Most people won’t be interested in this page, but it may help a few, so here you go.
I had a bit of a struggle with a Subaru Forester that wouldn’t start. Unfortunately the car originally came in for keyless entry not working, but I was able to upgrade the complaint to no-start. Hooray! It’s always nice when you can take a bad situation and make it worse. As if that weren’t bad enough, our customer was convinced that we “broke” the keyless entry while doing an air conditioning service the day prior. Get comfortable, this is a very long story.
Here are some of the things I learned about the Subaru body control unit, which they call either the integ. unit, or BIU (Body Integrated Unit). If you too are struggling with a Forester immobilizer, maybe this will help.
The BIU controls all of the functions you’d expect a body control unit to control, but it is also a key piece of the immobilizer system. This particular BIU has a part number of 88281SG600 or 88281 SG600, depending on how you like to space your Subaru numbers. Subaru can’t make up their mind about their number format, so I don’t see how anybody else can.
Don’t mess with “market”
You can modify some settings with the Subaru Select Monitor 4 (SSM4). One setting you shouldn’t modify is “Market”. This setting is the market setting (like is this car made for the US market or the Canadian market). Don’t mess with this. If you switch it to “Factory” which is how the unit is shipped, you may have a very hard time getting to the screen where you can set it back to the correct market. I certainly did, and in the end, I’m not sure how I was able to do it. It just “happened” one time when I went to the “customize” screen. Then you’ll need to know the code for the market. U3, U4, and U5 are US codes. C0 and C05 are Canadian codes. This info can be found (with considerable effort) at Subaru’s tech-info site.
Hey Rocky, watch me pull a rabbit out of my hat!
This particular BIU said it had 4 keys registered, even though it only had the two original keys that came with the car. Neither of the keys would start the car. Where did these extra keys come from? I think that will remain a mystery. Maybe they were magically generated while the BIU was in factory mode? Maybe there were actually 4 keys registered but the customer only knew about 2? Maybe there was a space/time distortion and my dumb ass just happened to be sitting in a Forester in the exact location where it occurred. Anyway….
The maximum number of keys that can be registered is 4, and new keys can’t be registered if 4 keys are registered. It’s not a first-in-first-out type deal. Keys can only be erased if you have a registered keys, and this unit didn’t think it’s previously registered keys belonged to it anymore, so erasing keys wasn’t a possibility. That’s all the functionality that the SSM4 offers, so I switched tools.
Will an aftermarket locksmith tool save the day?
The AutoProPad has a “lost all keys” feature. I tried it. No luck. It’s also possible to reprogram EEPROM chips (where all of the configuration information is stored), but there wasn’t a “virgin” bin file, so I’d need a donor BIU to get the file. We ordered a new BIU from Subaru. I googled the part number the dealer gave me just to make sure they were ordering me the right thing. I almost called them back when I saw they had ordered a transmission control module bracket. See the picture to the right for a chuckle.
The service Manual is wrong
According to the service manual, if the BIU is replaced, and all registered keys aren’t available, then an additional control unit must be replaced. For cars with Keyless Entry, the Security Control Module (SCM) must be replaced. For cars with Keyless Access, the combination meter (speedometer) must be replaced. (The manual is incorrect about part of this)
What’s the difference between Keyless Entry and Keyless Access you may wonder. I certainly did. Keyless Entry has a chipped key with a remote head. Keyless Access has a proximity key. Why would you call the two systems by nearly identical names instead of calling them proximity and non-proximity? Because Subaru.
Since this car has a regular key (Keyless Entry), the SCM should be replaced. According to our dealer, the SCM wasn’t applicable to our 2014 Forester, yet it didn’t have a proximity key. Who should I believe, the service manual writers? The parts catalog writers? It’s probably best to take all of their info with a bit of skepticism. I ordered the BIU only and hoped that I’d be able to register keys once it was installed.
Lemons? Open a Lemonade stand.
This was turning into a massive pain in the ass, and all of my other work was piling up while I dealt with this mess. I decided that once the new BIU arrived from Subaru, I’d grab the virgin file in case I ever ran into this issue again. At least I’d never need to buy another BIU if a customer lost their keys. I could use the saved virgin file instead.
The AutoProPad has an EEPROM reader/writer and comes with a Pamona clip that will piggy-back the EEPROM chip for an easy connection without de-soldering and re-soldering. I imagine any EEPROM reader would work just as well.
There’s a conformal coating on the board that needs to be removed before connecting the clip. A super-fine wire brush works great for this. I later found out there’s a product called “conformal coating remover pen“.
By the way, the AutoProPad doesn’t come with a manual. For most operations you can follow along with on-screen instructions written in a sometimes nonsensical version of English and everything will work out OK, if not on the first try then after a few more tries using different possible interpretations of the instructions.
For chip flashing, there’s no guidance. They do have a support phone number, so I called. I was told it was a complex subject and there are many different systems with no published information and knowledge about any system is hard-won and usually isn’t handed out without payment. He suggested I find a class on the system I was working on and take it. I took this as an “I don’t know”, thanked him for his time and moved on to Google-ing.
