Penloader, plus the voltage of either rechargeable batteries, if an external dc supply is not connected to the unit; else the voltage of the external dc supply. To display these 2 parameters the thumbwheel switch should be set to 99, and the START button pressed. The unit will display a WAIT message, then continually scroll through a message that shows the serial number and the supply voltage. 55 5 Uploading/Downloading Serial Data 5.1 Introduction The Penloader can save up to four data files, sourced from external memory devices, in onboard flash memory, with a maximum file size of 2048 bytes (corresponding to the largest anticipated memory devices that it will be required to function with – 93C86 microwire devices, and 24C16 I2C devices). The data files are stored in one of 4 memory blocks, numbered 0 through 3. Included in the Penloader is the capability to both send any of these 4 memory blocks up to an external computer; and to receive a text file containing data and save it to one of the 4 memory blocks (with some limitations). The send/receive capability is designed to work with standard off-the-shelf terminal emulator programs such as Microsoft’s Hyper-Terminal (usually included with the Windows operating system), and TeraTerm from Ayera Technologies. Other terminal emulators may be used if they contain the capability to send and receive files using the Xmodem protocol. Hyper Terminal can be found on a Windows computer under: Start-->All Programs-->Accessories-->Communications TeraTerm ver 3.1.3 can be downloaded for free from: http://www.ayera.com/teraterm/ Other versions have not been tested, but should function correctly with the Penloader. 56 It is also important that the computer to be used to communicate with the Penloader, has a working serial port. Many laptops do not include serial ports any longer. In this case the user will need to use a USB to serial adapter to provide the serial interface function. These can be purchased through a variety of vendors such as Office Depot, Staples, Best Buy, Amazon.com, Frys, etc… 5.2 General Setup 5.2.1 Terminal Emulation Software The following procedures can be used to setup the terminal emulation programs the first time that they are used. 5.2.1.1 Hyper Terminal Start Hyper Terminal by going to Start-->All Programs->Accessories-->Communications and selecting it with the left mouse button. A window should appear that looks like: 57 Enter a name for the connection, and select an appropriate icon, then click on the OK button. Another window will pop up that looks like: 58 Select the COM port available on the computer, and click on the OK button (Note: the area code and phone number fields are not required once a COM port has been specified. These fields should be ignored). A further window will pop up, as shown below. Select the options a shown (38400, 8, None, 1, None), click on the Apply button, then the OK button. 59 The main Hyper Terminal screen should now appear. It is recommended that the settings just entered be saved, so that they may be used again without having to go through the setup procedure. To save the settings, click on File from the menu options along the top of the Hyper Terminal window, then click on Save As from the drop down menu. As this action will actually save a short cut to Hyper Terminal, it is recommended that the user select the Desktop and an appropriate name as shown in the following screen shot. 60 Hyper Terminal is now ready to use. Before closing Hyper Terminal it is recommend that the program be disconnected from the COM port in use. To do this click on Call from the menu options along the top of the Hyper Terminal window, then click on Disconnect from the drop down menu. Each time that Hyper Terminal is started by double clicking on the saved short cut on the Desktop, it will automatically connect to the COM port specified. 5.2.1.2 Tera Term Once Tera Term has been downloaded and installed, it will be necessary to setup the serial communications parameters. Before working on this it is easiest if a short cut to Tera Term is created on the computer’s Desktop. To do this, locate the executable file (named something like ttermpro.exe) in the installation folder (named something like C:\TeraTermPro\ttpro313, but may be in a subfolder 61 under C: if one was selected during the unzip process), right click on the executable file and drag it to the Desktop. Once dragged to the desktop, release the right mouse button and a drop down menu will appear. Select Create Shortcuts Here from this menu and a shortcut will appear on the Desktop. Double click on the shortcut to start Tera Term. A popup window will appear as shown below. Select the Serial option as shown, then select the COM port available on the computer, and click on the OK button. It is now necessary to setup the COM ports parameters. Select Setup from the menu options along the top of the Tera Term window, then click on Serial Port from the drop down menu. Another window will pop up as shown. 