P38A Strange no-start issue, immobiliser related?

This site contains affiliate links for which LandyZone may be compensated if you make a purchase.
Its OK folks, I have a 5L can of Unleaded and a box of Swan-Vestas ready for tomorrow.
Dom' the local cab Co. is ABC and their number is 01268 556666. Have you home in no time fella! :D
 
It means the engine ecu does not need any permission from the BECM to run. Now I would consider that an immobiliser bypass.
If all the BECM security was going off including the Alarm siren you could still start it:eek:.

We really don’t know in this case what is what but things point towards it.

J
With the alarm going off the engine will not crank and if you have the message "Engine Disabled" on the diesel it also will not crank. The immobiliser is not relevant in the above cases. I suspect but do not know that the same applies to the V8.
 
Thanks for your time today @DanClarke !

We found with Dan's Nanocom that my BECM is... Peculiar. I don't have any EKA codes, or fob codes stored in the ECU.

We also found that I have a current P1668 code which is "anti theft alarm serial link fault" (signal too low) which was currently present.

At least this gives me something to go on, as I believe P1668 is quite common.

Thanks again @DanClarke
 
Thanks for your time today @DanClarke !

We found with Dan's Nanocom that my BECM is... Peculiar. I don't have any EKA codes, or fob codes stored in the ECU.

We also found that I have a current P1668 code which is "anti theft alarm serial link fault" (signal too low) which was currently present.

At least this gives me something to go on, as I believe P1668 is quite common.

Thanks again @DanClarke
The EKA code can not be read with Nanocom but there should be a FOB code in the BECM RF memory.
The ultrasound sensors in the cabin can cause alarm problems
 
Thanks for your time today @DanClarke !

We found with Dan's Nanocom that my BECM is... Peculiar. I don't have any EKA codes, or fob codes stored in the ECU.

We also found that I have a current P1668 code which is "anti theft alarm serial link fault" (signal too low) which was currently present.

At least this gives me something to go on, as I believe P1668 is quite common.

Thanks again @DanClarke
My "theory" is that you have the P1668 because the BECM cannot accept the codes sent to it by the RF receiver, because no RF code base pairs are lodged in the BECM for it to run its "matching" algorithm against, so it sees this as a serial link data fault because it expects the Key-fob-code base pairs to be workable for comparison. As they are not there is has no way to understand this other than "serial link fault ".
I have seen an article on the Black Box site (I think) about how the base pairs can be reconstructed for a BECM.
You might want to open a dialogue either with Rick-the-pick on here or with MartyUK and his partner over at the P38 Web shop where they built their keyfob code filter (so they must understand keyfob codes pretty well.
Happy to help today, sorry we didn't actually "fix/resolve" any of your issues.
We do know your ABS sensors are all statically working OK (correct volts sent to the ABS ECU ) and we do know that your BECM lacks EKA and fob-code pairs.
 
My "theory" is that you have the P1668 because the BECM cannot accept the codes sent to it by the RF receiver, because no RF code base pairs are lodged in the BECM for it to run its "matching" algorithm against, so it sees this as a serial link data fault because it expects the Key-fob-code base pairs to be workable for comparison. As they are not there is has no way to understand this other than "serial link fault ".
I have seen an article on the Black Box site (I think) about how the base pairs can be reconstructed for a BECM.
You might want to open a dialogue either with Rick-the-pick on here or with MartyUK and his partner over at the P38 Web shop where they built their keyfob code filter (so they must understand keyfob codes pretty well.
Happy to help today, sorry we didn't actually "fix/resolve" any of your issues.
We do know your ABS sensors are all statically working OK (correct volts sent to the ABS ECU ) and we do know that your BECM lacks EKA and fob-code pairs.
Good thinking about the lack of a received FOB code in the BECM. Not sure how you would know that the EKA codes are missing though, the cannot be seen in a locked BECM as far as I'm aware.
 
Good thinking about the lack of a received FOB code in the BECM. Not sure how you would know that the EKA codes are missing though, the cannot be seen in a locked BECM as far as I'm aware.
Really? I can see mine and showed it to @domlinson for comparison. But, my BeCM is probably unlocked, his appeared to be too!
 
