Immobiliser Fault Diagnosis: Symptom to Cause, System by System

The call comes in as "immobiliser fault". It almost never is one.

What the customer means is that a light stayed on, or the engine turned over and died, or the car went dead on a driveway after sitting for a fortnight. Somewhere between the transponder in the key and the engine control unit, one link in an authentication chain failed, and the dashboard reported it with the only symbol it has. Your job on arrival is to find out which link, and to do it before you have quoted a key you may not need to cut.

This guide works the way the diagnosis works: symptom first, then the system architecture that explains it, then the procedure. Every system section is built on the per-vehicle records in the Keysolved database — the module that owns authentication, where the security code lives, and what the tools actually manage on that specific car. Where the database does not confirm something, this guide says so rather than guessing.

What an immobiliser is required to do

Before the symptoms make sense, the architecture has to. An immobiliser is not a lock. Under UN Regulation No. 116, the international type-approval standard for protection against unauthorised use, an immobiliser is "a device which is intended to prevent normal driving away of a vehicle under its own power", and it must do that by disabling two or more separate circuits needed for operation — starter, ignition or fuel supply — or by interfering with at least one control unit required for the vehicle to run.

That second option is the one every modern car takes. The immobiliser does not cut a wire. It withholds a permission. A module reads the transponder, decides whether it is valid, and then tells the engine control unit over CAN whether it is allowed to fuel and spark. Three parties, two messages, and any of them can fail independently.

The same regulation requires that the device "cannot rapidly and without attracting attention be rendered ineffective or destroyed" with readily available tools, and that replacing major components to defeat it should be difficult and time consuming. That requirement is why an immobiliser fault so often turns into module work rather than a five-minute reset. It is behaving exactly as approved.

Symptom to cause, at a glance

The dashboard gives you less than you would like, but the pattern of the symptom narrows the field a long way before you plug anything in.

That last row is the one worth internalising. On several platforms a low battery does not report as a voltage fault. It reports as a communication fault, and you will spend an hour blaming your tablet.

The first fifteen minutes, before you reach for a tool

Do this on every immobiliser call, in this order. It costs a quarter of an hour and it stops you cutting a key for a car that needed a fuse.

1. Confirm ownership before anything else. V5C or equivalent, photographic identification matching the keeper, and a written record kept. Master Locksmiths Association members work to this as a condition of membership, and the expectation across the trade has hardened since accreditation arrived.
2. Put a battery support pack on. Not later, now. Several of the systems below fail their security handshake below roughly 12.4 volts and report it as no communication.
3. Watch the immobiliser telltale through a full ignition cycle. Note whether it flashes, sits steady, or never lights at all. This single observation splits the table above in half.
4. Try the customer's other key if one exists. A fault that follows one key and not the other is a key fault, and that is a different job with a different price.
5. Read fault codes across all modules, not just the engine. The authenticating module is usually the body control module or the instrument cluster, and its codes are the ones that explain the symptom.
6. Check the OBD socket has power and ground before you conclude the vehicle will not communicate. A dead socket looks identical to a dead module from the driver's seat. Port locations for every UK make are in the OBD port location guide.
7. Time: 12–15 minutes.

Only now is it worth deciding whether this is a key job.

Ford PATS: the body control module owns everything

On a Ford Transit Custom of 2012 to 2023, the Keysolved record is unambiguous about where authentication lives: the body control module owns it, not the instrument cluster, which is where PATS sat on the older Transit Mk7. The BCM reads the transponder through the antenna ring around the ignition barrel, or through the cabin low-frequency antennas on Keyless Entry and Start vans, validates it, and then authorises the powertrain control module to allow start over high-speed CAN at 500 kbps.

Two records in that entry explain most Transit Custom immobiliser calls. First, the diagnostic socket is not wired straight to CAN. The van uses a smart diagnostic link connector fed by a gateway module carrying four CAN networks, so passive dongles and splice-in trackers that expect raw CAN on pins 6 and 14 will not see the security modules and can set U0146. A customer who fitted an insurance tracker last month and has an immobiliser fault this month is not a coincidence.

Second, and this is the diagnosis that catches people: if the factory alarm is live, the BCM refuses the security access handshake altogether. The van will answer a scan perfectly and then decline every key erase or add request. That is not a tool fault and it is not a module failure. It is the alarm doing its job.

