Subaru Immobiliser History
Subaru started fitting immobilisers to some models sold in the UK and some other markets in MY96. These are of the ‘transponder key’ type, where the key contains an RFID chip which the immobiliser ‘talks to’. The engine will only start if the immobiliser system recognises the chip inside the key. Subaru used various different transponder key immobiliser systems over the years. The transponder key immobilisers work totally independently of any alarm which is fitted to the donor Subaru, and no user interaction is required. I.e. they’re a totally passive system – the user doesn’t have to do anything or even know they exist. By MY00, all Subaru models sold in the UK had them. In some other markets (particularly the US and Japan) no models got transponder key immobiliser systems until MY04 or later.
Having a transponder key immobiliser system presents no problems at all in terms of using the engine in a VW conversion, as long as you have the complete set of immobiliser components from a single Subaru (i.e. not a mixture from multiple Subaru’s). It very slightly increases the amount of work in making and ‘engine management only’ harness properly for a VW conversion, but we do not charge any extra for this – the amount of additional work is insignificant. If you have an incomplete or mismatched set of immobiliser components for your VW conversion, we can probably help you with that – see immobiliser system repair .
All of the Subaru transponder key systems that Subaru used are very reliable – in 20 years of working with them, we have never come across one which has failed. That is not to say we have never seen a problem – we have helped many customers diagnose and fix faults with these systems, but in every case, the cause was something silly like lost transponder chips, mismatched sets of immobiliser parts, or unsuitable installation such as hardware getting wet, etc.
We have all the genuine Subaru dealership tools to re-match mismatched immobiliser components in all the pre CAN bus Subaru models, and can supply new transponder chips where required, program them where required and program the engine management to accept them at a far lower prices than from Subaru.
Transponder key immobiliser FAQ:
‘Transponder’ is a portmanteau of ‘transmitter’ and ‘responder’. A transponder key looks like any other car key with a plastic handle, and contains a transponder chip. The key may or may not have buttons for central locking – they’re irrelevant, being part of a totally unrelated system (keyless remote entry). The chip does not require batteries or external connections to run. It is a type of RFID (radio frequency identification) system in which all components are built into a tiny chip.
Energy to run the transponder chip is transmitted from the car via wireless electromagnetic coupling to an antenna built into the ignition lock, and saved in a capacitor when you either insert the key into the ignition lock or turn the key in the ignition lock. When the capacitor has enough energy stored, it also receives data sent from the car in some cases (cryptographic transponders only), before transmitting data back to the car via the same wireless link. This happens very fast, so is instant as far as the used is concerned.
The transmission range of transponders used in keys is very short – only a few centimetres. The technology is similar to, but not quite the same as ‘smart keys’ (passive keyless entry) used in many modern cars, in which there is no mechanical lock for normal use – you just get into the car with the ‘key’ on you, , without having to use the key to undo a mechanical ignition lock, and press start. The main difference is that ‘smart keys’ have an increased transmission range (10cm), and multiple antennas around the car.
With some cars (especially VAG), the ECU firmware is very configurable, and has largely been reverse engineered. This means their transponder key immobilisers can easily be turned off using fairly readily available tools and techniques to edit the ECU firmware. The immobiliser hardware can then be removed. This is not generally the case with Subaru immobilisers. Subaru’s ECU firmware is not designed to be re-configurable like VAG’s is. While the ECU firmware in the Subaru models which are widely tuned in the aftermarket (i.e. some turbo models)have been reverse engineered in terms of the mapping, etc, the reverse engineering is not as public as VAGs, and not as thorough. Most of the normally aspirated Subaru ECU’s have bot really been reverse engineered at all, as there is no market for modifying them like there is with the turbos.
There are companies out there advertising modifications, especially to the Siemens immobiliser models, which allegedly stop them checking for the presence of a recognised transponder chip. However, there seems to be little to no evidence of this actually working, and ehrn we contacted a number of them to find out more, all very very shady sounding businesses. One could not get off the phone fast enough when it became apparent he was talking to someone with a reasonable knowledge of the systems, and another (in the UK) claimed he only did that work for customers in Australia, and didn’t want to discuss it further at all (Australian Subaru’s are near identical or actually identical to UK spec in terms of engine management).
