Lucas 5AS Reference

Reverse-engineering notes for a Lucas 5AS immobiliser.

Sources:

• Andrew Revill
• James Portman
• Blackbox Solutions

Hardware

• MCU: Motorola MC68HC05B16 marked ZC99399CFN, Lucas 53873483, OD650J
• J1 (large connector): TE Multilock 26-pin, 174516-6
• J2 (small connector): TE Multilock 12-pin, 173851-1

Pinout

Signals marked * exist only on 98MY versions of the 5AS.

J1 — 26-pin grey connector

J2 — 12-pin white connector

Pins 2, 3 and 5 are not connected. Early 5AS units have only the grey (J1) connector.

Connection

RX/TX at 12 V logic level with inverted RX. A CH340 VAG-KKL cable works: solder the RS232 pin to VCC to invert RX.

On the MGF's OBD port the K-line pins differ from standard — 1 and 3 instead of 7 and 15 — so an adapter is needed.

Modes

1. Diagnostic mode
2. EEPROM mode

Diagnostic mode

Setup: 5-baud init with address 0x1C (replies 0x55 0x83 0x76).

Test commands

Each device has an on and an off command. The low nibble selects the device, the high nibble the action (3 = on, 2 = off): on = 0x30 | device, off = 0x20 | device.

Other commands

Key programming erases all stored keys. Press each fob's lock button ≥8 times until the horn sounds; up to 4 keys. Test the horn first with the actuator tests.

Diagnostic packet (in progress — likely more fields)

Returned in response to 0x83. Indices not listed are unknown or unused.

Indices 14 and 15 pack the input states as individual bits (0 = inactive, 1 = active). These are the same states exposed at bit 7 of indices 1–13.

Index 14 (0x0E)

Index 15 (0x0F)

Voltage byte

EEPROM mode

Setup: 5-baud init with address 0x9D (replies 0x55 0x83 0xF7).

Address spaces:

• EPROM/RAM: 0x00–0xFF
• EEPROM: 0x100–0x1FF

A command is always 4 bytes. Write size is always 1; read size is set in byte 0.

Byte 0 bitfield

Full address: (byte1 << 1) | (byte0 & 1).

EEPROM map

Offsets are positions within the EEPROM image.

Quick reference

Identification and manufacture

Alarm serial number — 0x9C and 0xC7, 3 bytes each, decimal, LSB first. The serial printed on the case-front label. Stored twice, normally identical; believed informational only. Revill's convention for re-flashed units: this unit's real serial at 0x9C, the donor template's serial at 0xC7.

MEMS ECU code — 0x3B, 2 bytes, hex, LSB first. Unique immobiliser identity sent to the MEMS ECU. Any value except 0x0000, 0xFFFF and 0xF0F0.

Week / year of manufacture — 0xCF (1 byte) and 0xD0 (2 bytes), BCD, MSB digit first. From the case label; believed informational only.

LED flash patterns (in progress — offsets may differ)

Armed at 0x92, disarmed at 0x89, 1 byte each, identical encoding. The mask ranges from permanently off, through one or more flashes per cycle, to permanently on.

Decoding:

1. Take a 7-bit counter incrementing every 8 ms (wraps after 1024 ms).
2. AND the counter with the low 7 bits of the mask.
3. If the result is zero, take the mask's high bit; otherwise its inverse.
4. That bit is the LED state — 1 = on, 0 = off.

Low battery warning

• Flash LED on unlock — 0x38 bit 2, active high. LED double-pulses for a few seconds after unlock when the fob reports low battery. A further setting is believed to control how many consecutive low-battery messages trigger it, but hasn't been located.
• Double key press — 0x38 bit 3, active high. When the fob reports low battery, its button must be pressed twice, giving the impression it's failing.

Passive arming

Enabled — 0x37 bit 6, active low. When 0, the immobiliser (not the alarm) re-engages automatically after a timeout. When 1, it never re-engages once disengaged, and this persists across power cycles.

Three timeouts apply depending on state. 0 fires immediately (it does not wrap to 256):

• No ignition — 0x21, ×1 s, 1–255 s. Unlocked, ignition never on. Default ~30 s.
• Ignition & door — 0x20, ×1 s, 1–255 s. Unlocked, ignition on then off, then driver's door opened. Default ~30 s. (No driver's-door switch on a Caterham, so this case never arises there.)
• Ignition only — 0xAD, ×8 s, 8–2040 s. Unlocked, ignition on then off. Default 75 (= 600 s / 10 min). Ticks come from a free-running 8 s clock, so N×8 s actually fires between (N−1)×8 s and N×8 s.

Locking and alarm behaviour

Superlocking — Rover deadlocking, where a double-click of the fob lock button mechanically locks out the doors. Controlled by two bits that are always inverses: 0x36 bit 2 (active low) and 0x9A bit 2 (active high). To disable, set 0x36 bit 2 = 1 and 0x9A bit 2 = 0. Both appear to be required — every unit seen with it disabled has both inverted. Irrelevant on a Caterham.

• Hazards flash with alarm — 0x36 bit 1, active low. When 0, the hazards pulse with the alarm.
• Switch closed when bonnet open — 0x3E bit 0, active high. When 1, the bonnet reads as closed when the input is open-circuit (and open when shorted to ground); when 0, the sense is inverted.