Recovering an alarm-active Transit Custom

1. Confirm the alarm is the cause — full communication on a module scan, no communication the moment a key operation is requested.
2. Take Ford's timed route: wait ten minutes after the alarm triggers, at which point a single horn chirp opens a roughly one-minute window on the diagnostic link.
3. If the window is missed, the Advanced Diagnostics Smart Pro with the Ford emulator cable silences the alarm and allows the erase and add. The cable in question is the ADC2025 Ford BCM bypass lead, which connects directly to the Continental body control module and, on Advanced Diagnostics' own account, brings an active-alarm job down to around five minutes with no battery disconnection and no waiting. UK locksmiths have recovered these vans on that combination after Autel, Lonsdor, Abrites and Ford's own IDS and FDRS all returned no communication.
4. Programme two keys minimum after any erase. The database is explicit that the van needs at least two keys programmed before it will start.
5. Time: 25–40 minutes once the alarm is dealt with; add the ten-minute wait if you take the timed route.

Vauxhall and the Car Pass code

The Vauxhall Corsa D of 2006 to 2014 runs a Delphi body control module immobiliser, and the Keysolved entry names the constraint that turns a routine job into a difficult one: the BCM, instrument cluster, airbag module and engine ECU are all linked, and all must be matched for the vehicle to start.

That single line diagnoses a whole category of immobiliser fault. A car that developed one after a repair — a second-hand cluster, a replacement airbag module following an accident, a BCM from a breaker — has a matching fault, not a key fault. No amount of key programming will fix it. The database is equally clear on why: if the BCM is replaced, the original security code becomes invalid, because the EEPROM and microcontroller encryption keys are paired. That pairing is not an inconvenience the manufacturer overlooked. It is the direct expression of the type-approval requirement that swapping major components to defeat the system be difficult and time consuming.

The security model itself is a four-digit numeric code printed on the Car Pass card supplied at purchase. In practice the card is irrelevant to you — professional tools extract the code from the BCM over OBD automatically, and the database confirms this on both the Advanced Diagnostics Smart Pro and the OBDSTAR X300 DP Plus, which are the only two tools it records against this car. If your tablet is not one of those two, verify coverage before you attend rather than on the driveway.

One field note from the same record is worth more than most: Xhorse VVDI clone remotes carrying a PCF7946 chip do not work with the Corsa D Delphi system. The car needs a genuine PCF7941. A clone that decodes and cuts perfectly and then refuses to programme reads exactly like an immobiliser fault, and is not one.

Renault UCH: one module, four keys, and a PIN that lives in EEPROM

On a Renault Clio III of 2005 to 2012, the Unité Centrale d'Habitation handles authentication and talks to the engine ECU over CAN. The useful detail in the Keysolved record for fault diagnosis is that the engine ECU does not require separate key learning — the UCH handles all authentication. So on this platform, an engine that cranks and dies is pointing at the UCH-to-ECU link or at the ECU itself, not at a partially learnt key.

The UCH stores up to four keys or cards. The PIN required for an all-keys-lost job is read from the UCH EEPROM over OBD by most professional tools, or supplied by the Renault dealer network through CLIP. Adding a key with a working key present typically needs no manual PIN entry at all.

Tool honesty matters here. The Keysolved per-vehicle record for this car states plainly that Autel removed the all-keys-lost function for Renault across the IM range in January 2025. The IM608 Pro II and IM508S still add a key with a working key present, and they still need the UCH Reset menu opened and cancelled immediately afterwards to exit learning mode. But if you arrive at a Renault with no keys and an Autel tablet, you are not finishing that job. Abrites AVDI with the RR011 or RR014 licence, the Smart Pro with the Renault module, and the OBDSTAR X300 DP Plus are the routes the database still records for all keys lost.

Nissan NATS: the lockout that looks like a dead car

This is the one that most often gets misdiagnosed, and it is worth knowing cold.

The Nissan Qashqai J10 of 2006 to 2014 runs NATS, with the body control module handling transponder authentication and, on Intelligent Key cars, a separate Smart Entrance Control unit for the proximity functions. The BCM, engine control module and key transponder must all be synchronised, and the database is precise about the consequence: only keys with a registered Key ID in both the BCM and the ECM will start the engine.