In our opinion, removing the immobiliser from Subaru engine management would be the wrong approach anyway, because it would involve aftermarket hardware modification. This would inevitably increase the chances of something going wrong, either accidentally, or because the modifications to remove the immobiliser had not been engineered as well as they should have been. When the system is so reliable as Subaru intended, and can always be fixed when incomplete or mismatched, leaving them as Subaru intended makes more sense. Our objective is to have the engines run exactly as Subaru intended.
Transponder key immobilisers were introduced in the mid 1990’s when the technology first became available, and when the mechanical security of the ignition lock barrel was starting to prove inadequate. The ‘mechanical only’ security on a lot of cars was very weak, leading to more of them being stolen. As all new cars by then had electronic engine management in order to meet the relevant emissions requirements, making the new extra security electronic was the way to go, as it could be made far harder to bypass than mechanical locks.
The transponder in the key has nothing to do with locking or unlocking the cars doors – it only enables or disables the engine.
Fixed code transponder (Subaru Siemens transponder key immobiliser):
The mechanical action of a key blade in the door and ignition lock barrels means that it is only nearly impossible that someone else’s key will undo your locks, because with mechanical keys only a few tens of thousands of possible shapes for each key type. That sounds a lot, but with the simplest transponder keys, the increase security came only through massively increasing this number of possible combinations in terms of the fixed electronic code stored in the chip. The chances of someone else’s transponder chip allowing your engine to start are reduced enormously because far more data has to be right. However, like how the shape of a mechanical key is not hidden, and so can be copied, the data in a fixed code transponder is not hidden either, so can also be copied fairly easily with the right equipment. This is the weakness of fixed code transponders.
Cryptographic code transponder (Subaru Denso and Mitsubishi transponder key immobiliser key systems):
The ultimate solution to make transponder immobilisers totally secure is to use public key cryptography to verify whether the transponder is allowed to start the car. However, this required more processing power and cost than was available for car immobilisers in the 1990’s, when the first cryptographic immobilisers were being developed. The manufacturers compromised and used cryptography which was vastly better than fixed code immobilisers, but fell short of being proper public key encryption. This was an acceptable solution at the time, as the computing power and time to crack their encryption would have been very expensive, and such systems were in use by the late ‘90’s.
In 2005 the algorithm used to encode some cryptographic immobiliser transponder keys (including the ones used in some Subaru models) was cracked by security researchers by exploiting the simplification used to make the immobilisers cheap enough to be practical. Exploiting this to clone cryptographic transponders remained impractical for many years. However, recently it has become practical and economical, meaning some of the cryptographic transponders which Subaru used can now be ‘cloned’, making them no more secure than the old fixed code models.
Modern cars use increasingly secure encryption to make their transponders more secure.
In most cars, including all pre CAN bus Subarus with transponder key systems, they consist of are four main components:
- The engine management ECU
- The immobiliser ECU
- The antenna ring or combined antenna ring and amplifier
- The transponder chip(s) in the key(s)
By the time Subaru used CAN bus engine management the UK’s Thatcham Motor Insurers’ Automotive Research Centre (the same folks responsible for requiring performance cars to have better security such as transponder key immobilisers in 1996) had added more requirements. They introduced an amount of time in which is must not be possible to steal an immobilised car by swapping hardware. This is why by the early 2000’s Subaru’s had their immobiliser ECU’s inside steel cages with lids attached by security shear bolts. On it’s own that wasn’t enough, so manufacturers starter to add more usually unrelated hardware into the immobiliser matched set, so swapping all items for another matching set would take too long, and pass the test. Subaru added the instrument cluster to the matches set. Also, in a CAN bus Subaru, there ie no individual immobiliser ECU like earlier models had used. It’s functionality along with numerous other previously separate modules was all done by the BIU instead. Soo the matched set of immobiliser hardware in a CAN bus Subaru is:
- The engine management ECU
- The BIU
- The antenna ring
- The transponder chip(s) in the key(s)
- The dash instrument cluster
Subaru started fitting transponder key immobilisers in the UK market in MY96. Initially this was only in certain models. By MY98 or MY99 all models in the UK market had transponder keys. However, in most other markets, these dates are later, with some markets not getting transponder keys until as late as MY05. In markets which share the same basic engine management version as the UK market, (i.e. most of the ‘rest of world’ market excluding the US and Japan), versions of the exact same management systems existed without transponder key immobiliser systems until around MY04, but seem uncommon. Despite having done quite a lot of work on management system from models from most other parts of this market, we have only seen a few from South African and Israeli spec models which do not have the transponder key system.
