Overview - SKREEM SKIM (SKIS) and RKE Starting Difference?

Aqua Puttana

Poly - Thread Finder
Overview - SKREEM SKIM (SKIS) and RKE Starting Difference?

****************
Added:
Scroll down to post #21 for Information/Possible Solutions for Start Error
.
****************
This fuse isn't called out on the fuse maps.
Under the seat the top horizontal fuse is SKREEM related.

https://sprinter-source.com/forums/showthread.php?t=24683

vic
This isn't in-depth and radical. I have noticed per the Service Manual that the operation of the chipped key recognition seems to have some difference between the standard and key FOB remote option. I've been searching for some CAN bus or other commonality for the Start Error response and just noticed this during the search.

SKREEM - SENTRY KEY REMOTE ENTRY MODULE

aka Sentry Key Immobilizer System (SKIS)

The SKREEM module can contain dual function. Without the remote keyless entry option the SKREEM has the chipped key recognition capability only. With the remote key FOB option the SKREEM contains both the chipped key recognition and the RKE remote system.

I'll include this overview information for review before discussing the possible start sequence response difference.

84, 87 - 94

084CanBusExchgSKREEM.jpg

Note that there are differences in the "Start Error" response.
The RKE Keyless FOB will crank and stall within 2 seconds.
The SKIM standard unit remains immobilized and not crank at all.


087Skreem5.jpg

088Skreem5.jpg

089SkreemKeyFob5.jpg

090SkreemBlockDiag5.jpg
 
Last edited:

Aqua Puttana

Poly - Thread Finder
(Cont.)

091SkreemOperationNotesSm.jpg

092SkreemSkim5.jpg

093SkreemAnt5.jpg

094SkreemRKE5.jpg

SKREEM is not listed in the index of my service manual. The description and service information is found in section 8Q Vehicle Theft Security.

8Q-2

SENTRY KEY IMMOBILIZER

The Sentry Key Immobilizer System (SKIS)
authenticates an electronically coded Transponder
Key placed into the ignition and sends a valid/invalid
key message to the Engine Control Module (ECM)
based upon the results. The “VALID/INVALID KEY”
message communication is performed using a rolling
code algorithm. A “VALID KEY” message must be
sent to the ECM within two seconds of ignition ON
to free the engine from immobilization.
This Controller
Area Network (CAN) data bus message is sent to
the ECM after first going through the SKREEM. The
SKREEM is located behind the instrument cluster
and has a separately mounted antenna ring mounted
around the ignition cylinder (Fig. 3) which picks up
the transponder key signal.

8Q-3

OPERATION
SENTRY KEY IMMOBILIZER


The Sentry Key Remote Entry Module (SKREEM)
receives an encrypted Radio Frequency (RF) signal
from the transponder key which is read by the
remotely mounted antenna ring at the ignition cylinder.
The SKREEM then decrypts the signal and
broadcasts the requested remote commands to the
appropriate modules
[CTM included] in the vehicle over the Controller
Area Network (CAN) data bus. A valid transponder
key ID must be incorporated into the RF signal
in order for the SKREEM to pass the message on to
the appropriate modules.

Automatic transponder key synchronization is done
by the SKREEM if a valid transponder key is
inserted into the ignition cylinder, and the ignition is
turned ON. This provides a maximum operation window
for RKE functions.

Each Sentry Key Remote Entry System (SKREES)
consists of a SKREEM, an antenna ring mounted
around the ignition cylinder, and a transponder key.
Each system has a secret key code unique to that
system. The secret key is electronically coded in the
SKREEM and in all programmed transponder keys.
It is used for immobilization and RKE functions for
data security. In addition, each transponder key will
have a unique identification.

REMOTE KEYLESS ENTRY Operation

After pressing the lock button on the RKE transmitter,
all of the door locks will lock, the illuminated
entry will turn off (providing all doors are closed),
and the VTSS (if equipped) will arm. After pressing
the unlock button, on the RKE transmitter, one time,
the driver door lock will unlock, the illuminated
entry will turn on the courtesy lamps, and the VTSS
(if equipped) will disarm. After pressing the unlock
button a second time, the remaining door locks will
unlock.

