WIS 80.57 Drive Authorization System
Description - Drive Authorization System
Function - Drive Authorization System
All Mercedes-Benz vehicles manufactured since about the year 2000 use a Drive Authorization System (DAS) to electronically validate the vehicle’s key. Each key fob for this system contains an EEPROM chip that stores a fixed serial number and a rolling code. Each time the key is used in the ignition switch, DAS reads both the fixed serial number and the rolling code. These values are compared to known valid values stored in DAS. If a match is found, the ECM will allow the engine to start and run, and DAS will write a new “randomized” rolling code to the key fob’s EEPROM. If the key fails validation, even if it is mechanically able to turn the ignition switch, the ECM will prevent the engine form running.
Every Mercedes-Benz vehicle has a record in FDOK (M-B’s worldwide database that contains all information about every M-B ever built), including the assignment of all electronic key codes for all vehicles using DAS.
When the record is created for a new vehicle, a set of unique key serial numbers is assigned and stored in FDOK. Only certain authorized employees at authorized PDC PDC’s (Parts Distribution Centers) have access to this information. Authorized PDC’s stock virgin key transponders and have special equipment to program them with valid serial numbers from FDOK. Keys are programmed when a key set is ordered for a new vehicle or an additional or replacement key is ordered for an existing vehicle. Only a factory or an authorized service center can order keys. For existing vehicles, the service center is required to verify that the customer ordering a key is in fact the owner of the vehicle in question. Examining the customer’s photo ID and the vehicle’s registration receipt generally satisfies this.
For new factory vehicles, there is an operation that performs the initial programming of DAS to introduce it to its assigned key set. This loads all the pre-defined key serial numbers into DAS as defined in FDOK. Even though not all keys physically exist, all possible key ID’s for that vehicle are loaded. This is performed in different ways depending on which version of DAS the vehicle uses. Once performed, there is a programming process that irreversibly locks this data into DAS. Once married to a key set, DAS will only recognize keys in that set. Officially, there is no way to reverse this process and introduce a new key set to DAS, nor is there a way to alter any of the individual key ID’s know to DAS.
For all versions of DAS, there is no battery required for the key. The battery in the key fob is used only to power the Remote Control Locking (RCL) functions. The power for the DAS functions comes from an electronic coil mounted in the ignition switch housing that supplies inductive current to the circuitry in the key fob. For some early vehicles, this coil is also used to transmit and receive radio frequency signals for reading and writing the key’s EEPROM. For later vehicles, the transfer of data between the EIS and the fob’s EEPROM is performed via an infrared signal. Also, since there is no mechanical blade to unlock the ignition switch, the release of both the ignition switch and the steering column lock is performed electronically once DAS validate the key through the infrared data exchange.
OEM Keys - Drive Authorization System
DAS has a maximum of 24 keys per vehicle, however only 8 can be active at a time. Basically for each key number, there are three key segments. The valid key numbers and segments are programmed into the virgin ESL, EIS and ECM using a special green-colored workshop key. As delivered, the vehicle will have two keys using key number 1, segment 1 and key number 2, segment 1 (some models were delivered with three keys, the third one using key number 3, segment number 1).
Typical OEM as delivered vehicle with two keys per vehicle.
- Key Number 1
- Segment 1
- Segment 2
- Key Number 2
- Segment 1
- Segment 2
Typical OEM as delivered vehicle with three keys per vehicle.
- Key Number 1
- Segment 1
- Segment 2
- Key Number 2
- Segment 1
- Segment 2
- Key Number 3
- Segment 1
Additional Keys - Drive Authorization System
When a new key is ordered, the PDC determines which key number and segment to supply based on whether the key is a replacement for a lost one or and additional spare key.
If an additional spare key is requested, then the PDC will create it as the next unused key number, segment 1. If a replacement key is requested, the technician must determine which key number was lost and order its replacement. The PDC will create the replacement with the next unused segment number for that same key number. When the replacement key is first used in the vehicle, DAS will disable the use of the key using the same key number and the previous segment. For example, if key number 2 is lost, the technician orders a replacement for key number 2 and the PDC supplies key number 2, segment 2. When this new key is used in the vehicle, this will disable key number 2, segment 1. Even if that lost key is found, it will no longer operate the vehicle. If key number 2 is lost again, the technician again orders a replacement for key number 2 and the PDC supplies key number 2, segment 3, which disables key number 2, segment number 2. If key number 2 is lost again, the PDC will supply a key with the next unused key number, segment 1, and the technician will be instructed to disable key number 2 completely using a Hand Held Tester via the OBDII port and the vehilce’s CAN. Note that RCL functions are tied to DAS so no additional programming is necessary to completely disable the remote locking/unlocking ability of a lost key.
