2007 KIA CARNIVAL key

2007 > 2.7L V6 GASOLINE >
REPLACEMENT
1.Disconnect the negative ( - ) battery terminal.
2. Remove the overhead console and loosen sunroof motor bracket (A) mounting bolts (4EA).
3.Remove sunroof motor mounting screw (3EA) and disconnect connector (10pin). And then remove the sun roof
motor.
RESETTING THE SUNROOF
Whenever the vehicle battery is disconnected or discharged, or you use the emergency handle to operate the sunroof,
you have to reset your sunroof system as follows :
1. Turn the ignition key to the ON position. Press and hold the TILT UP button more than 15s until the sunroof has
tilted upward/downward slightly.
2. When this is complete, Press and hold the TILT UP button once again until the sunroof has raised above and
returned to the maximum TILT UP position.
When this is complete, the sunroof system is reset.

2007 > 2.7L V6 GASOLINE >
DESCRIPTION
The immobilizer system will disable the vehicle unless the proper ignition key is used, in addition to the currently
available anti- theft systems such as car alarms, the immobilizer system aims to drastically reduce the rate of auto
theft.
1. SMARTRA type immobilizer
a. The SMARTRA system consists of a transponder located in the ignition key, an antenna coil, a SMARTRA unit,
an indicator light and the PCM(ECM).
b. The SMARTRA communicates to the PCM(ECM) (Engine Control Module) via a dedicated communications line.
Since the vehicle engine management system is able to control engine mobilization, it is the most suitable unit
to control the SMARTRA.
c. When the key is inserted in the ignition and turned to the ON position, the antenna coil sends power to the
transponder in the ignition key. The transponder then sends a coded signal back through the SMARTRA unit to
the PCM(ECM).
d. If the proper key has been used, the PCM(ECM) will energize the fuel supply system. The immobilizer indicator
light in the cluster will simultaneously come on for more than five seconds, indicating that the SMARTRA unit
has recognized the code sent by the transponder.
e. If the wrong key has been used and the code was not received or recognized by the PCM(ECM) the indicator
light will continue blinking for about five seconds until the ignition switch is turned OFF.
f. If it is necessary to rewrite the PCM(ECM) to learn a new key, the dealer needs the customer's vehicle, all its
keys and the Scan tool (pro) equipped with an immobilizer program card. Any key that is not learned during
rewriting will no longer start the engine.
g. The immobilizer system can store up to four key codes.
h. If the customer has lost his key, and cannot start the engine, contact motor service station.
COMPONENTS OPERATIONS
PCM (Power Train Control Module)
1. The PCM(ECM) carries out a check of the ignition key using a special encryption algorithm, which is programmed
into the transponder as well as the PCM(ECM) simultaneously. Only if the results are equal, the engine can be
started. The data of all transponders, which are valid for the vehicle, are stored in the PCM(ECM).

SMARTRA unit
The SMARTRA carries out communication with the built- in transponder in the ignition key. This wireless
communication runs on RF (Radio frequency of 125 kHz). The SMARTRA is mounted behind of the crush pad under
panel close to the antenna coil for RF transmission and receiving.
The RF signal from the transponder, received by the antenna coil, is converted into messages for serial
communication by the SMARTRA device. And, the received messages from the PCM(ECM) are converted into an RF
signal, which is transmitted to the transponder by the antenna.
The SMARTRA does not carry out the validity check of the transponder or the calculation of encryption algorithm. This
device is only an advanced interface, which converts the RF data flow of the transponder into serial communication to
the PCM(ECM) and vice versa.
TRANSPONDER (Built-in keys)
The transponder has an advanced encryption algorithm. During the key teaching procedure, the transponder will be
programmed with vehicle specific data. The vehicle specific data are written into the transponder memory. The write
procedure is once only; therefore, the contents of the transponder can never be modified or changed.
Antenna coil
The antenna coil (A) has the following functions.a. The antenna coil supplies energy to the transponder.
b. The antenna coil receives signal from the transponder.