I've made an interesting find on a different forum... And this is really bizarre...

The important quote is as follows:
If Passive Immobilization is enabled, the vehicle will immobilize itself if the ignition key is not turned to position "II" or the engine is not started within 30 seconds of unlocking the vehicle. With the ignition key in position "II", the vehicle will show that it is in the immobilized state by illuminating the alarm LED continuously. The engine will not crank if the ignition key is turned in an attempt to start the engine

This relates specifically to a Discovery II I believe, but the behaviour is pretty much exactly what happens to me, except the jump wire that someone has installed between my key barrel and the starter relay means that it cranks all the time anyway.

In the testing (albeit limited) that I've done so far, every time I unlock the car and attempt to start within 30 seconds it starts without fail.
If I exceed the 30 seconds, it will crank (because of the jump wire) but not fire. If I tap the unlock button on the fob (don't even need to lock and unlock) it immediately fires....


So, could this actually be the intended behaviour of my P38??


https://www.landroversonly.com/threads/fault-code-p1668.28431/
 
I've made an interesting find on a different forum... And this is really bizarre...

The important quote is as follows:


This relates specifically to a Discovery II I believe, but the behaviour is pretty much exactly what happens to me, except the jump wire that someone has installed between my key barrel and the starter relay means that it cranks all the time anyway.

In the testing (albeit limited) that I've done so far, every time I unlock the car and attempt to start within 30 seconds it starts without fail.
If I exceed the 30 seconds, it will crank (because of the jump wire) but not fire. If I tap the unlock button on the fob (don't even need to lock and unlock) it immediately fires....


So, could this actually be the intended behaviour of my P38??


https://www.landroversonly.com/threads/fault-code-p1668.28431/
Apart from the cranking (due to your wiring), that exactly matches the behaviour of Otto.

Unlock, turn to II within 30 seconds and fires. Exceed 30s and you get 'engine immobilised'.
If you've exceeded 30s, then you need to unlock with the fob again with the ignition in 0 or I, if you do it in II it won't activate the engine.
However if you do unlock in II, turning back to I then immediately to II will allow starting.
 
I've made an interesting find on a different forum... And this is really bizarre...

The important quote is as follows:


This relates specifically to a Discovery II I believe, but the behaviour is pretty much exactly what happens to me, except the jump wire that someone has installed between my key barrel and the starter relay means that it cranks all the time anyway.

In the testing (albeit limited) that I've done so far, every time I unlock the car and attempt to start within 30 seconds it starts without fail.
If I exceed the 30 seconds, it will crank (because of the jump wire) but not fire. If I tap the unlock button on the fob (don't even need to lock and unlock) it immediately fires....


So, could this actually be the intended behaviour of my P38??


https://www.landroversonly.com/threads/fault-code-p1668.28431/
That 30 seconds business must be unique to the V8, it certainly doesn't apply to my 2 diesels as I tried it yesterday.
 
Just found this snippet from the 1999 manual:

ENGINE IMMOBILISATION Engine immobilisation is an important aspect of the Range Rover’s security system, and includes a feature known as ’passive immobilisation’. This is designed to safeguard the vehicle from theft should the driver forget to lock the doors. The engine is automatically immobilised whenever any of the following conditions occur.
1. When the vehicle is locked using the handset or key.
2. Thirty seconds after the starter switch has been turned off AND the driver’s door opened.
3. Ten minutes after the starter switch has been turned off (even if the key remains in the starter switch and the driver’s door has not opened).

The only one applicable here would be number 2, but that seems to be specific to when you've switched the engine off and then opened the door... not the other way around.
 
As I said earlier the set up on this particular car is a bit "hooky". ;)
The text below from the BeCM user guide from Black-Box Solutions (also attached as a PDF).