In the pre CAN bus Subaru models, four different transponder key immobiliser key systems were used:
- Siemens, fixed code, as fitted from MY96 – MY99 Impreza / Legacy. We can replace the transponder chips for these, but can’t clone them (their transponder chips are cloneable, just not with tools we have)
- Denso, cryptographic, as fitted to Foresters from MY97-01. We can clone or replace missing transponder chips for this system.
- Mitsubishi, cryptographic. 2 sockets on immobiliser ECU, as fitted from MY00 onwards in Imprezas / Legacies, and from MY02 onwards in Foresters, to MY03 in Legacies, and MY06 in some Imprezas and Foresters, and MY07 in the remaining Imprezas and Foresters .Originally not cloneable, but the cryptograpy used was cracked, so their transponder chips are now cloneable. We can clone or replace missing transponder chips for this system
- Mitsubishi, cryptographic, 1 socket on immobiliser ECU, as fitted to some but not all MY06-07 Imprezas and Foresters. Originally not cloneable, but the cryptograpy used was cracked, so their transponder chips are now cloneable. We can clone or replace missing transponder chips for this system
To understand this, a bit of background of the inadequate car security here in the UK in the 1990’s is required. At the time there was a bit of an epidemic of ’joyriding’ (stealing often high powered cars for fun, by breaking the locks, ‘hotwiring’ them, then abandoning them or setting them on fire after driving them) starting in the late 1980’s or early 1990’s. Most cars had virtually no security other than mechanical locks, and some quickly gained a reputation for being very easy to steal. The result was that it became insanely expensive to insure high powered cars – joyriders ultimate targets – unless additional immobiliser equipment had been fitted. Manufacturers of such sporty models like Subaru had already started to fit immobilisers from around 1995. How secure these were varied enormously, and sporty older cars also needed them too. But insurers only wanted to give discounts for better security to customers who could prove they had certain levels of security, both in new and used cars with aftermarket security improvements.
The UK Motor Insurers Automotive Research Centre, more commonly known as Thatcham Research (Thatcham is the town in which they are based), introduced a set of standards for alarms and immobilisers so they could rate the systems used in new car and aftermarket installations, and use the ratings in their premium calculations. Their alarm and immobiliser standards are called Thatcham Category 1, Thatcham Category 2, etc. (widely referred to as ‘Cat 1’ and ‘Cat 2’), and car alarm companies developed new products to meet these requirements. They were introduced in the mid 1990’s, and thanks to the UK’s increasing ‘epidemic of ‘joyriding’, it soon became near impossible to insure the sportiest car models if they didn’t specifically have a Thatcham Cat 1 or Cat 2 immobiliser.
It is very likely that this was either the first standardisation of immobiliser security levels anywhere, and / or that the level of security that they provided was significantly better than OEM or aftermarket immobilisers used in other markets. This is because the best of the systems developed mostly by aftermarket alarm / immobiliser specialists serving the UK market to meet the Thatcham requirements soon became sought after by both other markets and OEM’s looking for better security. BMW and others also used Sigma immobilisers.
Immobiliser and UK car crime history over, so back to Subaru immobilisers. None of Subaru’s three transponder key immobiliser systems met the Thatcham requirements. This is not because these systems were not very secure (very good arguments could be made for them being far more secure than the Thatcham approved models), but because they could not be used to get better insurance prices because they did not meet some of the Thatcham requirements, which are very specific. It’s effectively down to a difference in design philosophy in terms of what is required of a secure immobiliser between Thatcham and the Subaru transponder key system designers.
All OEM’s offering sportier models for sale here in the UK needed them to come with Thatcham rated security, and the easiest way to get it quickly was to fit one of the originally aftermarket only systems to all the relevant new models. Starting in around MY99, all the sportier Subaru models and some of the not so sporty ones came with a Sigma M30 Category 1 alarm / immobiliser. These were fitted to finished, new Subaru models not by Subaru, but by the UK importers before distribution to the dealerships. The Sigma system tool over the central locking control and keyless locking from the systems already in the Subaru, which were disabled. But being a passive system which most users are not even aware of, already fitted to all the sportier models by them anyway, and no doubt to keep the reworking of finished cars at the importers to a minimum, Subaru’s transponder key immobiliser system was left intact too, hence two entirely separate immobiliser systems.
