The problem is 2 part - as far as I see/understand it.
The first part is the well-known RF receiver problem - which will wake the BECM up, and can drain a good battery in a couple of days. This is well covered everywhere P38's are discussed and as mentioned by Grrrrr - the official fix is the 3rd gen receiver, which will only wake the BECM up when it detects a P38 fob code. The 2nd gen receiver might help a bit as it will filter out a load of spurious RF, but will still let anything 433mhz through - which is enough to keep the BECM from sleeping still. I know a load of owners who have no problems with the 2nd gen receiver, but it will vastly depend on where you live and what other 433mhz devices are around where the vehicle is kept. The second key fob with a power relay is another option that you can use to isolate the RF receiver from the BECM either on the power or signal wires to stop it from flooding the BECM with data. The only downside to this is that you have to have a second remote fob, and click that first to power the RF receiver, to then use the vehicle fob to unlock the vehicle (and vice versa when locking) - but the up side is that it's a fraction of the cost of a 3rd gen receiver.

The second part is more BECM related - in the fact that for some reason when it's bombarded with RF signals, it thinks it's being stolen, so it tries to keep locking the doors, which if they are already locked, is what then burns the motors out. The rear ones seem to be saved from this and the only reason I can think of is that the rear ones are driven as a pair, and directly from the BECM - rather than from the outstation. I don't know how this makes a difference on early ones - but the rears never seem to burn the motors out - just the fronts. This was actually solved also in later models of P38 as there was a change in code in the firmware of the BECM which meant that if the locks were triggered all the time (like with the RF problem) then it would stop driving the lock motors themselves to prevent the burnout problem. This can be seen 'in action' on later P38's if you lock/unlock it rapidly a number of times - if you do it enough/quickly enough, then the BECM will stop driving the lock motors temporarily as a prevention to stop them from burning out.

The best way of solving the issue is to bite the bullet and get the 3rd gen receiver - which will then sort the RF problems out, and that will also stop the chances that your new door latch motors will burn out, and let the BECM/RR sleep without being woken up all the time.

I bought one of the 3rd gen receivers a couple of days after getting the RR and having it drain the battery the morning after picking it up. I go away for work a LOT and it's left for a few weeks at a time fairly regularly - but always come back and it starts right up now.

Thanks Marty, I think I might just have to plump for a 3rd gen receiver if it doesn't have one already. I'm not sure if being left for 4-5 weeks and going flat is normal even with the good receiver or if there's more signals to affect it in Czech. It is parked in a garage below 6 apartments which I assume will all have wifi and key fobs for cars etc.
Was the 3rd gen fitted as standard to any vehicles or was it only an aftermarket fix? Like I say, when I first bought it, it sat for a week and a half and started fine but it could have been that at home there are less signals close enough by to cause a problem.
Also, what year did the upgraded firmware start that looks after the motors and can I tell with nanocom if I have it? If so, i'll just leave it alone and on the charger.

The 3rd gen receiver was not fitted to any production vehicles, no.

The revised/second gen one was fitted from about 1999MY onwards, through until runout. The 3rd gen was introduced somewhere around 2005 from memory to finally solve the problem, but it was never done as a recall or anything like that... just a replacement part at a silly price.

The only way of identifying what version receiver it is, it to open the casing up as the appearance of the internal PCB(s) is different. Some people say 'green dot' is the latest, and 'blue dot' are the original 1st/2nd gen versions - but then there have been unscrupulous eBay sellers in the past that whack a green dot on the 2nd gen ones and sell it as 'upgraded, green dot receiver' which people then assume is the 3rd gen.

BECM firmware... I'm not sure the actual change date that it was implemented. The document I have on BECMs which has some of the earlier software updates noted only goes up to V34, and there is no mention of it up until then. If I had to guess, then I would say that V36 is the most likely to be where it was implemented, as it *seems* to be a fair major update, just from the fact that it was implemented from then that you could put the EKA in with diagnostics via the OBD port, where you couldn't previously. I could be wrong - it may have been later than that to coincide with the 2nd gen receiver being fitted in 1999. I have various spare BECM boards around from old vehicles, with different versions of firmware on them - so at some point I might try and get them set up and do some testing to see if I can find out, given there seems to be very little documentation past V34 of the firmware.

See what version of software your BECM has with the Nanocom. If it's burnt the locks out before, then chances are whatever version of software you have, is before it was updated unfortunately, as the modification was brought in to stop that from happening.

I'll do a bit of digging again and see if I can find where I first read about the change to the firmware to prevent the burning of motors and see if it had any references to BECM part number or software version.

