P38 Security/Alarm System Operation & Diagnosis
Main System Components
Central Locking and Alarm Arming
Unlocking, Disarming and Remobilization
Remote Handset Synchronization
EKA (Emergency Key Access)
Alternative "Key in Position II" Disarming Procedure
Security System Fault Diagnosis
The designers of the Range Rover 4.0/4.6/P38A went overboard in the alarm and security department, presumably thinking that thieves would be keen on stealing such an expensive vehicle. Little did they realize that it would be one of the fastest depreciating vehicles ever, and the alarm system would merely be another electrical headache for owners. I have heard horror stories even about quite new Range Rovers being immobilized for weeks in the shop with alarm system problems. This page is an attempt to summarize accumulated owner knowledge on how the system operates, what the most common failures are and how to recover from them. Because the security system is so abominably complex and obscure, a better understanding of how it is supposed to operate should make fault diagnosis much easier.
Main System Components
Central Locking and Alarm ArmingCentral locking of all the doors can be done several different ways:
In cases 2 through 6 above, the alarm is armed to the "perimetric" mode in which it will be set off by opening any door, window, the rear hatch or the hood/bonnet. Engine cranking is disabled and and electronic engine immobilization is activated (more on this below).
In case 7, the "superlocking" mode energises an additional motor in each door lock actuator which disconnects the sill locking buttons so they cannot be used (e.g., by a burglar) for unlocking. If superlocking was done by the remote, and the windows and sunroof are closed, the ultrasonic volumetric alarm will also be activated. (If done by the key, a press on the remote locking button is still required before the volumetric alarm will be activated). In this mode, the alarm will be set off if any movement of a person or animal is detected inside the vehicle.
Whenever the alarm system is armed (or, on 1996 and later models when passive immobilization is enabled -- see below -- when the ignition key is removed), the engine is immobilized. In this state, the Engine Control Module (ECM) will not operate normally unless it receives a mobilization code from the BeCM. Furthermore, if some clever thief jumpers the starter solenoid and manages to turn the engine over, it will do no good because a crank signal is detected by the engine ECM (via the engine crank sensor which is normally used to time the ignition and determine engine speed). This information is sent to the BeCM which puts an "ENGINE DISABLED" signal on the message center on the dash and continues to make it impossible to start the engine.
On 1996 and later models (UK, Europe? and some other markets,
but not North America or Australia), the
system was "improved" by adding a so-called "passive
immobilization" feature (enabled in North America and some other
markets) that activates engine immobilization whenever the key is
from the ignition, regardless of whether or not the vehicle is
subsequently locked or the theft alarm armed. A "passive
immobilization coil" was added around the barrel of the ignition switch
to trigger a code from the remote handset when it is inserted in the
ignition, enabling remobilization (see remobilization section below).
Presumably the theory behind this "improvement" is that a thief cannot
start the vehicle even if you forgot to lock it and he can turn the
ignition switch on without a key. (NOTE: This wonderful feature also
requires you to leave the key in the ignition when changing the battery
to avoid immobilization. See Battery
above right by Ron Beckett, showing ignition switch barrel on a 1995
model, with no passive immobilization coil but with "key in" switch and
wiring clearly visible. Cobwebs are due to this photo being taken in a
partially dismantled vehicle at a wrecker's yard.
Unlocking, Disarming and Remobilization
The theft alarm is disarmed by pressing the unlocking button on the remote. The RF receiver located in the right hand side of the loadspace conveys this signal to the BeCm which decodes it and, if the code is correct, unlocks the doors and disarms the alarm. On 1995 models, the vehicle is then in an unarmed state.On 1996 and later models with passive immobilization enabled (UK, Europe? but not North America or Australia), if the key is not inserted into the ignition within 30 seconds of unlocking with the remote handset or EKA procedure (see below), the BeCM reverts to the immobilized condition. The engine remains immobilized until the remote/key is inserted into the ignition, closing the "key in" switch and activating a "Passive Immobilization Coil" (Z270) around the barrel of the the ignition switch. The electromagnetic field from this coil excites a receiving coil in the remote key handset. If the remote is acting normally (for example, does not have a dead battery), it will then transmit a mobilization signal to the BeCM via the RF receiver. The BeCM then disarms the vehicle and remobilizes the engine.
On all models, when the unarmed state has been achieved, the BeCM transmits a mobilisation code to the engine ECM commencing 48 milliseconds after the ignition is turned on, and until it receives a confirmation signal from the ECM telling it to illuminate the "Check Engine" light (as an indication of correct operation) and allows engine cranking when requested. In turn, the ECM enables engine fuelling and proceeds to allow all engine controls to act normally.
