2003 C3 key programming - central locking - Lexia

This is the Forum for all your Citroen Technical Questions, Problems or Advice.

Moderator: RichardW

User avatar
CitroenCrazy
Donor 2020
Posts: 131
Joined: 20 Mar 2005, 19:17
x 43

2003 C3 key programming - central locking - Lexia

Post by CitroenCrazy »

Hi guys

I wonder if anyone can enlighten me regarding programmimg of the remote central locking facility for a 2003 C3.

I've set up new keys from scratch for a S2 Xantia in the past and expected the C3 to be the same, but alas no.

Starting Point:
I have two keys. Both were supplied with the car when i bought it.
Key 1 works 100%; opens the door, starts the engine and operates the remote central locking
Key 2 opens the door, starts the engine, but does not operate the remote central locking (RCL, for brevity) - that's the bit I've been trying to address.

FWIW, I also have a (2nd hand) spare RCL fob that I know works, but again, I can't get the BSI to recognise it.

Although the context is C3, the same style of RCL fob is used across the PSA range, so I guess the task is similar. The board is marked 7337 3067C.
This is the style of key
C3 key 2.jpg
And this is the RCL bit
C3 key 3.jpg
The buttons and the battery are both good.
I've used a spectrum analyser to check the device is transmitting
Xantia key test 2.jpg
I've also used the BSI / parameter measurement option in Lexia, which shows that the BSI senses a press on the fob, but fails to act on it.
So that's the fundamental problem, the relationship between the fob and the BSI has been lost.

This screenshot from Lexia shows that although it's aware of 2 keys, it only recognises one RCL fob. Somehow I need to make it see the other one.
c3 lexia bsi - guided programming.png
I have the 4 digit key programming code and I've been through the process of reconfiguring the BSI to recognise the RFID chip in each of the two keys, but that doesn't address the RCL function.

Once the immobiliser part has been completed, the next page on the Lexia goes onto this procedure, which is widely quoted across the Internerd.

1 - Switch off the ignition and take out the key
2 - Wait 1 minute without pressing the buttons of any remote control
3 - Place the key of the high frequency remote control to be synchronised in position "ignition+"
4 - Within 10 seconds, press the locking button for 5 seconds
5 - Switch off the ignition and take out the key
6 - Repeat the procedure with the other keys from point N°3, otherwise move on to point N°7
7 - Wait 30 seconds, the remote controls are synchronised

I've tried this many times, without success. I can't see how this would work in my case, if the BSI only acknowledges a single fob.

In conclusion, there must be a way of introducing a new RCL; I just can't find it.

Sorry for the long post; I just wanted to be as clear as I can.
TIA

User avatar
GiveMeABreak
Forum Admin Team
Posts: 22618
Joined: 15 Sep 2015, 19:38
x 2341

Re: 2003 C3 key programming - central locking - Lexia

Post by GiveMeABreak »

When any programming session is undertaken for keys, you must programme ALL the keys you will ever use in the same session. Any excluded from a session will be locked out.

So in this case you should of programmed 3 keys in one session. Lexia is reporting only 2 keys are programmed, and only one of those has been synchronised with the remote control.

So if you have tried to re-programme ALL 3 fobs again and you find that they are allowing the car to start, but one or more are not working with the remote control functions, then it may be likely that the circuitry is damaged on the suspect fob, or it has been replaced with an aftermarket one that isn't correct for the vehicle.

User avatar
CitroenCrazy
Donor 2020
Posts: 131
Joined: 20 Mar 2005, 19:17
x 43

Re: 2003 C3 key programming - central locking - Lexia

Post by CitroenCrazy »

Hi Marc

Thanks for this. I probably shouldn't have mentioned the third RCL module, as it doesn't fundamentally change the situation or its diagnosis.

When I created a new key for the Xantia, there were two stages, first the BSI learned the ID of the immobiliser transducer chip, then it learned the ID of the RCL transmitter.

The C3 is more sophisticated, the immobiliser transducer is a one-time programmable device, which cannot be moved from car to car. However, that bit was fine, the BSI is happy with both keys; they both start the engine.

Equally, unlike the Xantia, the RCL transmitter uses a rolling code, so the system can't be hacked by simply recording an RF unlock "conversation" and then replaying it.

The weird thing is that after configuring the immobiliser, there is no second step, to initialise the RCL

As far as I've been able to discern, the RCL is still just a transmitter; it doesn't listen for a reply from the BSI, it just sends a lock or unlock code and then increments a counter, so the next code will be different, according to some shared algorithm.

However, the fundamental question remains, how is one supposed to establish, or re-establish a secure conection between the BSI and the RCL transmitter ?
There's obviously something I'm failing to grasp.

