Lock and unlock if this can help
:shifty: Security/Alarm System Operation & Diagnosis 4.0/4.6/p38)
Introduction
Main System Components
Central Locking and Alarm Arming
Engine Immobilization
Unlocking, Disarming and Remobilization
Remote Handset Synchronization
EKA (Emergency Key Access)
Alternative Disarming Procedure
Security System Fault Diagnosis
More Information
Request for Input for This Page
Introduction
The designers of the Range Rover 4.0/4.6/P38A went overboard in the alarm and security department, presumably thinking that thieves would be keen on stealing such an expensive vehicle. Little did they realize that it would be one of the fastest depreciating vehicles ever, and the alarm system would merely be another electrical headache for owners. I have heard horror stories even about quite new Range Rovers being immobilized for weeks in the shop with alarm system problems. This page is an attempt to summarize accumulated owner knowledge on how the system operates, what the most common failures are and how to recover from them. Because the security system is so abominably complex and obscure, a better understanding of how it is supposed to operate should make fault diagnosis much easier.
I would like to thank Ron Beckett for helping compile and edit this page. If you can contribute additional information PLEASE email me!
Main System Components
BeCM, incorporating a Theft Alarm Unit (Z163) -- part of the BeCM (under right front seat).
Remote Handset.
Emergency keys (supplied with later model vehicles only).
RF Receiver (in loadspace under right rear parcel shelf) 315 MHz (North America), 433 MHz (UK and ROW).
Passive Immobilisation Coil (component Z270, surrounding the ignition switch barrel) 1996 & later NAS & some other markets.
Driver's Door Lock and "CDL" (Central Door Locking) switch.
Door lock actuators and "door open" switches on other doors, rear hatch and fuel filler.
Window and sunroof actuators and sensor switches.
Ultrasonic Volumetric Sensor (located at top of "B" pillar inside the vehicle).
Inertia Switch (behind right footwell trim panel) shuts off fuel and allows unlocking after a crash.
Under-hood alarm klaxon, and/or Battery Backed Up Alarm Sounder ("BBUS" -- some markets 1996 & later).
Central Locking and Alarm Arming
Central locking of all the doors can be done several different ways:
Pressing down either front sill locking button with the doors closed will lock all doors.
"Slam locking" (pressing a sill locking button and then closing the door) will lock all doors -- only on vehicles up to mid-1996.
Locking the driver's door with the key.
Pressing the lock button on the remote.
"All Close" locking: Holding the key in the lock position for over a second also closes the winndows and sunroof.
"Lazy Locking" (Most UK, Europe? but not NAS or Australia) -- Holding the remote button for over a second also closes the windows and sunroof.
"Superlocking" with key or remote by a double turn of the key or double press of the locking button on the remote.
Auto Relocking will occur if the vehicle is unlocked but no door openings, ignition key insertion or turn-on, or movement inside the vehicle are detected.
In cases 2 through 6 above, the alarm is armed to the "perimetric" mode in which it will be set off by opening any door, window, the rear hatch or the hood/bonnet. Engine cranking is disabled and and electronic engine immobilization is activated (more on this below).
In case 7, the "superlocking" mode energises an additional motor in each door lock actuator which disconnects the sill locking buttons so they cannot be used (e.g., by a burglar) for unlocking. If superlocking was done by the remote, and the windows and sunroof are closed, the ultrasonic volumetric alarm will also be activated. (If done by the key, a press on the remote locking button is still required before the volumetric alarm will be activated). In this mode, the alarm will be set off if any movement of a person or animal is detected inside the vehicle.
Engine Immobilization
Whenever the alarm system is armed (or, on 1996 and later models when passive immobilization is enabled -- see below -- when the ignition key is removed), the engine is immobilized. In this state, the Engine Control Module (ECM) will not operate normally unless it receives a mobilization code from the BeCM. Furthermore, if some clever thief jumpers the starter solenoid and manages to turn the engine over, it will do no good because a crank signal is detected by the engine ECM (via the engine crank sensor which is normally used to time the ignition and determine engine speed). This information is sent to the BeCM which puts an "ENGINE DISABLED" signal on the message center on the dash and continues to make it impossible to start the engine.