The EEPROM is a 24C02 chip and is marked L02 2494W. If you hold the board with the connector on the bottom, you’ll find the EEPROM chip slightly above and to the left of the processor chip. Pin 1 is indicated with a circle and is on the top left (board held with the connector on the bottom). Many thanks to Andromeda Research Labs, who posted this video just 2 days before I found myself needing it. You’re awesome. Thank you.
Another important bit of information is the how the leads are connected to the Paloma chip clip. There are two connectors that can be attached to the clip in 4 possible ways. I’m certain that it will only work in one way, and didn’t want to try the trial and error method. I eventually found the answer in this video from the makers of the AutoProPad. The harness latch connectors need to go to the outside of the clip and when the clip is put onto the chip, the brown wire should go to pin 1.
The new part arrives tomorrow. I’ll probably copy the bin file, write it to the old unit and give it a try, just for curiosity’s sake. The new unit will be going in the car regardless of the results. I suspect (but don’t know for sure thanks to my misadventures) that the BIU is the cause of the wireless functions not working.
Next day
I changed my mind and decided not to install the new unit unless it turned out to be the cause of the keyless entry issue. The customer isn’t paying for it and I may as well try to sell it at some future date.
I finally found some accurate information on this Subaru immobilizer system. As I mentioned, the Subaru service manual was worse than useless, in that the information was incorrect. Subaru has a document titled “REGISTRATION MANUAL FOR IMMOBILIZER”. To find it, go to the Subaru Techinfo site linked above and search for the title without selecting a car on the “Online Reference” tab.
This 2014 Forester without a proximity key for the US market is designated as a “B type”. The components include:
- The Body Integrated Unit (the main immobilizer control unit located next to the fuse box under the dash)
- The combination meter (the part in the dash with the speedometer)
- The ECM (the computer that controls spark and fuel for the engine)
Each key has a unique code and all 3 units also have unique ID codes, which are somehow generated during the key registration process. For the car to start, the BIU must recognize the key ID and the meter ID. If it does, the it will give its ID to the ECM. If the ECM recognizes the BIU ID, it will allow the engine to start.
The keys, BIU, combination meter, and ECM are a set. If any one of them doesn’t have a “matching” ID, the car won’t start. So, what happens if you need to replace a component? In the case of the BIU, if you have ALL of the keys that were originally registered, you simply install the new BIU and use the “Immobilizer system registration” utility with the SSM4 or equivalent. When you register the same keys as were originally registered, the BIU and meter will become friends and agree on codes. What if you don’t have all of the keys? Well, then you have to replace the combination meter or somehow return it to it’s virgin state. I’m still waiting for the BIU to arrive. I guess I’ll find out what the deal is shortly.
The day after the next day
The BIU arrived. I copied the data from the chip and flashed it to the old BIU and put the BIU in the car. I was able to start the immobilizer initialization, which hadn’t been possible before the reflash. However, Subaru’s immobilizer manual was correct; the SSM4 wanted me to present all registered keys, which was still 4, even with no keys registered in the BIU. Sigh. I’ll need to order a combination meter.
While we were waiting for the part
Once again, why not grab the virgin EEPROM data from the new unit? While I was waiting for the unit to arrive, I disassembled the speedometer and found the EEPROM chip.
I didn’t find any information about the chip on my initial internet search, but there was an 8 pin chip that looked like the chip from the BIU. However, after punching the numbers into Google, I found it was a CAN controller, not an EEPROM. There was a tiny chip the size of a tick that was an EEPROM according to my searching. My clip wouldn’t fit, so I’d need to find another way to connect to it.
After punching the number from the top of the chip (S93c 76AC) into Google, I found a few data sheets and this once seemed pretty close to me. I guessed that I’d need connections to pins 1, 2, 3, 4, 5, and 8.
I don’t have a fancy camera microscope, so here’s a picture through the eyepiece.
Luckily there were 4 test pads above the chip that connected to pins 1 – 4. I connected some 0.004″ wire to the pads with solder blobs. That was fairly easy. Connecting directly to pins 5 and 8 was more of a challenge, but I eventually got a good connection.
I used coated magnet wire for this. Removing the enamel was a pain in the ass. If I ever do something like this again, I’ll use uncoated wire and some painter’s tape for insulation.
Since I wasn’t using the clip, I had to run individual wires to the programmer. I used an ohmmeter to figure out where each clip pin ended up on the adaptor connecter.
Two days after the day after the next day
$568.61 plus $80 “express” shipping later, we were the proud owner’s of the last Subaru Forester speedometer in the country. It could have been worse. We could have had to sit through a backorder.
There was absolutely no way I was going solder tiny wires to the speedometer board again, so I got a TSSOP breakout board and moved the chip from the new speedometer to the breakout board.
Once it was wired up, I read and saved the data from the new speedometer’s EEPROM and saved it for posterity, and to flash to the original speedometer.
Success! (sort of….)
