Are you ready for

Toyota Smart Key

systems?
the U
2004 ndersta
a
Cam nd 200 -2009 P nding
r
Key ry HV S7-2009 ius
Syst m
ems art

Image courtesy Toyota

Motor Corporation
by: Paul Cortes ([Link])

T
he Toyota Smart Key system was first audio, suspension, shift timing, and throttle
introduced on the Prius five years ago response for each driver, before they even get
in 2004. Many cars with Smart Key in the car!
systems are now out of warranty, and many
Smart Key service opportunities will not be That’s enough future fantasy, back to the here
covered by warranty anyway. It’s a great time and now….
to increase your Smart Key system knowledge.
This article will increase your Smart Key
Learning about this system will pay off. Smart knowledge in two parts.
Key systems are not going to go away any time
soon. In fact, they are likely to appear on more Part 1 will introduce you to the Smart
and more models, and their level of complexity Key components and their functions. A
is likely to increase as vehicle-customization solid understanding of how the system
features are added. Smart Key systems currently works will aid in effectively using the
provide passive entry and starting. Future service information available on TIS.
systems may passively customize the car to
match each driver’s preferences. Imagine a car Part 2 will offer some useful real world
that adjusts the seats, mirrors, climate control, diagnostic strategies you’ll be able to
use tomorrow.

2 Import service | [Link]

Part 1:
Components and Functions
Smart Key / Key Fob

The Smart Key looks like an alarm remote,

a small black rectangle with a lock and unlock
buttons. Unlike an alarm remote, it’s passive.
A person with a registered Smart Key in his
pocket and will be able to enter, steer, and start
the car without touching the key.

A few Prius came without the Smart Key

option. These keys can be easily identified
because the Toyota emblem is not chrome
colored. The cars can be easily identified
because they do not have a Smart Key
cancel switch.

The Smart Key broadcasts wireless data at A silver Camry Smart

315 MHz, at the very low end of the UHF band. Key lying on a stainless
“What data does the Smart Key broadcast?”
steel counter.
you may ask. Well, one of the things a Smart
Key broadcasts its unique Key ID code, which
is burned into its memory at the factory. The
other is the Vehicle ID code, which is obtained
from the car and burned to the Smart Key
during the registration process. Just as a key
blank is cut to work with a particular vehicle,
the key registration process also alters the
Smart Key to “fit” the “lock”.

The Smart Key broadcasts using it’s own 3V

battery power supply. In order to save battery
power, the Smart Key will only speak when
spoken to (by the oscillators). If a Smart Key
3V battery does go dead, the car can still be
opened using the key insert in the driver’s door,
and started by inserting the Smart Key into the
Smart key slot. However, wireless Smart Key
functions will not work with a dead 3V battery.
Replacement batteries (Camry PT# CR1632,
Prius PT#CR2032) can be purchased from A black Prius Smart Key with
Walgreens and other stores. a chrome colored emblem.
August 2009 | Import service 3
T o yota Smart Key P t 1

Function 2
The Certification ECU is like a middle
manager. Its “department” consists of the
oscillators, the receivers/tuners, the Power
Source Control ECU, the ID Code Box, and
the Steering Lock ECU. When the Certification
ECU wants information, it wakes the
appropriate control unit up and demands a
report. These individual control units have only
a narrow view of the system; they only know
the limited information they are designed to
know. The Certification ECU has a broader
view, and gathers and reports information
from its “department” to the Power Source
Control ECU and/or the Body Control Unit.

Exterior Oscillators

There are three exterior oscillators on both the

A close up of a Smart Prius and the Camry: one in each front door and
Key battery. one in the rear bumper near the trunk/hatch.
Oscillators broadcast 134.2 kHz wireless data at

Certification ECU
(AKA: Smart Key ECU)

Depending on what you’re reading, it may

be called the Certification ECU, or it may be
called the Smart Key ECU. Regardless of what
it’s called, the Certification ECU performs
two functions --

Function 1
The Certification ECU holds codes, which
are like electronic keys. The Certification ECU
holds a copy of the Vehicle ID codes and a
copy of the Key ID codes for verification with
registered Smart Keys. It also holds a copy of
the S-code for verification with the ID Code
Box (more on the ID Code Box later).