Remote Handset Synchronization and Desynchronization
The remote handset uses a "rolling code" algorithm, meaning the code is changed every time remote locking or unlocking is performed. The BeCM stores the code sequence in its RAM and has a capture range of 100 codes after the previously received value, so should be able to remain synchronized with the handset unless more than 100 attempts have been made to operate the remote while out of range, or the remote's batteries are removed or die, or the vehicle's battery dies or is disconnected. That is the theory -- in real life it seems to lose synchronization more often, such as when the vehicle's RF receiver has been activated by other spurious sources of 315 MHz (or 433 MHz in other markets) transmissions.
Resynchronization is accomplished by performing a key lock or unlock within 30 seconds of requesting a remote lock, superlock, or unlock. The BeCM senses the change in state of the "CDL" (Central Door Locking) switch in the driver's door to initiate resynchronization.
On 1997 and later models (all markets?), "friendly synchronization" is provided whenever the key/remote is inserted into the ignition. The passive immobilization coil around the ignition barrel activates a pickup coil in the remote, causing the remote to transmit an unlock signal to remobilize the vehicle.
Resynchronization Exception Mystery:
The driver's handbook, shop manual and ETM all contradict their own instructions on resynchronization, stating that it cannot be achieved by the above procedures if the vehicle security system is "active" (Shop manual) or "armed" (driver's handbook). In this case, you have to resynchronize by the Emergency Key Access method (see below). These instructions do not make sense to me, since the alarm is nearly always armed if the vehicle is locked. Perhaps it means if the remote is desynchronized and the alarm has meanwhile been set off somehow, the EKA procedure has to be used for resynchronization. Or, perhaps the exception refers to when some malfunction is present. In any case, probably the best method of resynchronization is to first unlock the vehicle with the key so the alarm will be disarmed (if everything else is working right), then perform the synchronization routine.
Overview and Instructions
The EKA procedure is provided as a back-up method of disarming the alarm and re-mobilizing the vehicle if all else fails. (For another equally good if not better method see the "Key in Position II" procedure below). It uses a series of locks and unlocks with the key in the driver's door lock cylinder. From owner reports to date, this feature seems to be enabled on 1996 and later models in Europe, but not North America or Australia -- but see below for a generic EKA code procedure that works in North America.
The manuals are vague and contradictory on when EKA might be necessary -- the shop manual says it is if you lock the vehicle with the remote handset and then you lose the remote or it fails. (This is understandable on models with passive immobilization which cannot be started without the remote, but the manuals are enigmatic on why this could happen on vehicles without passive immobilization). You still need the key part of the remote, or one of the spare mechanical keys supplied in later model years.
According to the manual, if the remote has failed or been lost and you try to open the door with just the mechanical key, the alarm will sound twice. (Of course, this does not make sense because you should be able to get into all models quite satisfactorily with just the mechanical key. Perhaps they are referring to situations when the remote has malfunctioned in a way that upsets the BeCM, or the alarm has been set off for some reason). If you then try to start the car, the message center will display "ENGINE DISABLED PRESS REMOTE OR USE KEY CODE". (This part makes sense on vehicles with passive immobilization, as described above, or perhaps if the alarm has been activated).
Make sure the doors, windows and bonnet/hood are closed, get out and lock the car again with the key. (Note: on 1996 and later models, you have to turn the key to the lock position four times for this step if the remote handset was not used to lock the vehicle). Then turn the key the required number of times according to the following sequence. (At each step the side lamps warning light on the dash will light to show it has recognized the input).
Turn the key to the unlock position to unlock the doors. The alarm will now be partially disarmed; if you try to open the hood the alarm will sound. After five incorrect attempts (3 for 1996 and later models) at this procedure, the BeCM goes into a 10 minute lockout mode (30 minutes for 1996 and later models), during which time the message center displays "KEY CODE LOCKOUT" and further attempts at EKA will not work.The EKA code is supposed to be on your "security card" but I don't have one for my vehicle and Staffan Tjernstrom, who first alerted us to this information, mentions that getting it probably involves knowing your dealer very well, and maybe a few pints of good beer! Alex Rudd informs me that he has used the EKA method to recover from alarm problems, and that in the UK you can present or fax your owner's log book (or email a photo of it) to a Range Rover dealer to prove ownership, and they will give you the code.
Security System Fault Diagnosis
"ALARM FAULT" Message:
The most common cause of the "ALARM FAULT" message being displayed on the Message Center is failure of the ultrasonic sensor (located above and to the side of the driver's head) which monitors the interior of the vehicle for intruders. The BeCM does a check on this sensor every time you switch the engine off and get out. If it does not work 5 consecutive times it generates the fault message when you have tried to activate it by superlocking the vehicle. Replacement of the sensor is simple, but the problem can also be caused by a bad connection. The Ultrasonic Sensor Repair page gives more details on how to diagnose and solve these problems.