The SKREEM is capable of retaining up to 8 individual
access codes (8 transmitters). If the PRNDL is
in any position except park, the SKREEM will disable
the RKE. Use a diagnostic scan tool or the customer
programming method to program the RKE
system. However, the SKREEM will only allow RKE
programming when the ignition is in the ON position,
the PRNDL is in park position, and the VTSS
(if equipped) is disarmed.

8Q-5

TRANSPONDER KEY (Remote Key FOB)

OPERATION

Each Sentry Key has a unique transponder identification
code permanently programmed into it by the
manufacturer. Likewise, the Sentry Key Remote
Entry Module (SKREEM) has a unique “Secret Key9
code programmed into it by the manufacturer as
well. When a Sentry Key is programmed into the
memory of the SKREEM, the SKREEM stores the
transponder identification code from the Sentry Key,
and the Sentry Key learns the “Secret Key” code
from the SKREEM. Once the Sentry Key learns the
“Secret Key” code of the SKREEM, it is also permanently
programmed into the transponder’s memory.
The Sentry Key’s transponder is within the range
of the SKREEM’s transponder ring when it is
inserted into the ignition lock cylinder. When the
ignition switch is turned to the ON position, the
SKREEM communicates with the Sentry Key via a
radio frequency (RF) signal. The SKREEM determines
if a valid key is present based on the information
it receives from the Sentry Key. If a valid key is
detected, that fact is communicated to the Engine
Control Module (ECM) via the Controller Area Network
(CAN) data bus and the vehicle is allowed to
continue running. If an invalid key is received by the
ECM or no status at all is communicated, the vehicle
will stall after two (2) seconds of running.
The indicator
light will be flashing at this point.

The Sentry Key’s transponder can not be repaired. If it is faulty
or damaged, it must be replaced.
Common communication problems:
* Two transponder keys too close together.
* Speed Pass too close to transponder key.
Solid indicator that there is a system failure.
* Loss of ECM communication.
* Failed transponder ring circuit.

***********************************

My recollection of "Start Error" when I was using the broken key (no OEM remote option).

If the broken half black plastic key bow (aka handle) which contains the gray chip wasn't held in close proximity to the ignition key antenna ring I would get "Start Error" on the dash inset and the engine wouldn't crank. Cycling the ignition key off would clear the "Start Error" and immediately repositioning the black handle would allow a proper start on subsequent attempts. The "Start Error" lockout was not permanent or subject to timeout.

I interpret the description of the key FOB type RKE to say that the engine will crank and start, but then stall if the proper chip signal is not established.

I don't have the OEM remote keyless entry FOB to test the operation sequence. Some real world Start Error experience from anyone who does have the key FOB might help to confirm or deny the operation. I suppose the description, or my interpretation, could be wrong.
Edit: Nope. Not wrong. Both are correct just as the manual indicates. See post #6.

vic

Some recent related threads.


Still Skeeming..Will it ever end?
https://sprinter-source.com/forums/showthread.php?t=30881

Start Error
https://sprinter-source.com/forums/showthread.php?t=30841

SOS comment on the Skreem - Immobilizer Comment
https://sprinter-source.com/forums/showthread.php?t=30895

Immobilizer Bypass - Some good antenna pictures here.
https://sprinter-source.com/forums/showthread.php?t=10697
 
Last edited:

autostaretx

Erratic Member
Vic wrote: "I interpret the description of the key FOB type RKE to say that the engine will crank and start, but then stall if the proper chip signal is not established."

..and that is what happens. I "tested" the behavior when i created my non-chipped "mechanical" key.

It happily cranked, and (if helpful) even fires a pop or two, then dies with "Start Err" on the screen.
(2005 NAFTA T1N with RKE, but without SKIS (immobilizer))

--dick
 
Last edited:

Aqua Puttana

Poly - Thread Finder
Been thinkin'.... :hmmm:

We may be able to check the operational differences fairly easily. Tomorrow I will wrap my key handle with chip in tinfoil layers to see if I get a Start Error. Based upon how sensitive to position my broken key was, my guess is that I will get a Start Error.