On 1996 and later models (UK, Europe? and some other markets, but not North America or Australia), the system was "improved" by adding a so-called "passive immobilization" feature (enabled in North America and some other markets) that activates engine immobilization whenever the key is removed from the ignition, regardless of whether or not the vehicle is subsequently locked or the theft alarm armed. A "passive immobilization coil" was added around the barrel of the ignition switch to trigger a code from the remote handset when it is inserted in the ignition, enabling remobilization (see remobilization section below). Presumably the theory behind this "improvement" is that a thief cannot start the vehicle even if you forgot to lock it and he can turn the ignition switch on without a key. (NOTE: This wonderful feature also requires you to leave the key in the ignition when changing the battery to avoid immobilization. See Battery Replacement page).
Photo above right by Ron Beckett, showing ignition switch barrel on a 1995 model, with no passive immobilization coil but with "key in" switch and wiring clearly visible. Cobwebs are due to this photo being taken in a partially dismantled vehicle at a wrecker's yard.
Unlocking, Disarming and Remobilization
The theft alarm is disarmed by pressing the unlocking button on the remote. The RF receiver located in the right hand side of the loadspace conveys this signal to the BeCm which decodes it and, if the code is correct, unlocks the doors and disarms the alarm. On 1995 models, the vehicle is then in an unarmed state.
On 1996 and later models with passive immobilization enabled (UK, Europe? but not North America or Australia), if the key is not inserted into the ignition within 30 seconds of unlocking with the remote handset or EKA procedure (see below), the BeCM reverts to the immobilized condition. The engine remains immobilized until the remote/key is inserted into the ignition, closing the "key in" switch and activating a "Passive Immobilization Coil" (Z270) around the barrel of the the ignition switch. The electromagnetic field from this coil excites a receiving coil in the remote key handset. If the remote is acting normally (for example, does not have a dead battery), it will then transmit a mobilization signal to the BeCM via the RF receiver. The BeCM then disarms the vehicle and remobilizes the engine.
On all models, when the unarmed state has been achieved, the BeCM transmits a mobilisation code to the engine ECM commencing 48 milliseconds after the ignition is turned on, and until it receives a confirmation signal from the ECM telling it to illuminate the "Check Engine" light (as an indication of correct operation) and allows engine cranking when requested. In turn, the ECM enables engine fuelling and proceeds to allow all engine controls to act normally.
Remote Handset Synchronization and Desynchronization
The remote handset uses a "rolling code" algorithm, meaning the code is changed every time remote locking or unlocking is performed. The BeCM stores the code sequence in its RAM and has a capture range of 100 codes after the previously received value, so should be able to remain synchronized with the handset unless more than 100 attempts have been made to operate the remote while out of range, or the remote's batteries are removed or die, or the vehicle's battery dies or is disconnected. That is the theory -- in real life it seems to lose synchronization more often, such as when the vehicle's RF receiver has been activated by other spurious sources of 315 MHz (or 433 MHz in other markets) transmissions.
Resynchronization is accomplished by performing a key lock or unlock within 30 seconds of requesting a remote lock, superlock, or unlock. The BeCM senses the change in state of the "CDL" (Central Door Locking) switch in the driver's door to initiate resynchronization.
On 1997 and later models (all markets?), "friendly synchronization" is provided whenever the key/remote is inserted into the ignition. The passive immobilization coil around the ignition barrel activates a pickup coil in the remote, causing the remote to transmit an unlock signal to remobilize the vehicle.
Resynchronization Exception Mystery:
The driver's handbook, shop manual and ETM all contradict their own instructions on resynchronization, stating that it cannot be achieved by the above procedures if the vehicle security system is "active" (Shop manual) or "armed" (driver's handbook). In this case, you have to resynchronize by the Emergency Key Access method (see below). These instructions do not make sense to me, since the alarm is nearly always armed if the vehicle is locked. Perhaps it means if the remote is desynchronized and the alarm has meanwhile been set off somehow, the EKA procedure has to be used for resynchronization. Or, perhaps the exception refers to when some malfunction is present. In any case, probably the best method of resynchronization is to first unlock the vehicle with the key so the alarm will be disarmed (if everything else is working right), then perform the synchronization routine. If you can shed light on this mystery, please email me.