Marty, great information. I haven't had door motor burn out yet but not had it long so who knows. It's been laid up for about 3 weeks this time but with the charger connected so maybe I'll find it not working when I get there Friday.
I suspect mine is a gen2 based on the year but I'll check.

Now, before I go on, apologies to raw11111 for hijacking the thread.

I'm a controls system engineer and this problem really irks me. I'm sure that there must be a reasonably priced solution to this. The extra relay workaround is OK to a point but here's my thinking.
If your fob battery is dead, I assume you can still get in the car on the key and start it? Therefore, there must be a passive transponder in the fob?
Could we upgrade the relay workaround so that it mimics the microswitches in the door and unlocks it, then fit the transponder in a fob with a blade allowing us to start the car?
I might be talking rubbish but it seems to me that if the key can open it then surely, the code sent via the fob isn't entirely necessary.
The other thing I thought is what is drawing so much current when the BECM wakes up? Would there be any way to physically isolate any current draw on the board apart from the door locks until it's actually unlocked then allow power to all??

Rambling I know but there has to be a way without spending 300 quid.

There isn't a passive transponder in the fob, like most vehicles seem to have.

The fob has a chip in it which is programmed to a certain ID, which is also programmed into the BECM. The ID along with information on what button has been pressed is encoded using some formula/lookup tables etc which is then sent to the vehicle. The RF receiver gets that, and then wakes up the BECM (if it's asleep) and passes on the info for it to decode, and check the ID. If it matches, then it locks/unlocks. If it doesn't its ignored.

The whole passive immobilisation/friendly sync part is done by the BECM detecting when the key is put in the ignition (key in switch which triggers BECM). It then engerises a coil around the ignition barrel (if it's fitted/not broken/and passive immobilisation is turned on in the BECM) which generates electromagnetic field, which excites a receiving coil in the handset. This then sends an electrical pulse to the chip on the fob PCB, telling it to send an unlock/mobilisation code - which again is received by RF receiver and passed on to the BECM. So rather than having a trasnponder which is picked up in the vehicle, the vehicle tells the key to send a signal.

Only when the BECM is in a state with the alarm disarmed and the immobiliser off will the vehicle start, and that can either be via the remote sending an unlock code by pressing the button, or the EKA being entered. If it's expecting the EKA, then putting the key in the ignition won't necessarily get it to send the unlock code, especially if the remote is out of sync to the vehicle.

You can make it so that the key in the door will just open the vehicle. If you turn the passive immobiliser and EKA off in the BECM, and then disconnect the RF receiver altogether, then you can just lock/unlock via the key in the drivers door. Which is fine until the door latch microswitches start playing up....

I'm not sure why the BECM draws 1A when it's awake... I'm guessing it's a culmination of all the logic IC's being powered up and monitoring the various vehicle inputs, over when they are in a low power state. But I don't think it would be easy to isolate where the power draw is coming from, given the complexity of the logic/power boards.

I am pretty sure I know what the new RF receiver chips look for in the encoded data that comes from the remote key, to filter out anything that isn't a P38 code... I am sure it must be possible with all the technology and microcontrollers these days to be able to make something that captures the data coming in, processes it, and then sends it to the BECM if it matches... (which is what the 3rd gen receiver does) - but it's just having the know how to program that which I don't have... I am almost sure a £5 arduino could be programmed to do it... and would be willing to collaborate with anyone who has the required programming knowledge to give something a shot at some point.

Marty, great reading. I'm getting a better feel for how it works now. I still think an improvement to the second rf controlled relay is to make it mimic the door switches. That way, you could do away with the RF receiver and then just use the normal key to start instead of having to press two remotes but obviously, you still need the two remotes then.

I'd certainly be interested in looking at this in more depth and maybe working together to come up with a solution. I'm no expert on programing pic's etc but my brother is and I'm into programming PLC's for industry. I remember an old boy telling me in the early years "Paul, all we're doing is moving one's and noughts from one place to another"

I honestly believe there is a way to solve this and it hinges around knowing what the fob outputs. If that is known, then it's not that difficult to say "Yep that's good, let's send it"

Before I bought mine, I read lots of horror stories about the BECM and then found an article "Demystifying the BECM" I then realised that it is no different to the PLC's that I use for work in essence and even considered building my own version of a BECM if I had problems.

I'll drop you a PM to exchange contact details and see if we can crack this. There MUST be a way!!!!

Cheers

Wazzajnr said:

I couldn't care less about battery drain as I would expect a decent battery of that size to last overnight at a couple of amps.
When it's left any length of time I'll just leave the trickle charger on. I'm just worried about frying the door motors. Of all types of work on cars, I detest working on doors more than anything.
Think I need to suss out a way to isolate the door motors when it's left a long time.
Either that or come up with a better motor system but then that involves working with doors............. I know now why you're called Grrrrrr.!!!!