I will double check that my 2004 Start Error locks out my cranking (immobilizes). That's what I remember, but... my memory can be suspect.

Perhaps someone with the RKE function option can do the same and see if the 2 second stall delay figures into the Key remote FOB scheme as described. Edit: I think Dick edited his post and I didn't notice. So RKE cranks, but either half starts or stalls.

Maybe we can make a bit more progress in understanding this beast. vic
 
Last edited:

Aqua Puttana

Poly - Thread Finder
Vic wrote: "I interpret the description of the key FOB type RKE to say that the engine will crank and start, but then stall if the proper chip input signal is not established."

..and that is what happens. I "tested" the behavior when i created my non-chipped "mechanical" key.

It happily cranked, and (if helpful) even fires a pop or two, then dies with "Start Err" on the screen.
(2005 NAFTA T1N with RKE, but without SKIS (immobilizer))

--dick
Dick,
My tinfoil signal block worked. Not the first time though. The first time I doubled the tinfoil, poked the key blade through it and folded the tinfoil back around the black plastic. Turned the key and it started as normal.

After traveling to the store I made the tinfoil into 4 layers and brought it around tightly to seal it back on itself. After that when I turned the key I got the Error message. Turned to crank, and no crank. Cycled the key off. Removed the tinfoil and start as normal.

So...
The SKIM has an immobilizer. The RKE remote FOB has a delay check and stall feature. All as the manual states.

My somewhat educated guess is that the difference is for a OEM remote start function. The RKE system allows crank (either manual or remote?) and then checks for security. If we could identify how any OEM remote start handles the security chip emulation/substitution we might be a bit further along in understanding.

Thanks goes to Dick yet again for the input and help. :thumbup:

vic

P.S. - JD Caples has returned. :thumbup::thumbup: Now where the heck is Talkinghorse43? :idunno:
 

autostaretx

Erratic Member
Just for chuckles, why not try the cranking *without* waiting for the glow plug light to go out?
(i.e. get in there before the 2 second time-out).
I fully agree with you that the RKE system probably has a different "response" than the SKIS.

--dick
 

Aqua Puttana

Poly - Thread Finder
Just for chuckles, why not try the cranking *without* waiting for the glow plug light to go out?
(i.e. get in there before the 2 second time-out).
I fully agree with you that the RKE system probably has a different "response" than the SKIS.

--dick
The engine was warm. I didn't wait at all, but I still have the tinfoil so I can try again. vic

Edit: But... remember that by turning the key we are asking the Sprinter to "PLEASE (Hal) :bow:
start my engine after you find that everything is OK to do that."

Nothing is direct. You can't really jump the gun.
 
Last edited:

Aqua Puttana

Poly - Thread Finder
A bit more information on the SKREEM operation is found in the VA Powertrain section of the Service Manual.

It appears to me that once "Start Error" has locked you out and is not recognizing your keys it might be worth clearing all the keys from memory and re-entering them. That may restore the handshake. If you can't start anyway then you have little to use.

The procedure can be tried to see if it works before sending the SKREEM, ECM, and keys out for repair.


VA Powertrain Section page 2


3.2.4 SKREEM OVERVIEW

The sentry key remote entry module system
(SKREEM) is designed to prevent unauthorized
vehicle operation. The system consists of a sentry
key remote entry module (SKREEM), ignition
key(s) equipped with a transponder chip and the
ECM. When the ignition switch is turned on, the
SKREEM interrogates the ignition key. If the ignition
key is Valid or Invalid, the SKREEM sends a
message to the ECM indicating ignition key status.
Upon receiving this message the ECM will terminate
engine operation or allow the engine to continue
to operate.

3.2.5 SKREEM ON-BOARD DIAGNOSTICS

The SKREEM has been programmed to transmit
and monitor many different coded messages as well
as CAN Bus messages. This monitoring is called
On-Board Diagnostics. Certain criteria must be met
for a DTC to be entered into SKREEM memory. The
criteria may be a range of; input voltage, CAN Bus
message or coded messages to the SKREEM. If all
the criteria for monitoring a circuit or function are
met and a fault is detected, a DTC will be stored in
the SKREEM memory and the START ERROR indicator
will be turned on in the instrument cluster.