The failure mode to recognise is the security lockout. Enter the PIN incorrectly too many times and the system drops into what Nissan calls lock mode, setting DTC P1610. The car then starts and stops immediately, over and over, on a key that was working an hour ago. It presents as a catastrophic immobiliser failure and it is a software lockout you caused, or the previous person on the car caused.

Clearing Nissan lock mode

Nissan's own service procedure, published in the Juke service manual for P1610 lock mode, is an ignition cycle rather than anything more dramatic:

1. Using a registered ignition key, turn the ignition switch on and wait five seconds.
2. Turn the ignition switch off and wait five seconds.
3. Repeat steps one and two twice more, for three cycles in total.
4. Check that the engine starts on the registered key.
5. Erase the stored DTC once any underlying fault is resolved.
6. Time: 3–5 minutes.

The Keysolved record for the J10 offers a longer alternative — disconnect the battery for thirty minutes — and that also works. Take the ignition cycle first, because it costs you five minutes rather than half an hour, and because disconnecting the battery on a car you have just been called to is a good way to inherit somebody else's radio code problem.

VAG IMMO IV: the security data is in the cluster

On a Volkswagen Golf Mk6 of 2008 to 2013, authentication is instrument-cluster based, with the security data held in the cluster EEPROM. The Keysolved record notes two cluster sub-types across the run — earlier cars typically using a NEC microcontroller with a 24C32 EEPROM, later cars and those with the 2012 colour display cluster using a 24C64 — and, importantly, that the sub-type affects only the all-keys-lost bench procedure, not the key hardware. Both use the same ID48 Megamos Crypto key. If you want the chip families laid out properly, the transponder chip cross-reference chart covers them.

There is no Component Protection layer on IMMO IV, which is what separates this generation from the MQB cars that followed. A Golf Mk6 with an immobiliser fault after a cluster swap is a cluster-matching problem with a known route; the same symptom on an MQB car is a different and much longer conversation.

The record also flags the electronic steering lock, component 5K0905861, as present on the Mk6. It may need re-adaptation if a second-hand unit has been fitted, but it does not complicate standard key programming. That distinction matters, because on the next platform it is the whole problem.

Mercedes EIS and ELV: when it is not the immobiliser at all

On a Mercedes-Benz C-Class W204 of 2007 to 2014, the Electronic Ignition Switch manages transponder authentication through a Hitag AES PCF7961 in the key, and the same EIS also controls the Electronic Steering Lock. That shared responsibility is why a steering lock failure arrives on your phone described as an immobiliser fault.

The symptoms are distinctive once you know them. UK trade guidance on ESL and EIS work across the W204, W207 and W212 lists the early warning as a steering lock that has become noisy on opening and closing, progressing to a car that will not start with the steering still locked, a key that turns with no crank, and a steering wheel that will not move. None of that is a transponder problem. The key is being read correctly and the car still will not go anywhere.

Two things follow for pricing the job. First, do not quote a key. Second, the same guidance is candid that repairing the original mechanism "does not give a 100% result" and that original problems tend to resurface, which is why the emulator route is the common trade answer. Be equally candid with the customer about that.

Where it does become a key job, the database is clear about the ceiling. Cloning is not possible on Hitag AES. Adding a key over OBD with a working key present is intermediate-level work on tools such as CGDI Prog MB, VVDI MB Tool, Abrites AVDI and the Autel IM608 family. All keys lost is graded expert and requires an EEPROM read from the EIS on the bench, with an ELV reset often needed alongside it. Anybody describing W204 all keys lost as a plug-in job has not done one.

Where the tools genuinely stop

Four honest limits, all recorded per vehicle in the database rather than inferred from marketing.

Autel and Renault all keys lost. Removed across the IM range in January 2025. Add-key still works. If the customer has no key, choose a different tool before you set off.

The alarm-active Ford. The body control module answers a scan and refuses every key operation. This has been reported failing on Autel, Lonsdor, Abrites and on Ford's own IDS and FDRS. The Smart Pro with the Ford emulator cable, or Ford's ten-minute timed route, are the two ways through.

Mercedes all keys lost. Bench work on the EIS, not a tablet job, on every tool the database records against the W204.

Base-model tablets on premium platforms. The Autel IM508 shares the Ford EU immobiliser engine with the IM608 family, so a bladed Transit is identical work on both. It does not share Mercedes or MQB without the XP400 Pro. The full picture is in the honest coverage matrix.