Online
Hell Razor5543
NOT Alistair or Simon
Posts: 11337
Joined: 01 Apr 2012, 09:47
x 1253

Re: 2003 C3 key programming - central locking - Lexia

Post by Hell Razor5543 »

I am NOT certain about this, but if the 'chip' in each key is recognised by the car, establishing (or, in your case, re-establishing) the connection between the remote locking board in the key and the central locking in the car should be simple. Put the key into the ignition, turn it on (you don't need to start the car), and then press (and possible hold for a few seconds) one of the buttons on the key. This should then get them back into sync.

I have just looked at the instructions for my C5, and it says to switch on the ignition and then immediately press button A (which is the lock button) until it locks the car; this can take up to ten seconds.

User avatar
GiveMeABreak
Forum Admin Team
Posts: 22618
Joined: 15 Sep 2015, 19:38
x 2341

Re: 2003 C3 key programming - central locking - Lexia

Post by GiveMeABreak »

CitroenCrazy wrote:
01 Feb 2021, 21:01
Hi Marc

Thanks for this. I probably shouldn't have mentioned the third RCL module, as it doesn't fundamentally change the situation or its diagnosis.

When I created a new key for the Xantia, there were two stages, first the BSI learned the ID of the immobiliser transducer chip, then it learned the ID of the RCL transmitter.

The C3 is more sophisticated, the immobiliser transducer is a one-time programmable device, which cannot be moved from car to car. However, that bit was fine, the BSI is happy with both keys; they both start the engine.

Equally, unlike the Xantia, the RCL transmitter uses a rolling code, so the system can't be hacked by simply recording an RF unlock "conversation" and then replaying it.

The weird thing is that after configuring the immobiliser, there is no second step, to initialise the RCL

As far as I've been able to discern, the RCL is still just a transmitter; it doesn't listen for a reply from the BSI, it just sends a lock or unlock code and then increments a counter, so the next code will be different, according to some shared algorithm.

However, the fundamental question remains, how is one supposed to establish, or re-establish a secure conection between the BSI and the RCL transmitter ?
There's obviously something I'm failing to grasp.
Yes, I'm aware of all this - the Xantia is nothing like the C3 or later systems. I'm just going off what you've already stated about the 3rd key and what Lexia is reporting - so it is relevant as if the third key was not programmed at the same time it won't be working and Lexia states only 2 keys are programmed.

The remote locking requests are the same - they must first be transmitted to the BSI for handshaking and authorisation. However, if the BSI is not recognising the transmission protocol / frequency then it will never work. Hence why I suggested that perhaps one of the fobs has been replaced at some point with an aftermarket fob of the incorrect frequency, or it is broken. In this case it will never work!

To go back to the issue - there is no secret method of programming a key - it is the same procedure that you have already completed in Lexia for programming and for resynchronising the fobs if the rolling code limit has been reached.

1) The transponder chip in both keys has been programmed successfully - we know that from what Lexia is showing us. This means both fobs will start the car as the transponder coil in the ignition barrel energises the chip in the fob and the authentication takes place.
2) The remote control circuitry uses the same code which is transmitted to a receiver in the car and still has to be authorised by the BSI. We know this is not faulty from the vehicle point of view as it is working with one of the 2 programmed fobs.

3) So this only leaves the remaining possibilities:
a) a faulty circuit in the dodgy fob or broken contacts / solder joints / microswitches
b) the fob is of the incorrect type and not using the correct frequency / transmission protocol. In this scenario, it's akin to the BSI is expecting English, but receiving Welsh. :-D

So the fault is in your non-working key fob.

ozvtr
Posts: 32
Joined: 13 Oct 2020, 01:11
x 2

Re: 2003 C3 key programming - central locking - Lexia

Post by ozvtr »

CitroenCrazy wrote:
01 Feb 2021, 21:01

The C3 is more sophisticated, the immobiliser transducer is a one-time programmable device, which cannot be moved from car to car. However, that bit was fine, the BSI is happy with both keys; they both start the engine.

Equally, unlike the Xantia, the RCL transmitter uses a rolling code, so the system can't be hacked by simply recording an RF unlock "conversation" and then replaying it.

The weird thing is that after configuring the immobiliser, there is no second step, to initialise the RCL

However, the fundamental question remains, how is one supposed to establish, or re-establish a secure conection between the BSI and the RCL transmitter ?
There's obviously something I'm failing to grasp.
I have literally been working on this for a year now and can almost tell you how it works...but not quite. This is as close as I have gotten.