Everything you ever wanted to know about the Drive Authorisation System (DAS), EIS and Keys
Information gathered from various official MBZ sources, included technical documentation, service documents, and even authorized technicians and factory personnel, by BenzWorld Member rudeney.
http://www.benzworld.org/forums/w163-m-class/1245088-everything-you-always-wanted-know-about.html
Remote Control Key
Description - Remote Control Key
The four main components of the Remote Control Key (A8/1) are the key fob case, electronic printed circuit board, the battery holder with fob lid and with two 3V CR2025 button type batteries, and the emergency mechanical key.
The Remote Control Key (A8/1) emits radio frequency (RF) (In Australia 315 MHz) frequency modulated (FM) signals to operate the remote control functions of unlocking, locking, and boot/trunk opening. The two internal batteries in the key fob are used to power these functions. If these batteries are weak or flat, the key will not unlock the doors or boot/trunk. A emergency mechanical key is stored inside the key fob and is provided in the event of this situation occurring.
The Remote Control Key also emits infra red (IR) signals to operate the convenience opening and closing feature. The IR signals are received by either IR sensor built into the two front door handles. The key needs to be pointing at the handle and within a few metres for the function to work. Better range is achieved if the receiving door handle is not in direct sunlight. The two internal batteries in the key fob are used to power the IR emitter for this function
How It Works - Remote Control Key and EIS
When a Remote Control Key (or a finger for that matter) is inserted in the electronic ignition switch (EIS or EZS) control unit (ignition lock) (N73), it operates a switch which activates an AC generator inside the ignition lock. This generator produces a high frequency (118KHz) sine wave which is inductively coupled to a small coil in the tip of the key fob.
The AC voltage produced in the coil is rectified and the resulting DC voltage is used to power the Remote Control Key ignition functions. (The induced DC voltage was measured as 7.6V.) Using a separate inductive power supply very cleverly avoids reliance on the Remote Control Key batteries and ensures the Remote Control Key will operate the ignition even if it has internal flat or weak batteries.
Once powered by the Induction Power Generator the Remote Control Key emits IR signals to, and receives IR signals from, the Drive Authorisation System (DAS) in the Electronic Ignition/Starter Switch (EIS) control module (N73). Start-up is enabled only after the transmitter key (A8/1) is identified by the encrypted data exchange between the
- EIS control unit (N73) and the
- ME-SFI control unit (N3/10) (with gasoline engine).
If the identification of the transmitter key (A8/1) is valid, the rotary lock of the EIS control unit (N73) is enabled. The transmitter key (A8/1) can now be turned. Once the correct code is recognised, the EIS allows the initial start procedures to commence, viz;
- rotary lock in EIS released, which allows the key to be turned in the lock to positions 1, 2 and 3, thus starting the car.
- steering wheel resumes it’s operating position (if this function has been previously activated),
- engine electric suction fan initiates,
- engine control module initiates,
- Automatic Climate Control (ACC) initiates,
- COMAND system initiates,
- gear selector lever lockout mechanism releases,
- any stored values for parameters such as seat and mirror positions, ACC settings, and COMAND settings etc. which are associated with this particular key are initiated (if this function has been previously activated).
When a non-recognised key is used the EIS Inductive Power Supply only operates for about 3 to 4 seconds after the key has been inserted into the Ignition Lock. When the key is not recognised, the Inductive Power Supply reverts to zero output for about 30 seconds when it generates another short burst of AC power in an attempt to read the key. I did not establish how many times it continues to do this before cancelling.
When a key is used that is recognised by the EIS, the Inductive Power Supply operates continuously until the key is removed.
Note the mechanical lock system in the EIS also prevents the Remote Control Key from being turned back to position 0 (Locked) and withdrawn from the EIS Ignition Lock unless the gear selector lever is in ‘P’ or Park.
Tip for Using Mechanical Key
Extract the Emergency Mechanical Key from the Remote Control Key Fob and after inserting into the door or boot lock, turn it all the way to the left (CCW).
Weak Batteries in Remote Control Key Fob
The Remote Control Key Fob functions may be affected by weak batteries in the key. If your key will not lock and unlock the car from 10m (30ft) or more, your batteries are weak and that will compromise the strength of the infrared (IR) beam. Try changing the batteries in the key before you go to more complicated (and expensive) efforts at restoring the function.