"ENGINE DISABLED" Message:
This is displayed if an attempt is made to crank the engine (e.g., by jumpering the starter solenoid) while the alarm is armed or passive immobilization is in effect. Try pressing the unlock button on the remote; if this does not work you will have to use the EKA procedure.
"ENGINE DISABLED PRESS REMOTE OR USE KEY CODE" Message:
This message can mean you have tried to start a vehicle that has passive immobilization (e.g., 1996 and later North American models) with a malfunctioning remote or a dead remote battery. Or for some other reason when you are trying to start the engine, the alarm system is still armed or is in a bad mood. The solution is to try the EKA procedure.
"KEY CODE LOCKOUT" Message:
This means you have made several wrong attempts to use the EKA procedure to remobilize the vehicle; wait 10 minutes (30 minutes for 1996 and later models) and try again; meanwhile carefully check the procedure and call your friendly Land Rover dealer to make sure you have the correct security code for your vehicle VIN.
False "IGNITION KEY IN" Message and inability to lock using
If you keep getting the "IGNITION KEY IN" message when the key is not in, the BeCM thinks the key is in the ignition and is thoughtful enough not to let you remote lock the vehicle in case you lock your keys in. The microswitch that detects whether the key is in is probably staying in the "in" state because of the center of the lock barrel being a bit sticky. Often, just pushing on the center of the lock barrel will cause it to pop out, fixing the problem. Otherwise, just try reinserting the key and wiggling it in and out a bit to free up the mechanism. Alterenatively, you might try puffing (with an applicator) graphite powder into the lock. Usually it will free itself up -- this is much cheaper than buying a new lock!!
Inability to Disarm Alarm due to Failed, Lost or
The security/central locking portion of the shop manual describes a process (known as "Emergency Key Access" or EKA) for disarming the theft alarm and remobilizing the vehicle in the event that the handset fails while the vehicle is in superlocked mode. Each vehicle has a four digit EKA code which is needed for the procedure. The code is entered by turning the key the required number of times in the driver's door lock according to a prescribed sequence. For detailed information on this and the recovery procedure see the EKA Procedure section above. It might be worth a try if you are having alarm troubles.
Vehicle Battery Death While Vehicle Locked or Superlocked:
If you leave the headlights on or for some other reason the battery dies while your vehicle is locked or superlocked, strange things happen to the alarm system.
This seems to be one of the conditions that sometimes upsets the security system and requires you to use the Emergency Key Access method (see key/remote problems) to "reboot".
Another is when you jumper the battery to start the car, you can easily get locked out. When the power comes back on, the BeCM seems to try to return the vehicle to the locked state. At least one owner has reported that after gaining entry to his dead car with the manual key unlock, he put the key in the ignition and then went out and hooked up the battery jumper cables. Immediately, the vehicle locked him out. If all your keys are inside the vehicle at this point the situation is fairly bleak. So DON'T leave your keys in the vehicle if you get out. If you absolutely have to, at least leave the door or window open.
"Remote Battery Low" Message:
When you get the "Remote Battery Low" signal on the message display, take heed and renew the battery, especially if yours is a 1996 or later model with passive immobilization. On these models, if the battery dies entirely, the remote will not be able to transmit the code to the ECU to remobilize the vehicle and allow starting. (See procedure below under "weak reception from remote handset" before you give up though).
For battery replacement procedure see Key/Remote Problems and Solutions Page
Unexplained Battery Drain:
Several owners have complained of unexplained battery drain when parked in certain areas like airports where a lot of RF energy is present, or in large parking lots where other vehicles with remote locking systems come and go. The problem is that the radio interference (and/or radio frequency energy from other peoples' remote locking handsets) gets received by the RF receiver which "wakes up" the BeCM from sleep mode, increasing its current drain to about one amp instead of a few milliamps. Paul Jameson of Avon Diagnostics reports that all remotes use the same frequency, and the Range Rover system does not bother to determine whether the code contained in the RF signal is a Range Rover one before waking up the BeCM. The battery can easily be dead after a few days of this. Meanwhile Jeffrey Upton came up with his own solution (he lives near Logan Airport in Boston and suffered this problem frequently). He disconnected the leads between the window RF antenna and the receiver. In this condition the remote still works fine as long as you are within a couple of feet of the vehicle, but the effect of external radio interference is eliminated! Andrew Walne came up with an even better idea -- installing a switch to control the RF receiver. See much more info on mysterious battery drain and Andy's cure on the Mysterious Battery Drain Page.
Reception from Remote Handset:
As the battery in the remote handset dies the signal it produces will become weaker. If you want or need to use the remote habdset (eg to disable the alarm) when teh barttery is weak, it is worth knowing that the antenna for the RF receiver is at the front of the right rear querter window glass. Holding the remote close to this location or even against the glass will increase your chances of successful operation.
If you have corrections, comments or suggestions, email us.
Page revised February 2, 2012