62 Select the options as shown (except for the COM port which was selected in the last step, and should match what is shown on this screen), and click on the OK button. Tera Term is now setup for use with the Penloader. It is recommended that the settings be saved for future use. To save these settings select Setup from the menu options along the top of the Tera Term window, then click on Save Setup from the drop down menu. Name the setup file Penloader.ini and select a folder that you will remember, then click on the Save button. Tera Term does not automatically restore the saved parameters. To restore the saved setup next time Tera Term is started, select Setup from the menu options along the top of the Tera Term window, then click on Restore Setup from the drop down menu. Navigate to the folder that the file Penloader.ini was saved in, select the file and click on the Open button. 63 5.2.2 Connecting the Serial Cable Before any data can be moved between the Penloader and a computer, a serial cable must be connected between the 2 devices. To connect a serial cable to the Penloader, the programming head must be removed and replaced with a serial cable head. To remove the programming head gently pull the head away from the end of the tube. Once removed, the serial cable head can be installed. To install the new head, align the 2 holes in the bottom of the head with the 2 alignment pins on the bottom of the Penloader. Note that the 2 alignment pins are not symmetrically positioned with respect to the end of the Penloader tube – ensure correct orientation of the new head with respect to the Penloader tube. A standard 9 pin “D” serial cable can now be plugged into the end of the 9 pin female “D” connector on the end of the Penloader, and the other end of the serial cable plugged into the 9 pin male “D” connector in the computer (or USB to serial adapter cable). 64 5.3 Transferring Memory Blocks Between The Penloader and the Computer All data transfers between the Penloader and a computer use the standard Xmodem protocol. For this reason it is necessary to sequence the transfer differently depending on which direction data is to be transferred. The following paragraphs describe the sequence to be followed to perform the data transfer. Important: Penloader must be connected to the computer (as described in section 5.2.2) before sequencing through the following paragraphs. 5.3.1 Using Hyper Terminal to send Memory Blocks from the Penloader to the computer Penloader: Set thumbwheel to 98, then power up Penloader and wait for thumbwheel number to scroll by. Penloader: Change thumbwheel to the correct setting for sending the desired Memory Block, then press the Start button. The following table specifies the thumbwheel settings for each memory block: Thumbwheel Memory Block 00 0 01 1 02 2 03 3 Penloader Display -00- Send Mem block 0 to computer -01- Send Mem block 1 to computer -02- Send Mem block 2 to computer -03- Send Mem block 3 to computer Hyper term: Select Transfer from the menu options along the top of the Hyper Terminal window, then click on 65 Receive File from the drop down menu. The following window will pop up: Hyper term: Select the Xmodem protocol (important – do not select the 1K Xmodem protocol option), and also a folder where the file should be saved. Click on the Receive button and another window will pop up, as shown below. Hyper term: Enter a filename in the field provided and click on the OK button. The following window appears. 