3.2.6 SKREEM OPERATION

When ignition power is supplied to the SKREEM,
the SKREEM performs an internal self-test. After
the self-test is complete, the SKREEM energizes
the antenna (this activates the transponder chip)
and sends a challenge to the transponder chip. The
transponder chip responds to the challenge by generating
an encrypted response message.

After responding to the coded message, the transponder
sends a transponder ID message to the
SKREEM. The SKREEM compares the transponder
ID message to the available valid key codes in
SKREEM memory (8 key maximum at any one
time). After validating the ignition key the
SKREEM sends a CAN Bus message request to the
ECM, then waits for the ECM response. If the ECM
does not respond, the SKREEM will send the request
again. If the ECM does not respond again, the
SKREEM will stop sending the request and store a
trouble code in memory. If the ECM sends a correct
response to the SKREEM, the SKREEM sends a
valid/invalid key message to the ECM. The ECM
will allow or disallow engine operation based on this
message.

Secret Key - an electronically stored value (identification
number) that is unique to each SKREEM.
The secret key is stored in the SKREEM, ECM and
all ignition key transponders.

Challenge - a random number that is generated by
the SKREEM at each ignition key cycle.
The secret key and challenge are the two variables
used in the algorithm that produces the
encrypted response message. The transponder uses
the crypto algorithm to receive, decode and respond
to the message sent by the SKREEM. After responding
to the coded message, the transponder
sends a transponder ID message to the SKREEM.

3.3 DIAGNOSTIC TROUBLE CODES

Each diagnostic trouble code (DTC) is diagnosed
by following a specific procedure. The diagnostic
test procedure contains step-by-step instruction for
determining the cause of the DTC as well as no
trouble code problems. It is not necessary to perform
all of the tests in this book to diagnose an
individual code.

Always begin diagnosis by reading the DTCs
using the DRBIIIt. This will direct you to the
specific test(s) that must be performed.


3.3.1 HARD CODE

A DTC that comes back within one cycle of the
ignition key is a hard code. This means that the
problem is current every time the ECM/SKREEM
checks that circuit or function. Procedures in this
manual verify if the DTC is a hard code at the
beginning of each test. When the fault is not a hard
code, an intermittent test must be performed.

NOTE: If the DRBIIIT displays faults for
multiple components (i.e. ECT, MAF, IAT
sensors) identify and check the shared
circuits for possible problems before
continuing (i.e. sensor grounds or 5-volt
supply circuits). Refer to the appropriate
schematic to identify shared circuits.


3.3.2 INTERMITTENT CODE

A DTC that is not current every time the ECM/
SKREEM checks the circuit or function is an intermittent
code. Most intermittent DTCs are caused
by wiring or connector problems. Problems that
come and go like this are the most difficult to
diagnose; they must be looked for under specific
conditions that cause them. The following checks
may assist you in identifying a possible intermittent
problem.

– Visually inspect the related wire harness connectors.
Look for broken, bent, pushed out or
corroded terminals.

– Visually inspect the related wire harness.
Look for chafed, pierced or partially broken
wire.

– Refer to hotlines or technical service bulletins
that may apply.

NOTE: Electromagnetic (radio) interference
can cause an intermittent system
malfunction. This interference can interrupt
communication between the ignition key
transponder and the SKREEM.

There is no special equipment needed to erase and restore the RKE keys to memory.

"When a key fob or a mechanical key with transponder is lost or stolen, it is necessary to erase the affected transponder code using the diagnostic scan tool. However the process does not allow to erase only one key. All the active keys will be erased and the remaining keys (not stolen or lost) should be re-programmed. It is necessary to relearn the key(s) to the SKREEM."

What I suggest trying is to re-introduce the keys without erasing any using the RKE procedure. It may restore recognition. The DAD cannot erase or introduce new keys. I don't know whether the other Sprinter friendly tools other than a DRBIII (or MB tool) can erase/introduce keys.