I registered the customer’s keys and started the car. Hooray! Did the keyless entry work? No. I was back to square one, right where I was before I changed the market setting to factory. Did I mention you should never do that?
ACT 2: Conquest of the problem that existed before I screwed things up
Rather than give in to the temptation of slapping the new BIU in to see if it would fix the issue, I decided to diagnose the issue as if I didn’t have a known good part to swap, and I’m glad I did.
The car has a keyless entry receiver in the back of the car, and it’s the next stop on Subaru’s flow chart after checking the fuses and market setting. This unit has four wires: Ground, key-off power, key-on power, and a single-wire network connection to the BIU. The powers and ground were good, but there wasn’t any jabbering on the network wire. Hmm. Let’s pull out the board and see what’s going on.
There’s heavy corrosion from water intrusion. After scrubbing the area with some isopropyl and a brush, I found the problem. A via is a small copper grommet that connects one side of a circuit board to the other. In the picture on the right you can see the trace isn’t touching the via anymore, and the via is actually completely rotted out in the middle. A quick check with an ohmmeter between pin 8 on the chip (the ground terminal on yet another EEPROM) and a test point on the other side confirmed what was already obvious under a microscope.
Finally! Let’s fix a problem I didn’t cause!
I scratched off a little of the solder mask over the trace on one side, then soldered a wire connecting the two sides of the board. Did it work? Yup. I’m finally done with this car and can’t wait to see its tail lights.
ACT 3: DEALING WITH AN UNREASONABLE CUSTOMER
OK. Let me start by saying that part of this is my fault. A large part. When I switched the market setting it created problems. It wasn’t on purpose and I still don’t know why it happened, but that’s what caused the majority of the inconvenience and expense. We owned it, and by “owned it” I mean we paid for labor, parts, rush shipping, and we even rented our customer a car, even though our warranty specifically states rental cars and other incidental and consequence are not covered. We did our part. The customer on the other hand wasn’t working in good faith.
The customer’s original complaint, that the wireless remotes weren’t working, had absolutely nothing to do with the air conditioning service as the customer claimed. It was caused by a water leak onto the wireless control unit. As you can in the picture to the right, this water leak is pretty obvious. During rainy months this car is likely pretty humid. There were “tide lines” in the body well below this leak.
Once provided with the evidence of the water damage to the circuit board and evidence that their car is leaking, they flat out refused to pay a dime. “The keyless entry worked when I brought it in, and didn’t when I picked it up, therefore you caused it”.
Not only that, they implied that we created the water leak too. “Hmm, that’s pretty weird. I’ve never seen that stain there. That’s kind of strange.”
Really? You’ve never seen the stain right next to the low quality body work on your previously wrecked car?
OK, whatever. The part of the job the customer should have paid for was maybe 15%. Why worry about that when we’re already hemorrhaging money on this project? It’s a little annoying though, and proof of their moral code.
So, we try to return their car, which now starts and has working keyless entry. A bill of $0. They refused to accept it. Why? The odometer reads 0 miles and it had around 47K before. That’s what happens when you buy a new speedometer, or in this case flash its EEPROM to its original factory settings.
As it turns out, they had already sold the car, but they had to fix the air conditioning before delivering it. The mileage couldn’t change or the deal was off. When you have a wrecked car that fills with water in the winter, I imagine it’s very important preserve any sale you’ve made.
Act 5: Correcting the mileage on the odometer
If you order a speedometer from Subaru, they have a service where they send it to a speedometer shop for programming the mileage before shipping it to you. It would have taken a week if we paid $80 for rush shipping twice and another week of car rental, although by this point I think I’d insist that they pay for their own rental.
It was obvious that the mileage is stored on the same EEPROM as the immobilizer data. The problem is that it’s not in plain text. If it’s like Toyota, it’s not even a hex number. Toyota uses character in the hex code, inverts them (F = 1, E = 0, etc.), then shuffles their position on the read odometer read out. If it sounds like they are trying to make it difficult to decode, you’re right. They’re deliberately obfuscating in data to make it hard to change the odometer information. If you’re interested in how Toyota does it, check this video out.
A very cool tool I found is Hex Compare (Fairdell HexCmp2). It finds the differences between any two hex files, which makes it great for finding where odo data is stored if you’re able to change the mileage.
I was looking for the fastest possible way to change the odometer and get this car out of my life, not a hacking challenge, at least not now. Fortunately the AutoProPad has a mileage adjustment feature so I was able to use the tool to type in a new mileage without figuring out how the EEPROM data was laid out. Lucky. (Finally.) Also, my pogo pin adaptor came in so programming was very easy. No soldering required.
Denouement
Hey, anybody want to buy a Subaru Speedometer, part number 85000 SG020? No. How about a Forester BIU, part number 88281 SG600? It was worth a shot.
I’d also be interested if anybody can tell me how the hex — 23 F4 DC 0B is equal to 999,999 (999,999 would be F423F if you were about to pull up your programming calculator.)
Comments? Questions? paul@artsautomotive.com