66 If the file transfer is successful, the above window will disappear, leaving only the original Hyper Terminal start up window, and the Penloader will display OK along with providing an audio cue. If the file transfer is not successful, the Penloader will display FAIL. 5.3.2 Using Tera Term to send Memory Blocks from the Penloader to the Computer Penloader: Set thumbwheel to 98, then power up Penloader and wait for thumbwheel number to scroll by. Penloader: Change thumbwheel to the correct setting for sending the desired Memory Block, then press the Start button. The following table specifies the thumbwheel settings for each Memory Block: 67 Thumbwheel Memory Block 00 0 01 1 02 2 03 3 Penloader Display -00- Send Mem block 0 to computer -01- Send Mem block 1 to computer -02- Send Mem block 2 to computer -03- Send Mem block 3 to computer Tera Term: Select File from the menu options along the top of the Tera Term window, then click on Transfer from the drop down menu, followed by clicking on the Xmodem option, and finally select the Receive option. The following window will pop up: 68 Tera Term: Enter the filename for the file to be used to save the received Memory Block data, and verify that the Binary option is not selected, and that the CRC option is selected. Then click on the Open button. The following window will pop up and the data transfer will start immediately. If the file transfer is successful, the above window will disappear, leaving only the original Tera Term start up window, and the Penloader will display OK along with providing an audio cue. If the file transfer is not successful, the Penloader will display FAIL. 5.3.3 Using Hyper Terminal to send Memory Blocks from the computer to the Penloader Penloader: Set thumbwheel to 98, then power up Penloader and wait for thumbwheel number to scroll by. Penloader: Change thumbwheel to the correct setting for receiving and saving the desired Memory Block. Do NOT press the Start button yet. The following table specifies the thumbwheel settings for each memory block: 69 Thumbwheel Memory Block 04 0 05 1 06 2 07 3 Penloader Display -04- Receive data from computer and save in Mem block 0 -05- Receive data from computer and save in Mem block 1 -06- Receive data from computer and save in Mem block 2 -07- Receive data from computer and save in Mem block 3 Hyper term: Select Transfer from the menu options along the top of the Hyper Terminal window, then click on Send File from the drop down menu. The following window will pop up: Hyper term: Select the Xmodem protocol (important – do not select the 1K Xmodem protocol option), and also the name of the file containing the Memory Block data (using the Browse button). When done, click on the Send button. The following window will appear: 70 Penloader: Press the Start button. The file transfer should start and the Penloader should display “RCVE”, while also making a ticking sound. When the file transfer has completed, the above Hyper Terminal window will disappear, leaving only the original Hyper Terminal start up window. The Penloader takes a little longer to complete the operation as it must save the transferred data into the onboard Memory Block. When the Penloader operation completes, it will display OK if the operation was successful, and also provide an audio cue. If the file transfer is not successful, the Penloader will display FAIL. 71 5.3.4 Using Tera Term to send Memory Blocks from the computer to the Penloader Penloader: Set thumbwheel to 98, then power up Penloader and wait for thumbwheel number to scroll by. Penloader: Change thumbwheel to the correct setting for receiving and saving the desired Memory Block. Do NOT press the Start button yet. The following table specifies the thumbwheel settings for each memory block: Thumbwheel Memory Block 04 0 05 1 06 2 07 3 Penloader Display -04- Receive data from computer and save in Mem block 0 -05- Receive data from computer and save in Mem block 1 -06- Receive data from computer and save in Mem block 2 -07- Receive data from computer and save in Mem block 3 Tera Term: Select File from the menu options along the top of the Tera Term window, then click on Transfer from the drop down menu, followed by clicking on the Xmodem option, and finally select the Send option. The following window will pop up: 72 Tera Term: Select the file containing the Memory Block data, and verify that the CRC option is selected. Then click on the Open button. The following window will pop up and the data transfer will start immediately. Penloader: Press the Start button. The file transfer should start and the Penloader should display “RCVE”, while also making a ticking sound. 