A door oscillator.
4 Import service | [Link]
regular intervals, in the hope a Smart Key will Touch Sensors /
hear the broadcast and respond. The Exterior Rear handle switch
Oscillators are controlled by the Certification
ECU. It’s important to note that oscillators only The car won’t unlock the door(s) just because
talk; they don’t listen. Oscillators are all mouth. there is a registered Smart Key within range.
First, the Certification ECU wants to know that
So what do oscillators say? They say, “Hey, the owner wants to get in the car, and isn’t just
wake up!” “What’s your Vehicle ID code?” walking by or standing near the car. The touch
The longer the car sits, the less frequently the sensors on the inside of the door handles let the
oscillator will talk. Eventually the Certification Certification ECU know that the driver wants
ECU will stop pulsing the Exterior Oscillators in, and it obliges by telling the Body Control
to save battery power. When this happens, the ECU to unlock the door or doors, depending
driver may need to use the unlock button on on how the car has been configured.
the remote to get the oscillators talking again.
The rear handle does not have a touch sensor,
If the Certification ECU receives a report that even though the rubber coating feels similar
a matching Vehicle ID code has been received, to touch sensors. The owner must press the
it will command the Exterior Oscillators to ask hatch/trunk release before the Certification
another question, “What’s your Key ID code?” ECU pulse the oscillator, verify the codes, and

The touch sensor on the inside of the driver’s door handle

August 2009 | Import service 5
T o yota Smart Key P t 1

Location diagram from TIS. (Courtesy of Toyota Motor Corporation.)

6 Import service | [Link]

command the Body ECU to open the hatch.
This is why there is a longer delay when waiting
for the trunk to unlock than there is when
waiting for the doors to unlock.

Interior Oscillators /
Room Oscillator

There are two interior oscillators: one Front

Room Oscillator, located in the center console,
and on Rear Room Oscillator, located in the rear
seat on the Camry, and in left quarter panel on
the Prius. Like the exterior oscillators, they also
broadcast at 134.2 kHz when the Certification Power off = LED off
ECU requests it.

Door switch /
Courtesy light switch

The Certification ECU pulses the Interior

Oscillators when the door is opened (it senses
the open door via the courtesy switch and the
Body Control ECU). If the driver doesn’t try to
start the car for a while, the Interior Oscillator
will stop pulsing to conserve power. When the
driver presses the Ready button, the oscillators
will start to pulse again.

ACC = LED green

A door switch. ON = LED amber

August 2009 | Import service 7
T o yota Smart Key P t 1

Door Control Receiver / Tuner Smart Key Cancel Switch

Unlike the Oscillators, the Door Control This is the most common and easiest to
Receiver is “all ears”. It listens for the Smart diagnose “failure” of the Smart Key system. If
Key to “talk” on the 315 MHz band. The this switch (located on the lower driver’s side
Door Control Receiver is not terribly smart. dash) is accidentally pressed, the Smart Key
If it hears something, it passes it along to the will not be passive anymore. The driver will
Certification ECU. need to press the Smart Key unlock button to
get into the car, and will need to insert the key
Power Switch into the Smart Key slot to start the car. Always
check this first before signing the car in. It will
The power button is both an input, and an make you a hero and save you from wasting
output. It houses two switches (redundant time on an un-billable “repair”.
for self diagnosis), and a two color LED. The
switches are inputs for the Power Source Same function, different name
Control ECU, which will be explained a few
paragraphs down. The LED is an output for the Before continuing with the component
Power Source Control ECU and can indicate description, let’s discuss out a couple of
the current power mode as well all switch faults. differences between the Camry HV and
the Prius.
Power off = LED off
First, the Prius has a separate control unit
ACC = LED green called the Power Source ECU, which will
ON = LED amber be explained below. The Camry HV has the
READY = LED off functionality of the Power Source ECU built
into the Main Body ECU, so there is not a
Switch fault = LED flashing amber separate unit hidden under the dash. The Main
Body ECU performs all of the Power Source
Brake Switch ECU functions.