Emergency Key Access ("EKA") Procedure
(Disarming Alarm & Starting Vehicle when Remote is Lost or Fails)
Overview and Instructions
The EKA procedure is provided as a back-up method of disarming the alarm and re-mobilizing the vehicle if all else fails. It uses a series of locks and unlocks with the key in the driver's door lock cylinder. From owner reports to date, this feature seems to be enabled on 1996 and later models in Europe, but not North America or Australia -- but see below for a generic EKA code procedure that works in North America. Iif you have more information on this please email me).
The manuals are vague and contradictory on when EKA might be necessary -- the shop manual says it is if you lock the vehicle with the remote handset and then you lose the remote or it fails. (This is understandable on models with passive immobilization which cannot be started without the remote, but the manuals are enigmatic on why this could happen on vehicles without passive immobilization). You still need the key part of the remote, or one of the spare mechanical keys supplied in later model years.
According to the manual, if the remote has failed or been lost and you try to open the door with just the mechanical key, the alarm will sound twice. (Of course, this does not make sense because you should be able to get into all models quite satisfactorily with just the mechanical key. Perhaps they are referring to situations when the remote has malfunctioned in a way that upsets the BeCM, or the alarm has been set off for some reason). If you then try to start the car, the message center will display "ENGINE DISABLED PRESS REMOTE OR USE KEY CODE". (This part makes sense on vehicles with passive immobilization, as described above, or perhaps if the alarm has been activated).
Make sure the doors, windows and bonnet/hood are closed, get out and lock the car again with the key. (Note: on 1996 and later models, you have to turn the key to the lock position four times for this step if the remote handset was not used to lock the vehicle). Then turn the key the required number of times according to the following sequence. (At each step the side lamps warning light on the dash will light to show it has recognized the input).
To enter the first digit, turn the key the required number of times to the unlock position.
To enter the second digit, turn the key the required number of times to the lock position.
To enter the third digit, turn the key the required number of times to the unlock position.
To enter the fourth digit, turn the key the required number of times to the lock position.
Turn the key to the unlock position to unlock the doors. The alarm will now be partially disarmed; if you try to open the hood the alarm will sound. After five incorrect attempts (3 for 1996 and later models) at this procedure, the BeCM goes into a 10 minute lockout mode (30 minutes for 1996 and later models), during which time the message center displays "KEY CODE LOCKOUT" and further attempts at EKA will not work.
The EKA code is supposed to be on your "security card" but I don't have one for my vehicle and Staffan Tjernstrom, who first alerted us to this information, mentions that getting it probably involves knowing your dealer very well, and maybe a few pints of good beer! Alex Rudd informs me that he has used the EKA method to recover from alarm problems, and that in the UK you can present or fax your owner's log book (or email a photo of it) to a Range Rover dealer to prove ownership, and they will give you the code.
Update February 2005: Confusion between LHD and RHD vehicles has been reported regarding this procedure. Alex Rudd from the UK reports "I have seen quite a few versions of using the EKA code on the net, most of which are wrong (I know, I've tried them all, and waited hours during the EKA Key Lockout session!). The correct one to follow is the version from the Range Rover handbook, which starts the key code entry on the clockwise turn - most of the others I have read refer to starting on an anti-clockwise turn, which then doesn't work." I think this contradiction is due to the difference in key lock direction between LHD and RHD vehicles (Alex's is a RHD model). This was confirmed by Ian Gibree who had to use the EKA on his Dutch-plated LHD Range Rover when interference from a cell phone tower stopped his remote from working. He used the procedure in his handbook starting withteh anti-clockwise turn and it worked. Thus it seems that the first turn should always be to the "unlock" position. If anyone has further clarification of this please email me.
Generic EKA Procedure on NAS Range Rovers
The EKA feature does not seem to be enabled on US vehicles, or Australian ones, and is not mentioned in their owners' handbooks. However there does seem to be an abbreviated version of the procedure available on NAS models, intended to be known only by Land Rover dealers and using a generic code (1515) for all vehicles. One US owner with a 2000 Range Rover had his vehicle stranded with a dead battery and no remote available, but when jumpering it got the message "Engine Disabled, Press Remote". Since he did not have a remote, he managed to reactivate the vehicle using a variant of the EKA procedure that the dealer confided -- the dealer was fairly sure that almost all NAS P38's have the same EKA code, which is:
Unlock once
lock 5 times,
unlock once,
and then lock 5 times.