73 When the file transfer has completed. The above Tera Term window will disappear, leaving only the original Tera Term start up window. The Penloader takes a little longer to complete the operation as it must save the transferred data into the onboard Memory Block. When the Penloader operation completes, it will display OK if the operation was successful, and also provide an audio cue. If the file transfer is not successful, the Penloader will display FAIL. 5.4 Troubleshooting Penloader Issues: Issue: Penloader doesn’t display the “-00- Send Mem block # to computer”, or the “-03- Receive data from computer and save” message. Response: Penloader must be powered up with thumbwheels set to 98 for this option to work correctly. Powering up the Penloader with the thumbwheels set to 98 results in an alternate set of functions being allocated to the thumbwheel settings. Issue: Penloader appears to hang during the data transfer. Response: 2 possibilities. First possibility is that a data error occurred during the transfer, and the data transfer has crashed. The second possibility is that the procedures outlined in this document were not followed correctly, and the data transfer has not started. It is important that the sequence of Penloader button presses, and terminal emulation program option selections, is done in the correct order, else the computer and Penloader will not synchronize correctly. If the Penloader hangs during the data transfer, it must be power cycled. 74 Terminal Emulator Issues: Issue: The terminal emulator data transfer window closes but the data transfer did not complete. Response: Most of the data transfer operations within a terminal emulator contain a time out function, which will stop the attempted data transfer and close the transfer information window should the data transfer take an abnormally long time. This should not happen unless (i) the data transfer has crashed, or (ii) the user is taking too long to dial through the Penloader selections. General Issues: Issue: No data is transferred between the Penloader and the computer even though the instructions have been exactly followed. Response: Most likely problem is the serial cable, or the COM port selection. The serial cable used should be a standard cable with a 9 pin D male connector at one end, and a 9 pin D female connector at the other. It should NOT include a null modem function. To verify that the serial cable is working, connect the Penloader to the computer and start up the terminal emulator (Hyper Terminal or Tera Term). If using Tera Term, be sure to restore the setup file that contains the serial settings. Set the thumbwheel on the Penloader to 98 and power up the Penloader. Set the thumbwheel to 03 and press the Start button (to start receiving data for memory block 0 from the computer). If the serial cable is working correctly, a single uppercase letter “C” should appear in the terminal emulator screen. It is also possible that the incorrect COM port has been selected. On the Windows computer start up the Control Panel (usually found under the START menu) and double click on the “System” icon. This will pop up the System 75 Window. Select the Hardware tab, then click on the Device Manager button. Find the line in the window labeled as “Ports (COM & LPT)” and click on the plus sign next to this text. This will expand the line and display all of the working COM ports on the computer. These are the only COM port numbers that can be selected to function with the terminal emulator. If using a USB to serial adapter, this screen will confirm the COM port number allocated to the adapter. Special note for Tera Term users – Tera Term defaults to only accepting COM numbers 1, 2, 3 and 4, which can be a problem if using a USB to serial adapter, as these are often allocated to higher COM port numbers. To fix this, use Windows Explorer or My Computer to display the folder that Tera Term was unzipped to. In the folder there should be a file called “teraterm.ini”. Open the file with WordPad or Notepad and search for the word “MaxComPort”. This should find a line of text which reads: MaxComPort=4 Edit this line to read: MaxComPort=16 And save the file. Restart Tera Term and more COM port numbers should be available now. Important: If the data transfer crashes, hangs, or does not complete, the operation must be cancelled on the computer (if it hasn’t already timed out) AND the Penloader should be powered off. Then the procedure should be started from the beginning. This is the only assured method of clearing errors, and retrying a transfer of data. 76 Data File 5.5 The Memory Block data transferred from the Penloader will be saved into a text file on the computer. This text file can be edited with any standard text editor (Notepad, Wordpad, Microsoft Word), however if the file is to be updated and transferred back to the Penloader it is important that the basic structure of the file not be changed. The file should NOT be opened with a binary hex editor – the Penloader compatible format is text only. An example of the contents of a file containing 256 bytes of data transferred up from