JAGUAR XFR 2010 1.G Workshop Manual

Anti-Theft - Passive - Anti-Theft - Passive - Overview
Description and Operation

Overview Published: 11-May-2011

The PATS (passive anti-theft system) prevents the vehicle's engine from being started by unauthorized persons.

Engine starting is prevented by inhibiting the fuel, engine (spark, injectors and crank) and ignition systems from operating.
This is achieved by using a uniquely coded Smart Key and an encoded data exchange between multiple control modules.
The system is automatic and requires no input from the driver.

The engine start system is initiated when the encoded data between the Smart Key and vehicle control modules is verified.
The engine can then be started when the drive selector is in the 'Park' position, and the start/stop switch and the brake pedal
are pressed simultaneously.

Published: 22-Apr-2013
Anti-Theft - Passive - Anti-Theft - Passive - System Operation and
Component Description
Description and Operation

Control Diagram

NOTE: A = Hardwired; D = High speed CAN; N = Medium speed CAN; O = LIN bus



Item Description 1 Battery 2 Drive selector 3 RJB (rear junction box) 4 ABS (anti-lock brake system) 5 ECM (engine control module) 6 Keyless vehicle module

7 Low frequency antenna - front 8 Low frequency antenna - center 9 Low frequency antenna - rear 10 Radio frequency receiver 11 Start control module 12 CJB (central junction box) 13 Instrument cluster 14 Megafuse (250 amp)
System Operation

The passive start function prevents the vehicle from being started by unauthorized persons. It does this by immobilizing the
ignition, fuel and engine crank functions. The system is automatic and requires no input from the driver.

At the request of the CJB, the keyless vehicle module prompts each of the Low Frequency (LF) antennae to output a signal. When the Smart Key is in the vehicle cabin, it detects the LF signals and responds with a Radio Frequency (RF)
data-identification signal back to the keyless vehicle module via the RF receiver.

If the data received matches that stored in the keyless vehicle module it continues the passive start process by
communicating a 'Smart Key valid’ signal to the CJB via the medium speed CAN (controller area network) bus.

Once the CJB receives the authorization and confirms a response with an internal calculation, it passes the result to the
instrument cluster on the medium speed CAN bus.
Before the instrument cluster sends a mobilization signal to the ECMit will exchange encrypted data with: The electric steering lock mechanism to authorize unlocking the steering column.
The RJB to authorize fuel pump operation. Once the RJB receives the authorization and confirms the response with an internal calculation, it will enable the FPDM (fuel pump driver module).
The CJB to authorize the ignition status. If the drive selector is in the park position and the driver presses the brake
pedal and simultaneously presses the start/stop switch, the CJB interprets this as an engine crank request. Before the
engine crank request is allowed, the CJB compares a brake pressure signal received from the ABS module. The brake pressure signal is compared to an internally stored threshold value within the CJB. If the signal is greater than the
stored threshold value, a crank request signal is sent to the ECM on the high speed CAN bus.

Once these factors have been confirmed, and the vehicle is in 'Park', the engine can be started by pressing the brake pedal and
the Stop/Start button simultaneously.
NOTES:


If the keyless vehicle module fails to locate the Smart Key, the message 'SMART KEY NOT FOUND PLEASE INSERT IN
SLOT' will appear in the instrument cluster message center. When inserted the start control module will read the transponder
within the Smart Key. If the transponder identification is valid, authorization will be transmitted to the instrument cluster on
the LIN (local interconnect network) bus.


When the vehicle is delivered from the factory the passive start function is inhibited. In this condition the vehicle can
only be started by placing the Smart Key in the start control module. The system should be switched on during the Pre-Delivery
Inspection (PDI) using the Jaguar approved diagnostic system. For additional information, refer to the PDI Manual.

To ensure optimum long term reliability of the smart key the battery must be replaced with a brand new, unused battery. If a
used battery is installed the "SMART KEY BATTERY LOW" message may not be cleared. To avoid contamination of the contacts
the battery should be removed from its packaging and installed into the smart key while wearing gloves. To confirm that the
replacement battery is working correctly press the unlock button twice while holding the smart key outside the vehicle, then
enter the vehicle with the smart key, press the start button and confirm that the "SMART KEY BATTERY LOW" message is not
displayed.



Start Control Module Component Description

The start control module is used if the keyless vehicle module is unable to authorise the Smart Key.

If the keyless vehicle module is unable to identify the Smart Key, for example if the Smart Key battery voltage is low or there
is local RF interference, the transponder within the Smart Key can be read in the conventional manner. The driver will be
alerted to this by a chime and a message in the instrument cluster message center 'SMART KEY NOT FOUND PLEASE INSERT IN
SLOT'.

