RangeRovers.net Forum banner

1 - 16 of 16 Posts

·
Registered
Joined
·
4 Posts
Discussion Starter #1
Hi so Iv had my rr p38 4.6 sitting for a long time, with a dead battery and the engine is disabled, when I turn the key in the ignition it says engine disabled press button. The central locking doesn’t work when I press the button, but turning it in the drivers lock opens all the door. I tried taking the battery off then putting the code in but it doesn’t accept it, also the alarm doesn’t go off like it used to when the key became un synced in the past. Any ideas?
 

·
Registered
1995-2002 Range Rover P38A
Joined
·
417 Posts
My alarm stopped sounding when the little unit on the end of the speaker(under fusebox) came loose, I simply screwed the unit tighter together and now it sounds again.
 

·
Super Moderator
Joined
·
2,084 Posts
As the fob has lost sync with the car, you need to enter the EKA using the key in the drivers door lock.
 

·
Registered
Joined
·
4 Posts
Discussion Starter #4
As the fob has lost sync with the car, you need to enter the EKA using the key in the drivers door lock.
Iv tried that but on the dash it doesn’t say to do that it just says engine disabled press button, the central locking works still but only when turning the key in the lock, where as last time it became Un synced only the drivers door would open and the alarm would go off, but now the alarm doesn’t go off and all the doors open with a turn of the key
 

·
Registered
Joined
·
4 Posts
Discussion Starter #5
My alarm stopped sounding when the little unit on the end of the speaker(under fusebox) came loose, I simply screwed the unit tighter together and now it sounds again.
I’ll have a look at that thanks
 

·
LEGACY VENDOR
1995-2002 Range Rover P38A
Joined
·
4,198 Posts
It sounds like it's in a bit of a 'limbo' state - the immobiliser isn't turning off like it should do, but the alarm isn't going off either to trigger it to need the EKA.

There are a couple of things that could be done - 1) if you have access to diagnostics, then you can turn the passive immobiliser or the EKA off, and this should sort it, or if you don't, you could try to 'force' it to need the EKA - I've done it a couple of times in the past before where I've wound a window down, locked the vehicle with the key in the door, and then unlocked it with the sill button and opened the door to trigger the alarm manually... It's then wanted the EKA, and after putting that in, it's behaved.

One thing I would do before trying that though is to test the microswitches in the door latch - if your key switch has failed, then it will lock/unlock all the doors, but it won't set/disarm the alarm/immobiliser as it hasn't detected being locked/unlocked with the key in the door. Definitely check this first, BEFORE trying to set the alarm off/enter EKA though - otherwise you'll just make things worse!

If that still doesn't work, then it might be a case of having to remove the BECM and send it to someone like myself who has the diagnostics gear to bypass the security features by talking directly to the CPU and switching off the passive immobiliser/EKA and then resetting any lockouts to get it back to a happy place.

Marty
 

·
Registered
Joined
·
4 Posts
Discussion Starter #7
It sounds like it's in a bit of a 'limbo' state - the immobiliser isn't turning off like it should do, but the alarm isn't going off either to trigger it to need the EKA.

There are a couple of things that could be done - 1) if you have access to diagnostics, then you can turn the passive immobiliser or the EKA off, and this should sort it, or if you don't, you could try to 'force' it to need the EKA - I've done it a couple of times in the past before where I've wound a window down, locked the vehicle with the key in the door, and then unlocked it with the sill button and opened the door to trigger the alarm manually... It's then wanted the EKA, and after putting that in, it's behaved.

One thing I would do before trying that though is to test the microswitches in the door latch - if your key switch has failed, then it will lock/unlock all the doors, but it won't set/disarm the alarm/immobiliser as it hasn't detected being locked/unlocked with the key in the door. Definitely check this first, BEFORE trying to set the alarm off/enter EKA though - otherwise you'll just make things worse!

If that still doesn't work, then it might be a case of having to remove the BECM and send it to someone like myself who has the diagnostics gear to bypass the security features by talking directly to the CPU and switching off the passive immobiliser/EKA and then resetting any lockouts to get it back to a happy place.

Marty
It sounds like it's in a bit of a 'limbo' state - the immobiliser isn't turning off like it should do, but the alarm isn't going off either to trigger it to need the EKA.