the computer, is shown below. A5 01 02 03 10 11 12 13 20 21 22 23 30 31 32 33 40 41 42 43 50 51 52 53 60 61 62 63 70 71 72 73 80 81 82 83 90 91 92 93 A0 A1 A2 A3 B0 B1 B2 B3 C0 C1 C2 C3 D0 D1 D2 D3 E0 E1 E2 E3 F0 F1 F2 F3 *My special 04 05 06 E2 FE 09 0A 14 15 16 17 18 19 1A 24 25 26 27 28 29 2A 34 35 36 37 38 39 3A 44 45 46 47 48 49 4A 54 55 56 57 58 59 5A 64 65 66 67 68 69 6A 74 10 36 77 78 79 7A 84 85 86 87 88 89 8A 94 95 96 97 98 99 9A A4 A5 A6 A7 A8 A9 AA B4 B5 B6 B7 B8 B9 BA C4 C5 C6 C7 C8 C9 CA D4 D5 D6 D7 D8 D9 DA E4 E5 E6 E7 E8 E9 EA F4 F5 F6 F7 F8 F9 FA custom hotrod file* 0B 1B 2B 3B 4B 5B 6B 7B 8B 9B AB BB CB DB EB FB 0C 1C 2C 3C 4C 5C 6C 7C 8C 9C AC BC CC DC EC FC 0D 1D 2D 3D 4D 5D 6D 7D 8D 9D AD BD CD DD ED FD 0E 1E 2E 3E 4E 5E 6E 7E 8E 9E AE BE CE DE EE FE 0F 1F 2F 3F 4F 5F 6F 7F 8F 9F AF BF CF DF EF 5A Each byte of data is shown using hexadecimal (or hex) representation. The Penloader performs the task of translating between text and binary forms. When receiving data from the computer, it parses each byte according to the following rules: - Each byte (2 hex characters) must be separated by at least one space character, or a carriage return(CR)/line feed(LF) pair indicating end of line. 77 There is no limit to the number of spaces, or CR/LF combinations used between bytes. - A byte is identified by 2 hex characters. A hex character is a character between “0” and “9”, “A” and “F”, or “a” and “f”. - Any character not identified as a hex character, a space character, or CR/LF combination, is ignored. It is thus possible, but not recommended, to insert other characters within the file, as they will be ignored. - For readability it is recommended that 16 consecutive bytes be shown on one line, however this is not a requirement. - Data bytes must be shown in a consecutive order, from lowest address to highest address, as read from left to right on a line, and top to bottom for consecutive lines. - At the end of the data, it is permissible to include a short comment field, delineated by the “*” character. This comment field will appear on the Penloader display when the thumbwheel is used to select one of the memory blocks as the source of data for a programming operation (thumbwheel options 00, 01, 02 or 03 under the regular thumbwheel settings). - Comment field may only be placed after the data field. - The comment field should not exceed 60 characters. 78 APPENDIX A Toyota/Lexus Post Programming Procedures 79 A.1 Procedure to be followed for the following vehicles: Make Model 4Runner Avalon Year 1999-2002 1998-2003 1998-2002 Camry Toyota Lexus 2001-2003 Highlander LandCruiser MR2 RAV4 Sequoia Sienna Solara ES300 GS300 GS400 GS430 IS300 LS400 LX470 RX300 SC300 SC400 Remark 4 cylinder engine 2001-2003 1998-2002 2000-2003 2000-2003 2001-2002 1998-2003 1999-2003 1998-2003 1998-2003 1998-2000 2001-2003 2001-2003 1998-2000 1998-2002 1999-2003 1998-2000 1998-2000 A.1.1 To register Keys in a new ECU: a. ECU is in Automatic Registration mode, and the Security light should be blinking. b. Insert a key into the ignition switch (do not turn ignition on). The Security light should now be on (not blinking). c. The key is now registered. d. Remove key from the ignition switch. e. Repeat steps b through e if more keys are to be registered. f. Once all keys are registered, remove last key from the ignition switch, then depress and release the brake pedal once. g. Programming mode completes after 10 seconds. 80 Note: The first key registered will be the new Master Key. The last key registered will be the Valet key. If only 1 key is to be registered, cycle the single key through the registration process 4 or 5 times. A.1.2 To register an additional Master Key: a. Insert a registered Master key into the ignition switch (do not turn ignition on). b. Depress and release the gas pedal 5 times. c. Depress and release the brake pedal 6 times. d. Remove the Master key from the ignition switch. e. Insert new key to be registered into the ignition switch (do not turn ignition on). f. Depress the gas pedal once. g. Wait approximately 1 minute until the security light stops blinking. h. Remove the key. i. Depress and release the brake pedal once. j. Programming mode completes after 10 seconds. A.1.3 To register an additional Valet Key: a. Insert a registered Master key into the ignition switch (do not turn ignition on). b. Depress and release the gas pedal 4 times. c. Depress and release the brake pedal 5 times. d. Remove the Master key from the ignition switch. e. Insert new key to be registered into the ignition switch (do not turn ignition on). f. Depress the gas pedal once. g. Wait approximately 1 minute until the security light stops blinking. h. Remove the key. i. Depress and release the brake pedal once. j. Programming mode completes after 10 seconds. A.1.4 To delete all other existing keys: a. Insert a registered Master key into the ignition switch (do not turn ignition on). b. Depress and release the gas pedal 6 times. c. Depress and release the brake pedal 7 times. 