Once inserted the start control module will read the transponder within the Smart Key. If the transponder identification is
valid, authorization will be transmitted to the instrument cluster on the LIN bus.


NOTE: Inserting the Smart Key into the start control module will not charge the Smart Key battery. The battery is
non-chargeable and must be replaced if defective.

A message 'REMOVE SMART KEY' will be displayed if the Smart Key is still in the start control module and the driver's door is
opened.

Low Frequency Antenna

Three Low Frequency (LF) antennae for the passive start system are positioned in specific locations in the vehicle; refer to
Component Location graphic.


NOTE: On vehicles with the passive entry system, five additional antennae are used; one integrated into the rear bumper
and one in each door handle assembly. These are only used by the passive entry system and have no function in the passive
start system.

The keyless vehicle module transmits an LF signal via the antennae which is received by the Smart Key. The Smart Key then
responds by transmitting a Radio Frequency (RF) signal which is received by the RF receiver and passed to the keyless vehicle
module for authorization.

Keyless Vehicle Module

The keyless vehicle module controls signal transmissions to and from the Smart Key and provides authorization to allow the
vehicle to be started. The module has a medium speed CAN connection to the CJB for authorizing vehicle starting.

Radio Frequency Receiver

The Radio Frequency (RF) receiver transmission is received from the Smart Key to enable key identification.

Anti-Theft - Passive (Description and Operation), Anti-Theft - Passive (Description and Operation).
Inspection and Verification

Anti-theft - Passive

The best method to confirm the correct operation of the Passive Anti-Theft System (PATS) is to check the LED (located in the
center of the instrument panel). The LED should illuminate solid for 3 seconds, when the ignition status is set to ON, and then
extinguish. This validates all PATS functions (i.e. the key transponder matches a stored key code, the challenge/response
sequence between the respective modules was successful resulting in the EMS being enabled).
Ignition fails to operate

Check that the smart key is located within the vehicle interior, and that it is the correct one for the vehicle.

Insert the smart key into the start control unit (located at out board side of driver instrument panel lower panel), this is an
alternative method to allow Ignition On/Engine Start.



Check that the start button circuit to the CJB is not open circuit or short circuit to power.

Check that the Low Speed CAN network is not malfunctioning, i.e. open circuit or short circuit. This would mean that the
remote keyless entry module, Central Junction Box (CJB) and instrument cluster would be unable to communicate.
Engine fails to crank

If a PATS fault is detected, the LED will flash for 60 seconds at 4Hz with a 50% duty cycle. At the end of this period, the LED
will flash a 2 digit code; this code is repeated 10 times. The meaning of these fault codes along with the frequency of flashing
is given in the accompanying table. As a general rule a fault code of 16 or less will cause the vehicle not to crank. Additionally,
the manufacturer approved diagnostic system should be used to check the instrument cluster, CJB & ECM for Diagnostic Trouble
Codes (DTCs).
One potential occurrence for failing to crank could be due to the P & N start switch (input to the ECM).
Check the Crank Request output from the CJB to ECM is not short circuit to ground or open circuit. www.JagDocs.com

Check the Starter Relay circuit.


NOTE: On petrol engine variants, due to Smart Start, both sides of Relay Coil are switched directly from ECM (If
conditions correct). On diesel engine variants the low side only is switched directly from the ECM.
Check that the Steering Column Lock correctly operates and the steering wheel can turn freely.

Check that the High Speed CAN network is not malfunctioning, i.e. the CAN circuit is open or short circuit. This would mean
that the instrument cluster and ECM would be unable to communicate resulting in no Challenge being performed to enable the
ECM. This would be supported by LED Flash Code 24, see PATS Fault Code Table.

Also check the CAN network between the ABS module and the CJB. The CJB uses the CAN_BrakePressureTMC signal to
determine if the brake pedal has been pressed in order to allow an engine crank. The CJB uses a value of 0x05, if the CJB sees
a value less than this, it will not enable the Crank Request Output.
Engine cranks but will not start

If the Engine is cranking it means that the ECM has passed the authorisation required with the Instrument Cluster. If this
authorisation failed, the ECM would not engage the starter relay. This could be confirmed by verifying the PATS LED prove out
(illuminated solid for 3 seconds) or by reading DTCs from the instrument cluster and ECM.

In this case, the fuel pump circuit should be verified. The Fuel Pump Delivery Module (FPDM), which is supplied via the RJB
(authentication required with the instrument cluster) and controlled by the ECM, supplies the fuel pump.
In all cases of suspected non-start issues, the most logical failure modes should be eliminated first. i.e.