Click to expand...

Brian's fix is cheap and sorts the lot. Just need a second fob. It switches the RF receiver off until you need it. No more lock motors being burnt out. I lost about 3 sets before I did mine. I got pretty quick at it! The MGF locks from the same era have the same motors inside and are way cheaper than the Rangie.

Thanks for all the great info gents! Really interesting to see more about what the causes of the issue are, as someone with a degree that covered control systems and who plays with electronics and PICs for fun occasionally its a bit annoying that the hundreds of millions they spent developing this car is messed up by a weather station. 433mhz isn't near wifi in the uk but there's plenty of other things in the range to keep it awake! I wonder if a PIC could be produced to 'upgrade' an early receiver to gen 3 spec. Issue would be finding out the codes used I expect :/

Our BECM definitely stops triggering the lock motors once you lock and unlock a few times in succession but the front motors are both dead and one has been replaced before so clearly not fixed! Once the new motors are in at the weekend I'll have a better idea of how its all behaving.

Rich

If you want to crack it then you might want to get @MrSporty involved as he has tried playing with this. Rick-the-pick is very knowledgeable too.

Remember the rolling code for the engine immobilisation. At least it is rolling on the GEMS petrol. Diesel is static. Not sure about the THOR. Each key has a code and then a rolling number on the end. So each time you use that key it increments by 1. If you clone the key then it increments 1 key but not the other so you constantly have to resync.

Grrrrrr said:

If you want to crack it then you might want to get @MrSporty involved as he has tried playing with this. Rick-the-pick is very knowledgeable too.

Remember the rolling code for the engine immobilisation. At least it is rolling on the GEMS petrol. Diesel is static. Not sure about the THOR. Each key has a code and then a rolling number on the end. So each time you use that key it increments by 1. If you clone the key then it increments 1 key but not the other so you constantly have to resync.

Click to expand...

Ish...
The EMS code for all engine type is static. On GEMS and EDC up to 1996, the code is transmitted once and when the BECM is happy that the code has been received, then it will allow it to start. On GEMS models, the engine ECU acknowledges the correct code by turning on the CEL - the diesel models don't, and there's no mention in RAVE or the ETM about how the early diesel models acknowledge the code - or if they even do, and the BECM just waits a certain time before allowing cranking. On the later EDC and Thor models the BECM constantly transmits the code about every 144ms whilst the vehicle is mobilised.

I was in touch with MrSporty awhile ago about keys and their transmissions etc, and from conversations with him, and some of my own research the way the keys work is they transmit a static ID, along with information regarding what button was pressed - lock, unlock etc. This is encoded using tables and the likes which are programmed in, and then transmitted. When the remote is synced, then it means that the BECM and key are using the same part of the table, so it can work out what the decode sequence is. I think the BECM looks up the current plus the next say 20 entries or possible codes which if any of those match, it will lock/unlock (to take into account random buttons being pressed in pockets etc).

Each key has a separate hardware ID, and the BECM is coded to accept the starting ID of a lockset (the 'Key 1') and the next sequential 3 ID's to make up a 4 key lockset. when the keys are cloned by some of the people that advertise spare keys, then in fact it's transmitting the same ID as the original Key x and hence why one can only be synced at a time as they will be at different places in the coding tables.

The way I think the gen3 receivers work is that it identifies the header of the transmission from the key, and if that matches what it's expecting from a p38 key fob, then it will allow the information to pass to the BECM for decoding to make sure it's a valid ID for that vehicle.

I've crudely analyzed the transmissions from about 10 different P38 keys that I have, and they all appear to start with the same transmission of data, before they all change up (the rolling coded part of the transmission).

I realise that how it probably works is a lot more complex than how I've described it, but from my basic understanding, and of the bits that I DO know for sure, it makes the most sense. Ever knowing the encoding tables or things like that is highly unlikely thing unless you are well versed in automotive entry systems, or worked on the design/programming of the BECMs to begin with.... but as far as what we want to try and achieve regarding the receiver side of things - I don't think any of the rolling code stuff matters.

If all P38 keys have the same header transmission before the encoded part, as long as you can build something to capture the whole transmission, identify the header as being valid for a P38 key, and then send the whole transmission on to the BECM if it does match, then the BECM will do the rest as per normal... but if any transmissions that didn't match the P38 header were not passed on, then this in theory would mean the BECM stays asleep and isn't woken up by random transmissions like they are now.