093SkreemAnt5.jpg

094SkreemRKE5.jpg


:2cents: vic
 
Last edited:

Aqua Puttana

Poly - Thread Finder
I'm not posting this information here for discussion. Please start a new thread for that, or as always you can access the original thread/post by clicking the blue arrow icon within the quote box to use that thread. Any additional posts found here which are at all related to tunes will be deleted.
**********************
Keith at GDE has the ability to eliminate the SKREEM function with an ECM tune. If you're having recurring SKREEM problems this may be a solution for some people.

Thanks goes to Keith and Davisdave for the info. :thumbup:

I wanted to report back that all has been well with my GDE immobilizer elimination! I have left the CAN+/- disconnected from the SKREEM box and have not received any CELs. After over a year of intermittent starting, carrying spare ecu/skreem, and sending ecu/skreem off in the mail, I am beginning to have faith that my van will start every time:clapping:
vic
 
Last edited:

Ingineer

Always Tinkering
Supposedly these modules now available will bypass the need for the SKREEM by faking it's signal response to the ECM:



Search Google/Ebay for "CR2 IMMO".

I ordered one to try for $30. My 2004 has gone intermittent "Start Error".

-Phil
 

Aqua Puttana

Poly - Thread Finder
Supposedly these modules now available will bypass the need for the SKREEM by faking it's signal response to the ECM:



Search Google/Ebay for "CR2 IMMO".

I ordered one to try for $30. My 2004 has gone intermittent "Start Error".

-Phil
Thanks. Please let us know how complex it is to install, whether it works, and which system you have. vic
 

One call a/c

New member
So much easier to epoxy the chip from the key to the transponder ring


Howboutcha-


Added by vic:
The chip is best levered out using the Three Point Star side of the OEM key. I used a small thin blade screwdriver to slide in on the sides a bit to first loosen. I suppose that an Exacto blade could work, but they are brittle. After that I pried the chip holder up/out until I could grab it with pliers. I distorted the key plastic, but it formed back enough that the empty holder could be re-inserted. The chip holder and chip are pretty rugged so damaging them isn't a real concern.

If you epoxy the chip into place, test any chip location choice before final epoxy. My chip wouldn't work unless in specific positions. The alignment and position of the narrow end of the chip seem to be critical. Narrow end goes near the face as shown.

The sensing ring can be easily accessed by removing 2 ea. screws above the FB#1 and tipping the plastic housing down. A pair of needle nose pliers can then position and set the chip using Goop glue. Either side of the cable tombstone can be selected for the chip installation. Favor the chip being as close to the face of the ring as practical. Even if it is a bit proud, before hardening, the Goop glue will let the chip slide back a bit when the outer plastic housing cover is re-installed. Unlike epoxy, Goop glue allows easy re-positioning. Once cured it will tenaciously hold the chip into place.

Plastic handle OEM appearing un-programmed or non-chip brass keys are cheap to buy. Look for brass. I couldn't find a local locksmith to cut a steel key for me. I recommend choosing an OEM key look-a-like rather than a plain brass key. Then you will walk like a duck.

SKREEMchip01.jpg

SKREEMchip02.jpg

Steel OEM style key. It fits, but most locksmiths will not cut a steel key. I hand cut mine.
https://www.amazon.com/SODIAL-Replacement-Transmitters-Mercedes-Sprinter/dp/B01A2SNBAK

Some additional info is here.
https://sprinter-source.com/forums/showthread.php?p=605656
 
Last edited by a moderator:

Aqua Puttana

Poly - Thread Finder
A couple updates.

There is a SKREEM fuse which is under the driver seat. That 10 amp horizontal fuse does not show on my fuse map. There are 2 each ABS (CAB) horizontal fuses which aren't called out either.

This is the position of the SKREEM fuse in my 2004.