There are a couple of things that could be done - 1) if you have access to diagnostics, then you can turn the passive immobiliser or the EKA off, and this should sort it, or if you don't, you could try to 'force' it to need the EKA - I've done it a couple of times in the past before where I've wound a window down, locked the vehicle with the key in the door, and then unlocked it with the sill button and opened the door to trigger the alarm manually... It's then wanted the EKA, and after putting that in, it's behaved.

One thing I would do before trying that though is to test the microswitches in the door latch - if your key switch has failed, then it will lock/unlock all the doors, but it won't set/disarm the alarm/immobiliser as it hasn't detected being locked/unlocked with the key in the door. Definitely check this first, BEFORE trying to set the alarm off/enter EKA though - otherwise you'll just make things worse!

If that still doesn't work, then it might be a case of having to remove the BECM and send it to someone like myself who has the diagnostics gear to bypass the security features by talking directly to the CPU and switching off the passive immobiliser/EKA and then resetting any lockouts to get it back to a happy place.

Marty
Had a go and trying to force the alarm but no joy, the red light on the top of the dash near the window is never lit. How much would it cost for you to look at becm?
I do have another p38 can you swap becm over as I need to get the car moved soon
 

·
LEGACY VENDOR
1995-2002 Range Rover P38A
Joined
·
4,198 Posts
Had a go and trying to force the alarm but no joy, the red light on the top of the dash near the window is never lit. How much would it cost for you to look at becm?
I do have another p38 can you swap becm over as I need to get the car moved soon
I've sent you a PM with some more details etc.

Regarding swapping BECM - I wouldn't recommend it - it has to be set up the same as your current vehicle for it to work properly, and it's very easy to mess things like mileages up on the dash, which then causes other headaches.

If it's a case of just having to get it moved and the BECM is set up properly, then you can do it - but I'd use it as a last resort. My turnaround time for BECM services is usually 24-48 hours from when it gets here - I try to prioritize them, as obviously the vehicle isn't much use without it!

Marty
 

·
Registered
1995-2002 Range Rover P38A
Joined
·
134 Posts
The BeCM swap isn't all that bad. You just need to swap the ECU and instrument cluster along with it. Which is a trivial amount of additional effort, since 80% of the work is in swapping the BeCM. If the year and trim level of your truck and the donor is the same, things will pretty much work.

You will need use the key to open the truck if you swap the BeCM+ECU+Instrument Cluster. I am not sure whether the remote will work.
 

·
LEGACY VENDOR
1995-2002 Range Rover P38A
Joined
·
4,198 Posts
The remote from the original vehicle won't work, but it would from the replacement vehicle's BECM - but the key blade would be the one from the original vehicle.

You can do the swap, if you have the ECU and all that aswell, but if it isn't set up the same, or you just have the BECM and not the engine ECU, then you would need it on diagnostics to resync.

I far prefer to sort the original issues out than just swap things out and call it done, as in my experience, people don't make note of what's been swapped, or even things like VIN numbers of vehicle's its come from etc. Yes, it's fine if you just need to get it moved, but given the number of headaches that I've had from vehicles where it's brought to me, and THEN you find the BECM isn't original.

My favourite is the owner treating themselves to a brand new key fob, and then finding it doesn't work because the BECM has been swapped at some point in the past, with no paperwork, and now they have a new key fob they can't use. (though I know have the tools to read the ID of a key fob and program it back to the BECM to make it usable)

I'm not saying don't swap parts out - especially if you are somewhere where there isn't anyone who can reset lockouts etc on the original unit, but just aware that it can come back to bite!
 

·
Registered
1995-2002 Range Rover P38A
Joined
·
134 Posts
Is there a VATS bypass available for Thor engines?

I am wondering if any information on the ECU <-> BECM serial link is available? I am seriously tempted to grab one of these devices https://en.wikipedia.org/wiki/ESP32 and make it into an immobilizer that can be locked and unlocked using a cell phone with bluetooth. I am seriously sick and tired of hearing stories of this BeCM immobilization silliness.
 