If the key will not turn in the ignition lock it is NOT caused by weak batteries in the key as the key electronics are powered inductively from the EIS Control Module when inserted into the ignition. See below for solutions to malfunctioning EIS.
Part Numbers - Remote Control Key Fob Batteries
- 2003 Update S500L Remote Key Fob has two batteries ie CR2025 x 2
- 2005 S500 Keyless Go Fob has only 1 Battery #2025
How To Change Batteries - Remote Control Key Fob
http://www.mbworld.org/forums/audio-...-pictures.html
Programming - Remote Control Key Fob
This video instruction is suitable for Car Key Master: CKM-100(PC Version) and CKM-200(Handhold Version), also it is suitable for Digimaster 3.
Electronic Ignition/Starter Switch (EIS or EZS) Control Module (N73)
Common Issue - Remote Control Key Will Not Rotate/Work/Turn in EIS (EZS)
Normally after inserting the correct Remote Control Key in the ignition lock (Electronic Ignition/Starter Switch (EIS) control module (N73)) it will turn instantly to position 1 (accessories), 2 (ignition on) and position 3 (engine start). However it seems that a common fault in the W220 occurs whereby the correct key will unlock the doors but once inserted in the ignition will not rotate and appears frozen. The vehicle cannot be started while the key will not turn.
Temporary Solution for Issue - Remote Control Key Will Not Rotate/Work/Turn in EIS (EZS)
The frozen key often happens intermittently causing huge frustration when out travelling. If you are lucky it may eventually start working again after continually trying and waiting twenty minutes. It is presumed that the EIS warms up slightly during this process.
Some owners have successfully used hair driers and electrical heaters to pre-warm the area around the ignition switch (EIS) to get the car started. Of course this is not a permanent fix but may get you out of immediate trouble.
Possible Failure Mechanism for Issue - Remote Control Key Will Not Rotate/Work/Turn in EIS (EZS)
It is now apparent, thanks to several BenzWorld Members and especially YouTube Poster John Kennedy, that one of the microprocessor chips on the EIS becomes sensitive to cold temperatures. Warming this particular chip temporarily solves the problem until it cools down sufficiently again. A DIY fix for this is available below.
Of course it may be that it is not the actual chip that is sensitive to cold but one or more of the solder joints connecting the chip to the board may have developed hair line cracks which open when cold and close when warmed.
Investigation of Issue - Remote Control Key Will Not Rotate/Work/Turn in EIS (EZS)
The link shows one investigation with the bottom line that it was not a DIY solution. (Later note: YouTube Poster John Kennedy shows that a DIY fix is now possible.)
- Parts of a W220 Remote Control Key
- How the Remote Control Key Works in a W220
- Diagnosing An Intermittent Key
- Testing EIS Induction Power Generator Output
- Test of Induced Voltages In Actual OEM Remote Control Key
- Removing the EIS
http://www.benzworld.org/forums/w220-s-class/1300215-cold-weather-electronic-key-problems-5.html
Replacing EIS Module
How To Remove - EIS Module
Turns out it was an easy job for a RHD car (probably much easier than a LHD car) to remove the EIS.
The first step was to remove the Glove Box so that the two nuts securing the Burred Walnut strip across the dash could be removed. Then the Walnut strip was removed making it easier to extract the Instrument Cluster.
For a RHD car the Instrument Cluster is removed using special tools or easy manufactured homemade ones fashioned out of 1mm thick sheet aluminium. See Instrument Cluster Repair Tool Kit here [1]
When inserted into the slots on each side of the Instrument Cluster they release plastic retaining clips. The left hand clip took much persuading but eventually released.
The EIS bezel is easily unscrewed using a special tool. See Electronic Ignition Switch (EIS) here [2]
Then it is an easy matter to reach inside and extract the EIS to the point where the connectors canbe removed. The mechanical rod which activates the Transmission Lock was also disconnected.
M-B Solution - Replacing EIS Module
The easiest but extremely expensive solution is to replace the EIS with a new one. It will cost over $3,000 and requires reprogramming of the new EIS to match the vehicle. As this is deemed a safety/security issue it can only be done by an authorized M-B agent.
DIY Solution No. 1 - Less Expensive Solution for Complete EIS Replacement
In Australia it is not necessarily a Dealer only option any more.
On line parts supplier Genuine Auto Parts will sell an EIS to the public for about AU$625 and Mercedes-Benz will supply a green (workshop) key with a AU$500 deposit, refunded on return of the key.