2007 > 2.7L V6 GASOLINE >
DIAGNOSIS OF IMMOBILIZER FAULTS
a.Communication between the PCM(ECM) and the SMARTRA.
b. Function of the SMARTRA and the transponder.
c. Data (stored in the PCM(ECM) related to the immobilizer function.
The following table shows the assignment of immobilizer related faults to each type:
Immobilizer Related Faults Fault typesDiagnostic codes
PCM(ECM) fault a.Non- Immobilizer- EMS connected to an Immobilizer P1610
Transponder key fault a.
Transponder not in password mode
b. Transponder transport data has been changed. P1674
(Transponder status error)
Transponder key fault a.Transponder programming error P1675
(Transponder programming error)
SMARTRA fault a.Invalid message from SMARTRA to PCM(ECM) P1676
(SMARTRA message error)
SMARTRA fault a.
No response from SMARTRA
b. Antenna coil error
c. Communication line error (Open/Short etc.)
d. Invalid message from SMARTRA to PCM(ECM) P1690
(SMARTRA no response)
Antenna coil fault a.Antenna coil open/short circuit P1691
(Antenna coil error)
Immobilizer indicator lamp
fault a.
Immobilizer indicator lamp error (Cluster) P1692
(Immobilizer lamp error)
Transponder key fault a.
Corrupted data from transponder
b. More than one transponder in the magnetic field
(Antenna coil)
c. No transponder (Key without transponder) in the
magnetic field (Antenna coil) P1693
(Transponder no response error/invalid response)
PCM(ECM) fault a.
Request from PCM(ECM) is invalid
(Protocol layer violation- Invalid request, check sum
error etc.) P1694
(PCM(ECM) message error)
PCM(ECM) internal
permanent memory
(EEPROM) fault a.
PCM(ECM) internal permanent memory (EEPROM)
fault
b. Invalid write operation to permanent memory
(EEPROM) P1695
(PCM(ECM) memory error)
Invalid key fault a.
Virgin transponder at PCM(ECM) status "Learnt"Learnt
(Invalid) Transponder at PCM(ECM) status
"Learnt"(Authentication fail) P1696
(Authentication fail)
Hi - Scan fault a.Hi - Scan message error P1697
Locked by timer a.
Exceeding the maximum limit of Twice IGN ON ( ⊇ 32
times) P1699
(Twice IG ON over trial)
IMMOBILIZER (SMARTRA) DTC LIST No. Fault code Monitor strategy description GasolineDiesel
1 P1674 Transponder status error O-
2 P1675 Transponder programming error OO

2007 > 2.7L V6 GASOLINE >
TEACHING PROCEDURES
1.Key Teaching Procedure
Key teaching must be done after replacing an inoperative PCM(ECM) or when providing additional keys to the
vehicle owner.
The procedure starts with an PCM(ECM) request for vehicle specific data (PIN code: 6digits) from the tester. The
"virgin" PCM(ECM) stores the vehicle specific data and the key teaching can be started. The "learnt" PCM(ECM)
compares the vehicle specific data from the tester with the stored data. If the data are correct, the teaching can
proceed.
If incorrect vehicle specific data have been sent to the PCM(ECM) three times, the PCM(ECM) will reject the
request of key teaching for one hour. This time cannot be reduced by disconnecting the battery or any other
manipulation. After reconnecting the battery, the timer starts again for one hour.
The key teaching is done by ignition on with the key and additional tester commands. The PCM(ECM) stores the
relevant data in the EEPROM and in the transponder. Then the PCM(ECM) runs the authentication required for
confirmation of the teaching process. The successful programming is then confirmed by a message to the tester.
If the key is already known to the PCM(ECM) from a previous teaching, the authentication will be accepted and the
EEPROM data are updated. There is no changed transponder content (this is impossible for a learnt transponder).
The attempt to repeatedly teach a key, which has been taught already during the same teaching cycle, is
recognized by the PCM(ECM). This rejects the key and a message is sent to the tester.
The PCM(ECM) rejects invalid keys, which are presented for teaching. A message is sent to the tester. The key
can be invalid due to faults in the transponder or other reasons, which result from unsuccessful programming of
data. If the PCM(ECM) detects different authenticators of a transponder and an PCM(ECM), the key is considered
to be invalid.
The maximum number of taught keys is 4
If an error occurs during the Immobilizer Service Menu, the PCM(ECM) status remains unchanged and a specific
fault code is stored.
If the PCM(ECM) status and the key status do not match for teaching of keys, the tester procedure will be stopped
and a specific fault code will be stored at PCM(ECM).

(2)PCM(ECM) virgin status.
After replacing new "PCM(ECM)" scantool displays that PCM(ECM) is virgin status in Key Teaching mode.
"VIRGIN" status means that PCM(ECM) has not matched any PIN code before.

2.User Password Teaching Procedure
The user password for limp home is taught at the service station. The owner of the vehicle can select a number
with four digits.
User password teaching is only accepted by a "learnt" PCM(ECM). Before first teaching of user password to an
PCM(ECM), the status of the password is "virgin" No limp home function is possible.
The teaching is started by ignition on, with a valid key and sending the user password by tester. After successful
teaching, the status of the user password changes from "virgin" to "learnt"
The learnt user password can also be changed. This can be done if the user password status is "learnt" and the
tester sends authorization of access, either the old user password or the vehicle specific data. After correct
authorization, the PCM(ECM) requests the new user password. The status remains "learnt" and the new user
password will be valid for the next limp home mode.
If incorrect user passwords or wrong vehicle specific data have been sent to the PCM(ECM) three times, the
PCM(ECM) will reject the request to change the password for one hour. This time cannot be reduced by
disconnecting the battery or any other actions. After reconnecting the battery, the timer starts again for one hour.
(1) User password teaching

2.LIMP HOME BY IGNITION KEY
The limp home can be activated also by the ignition key. The user password can be input to the PCM(ECM) by a
special sequence of ignition on/off.
Only if the PCM(ECM) is in status "learnt" and the user password status is "learnt" and the user password is
correct, the PCM(ECM) will be unlocked for a period of time (30 sec.). The engine can be started during this time.
After the time has elapsed, engine start is not possible. After a new password has been input, the timer (30 sec.)
will start again.
After ignition off, the PCM(ECM) is locked if the timer has elapsed 8 seconds. For the next start, the input of the
user password is requested again.