The only involvement of Subaru engineers in the fitting of the Thatcham approved Sigma M30 seems to have been the new single ‘lock / unlock’ button key cover, effectively building Sigma’s aftermarket remote locking key fob into the key. The rest of the system was installed exactly as any other neatly done, aftermarket Sigma M30 – i.e. it was done with ‘minimum effort’ approach, installing hardware and tapping into the necessary circuits to immobilise the engine wherever they were most easily accessible, which actually makes them much easier to bypass than a proper OEM installation.
Later (around MY02 onwards), Sigma became an OEM to Subaru in Japan, supplying the exact same M30 system for factory installation. No doubt so they could be sold into other markets, and to make bypassing them harder by not tapping into the wiring harnesses in the easiest to access locations possible. However, even then, this was not done initially done via a proper OEM re-design of the wiring harnesses. Instead it was initially done by modifying the same non Sigma M30 harnesses before they were fitted into the cars. A couple of years later they redesigned the harnesses to suit, and the Sigma M30s (and later S30’s which superseded it) finally became a proper OEM installation.
Yes. We stock new transponder chips for all of the pre CAN bus Subaru models, and have the hardware to program both the chips and the engine management to accept them. Some of the transponders that Subaru used are ‘one use only’, meaning you cannot re-use the transponder from the key from a different, used Subaru, and a new transponder is always required. With others we can either use a new transponder or re-use your used one from a different car.
To do this we will always need your immobiliser hardware, and sometimes your engine management wiring harness too (when we do not already have a suitable harness here). This can be done either via mail order or in person, while you wait (by appointment only).
No. We provide transponder key services to help our and other customers using Subaru engines in VW engine conversions only. If you need a complete key, that’s a job for either the Subaru dealership or an automotive locksmith who has both stock of key blanks and the relevant key cutting machinery.
Yes, we can help with the transponder chip. Please get in touch, there are a few options on how this can be done. We cannot provide a key blank or cut a key though – that’s a job for a locksmith.
That depends on which immobiliser system you have. The Siemens system is not bothered whether the lock barrel is present or not – it will read the transponder regardless as long as it us securely held I the right position.
The Mitsubishi system will not reliably read the transponder when the lock barrel assembly is not present with the original antenna. Reading the transponder reliably requires either the ignition lock barrel assembly or one of the new antennas which we manufacture which reads the transponder with no lock barrel assembly. These are not suitable for using when you want to use the immobiliser to immobilise the VW – they are designed to be as compact as possible to tidy up systems in which the immobilise will not be used to immobilise the VW. We pioneered using the Phase II management system with the Mitsubishi immobilisers long before anyone else did here in the UK, and this included a lot of experimenting with tem, resulting in enough knowledge to design the antennas.
We have never done similar experimenting on the Denso immobilisers, as they are considerably less common. They used similar transponder technology to the Mitsubishi ones though, so probably behave similarly. Determining whether a similar aftermarket antenna is required for them to work reliably without the lock barrel, and developing the antenna if necessary is o the ‘to do’ list, but will likely never get to the top. Therefore if you have one of the Forester management systems which use them, use the complete ignition lock barrel assembly, to be sure of reliable operation.
- Use the key(s) and ignition lock barrel assembly positioned in the rear of the VW, near the engine management.
- Remove the Subaru ignition switch from the non key end of the ignition lock barrel assembly and throw it away.
- Do not attempt to extend the wiring to mount some of the immobiliser parts in the front of the VW unless you have a good understanding of the likely consequences of doing so, and are happy to experiment.
- If you only have one key, either get the engine management programmed to accept another transponder or get the transponder cloned, so you have a backup, or never remove the key from the vehicle. Tie it to a long string, the other end of which is tied to the VW. Then when you remove the key to immobilise, you can move it away from the antenna and hide it under a carpet, etc, but can’t ever lose it.
Yes.