1. Check all relevant supplies and grounds to the relevant modules listed herein.
2. Note any unusual behaviour from other systems/functionality.
3. Note any functions that are not operating as expected.
PATS Fault Codes

For the various PATS modes/faults listed in the table , the instrument cluster will store a DTC and indicate this to the customer
during the detection period defined in the 'when logged' column, by illuminating the indicator as described for 60 seconds and
then flashing the LED 10 times as appropriate. The indication will stop immediately the ignition status is set to OFF any time
during the fault indication sequence. Up to 4 DTCs could be stored per key read sequence (1-10 read attempts). No DTCs will be
stored until all retry attempts are complete. Only the highest priority fault code will be flashed.

To determine the fault code from the LED: The LED will flash initially ten times with 1.5 seconds between. The LED will remain
OFF for 2.5 seconds then flash a number of times with 0.5 seconds between (the number of times the LED flashes represents
the first digit of the code), the LED will remain OFF for 1.5 seconds then flash a number of times with 1.5 seconds between
(the number of times the LED flashes represents the second digit of the code).

The PATS LED will be commanded on as shown under 'indication'. Normal PATS operations are complete within 400ms of the
ignition switch transition from OFF to ON or START, worst case for ECM communication problems will be less than 2 seconds. If
PATS is not complete during the 2 seconds the ECM will terminate PATS and await the next ignition ON or START event. PATS
faults will be indicated via the LED as soon as possible and will terminate the LED prove out. At ignition OFF all previous
flashing will cease and the perimeter anti-theft system will control the LED when the vehicle is locked and armed.

PATS Fault Code Table


Mode of Operation/Fault

When Logged
Ignition
Status

DTC LED
Fault
Code

Indication Prove out N/A Transition
from OFF to
ON N/A N/A
3 Seconds of steady
illumination Perimeter Anti-theft Control N/A OFF -
Vehicle
locked and
armed N/A N/A
Off or 0.5Hz flashing
at 5% duty cycle ±
20% until Off Start Control Unit already programmed Key Insert Any B1B0105 N/A No Indication Start Control Unit status = invalid response Key Insert Any B1B0167 N/A No Indication Start Control Unit programming error Key Insert Any B1B0151 N/A No Indication Start Control Unit challenge response error Key Insert OFF B1B0162 N/A No Indication Key Programming timer expired or Key Auth Timer expired Key Insert Any B1B0187 N/A No Indication Transponder challenge response error Key Insert Any B1B0164 N/A No Indication Transponder keys stored below minimum number required B&A/Dealer Any B1B0100 N/A No Indication Transponder not programmed B&A/Dealer Any B1B0155 N/A No Indication If the instrument cluster sends a 'theft' key status
to the ECM or the ECM returns a status message
containing the data 'Disabled/Theft', the instrument
cluster will set this DTC EMS CAN
communication OFF to ON B1B3364 16
60 seconds of 4Hz
flashing at 50% duty
cycle followed by fault
code 16 flashing 10
times

During manufacturing a Target ID is transferred from
the ECM when requested by the instrument cluster. The instrument cluster stores this unique vehicle
number in EEPROM. If this ID fails to store in
EEPROM correctly, the instrument cluster will set this
DTC B&A/Dealer OFF to ON B1B3305 22
60 seconds of steady
indication followed by
fault code 22 flashing
10 times If the status message received from the ECM
contains the data challenge response error, the
instrument cluster will set this DTC Challenge/Response OFF to ON B1B3362 23
60 seconds of steady
indication followed by
fault code 23 flashing
10 times After the instrument cluster has transmitted its first
PATS idle message, it will start a 2 second timer
running. If the PATS sequence does not complete
(Cluster received the Enable msg) within this time period the instrument cluster will set this DTC Idle message
missing OFF to ON B1B3387 24
60 seconds of steady
indication followed by
fault code 24 flashing
10 times
1. If an obvious cause for an observed or reported concern is found, correct the cause (if possible) before proceeding to
the next step.
2. If the cause is not visually evident, verify the symptom and refer to the manufacturer approved diagnostic system.

Telematics - Telematics
Diagnosis and Testing Published: 11-May-2011

The complexity of the electronics involved with the JaguarNet system, of which the GPS antenna and navigation display are
parts, and the multiplexed communication network which are connected to it preclude the use of workshop general electrical
test equipment. Therefore, reference should be made to the approved Jaguar diagnostic system for detailed instructions on
testing the VEMS unit.
The approved Jaguar diagnostic system tests and analyses all functions of the VEMS and the various systems affected by it.

Where a fault is indicated, some basic diagnostic methods may be necessary to confirm that connections are good and that
wiring is not damaged before installing a new component.