81 d. Remove the Master key from the ignition switch. e. Insert new key to be registered into the ignition switch (do not turn ignition on). f. Depress the gas pedal once. g. Wait approximately 1 minute until the security light stops blinking. h. Remove the key. i. Depress and release the brake pedal once. j. Programming mode completes after 10 seconds. A.2 Procedure to be followed for the following vehicles: Make Toyota Lexus Model Sequoia LS430 SC430 Year 2003 2001-2003 2002-2003 Remark A.2.1 To register an additional Master or Valet Key: a. Ensure there is no key in the ignition. b. While sitting in driver’s seat, close all vehicle doors, but do not lock them. c. Insert a registered Master key into the ignition switch. d. Turn ignition switch ON then OFF 5 times. e. Open, then close, the driver’s door 6 times. This must be completed within 35 seconds of finishing the previous step (item d above). f. Remove the Master key from the ignition switch. g. Insert new key to be registered into the ignition switch (do not turn ignition on). This must be completed within 10 seconds of removing the Master key. h. Wait approximately 60 seconds until the Theft light goes out. i. Remove the key. j. Programming mode is complete. A.2.2 To delete all other existing keys: a. Ensure there is no key in the ignition. 82 b. While sitting in drivers seat, close all vehicle doors, but do not lock them. c. Insert a registered Master key into the ignition switch. d. Turn ignition switch ON then OFF 6 times. e. Open, then close, the driver’s door 7 times. This must be completed within 35 seconds of finishing the previous step (item d above). f. Remove the Master key from the ignition switch. g. The Master key is the only key now programmed into the ECU. A.3 Procedure to be followed for the following vehicles: Make Lexus Model LS400 Year 1997 Remark A.3.1 To register a new Master Key after installing a new ECU: a. While sitting in driver’s seat, close all vehicle doors, but do not lock them. b. Insert a working "Master" key into the ignition switch. c. Turn ignition switch ON then OFF. d. Remove key from ignition switch. e. Open, then close, the driver’s door. Programming mode is complete. A.3.2 To register an additional Master Key: a. Ensure there is no key in the ignition. b. While sitting in driver’s seat, close all vehicle doors, but do not lock them. c. Insert a working "Master" key in the ignition and turn lock to On 5 times. d. Open and shut the driver door 6 times. e. Remove the "Master key from the ignition. 83 f. Insert the new in-programmed key in the ignition to the ON position for a few minutes until the security light goes out. g. Remove the key, open and shut the driver door once. The key is now programmed as a master. A.3.3 To register an additional Valet Key: a. Ensure there is no key in the ignition. b. While sitting in drivers seat, close all vehicle doors, but do not lock them. c. Insert a registered Master key into the ignition switch. d. Turn ignition switch ON then OFF 4 times leaving the ignition switch in the ON position on the 4th cycle. This operation must be completed within 15 seconds of inserting the key into the ignition switch. e. Open, then close, the driver’s door within 15 seconds of starting step d (timing starts when Master key was inserted into the ignition switch). f. Open, then close, the driver’s door 4 times. This must be completed within 20 seconds of closing the door in the previous step (item e above). g. Remove the Master key from the ignition switch. This must be completed within 20 seconds of closing the door in step e above. h. Insert new key to be registered into the ignition switch. This must be completed within 10 seconds of removing the Master key. i. Turn ignition switch ON. This must be completed within 10 seconds of inserting the key into the ignition switch. j. Wait at least 60 seconds, then turn ignition switch OFF and remove key. k. Key is now registered in ECU. l. Another key may be registered if it is inserted into the ignition switch within 10 seconds or removing the previous key, and repeating steps i through k. m. Open, then close, the driver’s door. Programming mode is complete. 