The all-CAN BUS PSA vehicles run a different security system to the CAN-VAN vehicles. Coding keys for the CAN-CAN vehicles is straight forward and works like every one believes. Is your Xantia CAN-CAN?
The 2003 C3 will be a CAN-VAN set up. Your in for a treat!
There are two parts to the key fob. 1) an RFID chip. 2) the central locking transmitter board. (In the Chinese knock-off boards they are both on the one board)
The RFID chip is used for the ignition system and is a ID46 style chip (in the genuine keys). A brand new chip is "unlocked". Once read by the "coding process to the car" the chip is "locked". If the chip is locked and you try to code it to your car, the car checks if the unique identifier of that chip is already in it's data base (from a previous session). If it is, it accepts it and continues. If not, it wont code it to the car. So you can code brand new RFID chips or one it recognizes but not an old one from another car. Or at least not one that's locked and it doesn't recognize. So you can create a key to start the engine relatively easily. Just use brand new RFID chips, they are cheap. The unique identifier is committed to memory in the BSI (I think) and is never forgotten. In the scenario the engine ECU is not relevant and I am not going to go into it.
Now that is just to run the engine!!!!
The central locking board...OH boy!!
In the factory, a brand new RFID chip and central locking board are "paired together" by programming the central locking board with a unique identifier number from the RFID chip.
When you synchronize a key, the system checks that the RFID chip and central locking board have the same identifier. If they don't, the system rejects the central locking board. So you could have an new RFID chip and an old (not from your car) central locking board and it will accept the RFID chip but reject the board. Because they are not paired. Got it?
If you have an old genuine key but it's not from your car, the RFID chip and transmitter will be paired BUT the RFID chip is locked and the system will not recognize the identifier.
See how it all works now?
As far as I know this unique identifier is only used when the central locking board is synchronized to the system. Once the rolling code synchronization is set, only the code is sent by the transmitter.

OK, pop quiz just to see if you were paying attention.
1) If you have two keys from the same car and they work as advertised. Then you swap the RFID chips, will the keys work properly? The old key cases are worn and you buy replacements but you stuff things up.
2)If you attempt to synchronize the keys in the "swapped state" will the synchronization work? After some time the transmitter becomes de-synchronized from the car?
Answer 1. Yes they will work fine, the engine security and central locking work separately. The car just thinks you are starting it with one key and unlocking it with the other.
Answer 2. NO, the chip and board are not paired.
So, the cheap Chinese knock-off keys tend to work in the CAN-CAN BUS vehicles because the CAN-CAN security is...well...less secure. They don't work in the CAN-VAN because the RFID chips and the central locking transmitter are not paired in the factory.
The one way I have seen this system hacked (to use old keys) is to read the RFID unique identifier of a brand new unlocked chip and re-program the transmitters MPU code with the new identifier!!!
The other is that there is a brand of aftermarket key that can be synchronized, I'm not sure but I think the brand is golden horse.
I am 99% confident that this is how the security system works. If I have made any technical errors I'm sorry and I will gladly stand corrected.
There is also different digital modulation protocols, such as ASK and PSK that can be thrown into the mix, but that's beyond my knowledge...sorry.

User avatar
CitroenCrazy
Donor 2020
Posts: 131
Joined: 20 Mar 2005, 19:17
x 43

Re: 2003 C3 key programming - central locking - Lexia

Post by CitroenCrazy »

Thanks guys, I really appreciate the time you've taken to share your experience and expertise.

James, although I haven't tried the procedure exactly as you outlned, it's more or less covered by the 7 step process in my original post. It might just be me, but I couldn't get that to work in this case.

Marc, I understand your logic, and I agree that the issue lies between the "failed" fob and the BSI, but I'm confident the fob is working, at least in the first instance - see below.

ozvtr I'm slightly confused; I think you and I may be using terminology differently. In my mind at least, the RFID chip is the wee module down by the key blade; mine's labelled Philips PCF 7936AS. I've learned a lot about these, but they're only used for the immobiliser, so can be discounted for now.
On the RCL board (7337 3067C), there's only a microcontroller and an oscillator that sets the transmission frequency. I haven't managed to find any technical documents covering these. So far, I've assumed they are not configurable after they leave the factory and thus pairing one with a car requires instructing the BSI to accept the code that's transmitted, but that may be a gross oversimplification.


If you'll permit me, I'll restate where I am, stripping out all but the essentials.

The only issue I have is associated with the RF central locking (RCL), all other aspects of the key and key programming are ok.
RCL works with one key but not the other.

Both keys came with the car. I wish I could be sure whether or not the RCL has ever worked on the problem key, but the car was my mother's and one key was kept as a spare, so alas, I can't be sure whether the problem is relatively new or long standing.