One more limit is procedural rather than technical. Since 1 April 2026, the manufacturer route to security data in the UK runs through SERMI accreditation, which requires business-level approval and individual employee authorisation. Aftermarket tools taking security access directly from the vehicle are unaffected. If your diagnostic plan depends on an OEM portal, that plan now needs accreditation behind it.

Common pitfalls

Cutting a key before watching the telltale The single most expensive mistake on these calls. A steady immobiliser light with a crank-and-die is telling you the transponder was accepted. A new key will do nothing at all. Spend the ignition cycle watching the dashboard before you spend the customer's money.

Blaming the tool for a flat battery On the Transit Custom the security access fails below roughly 12.4 volts and reports as a communication error rather than a voltage error. The same pattern appears across several platforms in the database. Battery support goes on first, every time.

Treating a module-matching fault as a key fault On the Corsa D the body control module, cluster, airbag module and engine ECU must all be matched. A car that has had any of those replaced has a matching problem. Programming keys into it will not help, and will cost you the diagnosis time you should have charged for.

Assuming an aftermarket chip is equivalent The Corsa D rejects PCF7946 clone remotes and needs a genuine PCF7941. The Transit Custom needs a Transit-specific ID63 80-bit chip that a generic 4D63 will not substitute for. In both cases the key decodes, cuts and fits perfectly, and then fails at verification looking exactly like a vehicle fault.

Entering PINs repeatedly on a Nissan Three wrong attempts and the car is in lock mode with P1610 stored. Read the PIN from the body control module with a tool that does it automatically rather than typing anything by hand.

Skipping the ownership paperwork because the fault sounds mechanical An immobiliser diagnosis can end with a key being made. The V5C check belongs at the start of the call, not at the point where the job changes shape.

Frequently asked questions

What causes an immobiliser fault?

Most commonly one of four things: the transponder is not being read, the transponder is read but rejected, the authenticating module and the engine ECU have lost the ability to talk to each other, or the security system has entered a lockout after failed attempts. Low system voltage produces symptoms that mimic all four and should be excluded first with a battery support pack.

Why does my car start and then immediately stop?

That pattern means the transponder was accepted long enough to allow a start, and then the engine control unit withdrew the release. It points at the link between the authenticating module and the ECU rather than at the key. On Nissan it is frequently the NATS lock mode fault P1610, which is cleared with an ignition cycle rather than a new key.

Can a flat battery cause an immobiliser fault?

Yes, and it is one of the most common causes on a call-out. Several systems fail their security handshake below roughly 12.4 volts, and the vehicle reports it as a communication fault rather than a voltage fault. Fit a battery support pack before diagnosing anything else.

Will a new key fix an immobiliser warning light?

Only if the fault is in the key or in the reading of it. If the immobiliser light sits steady and the engine cranks and dies, the transponder was accepted and a new key changes nothing. If the light flashes and the engine will not fire, a key or antenna fault is likely.

Is a steering lock failure the same as an immobiliser fault?

No, though it arrives described as one. On Mercedes models such as the W204, the Electronic Ignition Switch controls both authentication and the Electronic Steering Lock, so an ESL failure presents as a car that will not start. The distinguishing symptom is that the steering stays locked and the dashboard illuminates normally.

Can I clear an immobiliser fault by disconnecting the battery?

Sometimes, and it is a legitimate step on a few platforms — the Keysolved record for the Nissan Qashqai J10 gives a thirty-minute disconnection as a route out of lock mode. It is rarely the best first move. Manufacturer recovery procedures are usually faster and do not risk losing other stored settings.

The short version

Watch the light, support the battery, and read the codes from the module that owns authentication rather than from the engine. Those three steps put you on the right side of the diagnosis before any tool comes out of the van, and they are what separates a priced job from an afternoon spent guessing.

The architecture is what makes the symptom mean something, and it changes make by make. Before you quote, look the vehicle up on Keysolved for the exact make, model and year in front of you: which module authenticates, where the security code lives, what the tools are confirmed to manage on that specific car, and what they are not. For Ford specifically the complete Ford key programming guide goes generation by generation through PATS, and if you are early in the trade the transponder key programming beginners guide covers the fundamentals the diagnosis rests on.