84 A.3.4 To delete all other existing keys: a. Ensure there is no key in the ignition. b. While sitting in driver’s seat, close all vehicle doors, but do not lock them. c. Insert a registered Master key into the ignition switch. d. Turn ignition switch ON then OFF 6 times leaving the ignition switch in the ON position on the 6th cycle. This operation must be completed within 15 seconds of inserting the key into the ignition switch. e. Open, then close, the driver’s door within 15 seconds of starting step d (timing starts when Master key was inserted into the ignition switch). f. Open, then close, the driver’s door 6 times. This must be completed within 20 seconds of closing the door in the previous step (item e above). g. Remove the Master key from the ignition switch. This must be completed within 20 seconds of closing the door in step e above. h. Open, then close, the driver’s door. Programming mode is complete. A.4 Procedure to be followed for the following vehicles: Make Toyota Model Prius Year 2001-2003 Remark A.4.1 To register Keys in a new ECU: a. Ensure there is no key in the ignition. b. While sitting in driver’s seat, close all vehicle doors, but do not lock them. c. Insert first new Master key into the ignition switch. d. Wait 5 seconds, then remove key from ignition switch. e. Insert second new Master key into the ignition switch. f. Wait 5 seconds, then remove key from ignition switch. g. Insert new Valet key into the ignition switch. 85 h. Wait 5 seconds, then remove key from ignition switch. i. All 3 keys should now turn off the theft light, but will no start the vehicle. j. Insert a Master Key into the ignition switch, and turn ignition switch on. a. Short OBD2 connector terminal 4 to terminal 13 using a wire or paper clip. i. Wait 30 minutes, then turn ignition switch off and remove shorting wire from OBD2. Programming mode is complete. Vehicle should now start with any of the 3 keys. A.4.2 To register an additional Master or Valet Key: a. Ensure there is no key in the ignition. b. While sitting in driver’s seat, close all vehicle doors, but do not lock them. c. Insert a registered Master key into the ignition switch. d. Quickly turn ignition switch ON then OFF 5 times. e. Quickly open, then close, the driver’s door 6 times. f. Remove the Master key from the ignition switch. g. Insert new key to be registered into the ignition switch (do not turn ignition on). This must be completed within 10 seconds of removing the Master key. h. Leave key in the ignition switch for a minimum of 60 seconds, until the Theft light goes out. i. Remove the key from the ignition switch. j. Key is now registered in ECU. A.5 Procedure to be followed for the following vehicles: Make Lexus Model GX470 LS430 LX470 SC430 Year 2003 - 2004 2001-2003 2003 - 2004 2002-2003 C.5.1 To register Keys in a new Immobilizer: 86 Remark a. Theft light should be on indicating that the immobilzer is in Auto learn mode. b. Insert first Master key (4D with an id of 32, 52 or b) into the ignition switch. Theft light will blink once then remain on. c. Remove key from ignition switch. d. Repeat steps b and c for the remaining 3 keys. Last key registered is the Valet key (4D with an id of 72 or 92). e. Removing fourth key closes Auto learn mode. f. Once Auto learn mode is closed the Immobilizer must be resynchronized with the ECU, else vehicle will not start. Insert a Master Key into the ignition switch, and turn ignition switch on (do not try to start the vehicle). g. Short OBD2 connector terminal 4 to terminal 13 using a wire or paper clip. h. Wait for 30 minutes. i. Remove shorting wire from OBD2 connector. j. Turn ignition switch off and remove key. k. Reinsert key and verify that vehicle can now be started. Notes: Up to 4 keys may be registered. If less than 4 keys are registered, Auto learn mode must be closed manually. To close Auto learn mode, turn ignition switch on, then off, 5 times within a 10 second period, then remove the key from the ignition switch. Theft light blinking two long blinks, and one short blink, indicates that Auto learn mode failed. Theft light blinking two short blinks, and two long blinks, indicates that a key that has already been registered, was registered a second time. 87 A.6 Procedure to be followed for the following vehicles: Make Toyota Toyota Toyota Lexus Lexus Model Sequoia Camry Solara LS430 ES330 Year 2003 2001 - 2004 2003 - 2004 2004 2004 Lexus RX330 2004 Remark VIN starts with J or 2 A.6.1 To register 3 Keys (2 Master, 1 Valet) in a