If you have the complete Subaru, look for the key icon flashing red when the ignition has been turned off fr a couple of minutes. This is the LED which flashes when immobilised to warn potential thieves. In Early Subaru’s this is easy to spot. There is a key shaped symbol which is always visible with a standard 5mm red LED sticking through it. If you have this, it has a transponder key immobiliser. Don’t confuse it for any other LED’s which flash and are not built in to the instrument cluster. They’re probably part if another immobiliser system:
In later models the LED is much harder to spot, especially if you can not power up the electrics. This is because the symbols can’t be seen in later models until they light up. The picture below shows the ‘hidden’ lights in a dismantled instrument panel by back lighting them:
The presence of an immobiliser light icon in the dash is not a definitive indicator of whether the Subaru has a transponder key system. It is very likely that light is still present in the dash, especially in the later models, on models with no immobiliser too.
You can also tell on the European spec models with no remote central locking buttons on the key (the buttons were on a separate remote key fob) by looking for this rectangular ‘drawer’:
Later key models with remote central locking buttons built in did not have this ‘drawer’. The transponder key, if fitted was hidden inside the key, only accessible by dismantling it (as you would to change the remote battery),
Another good way to definitively tell whether a Subaru has a transponder key immobiliser system is to look for wiring going into the plastic trim around the ignition lock. If the trim is black, one 4 core cable, or two black wires will enter the trim, or there will be a 2 pin socket. If it is clear, two black wires will enter the trim, but other wiring will also go to a bulb (the clear ones illuminate). As well as being trim, in models with transponder key systems, these are the immobiliser antennas. Versions which are just trim, or just lights (with no antenna) exist for markets / models which didn’t get the transponder key system:
To our knowledge, all models up to MY06 – the ones which use the hardware shown below:
If buying an engine with a transponder key immobiliser system, and you want your conversion to go as smoothly as possible, you should make sure you buying a matching set of immobiliser components. By ‘matching’, we mean you are 100% certain that the engine ECU, immobiliser ECU, and key are from a single donor car. If you are buying a complete, running car, then you can easily check that the components are matched. If the engine runs for more than 10 seconds, then they are matched. However, if you are buying components from a breaker or as a set of parts already removed from the donor car by someone not known to be a trusted specialist, you have to be careful. The engine will not be able to start without them.
Unlike some cars (eg VW), where the transponder key system can be reconfigured from on to off in the ECU firmware, enabling an engine which originally had one to run normally without, in Subaru’s the ECU’s are not generally reconfigureable, and the transponder key system in models which had it is not generally considered removable.
It is not the end of the world if you end up with a mismatched or incomplete set of parts – we can almost always fix it for you while we’re doing the harness work to make the Suabru engine management work in your VW. This involves sourcing any missing parts, sometimes replacing the transponder chips (depending on what parts of the matches set are missing), and re-matching them using our Subaru dealership diagnostic tools.
If you are not in the UK, ‘Thatcham’ is an organisation (Motor Insurers’ Automotive Research Centre, commonly known as Thatcham – the town they’re based at) which assesses the security and other things for the UK car insurance industry. Their security requirements have often been ahead of the game in terms requiring feature which OEM’s later included as standard. We got the following thanks to their work:
- transponder key immobilisers
- immobilisers which meet more specific requirements such as the Sigma M30 which Subaru much later fitted as an OEM option
- additional hardware such as the dash instrument cluster included in the ‘matched set’ of immobiliser parts, so cars could pass Thatcham’s ‘can’t steal a car within a certain time by swapping hardware’ test
…….all of which many OEMs including Subaru later fitter as standard in many, most or all markets.
If you are in the UK it may be of interest that none of Subaru’s transponder key immobiliser systems have Thatcham approval, so will not enable the user to get reduced insurance. In terms of security they are both very similar to Thatcham Category 2 specification, and the lack or approval is probably due to them never having been tested, rather than having been tested and failed. They were all at the far more secure end of factory fitted immobilisers, as demonstrated by the fact that no aftermarket hardware has been developed to bypass or remove them. Such devices are available for many other car’s immobilisers (VW, Renault, etc), many of which are Category 2 rated. Most UK Subaru’s from about MY00 –> have Thatcham Category 1 alarm immobilisers as standard (see http://www.thatcham.org/security/pdfs/categories/PassengerCarCAT1.pdf ), but this is nothing to do with the transponder key system. They have a separate Category 1 alarm immobiliser system too, and the two work independently.