·
LEGACY VENDOR
1995-2002 Range Rover P38A
Joined
·
4,198 Posts
There isn't an immobiliser bypass for the Thor engines as far as I know, or the EDC diesel (which is also a Bosch system). I'm sure it could be done though, but there isn't any information about that I have seen as to how it's transmitted.

There is only one wire from the BECM to the engine ECU for the immobiliser code to be sent down, so it must be some kind of digital transmission.

The later BECMs seem to be far better when it comes to just randomly losing sync. Most immobiliser issues come from the fact that people ignore warning signs like jumping door latches, don't have a working remote (not strictly necessary, but then you are relying on the microswitches in the door latch to be working properly), or they have battery drain issues, and the vehicle goes into lockout whilst it's locked/alarmed - which seems to cause the most issues.

Turning the passive immobiliser off solves a lot of headaches, as it's the bit that re-immobilises the vehicle after a time out period. It's supposed to automatically allow starting again once the key fob is put in the ignition, but that requires a working/synced key fob to make that happen. Turning that off still means the vehicle is immobilised when it's locked/alarmed, but stops it from getting into the 'limbo' state the OP seems to have, when you don't have a working fob.

I turned mine off as even though I have a pair of working fobs, the coil around the ignition was damaged on my RR, so whilst it would immobilise, and I could press the unlock button on the fob again to get it going, it wouldn't do it automatically. I also got sick of coming out of the house, unlocking the car, putting stuff in the boot, and then having to press unlock again every time to start it. The idea of the passive immobilisation is great, but in reality for a system that uses a transmitted rolling code, rather than a transponder which activates in proximity to the dash - it can be a source of the odd headache.

Still, it's not BAD technology considering it was developed in the early '90s - and whilst people do sometimes have issues with it, a lot of that comes from either not understanding how the system works (and not caring - they just want an answer, rather than to understand what they have), or as I mentioned earlier, ignoring signs that something is amiss to begin with, and then heading to forums/social media groups etc once it's actually stopped them from starting it.

Back to your question though - I am sure that a decent logic analyser would be able to read something of what the BECM sends to the engine ECU... the only thing you would have to watch for is that it's 12V logic signals sent between them, and most logic analysers are only up to 5/5.5V inputs, so you would either need one that will allow up to 12V on the input, or do some level-shifting first.
 

·
Registered
1995-2002 Range Rover P38A
Joined
·
134 Posts
There isn't an immobiliser bypass for the Thor engines as far as I know, or the EDC diesel (which is also a Bosch system). I'm sure it could be done though, but there isn't any information about that I have seen as to how it's transmitted.

There is only one wire from the BECM to the engine ECU for the immobiliser code to be sent down, so it must be some kind of digital transmission.

The later BECMs seem to be far better when it comes to just randomly losing sync. Most immobiliser issues come from the fact that people ignore warning signs like jumping door latches, don't have a working remote (not strictly necessary, but then you are relying on the microswitches in the door latch to be working properly), or they have battery drain issues, and the vehicle goes into lockout whilst it's locked/alarmed - which seems to cause the most issues.

Turning the passive immobiliser off solves a lot of headaches, as it's the bit that re-immobilises the vehicle after a time out period. It's supposed to automatically allow starting again once the key fob is put in the ignition, but that requires a working/synced key fob to make that happen. Turning that off still means the vehicle is immobilised when it's locked/alarmed, but stops it from getting into the 'limbo' state the OP seems to have, when you don't have a working fob.

I turned mine off as even though I have a pair of working fobs, the coil around the ignition was damaged on my RR, so whilst it would immobilise, and I could press the unlock button on the fob again to get it going, it wouldn't do it automatically. I also got sick of coming out of the house, unlocking the car, putting stuff in the boot, and then having to press unlock again every time to start it. The idea of the passive immobilisation is great, but in reality for a system that uses a transmitted rolling code, rather than a transponder which activates in proximity to the dash - it can be a source of the odd headache.

Still, it's not BAD technology considering it was developed in the early '90s - and whilst people do sometimes have issues with it, a lot of that comes from either not understanding how the system works (and not caring - they just want an answer, rather than to understand what they have), or as I mentioned earlier, ignoring signs that something is amiss to begin with, and then heading to forums/social media groups etc once it's actually stopped them from starting it.