· Immobilization Code: Only used on EDC andMotronic engineManagement Systems
(EMS). When the ignition is turned on, the BECM, providing it is in receipt of a valid
mobilization code, from receiving an unlock signal from the correct key fob or having its
EKA code entered, and is therefore not in an alarmed or immobilised state, sends a
coded signal to the Engine Management System (EMS) ECU and in turn, the EMS ECU
then compares against a code it already has stored in it. If the two codes compare OK,
the EMS ECU allows the engine to start. This forms the basis of the immobilizer. If the
EMS ECU or the BECM is replaced, the two codes will not match and it will not be
possible to start the engine. It is therefore necessary to synchronize the codes in both
the BECM and the EMS ECU. For EDC, a function can be found in the EDC section which
gives the fixed code from the EDC ECU which must be entered here. For GEMS, any
number can be used here as the GEMS ECU has a learn function located in the OTHER
section which can be used to force it to learn this code. A valid number is between 0 and
65535.
· EKA number: This is the Emergency Key Access (EKA) Number for this vehicle. Only
available on unlocked BECM's (see BECM STATUS). Even if the EKA function is disabled
(see PASSIVE EKA) and therefore not used, each BECM still has a number programmed
into it. The number has to be 4 characters long, each character can be a number
between 1 and 6, and the four numbers cannot be all the same.
· FOB code: For security this information is only available to be read or programmed on
unlocked BECM's (see BECM STATUS). The fob code is a 3-part code, which uniquely
identifies the family of key fobs (key 1, key 2, etc.) that go with this vehicle. Any key Fob,
when pressed, transmits its unique electronic ID code (FOB CODE) in an encrypted
format. The BECM of any vehicle within range of that key fob decrypts the received
transmission and compares the FOB CODE that was received, against the FOB CODE that
is stored here. If the two match, it will accept the key as valid and perform the relevant
task (lock, unlock, send mobilize signal to engine ECU, etc). This FOB CODE is derived
from converting the manufacturer's Bar Set Lock code. This is a 14 digit alphanumeric
number, which is printed on a label that accompanies every new key fob or lockset.
When the vehicle was assembled at the factory and was first fitted with its new lock set,
the Bar set lock code was recorded along with the vehicles VIN number; this can be
obtained from your local dealership by quoting the Vehicle's VIN number. If the bar set
lock code given by the dealer is no longer correct for the vehicle (due to an earlier
replacement of the lockset and where the kept records were not updated), there is then
no alternative but to replace the lockset and use the bar set lock code that comes with
it. When you have the bar set lock code, do not attempt to enter this directly, but email
this code to [email protected] who will then convert the bar set lock
code into a the 3-part FOB CODE. This FOB CODE is then entered in this section. The FOB
CODE can only be obtained by this method.
NOTE.DO READ THE BECM STATUS
REGARDING THE BECM BEING LOCKED OR UNLOCKED. THE BECM CANNOT BE
UNLOCKED USING THE NANOCOM EVOLUTION


Cheers!
 

Attachments

  • P-38 BeCM Body Control ECU Guide.pdf
    215.6 KB · Views: 276
As I said earlier the set up on this particular car is a bit "hooky". ;)
The text below from the BeCM user guide from Black-Box Solutions (also attached as a PDF).