I am sure the non-working RCL module is transmitting on the correct frequency, so the buttons and the battery are ok.
The reason I can say this with confidence is that, firstly, I can see a response on an RF spectrum analyser (a slightly grand way of describing some open source software and a £15 USB module) but more importantly, if I use the BSI parameter measuring page in Lexia, a button press is registered, but it's shown as an unidentified message. It's transient, and I didn't manage to catch it in a screenshot, but imagine the highlighted section below blinking from No to Yes and back again as the button is pressed.
BSI parameter measuring.jpg
The bit that I'm most curious about is the BSI status screen that shows only one RCL module programmed. Somehow, I need to make the lower field read 2
BSI - number of keys.jpg
If I went to a dealer and said I've lost my spare key and need a new one, they would be able to produce one for me. Obviously the price would be a significant proportion of the value of a 2003 C3 these days, which is why I don't propose to do it, but ultimately, the question comes down to how they would configure a new RCL fob to work with the car, and is that course of action available to anyone with a Lexia ?

At one point, while I was searching around BSI-related screens in Lexia, I found one called Guided Programming, which has this interesting line:
c3 lexia bsi - key status.png
This is a configurable field, but when I dug deeper, it asked me for a 4 digit code and the one I used for programming the immobiliser (the one on the card that comes with a new car) didn't work, so I'm wondering whether there is a dealer ID that allows some parts of the cofiguration to be updated. In any case, to be of any use, we would have to convince ourselves that encoded within "0C1A" is the number of RF remotes........


The car's gone back to my mother for now, so I have a few days to formulate my next plan of attack

ozvtr
Posts: 32
Joined: 13 Oct 2020, 01:11
x 2

Re: 2003 C3 key programming - central locking - Lexia

Post by ozvtr »

CitroenCrazy wrote:
02 Feb 2021, 14:44

ozvtr I'm slightly confused; I think you and I may be using terminology differently. In my mind at least, the RFID chip is the wee module down by the key blade; mine's labelled Philips PCF 7936AS. I've learned a lot about these, but they're only used for the immobiliser, so can be discounted for now.
No, It cant. As I said the RFID chip AND the central locking board are paired by using a unique identifier FROM the RFID chip. If you know anything about RFID chips, when polled, they give off a LOT of data. One part of that data is programmed into the central locking board DURING THE MANUFACTURE OF THE KEY. If you are talking only about the engine immobilizer, then, yes the identifier is not relevant, but we are not. We are talking about the central locking. The identifier IS part of the programming of the central locking board. Now, I do not know why YOUR board does not want to work. As Givemeabreak says there are multiple reasons why the board wont work. I am trying to explain how the system works so that you can better fault find it.
CitroenCrazy wrote:
02 Feb 2021, 14:44
On the RCL board (7337 3067C), there's only a microcontroller and an oscillator that sets the transmission frequency. I haven't managed to find any technical documents covering these. So far, I've assumed they are not configurable after they leave the factory and thus pairing one with a car requires instructing the BSI to accept the code that's transmitted, but that may be a gross oversimplification.
OK, you need to inform the BSI of the current code transmitted by the "RCL board", to synchronize them,right? So that the BSI can predict what the next code will be by applying an algorithm to the current code. I know that you know that! To do that you need to go through the "synchronization process" in the LEXIA. I know that you know that too. BUT to validate that the code being transmitted by the RCL board is from a "kosher" source, during the synchronization process the BSI checks that the unique identifier between the RFID chip AND the RCL board are the same. AND that unique identifier is in its memory...otherwise it rejects the RCL board and will NOT synchronize it!