023a2004FuseBlock2PicNotes1.jpg
https://sprinter-source.com/forums/showthread.php?t=24683

The GDE tuning solution has shown to be effective for closing the open emissions checks needed for government mandated periodic inspections. I would suggest that GDE is also a good solution for any pesky SKREEM problems which can't be tracked down and corrected. SOS Diagnostics is another firm who corrects SKREEM issues.

vic
 
Last edited:

BachsCarD

New member
When using the DRB3 scantool in trouble-shooting the 'Start Error' on a 2004 T1N there are no DTC's registered.

When looking at the I-O function of the Sentry system (1) Keys 1-8 were Un-inhibited (2) Trans Msg Detect was-YES > No (3) Fixed code valid-NO (4) Counter is valid -NO (5) Transponder Detect -YES (6) Temic Transponder -YES (7) Transponder Valid -YES (8) Read Transponder Complete -YES (9) Read Transponder Inhibit -NO (10) Req Eng CTRL Mod -YES (11) ANS Been Transmit -NO (12) Start Enable -NO (13) Engine Enable -YES (14) Status Control Module -INORDER

Sensors- Num Transponder Keys -4, all key fobs have new batteries installed

I am unfamiliar with the DRB3 operation and using a borrowed unit that has no support literature so I am slowly working my way through the systems. Any help or advice would be appreciated.
 

autostaretx

Erratic Member
If you follow the procedure shown on the scanned page #94 in Vic's post #9 above, (it says "disabling a key", but it's also the way you *enable* all keys you have), you may overcome the Start Err.

It's what i'd try first...

good luck
--dick
 

Aqua Puttana

Poly - Thread Finder
The RKE/SKIS/SKREEM response for the NAS aka NAFTA 2001 - 2003 remote lock models may not be the same as the 2004 - 2006.

That wasn't the case with my 03. Has remote but would not crank & get S.E. GreenDiesel improved performance but, as stated, didn't address S.E. which I still get occasionally. One hand on emergency flasher pushing down and a couple swift blows to fuse box cover gets me going. Replaced fuse box, so evidently one of the wire connectors is amiss. :2cents:
Interesting.

Do you have an OEM remote Fob or aftermarket?

If OEM, the difference may be between the NAS aka NAFTA 2001 - 2003 Model Year (OM612) and NAS aka NAFTA 2004 - 2006 MY (OM647).

The 2004 - 2006 operations have been verified. I can't say as I recall the 2001 - 2003 showing any testing/verification results here on Sprinter-source.

Some info is here.

Overview - SKREEM SKIM (SKIS) and RKE Starting Difference?
http://www.sprinter-source.com/forum/showthread.php?t=30941

vic

Does this look like the oem? VIN: WD2YD24........
That looks OEM. So maybe earlier year SKREEM response is different.
vic
 

Aqua Puttana

Poly - Thread Finder
While messing with a clone key I learned something today. I was trying key on - off sequences to see if I could get the not yet programmed eBay clone key to work.

Once the security handshake with a properly recognized chipped key is established, that start enable will remain active for a short time.

What works.
Turn a good chipped key to the first ignition position for about 2 - 3 seconds. Without starting, turn back and remove the OEM chipped key. Quickly insert any properly cut key and start the engine.

The first time that my clone key started the engine I thought I had made it work. No dice. It actually only works after a handshake is established with an OEM key.

I have no idea if the above information has any real value.

Once a door key (with no chip) has started the engine by holding an OEM chip in close proximity, there is no reason to worry that the chip needs to be kept close. The engine will run with just the door key in place until the engine is shut down. The security handshake remains enabled until key off.

vic

Added:
I messed around a bit more today with key chips and Start Error. ON MY 2004 it seems that the sensor ring is maybe directional, or at least otherwise sensitive to the actual chip position. I had learned that when my OEM chipped key broke. With the broken stub still in the way it was difficult to position the OEM key to use my door key to start. Once I cut off the stub of the broken key I was able to get consistent start results using the door only key with the chipped OEM key plastic handle held next to/close.

It seems that unless my 2004 key chip is held in the front area of the sensing ring the results are sporadic. When the chip was held inplace favoring the rear area of the sensing ring I almost always got Start Error with my door only key.
 
Last edited:

Top Bottom