· Immobilization Code: Only used on EDC andMotronic engineManagement Systems
(EMS). When the ignition is turned on, the BECM, providing it is in receipt of a valid
mobilization code, from receiving an unlock signal from the correct key fob or having its
EKA code entered, and is therefore not in an alarmed or immobilised state, sends a
coded signal to the Engine Management System (EMS) ECU and in turn, the EMS ECU
then compares against a code it already has stored in it. If the two codes compare OK,
the EMS ECU allows the engine to start. This forms the basis of the immobilizer. If the
EMS ECU or the BECM is replaced, the two codes will not match and it will not be
possible to start the engine. It is therefore necessary to synchronize the codes in both
the BECM and the EMS ECU. For EDC, a function can be found in the EDC section which
gives the fixed code from the EDC ECU which must be entered here. For GEMS, any
number can be used here as the GEMS ECU has a learn function located in the OTHER
section which can be used to force it to learn this code. A valid number is between 0 and
65535.
· EKA number: This is the Emergency Key Access (EKA) Number for this vehicle. Only
available on unlocked BECM's (see BECM STATUS). Even if the EKA function is disabled
(see PASSIVE EKA) and therefore not used, each BECM still has a number programmed
into it. The number has to be 4 characters long, each character can be a number
between 1 and 6, and the four numbers cannot be all the same.
· FOB code: For security this information is only available to be read or programmed on
unlocked BECM's (see BECM STATUS). The fob code is a 3-part code, which uniquely
identifies the family of key fobs (key 1, key 2, etc.) that go with this vehicle. Any key Fob,
when pressed, transmits its unique electronic ID code (FOB CODE) in an encrypted
format. The BECM of any vehicle within range of that key fob decrypts the received
transmission and compares the FOB CODE that was received, against the FOB CODE that
is stored here. If the two match, it will accept the key as valid and perform the relevant
task (lock, unlock, send mobilize signal to engine ECU, etc). This FOB CODE is derived
from converting the manufacturer's Bar Set Lock code. This is a 14 digit alphanumeric
number, which is printed on a label that accompanies every new key fob or lockset.
When the vehicle was assembled at the factory and was first fitted with its new lock set,
the Bar set lock code was recorded along with the vehicles VIN number; this can be
obtained from your local dealership by quoting the Vehicle's VIN number. If the bar set
lock code given by the dealer is no longer correct for the vehicle (due to an earlier
replacement of the lockset and where the kept records were not updated), there is then
no alternative but to replace the lockset and use the bar set lock code that comes with
it. When you have the bar set lock code, do not attempt to enter this directly, but email
this code to [email protected] who will then convert the bar set lock
code into a the 3-part FOB CODE. This FOB CODE is then entered in this section. The FOB
CODE can only be obtained by this method.
NOTE.DO READ THE BECM STATUS
REGARDING THE BECM BEING LOCKED OR UNLOCKED. THE BECM CANNOT BE
UNLOCKED USING THE NANOCOM EVOLUTION


Cheers!

Interesting reading...

To me, this shows that my BECM is most likely in a 'locked' state... although the icon on your Nanocom appeared to have an unlocked padlock icon on the 'BECM' item, I'm guessing that there's actually another field/menu somewhere that shows the true status of the BECM - 'Unlocked/Locked'..

This would make sense as to why the Nanocom couldn't read the fob or EKA codes.
 
Interesting reading...

To me, this shows that my BECM is most likely in a 'locked' state... although the icon on your Nanocom appeared to have an unlocked padlock icon on the 'BECM' item, I'm guessing that there's actually another field/menu somewhere that shows the true status of the BECM - 'Unlocked/Locked'..

This would make sense as to why the Nanocom couldn't read the fob or EKA codes.
Not sure about that TBH.
I just connected up my Nanocom and navigated to the page where it tells me specifically that my BeCM is "Unlocked" (we should have gone here when looking at yours, my bad) :(

upload_2022-10-10_13-24-2.png


and here in the BeCM it has my immobilisation, code, EKA (edited by me earlier) and fob-codes for decoding and working with the immobiliser.
upload_2022-10-10_13-29-4.png


Happy to jump back into your BeCM and see if your is indeed unlocked.
 
Not sure about that TBH.
I just connected up my Nanocom and navigated to the page where it tells me specifically that my BeCM is "Unlocked" (we should have gone here when looking at yours, my bad) :(

View attachment 275745

and here in the BeCM it has my immobilisation, code, EKA (edited by me earlier) and fob-codes for decoding and working with the immobiliser.
View attachment 275746

Happy to jump back into your BeCM and see if your is indeed unlocked.

Pretty sure I cannot see those codes on mine but mine's locked. I think @Datatek is like me and turned off passive immobilisation.
 
Just an update for anyone that comes across this thread in the future...

This was never an issue at all, the behaviour of my P38 is in line with how Passive Immobilisation works as described in the user manual (and RAVE I think).

In addition, when decoding my VIN online the list of options includes this:
Vehicle Immobilisation - Passive immobilisation [076CZ];

So, some have it, some don't!

If yours cranks forever without firing, try removing the key from the ignition, clicking the unlock button, and then try to start it again within 30 seconds.
 
Yes it does show D or R on the dash whilst it cranks, which is very weird.

I've had the covers off from under the steering column, and I can see that a wire has been spliced in from the back of the ignition switch directly to the fuse box... So I'm guessing someone has rigged the ignition switch to directly enable the starter motor relay, and this is also why the car cranks in gear

so have you removed this extra wiring?
Does it still crank in “D”?

J
 
Back
Top