The brake switch is an important input. The Second, the ID Code Box on the Camry is
car will not Ready without it. Like the Power the same as the Transponder Key ECU on the
Switch, the brake switch contains two separate Prius. In the parts catalog it may be called the
switches for error checking. The brake switch Immobiliser ECU. On the Techstream, it’s
for the Smart Key system is the same as the called “Immobiliser”.
brake switch for the brake lights, so if the brake
lights work, the brake switch signal is being It’s a bit confusing, but just remember that –
recognized. On the Camry HV, the Power •Power Source ECU on Prius = Main Body
Button LED will illuminate when the brake ECU on Camry
pedal is pressed, allowing for a in-car brake •Transponder ECU on Prius = ID Code Box
switch check. on Camry = Immobiliser ECU on both

8 Import service | [Link]

 After the 2009 model year, the names (and Instead of using a lock cylinder to control
perhaps functions) may change again. Even so, ignition switch access, the Certification ECU
time spent learning this system will provide controls Power Source ECU access. The
the building blocks for learning the next Certification ECU verifies the Smart Key’s
generation, even if they are not the same. Vehicle ID and Key ID, and then the Certification
ECU and Transponder ECU compare S codes.
Power Source Control ECU If they match, the Transponder ECU tells the
(Prius) / Main Body ECU (Camry) Power Source Control ECU to allow ACC,
ON, or START positions. It’s important to
The Power Source Control ECU is described know that even if the Power Source ECU is
as the main output of the Smart Key system in “hot wired”, the car still cannot be started. The
the manual. What is it? It’s like an electronically Immobiliser still must be satisfied in order for
controlled ignition switch. the car to Ready.

System diagram. (Courtesy TMC.)

August 2009 | Import service 9

T o yota Smart Key P t 1

ID Code Box (Camry HV) / An L-code is stored in both the ID Code Box
Transponder Key ECU (Prius) / and the Steering Lock ECU. (L is for lock, as
Immobiliser ECU in steering lock). During the start-up sequence,
the ID Code Box and the Steering Lock ECU
Think of the ID Code Box as “lock box” compare codes and report to the Certification
holding keys. Just as a traditional key is cut ECU. If the codes match, the Certification ECU
with a specific pattern of peaks and valleys to tells the Main Body ECU to supply voltage to
match a specific pattern of wafer placement in the Steering Lock ECU motor, and the lock
a lock cylinder, the bits of the electronic keys pawl is pulled from the column. The retraction
held in the ID Code Box must exactly match of the pawl is sensed by the Steering Lock ECU,
the pattern of the bits of the electronic keys and reported to the Certification ECU. If the
held in other ECUs on the same car. steering lock retraction is not reported, the car
will not “Ready” (start).
If the ID Code Box is a box containing the
keys to start the car, we wouldn’t want just HV ECU (a component with only
anyone to be able to open it right? That’s where one name, hooray!)
the S code comes in (S is for Security). The S
code is the “key” for the ID code box. If the The HV ECU is the primary power plant
Certification ECU has a matching S code, the ECU. It tells the engine (ICE) when to run,
ID Code box will “unlock” the other ECUs. If when to stop, and how much power to produce.
not, it won’t and the car will remain immobile. It tells the ABS ECU how to brake. It directs the
charge and discharge of the HV battery after
So lets imagine the Certification ECU has consulting with the HV Battery ECU. Perhaps
just communicated a valid S code to the ID most importantly, it drives the MGs (Motor/
Code box. The ID Code Box is now willing to Generators) by controlling the inverter.
allow its keys to unlock other ECUs. What will
be unlocked? Without the aid of the HV ECU the car
is not driving, so if you want to cripple a
If the car is a Camry, the steering unlocked Prius, disabling the HV ECU is a good way to
first, then the HV ECU will be unlocked. If the accomplish the goal.
car is a Prius, the HV ECU will be unlocked.
A G-code (“go code”) is stored in both the
Steering Lock ECU ID Code Box (Immobilizer ECU) and the HV
(Camry HV only) ECU. Once the steering lock has released (if
applicable), the ID Code Box asks the HV ECU
The Steering Lock ECU locks the steering for its G-code. If it matches, the ID Code Box
column, thus aiding in the prevention of theft gives the HV ECU a start authorization and the
by eliminating the ability to steer the car. Here’s car will Ready.
how it works –

Part 2 will offer some useful real world diagnostic strategies you’ll be able to use tomorrow.
10 Import service | [Link]