The HF module (the receiver in the car) will receive and pass on to the BSI EVERY signal it can discriminate (that pass certain criteria, like correct frequency). So when you look at the relevant LEXIA page, ANY signal the BSI CAN decipher is displayed as "reception of an IDENTIFIED high frequency remote control message-yes". If it CANT decipher the signal you get "reception of an UNIDENTIFIED message from the high frequency remote control-yes". By the way, if it gets an "unidentified" signal the BSI goes into "anti scanning mode" and WILL NOT PROCESS signals for the next 60 seconds. Try it. Try to lock/unlock your C3 with the transmitter that puts out a signal but wont open the doors. Then try locking/unlocking with the good one within 60 seconds...it wont work! Wait a further 60 seconds and it will work. This is a strategy against "bruit force attacks", if you know anything about hacking.
CitroenCrazy wrote:
02 Feb 2021, 14:44
If I went to a dealer and said I've lost my spare key and need a new one, they would be able to produce one for me. Obviously the price would be a significant proportion of the value of a 2003 C3 these days, which is why I don't propose to do it, but ultimately, the question comes down to how they would configure a new RCL fob to work with the car, and is that course of action available to anyone with a Lexia ?
A brand new key from Citroen will cost you 110 pounds!!!
YOU (who own a LEXIA) will easily be able to code in a BRAND NEW KEY FROM CITROEN because the RFID chip is unlocked AND the RCL board has the RFID unique identifier programmed in!!!!!
We are finally getting to the heart of problem...greed! This means you can ONLY go to PSA to get a key!!!!! At least one with an RCL board that will lock/unlock your car. Got it now?
CitroenCrazy wrote:
02 Feb 2021, 14:44
This is a configurable field, but when I dug deeper, it asked me for a 4 digit code and the one I used for programming the immobiliser (the one on the card that comes with a new car) didn't work, so I'm wondering whether there is a dealer ID that allows some parts of the cofiguration to be updated.
Look carefully...it's a 5 digit code, not a 4 digit code. It's a generic code used by PSA technicians as a fail-safe against "unauthorized" users.
I think there are a few users on here who know the code. :roll:

wheeler
Posts: 4652
Joined: 21 Sep 2002, 19:07
x 212

Re: 2003 C3 key programming - central locking - Lexia

Post by wheeler »

The 5 digit code you need to change settings is 03114

User avatar
CitroenCrazy
Donor 2020
Posts: 131
Joined: 20 Mar 2005, 19:17
x 43

Re: 2003 C3 key programming - central locking - Lexia

Post by CitroenCrazy »

Once again, thanks guys, I'm in your debt for your help.

ozvtr I'm sorry, I didn't fully grasp what you said originally, thanks for spelling it out for me

wheeler, thanks, that's another snippet to add to my Lexia file that I wasn't aware of before. I can really create mayhem now :-)

The hive mind behind this forum is just amazing :-)

ozvtr
Posts: 32
Joined: 13 Oct 2020, 01:11
x 2

Re: 2003 C3 key programming - central locking - Lexia

Post by ozvtr »

I have been following a thread over on a site called Digital-Kaos. The thread goes on for pages and pages and pages. I gleaned bits and pieces from the volumes of sh!t.
There was one guy who hacked the code but refused to share the code to break the encryption. If you gave him money and a dump of a new RFID chip, he would give you the hack for the MPU on the transmitter board. Affable sort of guy-NOT!
They actually gave up and said just buy the the Golden Horse keys!
I have seen videos where, using an RFID reader, an Arduino and a bit of code, you can unlock RFID chips. I don't know if that's only certain types of chips or not.
From what little I know, if you can unlock the RFID chip on an old key, you should be able to re-use the RCL board and hence the whole fob. You'd need to change the blade but that's not a big problem.
As I said all this BS is for the early CAN-VAN cars and the fobs for the later CAN-CAN are easier to code in. I can only assume it's cheaper to skip the step (in the factory) of reading individual RFID chips and individually programing the MPU's on the RCL boards. Money, money, money! Anyway at 110 pounds I can't see too many people buying spare keys, so I don't think they lost out on sales by going to a cheaper system, do you?

ozvtr
Posts: 32
Joined: 13 Oct 2020, 01:11
x 2

Re: 2003 C3 key programming - central locking - Lexia

Post by ozvtr »

It seems to me that if you have three keys then, statistically speaking, two of the keys are original and one is a ring-in. Sorry if you have covered this before.
The one that neither starts or opens the car would be the ring-in. I would forget about it for the time being. The odds that the previous owner paid for a brand new key and then had it coded in, are just too high. It's most likely they got one off ebay (or whatever) got the blade cut but it didn't work.
The one that starts the car but doesn't open it is your best bet as one of the originals.
Have you tried swapping the RCL board out of the "bad" fob into the fob that starts the car, the semi-good one? Leave the RFID chip in the key. Then try the re-synchronizing process? Is it possible they were swapping RCL boards around because the original de-synced and they thought it was faulty? Remember you have to find the RCL board that's paired to the RFID chip before you can re-synchronize it
The BSI will accept "current" and "future" encrypted codes from the fob but not "past" codes. You eluded to that above. If your fob is too far from the car when you try to unlock it, the car will not "hear" the code and the code is "used up" by the fob. Now your fob is "ahead" (sorry about all the quotation marks) of the "next" code in the BSI. But not to worry the BSI will "look ahead" to the next few codes. If the transmitter gets too far ahead, the BSI refuses to accept the code and the car wont open. Hence the need to Re-synchronize from time to time.