new Immobilizer: a. Ensure there is no key in the ignition. b. While sitting in driver’s seat, close all vehicle doors, but do not lock them. c. Insert first Master key into the ignition switch and wait 5 seconds. d. Remove key and insert second Master key into the ignition switch and wait 5 seconds. e. Remove key and insert Valet key into the ignition switch and wait 5 seconds. f. Remove key. l. The Immobilizer must be resynchronized with the ECU, else vehicle will not start. Insert a Master Key into the ignition switch, and turn ignition switch on (do not try to start the vehicle). m. Short OBD2 connector terminal 4 to terminal 13 using a wire or paper clip. n. Wait for 30 minutes. o. Remove shorting wire from OBD2 connector. p. Turn ignition switch off and remove key. q. Reinsert key and verify that vehicle can now be started. To register less than 3 Keys in a new Immobilizer: a. Ensure there is no key in the ignition. b. While sitting in driver’s seat, close all vehicle doors, but do not lock them. 88 c. Insert first Master key into the ignition switch and wait 5 seconds. d. Remove key. If required, insert a second key into the ignition switch, wait 5 seconds then remove key. e. Insert first Master key into the ignition switch. f. Quickly turn ignition switch ON then OFF 5 times. g. Remove key. h. The Immobilizer must be resynchronized with the ECU, else vehicle will not start. Insert a Master Key into the ignition switch, and turn ignition switch on (do not try to start the vehicle). i. Short OBD2 connector terminal 4 to terminal 13 using a wire or paper clip. j. Wait for 30 minutes. k. Remove shorting wire from OBD2 connector. l. Turn ignition switch off and remove key. m. Reinsert key and verify that vehicle can now be started. A.7 Procedure to be followed for the following vehicles: Make Toyota Model 4Runner Camry LandCruiser Sienna Year 2003 2003 2003 2004 Remark V6 Engine A.7.1 To register Keys in a new Immobilizer: a. Theft light should be on indicating that the immobilzer is in Auto learn mode. b. Insert first Master key (4D with an id of 32, 52 or b) into the ignition switch. Theft light will blink once then remain on. c. Remove key from ignition switch. d. Repeat steps b and c for the remaining 3 keys. Last key registered is the Valet key (4D with an id of 72 or 92). e. Removing fourth key closes Auto learn mode. f. Once Auto learn mode is closed the Immobilizer must be resynchronized with the ECU, else vehicle will not start. Insert a Master Key into the ignition 89 switch, and turn ignition switch on (do not try to start the vehicle). g. Short OBD2 connector terminal 4 to terminal 13 using a wire or paper clip. h. Wait for 30 minutes. i. Remove shorting wire from OBD2 connector. j. Turn ignition switch off and remove key. k. Reinsert key and verify that vehicle can now be started. Notes: Up to 4 keys may be registered. If less than 4 keys are registered, Auto learn mode must be closed manually. To close Auto learn mode, turn ignition switch on, then off, 5 times within a 10 second period, step on the brake, then remove the key from the ignition switch. Theft light blinking two long blinks, and one short blink, indicates that Auto learn mode failed. Theft light blinking two short blinks, and two long blinks, indicates that a key that has already been registered, was registered a second time. A.8 Procedure to be followed for the following vehicles: Make Saab Model Year 2003-2009 Remark A.8.1 To register Keys in the Immobilizer – use AD t-code Pro or MV Pro: a. Go to type 5 under immo. section with key in the "on" position. b. Next menu you will see "Learn Key". c. After that has been completed key has been registered. Car will not start until the immo is married to the ECU. d. Use the black dongle provided in the kit to marry system. e. Turn key to "ON" and install the black dongle to the data port "OBDII". 90 APPENDIX B User Manual – Circuit Board Photos 91 Penloader kit 92 Attachment of Pomona clip to Penloader Correct installation of extension cables to Pomona clip 93 Circuit Board from 34010 module 94 Chrysler (Type 1) PIN read 95 Chrysler (Type 1) – circuit board pad to ground before reading PIN 96 Circuit Board from 02060 module 97 Circuit Board from 50020 module 98 Circuit Board from AA010 module 99 Toyota-Lexus 16bit ECU circuit board 100 Penloader installed on Toyota-Lexus 16bit ECU circuit board 101 Penloader installed on Nissan 09 BCM circuit board 102 Pomona clip installed on Nissan 09 BCM circuit board 103 2003 and later Sequoia immobilizer location behind instrument cluster. 104