CAL Automotive Locksmith Security & Anti-Theft Technologies 3 — Questions and Answers
Question 1: What is the purpose of a Tiris DST40 transponder in automotive security?
- It provides a 40-bit encrypted challenge-response authentication used primarily in Ford and Toyota vehicles (Correct answer)
- It transmits a 40-channel rolling code for remote start systems
- It stores a 40-digit PIN for dealer-level key programming
- It broadcasts a 40 MHz signal for passive entry range extension
Correct answer: It provides a 40-bit encrypted challenge-response authentication used primarily in Ford and Toyota vehicles
The Texas Instruments DST40 uses a 40-bit proprietary cipher for immobilizer authentication, used in Ford and Toyota among others.
Question 2: A locksmith is asked to program a proximity key for a vehicle that requires 'pin code extraction.' What does this process involve?
- Extracting the vehicle's security PIN from the BCM, EEPROM, or via OBD-II to authorize new key programming (Correct answer)
- Asking the customer for their personal key fob PIN
- Disabling the immobilizer by entering a universal override code
- Calculating the key cut code from the VIN number
Correct answer: Extracting the vehicle's security PIN from the BCM, EEPROM, or via OBD-II to authorize new key programming
Pin code extraction retrieves the vehicle's security access code from the BCM or EEPROM, which is needed to authorize programming a new key.
Question 3: Which transponder type is commonly referred to as a 'glass transponder' and why?
- A transponder encased in a glass tube, typically embedded in the key head or fob (Correct answer)
- A transparent plastic transponder used in windshield-mounted RFID systems
- A transponder that uses optical glass fiber for signal transmission
- A high-security transponder manufactured by Pilkington Glass
Correct answer: A transponder encased in a glass tube, typically embedded in the key head or fob
Glass transponders are passive RFID chips sealed inside a small glass tube, typically implanted in the plastic head of a vehicle key.
Question 4: What is the main difference between ID46 and ID47 transponders?
- ID46 uses PCF7936 with a 128-bit rolling code while ID47 uses AES-128 encryption (Correct answer)
- ID46 is a fixed-code transponder while ID47 uses crypto authentication
- ID47 operates at 433 MHz while ID46 operates at 125 kHz
- ID46 is used in European vehicles only while ID47 is North American only
Correct answer: ID46 uses PCF7936 with a 128-bit rolling code while ID47 uses AES-128 encryption
ID46 (PCF7936) uses a 128-bit rolling cipher, while ID47 is a newer generation using stronger AES-128 encryption for enhanced security.
Question 5: When a vehicle is in 'anti-theft lockout mode' after multiple failed key attempts, what is the recommended first step for a locksmith?
- Immediately attempt EEPROM extraction to bypass the lockout
- Wait for the lockout timer to expire or consult OEM procedures for resetting the security system (Correct answer)
- Replace the BCM to clear the lockout state
- Disconnect the battery for 30 seconds to reset the immobilizer
Correct answer: Wait for the lockout timer to expire or consult OEM procedures for resetting the security system
Most OEM systems impose a timed lockout that clears automatically; jumping ahead with invasive methods risks permanently locking the ECU.
Question 6: What is a 'token' in the context of BMW CAS (Car Access System) key programming?
- A one-time-use authorization credit consumed each time a new key is programmed to the CAS module (Correct answer)
- A physical USB dongle required by BMW dealer software
- A rolling code counter stored in the key fob
- A diagnostic code generated after a successful key learn
Correct answer: A one-time-use authorization credit consumed each time a new key is programmed to the CAS module
BMW CAS modules use a finite number of programming tokens; each new key programming session consumes one, limiting total keys that can ever be programmed.
Question 7: Which of the following vehicle security systems uses ultrasonic interior sensing as a primary detection method?
- OEM transponder immobilizers
- Aftermarket alarm systems with interior motion protection (Correct answer)
- Passive keyless entry systems
- Remote start systems with safety interlocks
Correct answer: Aftermarket alarm systems with interior motion protection
Many aftermarket alarm systems include ultrasonic sensors that detect movement or sound waves inside the cabin as a secondary theft deterrent.
CAL Automotive Locksmith Security & Anti-Theft Technologies 3
What is the purpose of a Tiris DST40 transponder in automotive security?