Back to your question though - I am sure that a decent logic analyser would be able to read something of what the BECM sends to the engine ECU... the only thing you would have to watch for is that it's 12V logic signals sent between them, and most logic analysers are only up to 5/5.5V inputs, so you would either need one that will allow up to 12V on the input, or do some level-shifting first.
Thank you very much for sharing the wealth of technical knowledge about the P38 electronics, I really appreciate it. Do you know whether Disco II uses the same or different protocol for mobilization? The Valeo BCU seems to be a lot less troublesome on the Disco, which also uses Thor engine. The ECUs out of a Disco II are a dime a dozen, I am wondering if the ECUs are interchangeable between P38 and Disco, and if not whether they are plug-compatible or not?

If the ECUs were plug-compatible, one could simply swap the ECU from a Disco II and rig a minimal amount of wiring between Disco II Valeo BCU and disco ECU. I have a Disco II that I got for free (runs but needs work, probably a parts truck). I am wondering if a simple solution to immobilization woes could be in a Disco BCU. I am not going to worry about calibration differences that may or may not be even there. Motronic 5.2 has enough adaptation abilities built into it. You can run a 4.0 engine with an ECU programmed for 4.6 and it actually runs better. As does the 4.0 engine with a 4.6 camshaft :)
 

·
LEGACY VENDOR
1995-2002 Range Rover P38A
Joined
·
4,198 Posts
The Disco2, I believe probably uses the same as the P38 does with regards to the signal type that it's fed. However, from memory, the D2 ECU has a security learn feature, where you can tell it to learn the next code that comes in as being the one that is valid for it (in the case off lost sync for example). On the P38, the immobiliser code is hard-coded into the ECU and this then has to be read from the ECU memory and programmed into the BECM to tell it what to transmit.

The Disco is the other way around - the code is obviously written into the BCU, and the ECU is told to learn whatever it's being sent.

I am not sure if they are plug-compatible or not - or whether the programmed fuel maps are different - though the later Thor engine is the same - I don't know if there are subtle differences in how they are managed by the ECU, but I'm sure it would run. If it does end up running out of adaptation, then they just start to run like a sack of spanners - mine got to that point with a bad MAF sensor, and then again with bad O2 sensors, but in theory, yeah it should work.

You could then in theory just tell the ECU to learn whatever code the BECM is sending - but either way, something would have to send it some form of code.

It's a bit like the keys on the P38 vs Disco2 - as far as I know, they use the same rolling code idea, but the disco keys come programmed with a code, and you then train the BCU to learn up to 4 key codes. The P38 on the other hand has a 'lockset' - group of 4 possible fobs that it will accept, and the the fob has to be programmed correctly to the code that the BECM will accept. Which is why if the BECM has been changed with no information about it and you order a new key to the original VIN, it won't work - as the BECM that's now in there is programmed to accept a different bunch of fobs.
 

·
Read Only
1995-2002 Range Rover P38A
Joined
·
17 Posts
The BeCM has an internal fault where the two circuit boards can come loose and short out. A bolt comes loose. If you take out the unit and send it for a check, that can save you fortune and a load of trouble and money later.
If you get a replacement unit it needs to be reset to no data, then you need the specialist computer system with your VIN number to reprogram the unit. If you try any other route you can find nothing working properly from the engine to the rear view mirror system. I just went through all this the expensive way.
 

·
LEGACY VENDOR
1995-2002 Range Rover P38A
Joined
·
4,198 Posts
The BeCM has an internal fault where the two circuit boards can come loose and short out. A bolt comes loose. If you take out the unit and send it for a check, that can save you fortune and a load of trouble and money later.
If you get a replacement unit it needs to be reset to no data, then you need the specialist computer system with your VIN number to reprogram the unit. If you try any other route you can find nothing working properly from the engine to the rear view mirror system. I just went through all this the expensive way.
If your BECM has shorted because the board(s) are loose then that's not an internal fault, that's someone cutting corners and not putting it back together properly.

In a correctly assembled BECM, the logic board is held to the bottom of the case with 7 screws, and then when the lid is on the unit, there's about 11 screws that bolt into the heatsinks on the power board and secure it to the metal lid... So there should be NO way the boards can move and short together.
 
1 - 16 of 16 Posts
Top