I am always interested to learn more about how the systems work, so if anyone has any more in depth info, that they are happy to share, then feel free to drop me a PM. I enjoy finding out how things work and understanding the methods behind it.

Interesting. Maybe if a get really bored or have real problems I'll look into trying to make something to decide that initial identifier header code. Seems like that shouldn't be too hard actually. Even if we could filters it only being woken by p38 keys would be a good start!

martyuk said:

Ish...
The EMS code for all engine type is static. On GEMS and EDC up to 1996, the code is transmitted once and when the BECM is happy that the code has been received, then it will allow it to start. On GEMS models, the engine ECU acknowledges the correct code by turning on the CEL - the diesel models don't, and there's no mention in RAVE or the ETM about how the early diesel models acknowledge the code - or if they even do, and the BECM just waits a certain time before allowing cranking. On the later EDC and Thor models the BECM constantly transmits the code about every 144ms whilst the vehicle is mobilised.

Click to expand...

What does CEL stand for? Check Engine Light? If so, nothing happens in the diesel.

As far as I'm aware, once the BECM has accepted the key the diesel just checks the EMS code matches the one in the BECM and after that you're good to go.

I am very much of the opinion that getting the BMW engine in the Rangie was a bit of a Land Rover bodgit. A good bodgit but a bodgit nonetheless.

Sorry, yes, CEL = Check Engine Light.

Not showing up on the Diesel fits in with the description in the ETM and the likes - as it says that there is no confirmation back on the later ones, and no check engine light like the GEMS on the early diesels..

martyuk said:

Sorry, yes, CEL = Check Engine Light.

Not showing up on the Diesel fits in with the description in the ETM and the likes - as it says that there is no confirmation back on the later ones, and no check engine light like the GEMS on the early diesels..

Click to expand...

Sounds like the Thor setup is a lot more like the diesel than the GEMS.

Grrrrrr said:

Sounds like the Thor setup is a lot more like the diesel than the GEMS.

Click to expand...

Pretty much identical, yes. But then they are both Bosch ECU's so it make some sense. In theory, if you could find another suitable engine type to fit in the P38 - which used a Bosch ECU, with the same immobiliser strategy, then it would be fairly easy to get it to behave properly in the P38...

martyuk said:

Pretty much identical, yes. But then they are both Bosch ECU's so it make some sense. In theory, if you could find another suitable engine type to fit in the P38 - which used a Bosch ECU, with the same immobiliser strategy, then it would be fairly easy to get it to behave properly in the P38...

Click to expand...

I'm more interested in whether I can get an XJ8 engine in mine! Assuming the Jag fails an MoT test catastrophically.

Managed to get a couple of photos while moving the horse from one yard to another. Removing the electric fence from the field seemed like a good opportunity to teach how the gearbox can be controlled and how the air suspension worked. Unlike Swindon they hadn't had any rain on Tuesday back home so the risk of getting stuck was low too.

Nice looking car. Good colour choice.

Well it made it to Dublin! Apparently spent two lovely days there, before the centre viscous coupling seized as they tried to leave to spend their final day enjoying a few sights! Much laughing and five AA trucks later it arrived back home. On the plus side, this does mean that technically it managed an impressive 56MPG over the whole trip

Before it left i had replaced a front prop UJ which had play in it, and still had vibration all the time. I now know why. Hint, it was still there after replacing the VCU. It's something you'd never normally think to actually check. Have a picture of a fully functional RR while you think.



The front tyres were Vanco 235/65/R16. The rears are Vredstein Winters, 235/70/R16. Suspect that was the root of the issue finally found! Today I spent nearly three hours sitting outside Slo-Fit in birmingham as they were the only place within an hour with any suitable tyres in stock open on a sunday. Needless to say it's now fixed. In fairness to them, they had none of the issues you'd normally expect from Kwik-Fit - not one air tool was used to over tighten anything and no-one was trying to rip anyone off, but it did take over two hours to change two tyres on wheels that weren't even on a car!

Still, very happy that the car now finally drives like it's meant to, so now I can move on to all the other issues!

Rich

RAW111111 said:

Well it made it to Dublin! Apparently spent two lovely days there, before the centre viscous coupling seized as they tried to leave to spend their final day enjoying a few sights! Much laughing and five AA trucks later it arrived back home. On the plus side, this does mean that technically it managed an impressive 56MPG over the whole trip

The front tyres were Vanco 235/65/R16. The rears are Vredstein Winters, 235/70/R16. Suspect that was the root of the issue finally found!
Rich

Click to expand...

Ah, yes. Different sized wheels is a definite no no.

So is the VCU OK?