DIY Solution No. 2 - Replacing EIS Microprocessors
With a huge acknowledgement to YouTube Poster John Kennedy (and BenzWorld Member pinkster, Dean, for discovering the video) whose excellent diagnosis shown in the video referenced below positively demonstrates a faulty microprocessor which caused his issue.
In his case the fault was due to the lower Hc08 microprocessor chip (4j74y), shown in the next figure.
This microchip was very sensitive to cold temperature, shown here being cooled with a can of freezer solution. Once cooled the key freezes in the lock and will not turn.
Warming the culprit chip, just with applied finger warmth for a few seconds, solves the issue and the key will turn again.
John Kennedy reports that the issue was fixed by replacing the faulty microprocessor.
Warning
Be aware that in other cases it may not be the microprocessor chip shown in this article that fails but could be other components or even the solder joints themselves so some diagnosis as per the video will be necessary to thoroughly isolate the faulty component or item.
Also be aware that working with electronic components requires some specialized skills such as fine soldering technique and appropriate earthing techniques to aid in prevention of electrostatic discharge. Surface mount electronic components can be very sensitive to excess heat and static electricity.
Replacement microprocessor chips are available but will require the original programme to be copied to the replacement chip which requires some speciallised equipment and knowledge.
Any comments on how the reprogramming is done would be appreciated, especially by some one who has successfully completed the DIY fix of an EIS.
Part Numbers - EIS Microprocessors
The part numbers for the microprocessors in the EIS from a 2003 (Update) W220 S500L are:
- The 64-pin quad flat pack (QFP) microprocessor at the bottom location in the figures above has the following information on its face.
- 00198128A3
- EWM
- Motorola Logo
- SC510108CFU
- 4J74Y
- QQCF0305
- 06/03 R2
- The 64-pin quad flat pack (QFP) microprocessor at the top location in the figures above has the following information on its face.
- 001981287A
- Motorola Logo
- SC510108CFU
- 4J74Y
- QQCV0309
- 20/03 R1
Parts Availability - EIS Microprocessors
With thanks to BenzWorld Member pinkster, Dean these microprocessors are available for about US$30 posted from this source. [3]
DIY Solution No. 3 - Replacement EIS via eBay
Australian BenzWorld Member iSteve reported that he purchased a replacement EIS with the same part number as his on eBay from the USA.
He was advised by his Indie that the US uses the same key frequency as Australia and hence the USA sourced EIS would be compatible with the Australian standards.
Initially the Indie only "cloned" one EPROM which resulted in some errors such as;
- A side marker lights error as Australian delivered cars do not have side marker lights.
- The Steering Wheel Comfort feature would not work.
- The odometer reading of the new unit was incorrect and unfortunately was higher than the original.
iSteve reported that his Indie used an In Circuit Serial Programming (ICSP) cloning tool and a laptop which allowed programming a microprocessor chip while it is still attached to the application circuit. That is there is no need for chip swapping.
The ICSP tool was used to save the original Hex files and copy them over to the replacement EPROMs. There were 88 differences between the old and the replacement unit.
After a second attempt whereby both "EPROMs were cloned" the new unit is working the same as the original but with no cold start problem.
Reference [4]
DIY Solution No. 4 - "The Ultimate EIS Repair Guide"
MHH Auto senior member 'bawarek' has posted an excellent although very technical article titled, "The ultimate Mercedes EIS repair guide".
See http://mhhauto.com/Thread-The-ultimate-Mercedes-EIS-repair-guide
Internal Components - EIS Module
Here are some of the internal components of the IES and their functions.
- Motorola SC510108CFUis a 64pin microprocessor. (There are two of these in my EIS.) (I could not find a pin configuration diagram identifying pin functions.)
- PCA82C250 is a 8 pin Philips Can Controller Interface. It provides differential transmit and receive to the CAN-C (Engine) bus.
- TJA1054 is a 14 pin Philips Fault-tolerant CAN Transceiver. . It provides differential transmit and receive to the CAN-B (Interior) bus.
- 42760V5 is a 5 pin 5V Regulator in a TO252-5 case.
- IR322A is a hexfet power mosfet in a TO252-AA case.
Connector Pin Diagram - EIS Module
Here are the pin diagrams for the connectors.
Matching rear view showing fixed connectors.
Circuit Diagram for ‘A’ Connector for EIS.
Also shown for interest is the circuit diagram for the EIS Lock Solenoid. A signal from one of the microprocessors turns on the hex mosfet which activates the solenoid and allows the key to rotate in the EIS.