Navigation System - Navigation System
Diagnosis and Testing

Inspection and Verification Published: 15-Jul-2014

CAUTION: Diagnosis by substitution from a donor vehicle is NOT acceptable. Substitution of control modules does not
guarantee confirmation of a fault, and may also cause additional faults in the vehicle being tested and/or the donor vehicle.
NOTES:


If a control module or a component is suspect and the vehicle remains under manufacturer warranty, refer to the Warranty
Policy and Procedures manual, or determine if any prior approval programme is in operation, prior to the installation of a new
module/component.


When performing voltage or resistance tests, always use a digital multimeter accurate to three decimal places, and with
an up-to-date calibration certificate. When testing resistance always take the resistance of the digital multimeter leads into
account.


Check and rectify basic faults before beginning diagnostic routines involving pinpoint tests.
1. Verify the customer concern.

2. Visually inspect for obvious signs of damage, water ingress and system integrity.

Visual Inspection
Mechanical Electrical
Navigation system DVD player Mechanism
Navigation system display
Navigation system module
GPS antenna
Wiring harness for damage and corrosion
ABS Module
Electrical connector(s)
Audio unit
3. If an obvious cause for an observed or reported concern is found, correct the cause (if possible) before proceeding to
the next step.
4. If the cause is not visually evident, check for Diagnostic Trouble Codes (DTCs) and refer to the DTC Index.

Symptom Chart

Symptom Possible Cause Action Poor satellite reception
Electrical harness open/short
circuit, dis-connected
Component failure
No reception from satellite GO to Pinpoint Test A. Map disc will not insert/eject
Electrical harness open/short
circuit, dis-connected
Component failure
Map disc failure GO to Pinpoint Test B. Black screen (navigation map
screen does not display)
Electrical harness open/short
circuit, dis-connected
Component failure
GVIF cable GO to Pinpoint Test C. Navigation map screen color
is abnormal
Electrical harness open/short
circuit, dis-connected
Component failure
GVIF cable GO to Pinpoint Test D.

Symptom Possible Cause Action Vehicle’s current position
mark turns independently
Electrical harness open/short
circuit, dis-connected
Component failure
Vehicle on a turntable in a parking
building GO to Pinpoint Test E. Car current position not
stable
Electrical harness open/short
circuit, dis-connected
Component failure GO to Pinpoint Test F. Map display is incomplete
Map disc contaminated/damaged
Electrical harness open/short
circuit, dis-connected
Incorrect market map disc
Component failure GO to Pinpoint Test G. No navigation voice guidance
Voice guidance soft key set to OFF
position
Volume level set too low
Component failure GO to Pinpoint Test H. No response to pressing
navigation menu
Interruption during map disc
update
Electrical harness open/short
circuit, dis-connected
Incorrect Navigation Control
Module (NCM) installed
Incorrect car configuration data
received GO to Pinpoint Test I. 'NO DVD PLEASE INSERT MAP
DVD' message is displayed
A disc other than the map disc is
inserted Insert the correct map disc 'UNABLE TO READ DATA
CONSULT YOUR DEALER'
message is displayed
DVD player abnormality Check and install a new Navigation Control Module
(NCM) as required. Refer to the new
module/component installation note at top of DTC
Index. 'UNABLE TO READ DATA TEMPERATURE IS TOO HIGH'
message is displayed
Operating temperature has been
exceeded
Navigation Control Module (NCM)
internal temperature is high Move the vehicle to a cool location, and turn the
engine OFF. Wait for a while, then verify conditions
again. If the temperature around the Navigation
Control Module (NCM) is high, take measures to lower
temperature 'UNABLE TO READ DVD
CORRECTLY CHECK IF THE
DVD IS DAMAGED OR DIRTY'
message is displayed
Check map disc for contamination,
deformation, cracks, scratches or
non-genuine disc Clean the map disc and retest, replace the map disc 'UNABLE TO READ DATA
CHECK IF MAP DVD IS
CORRECT' message is displayed
Incorrect DVD map disc is inserted Insert a map disc with the correct part number Pinpoint Tests

NOTES:


If the control module or a component is suspect and the vehicle remains under manufacturer warranty, refer to the
Warranty Policy and Procedures manual (section B1.2), or determine if any prior approval Program is in operation, prior to the
installation of a new module/component.


Navigation Diagnostic Screen Access

1. With the vehicle at rest, place the ignition switch in either "ACC", "ON", or start the engine.
2.On the "Menu" screen, press the top center of the screen for more than three seconds.
3. Enter the PIN code, and then touch "OK". 660: Diagnosis Menu screen 661: System Check screen (DTC code
verification screen) 662: GPS Information screen.
4. The diagnostics screen will be displayed.

PINPOINT TEST A : POOR SATELLITE RECEPTION www.JagDocs.com