Aidan confirms that he found out from Land Rover that the normal EKA is not applicable to US spec P38A Range Rovers, but the generic "null" code (1515) is used. For example, when replacing a BECM it asks for the code and a null # is inputted (1515).
Ove Sognnes from Norway reports that this worked on his also: "Range Rover Norway didn't supply me with the correct procedure for opening RR when remote is lost, but you did. Thanks again. Your procedure works perfectly on my 97 range rover hse, open door, lock 4 times, then starting procedure. Smashing."
Alternative Disarming Procedure
Steve reports that an alternative procedure for getting the system out of disabled mode is to connect the battery when the key is in position II. If you try this please let me know the results!! (Mike Coleman reports he tried it on his UK model when he did not have the correct EKA code available, but it did not work for him).
Security System Fault Diagnosis
"ALARM FAULT" Message:
The most common cause of the "ALARM FAULT" message being displayed on the Message Center is failure of the ultrasonic sensor (located above and to the side of the driver's head) which monitors the interior of the vehicle for intruders. The BeCM does a check on this sensor every time you switch the engine off and get out. If it does not work 5 consecutive times it generates the fault message when you have tried to activate it by superlocking the vehicle. Replacement of the sensor is simple, but the problem can also be caused by a bad connection. The Ultrasonic Sensor Repair page gives more details on how to diagnose and solve these problems.
"ENGINE DISABLED" Message:
This is displayed if an attempt is made to crank the engine (e.g., by jumpering the starter solenoid) while the alarm is armed or passive immobilization is in effect. Try pressing the unlock button on the remote; if this does not work you will have to use the EKA procedure.
"ENGINE DISABLED PRESS REMOTE OR USE KEY CODE" Message:
This message can mean you have tried to start a vehicle that has passive immobilization (e.g., 1996 and later North American models) with a malfunctioning remote or a dead remote battery. Or for some other reason when you are trying to start the engine, the alarm system is still armed or is in a bad mood. The solution is to try the EKA procedure.
"KEY CODE LOCKOUT" Message:
This means you have made several wrong attempts to use the EKA procedure to remobilize the vehicle; wait 10 minutes (30 minutes for 1996 and later models) and try again; meanwhile carefully check the procedure and call your friendly Land Rover dealer to make sure you have the correct security code for your vehicle VIN.
False "IGNITION KEY IN" Message and inability to lock using remote:
If you keep getting the "IGNITION KEY IN" message when the key is not in, the BeCM thinks the key is in the ignition and is thoughtful enough not to let you remote lock the vehicle in case you lock your keys in. The microswitch that detects whether the key is in is probably staying in the "in" state because of the center of the lock barrel being a bit sticky. Often, just pushing on the center of the lock barrel will cause it to pop out, fixing the problem. Otherwise, just try reinserting the key and wiggling it in and out a bit to free up the mechanism. Alterenatively, you might try puffing (with an applicator) graphite powder into the lock. Usually it will free itself up -- this is much cheaper than buying a new lock!!
Inability to Disarm Alarm due to Failed, Lost or Desynchronized Remote:
The security/central locking portion of the shop manual describes a process (known as "Emergency Key Access" or EKA) for disarming the theft alarm and remobilizing the vehicle in the event that the handset fails while the vehicle is in superlocked mode. Each vehicle has a four digit EKA code which is needed for the procedure. The code is entered by turning the key the required number of times in the driver's door lock according to a prescribed sequence. For detailed information on this and the recovery procedure see the EKA Procedure section above. It might be worth a try if you are having alarm troubles.
Vehicle Battery Death While Vehicle Locked or Superlocked:
If you leave the headlights on or for some other reason the battery dies while your vehicle is locked or superlocked, strange things happen to the alarm system.
This seems to be one of the conditions that sometimes upsets the security system and requires you to use the Emergency Key Access method (see key/remote problems) to "reboot".
Another is when you jumper the battery to start the car, you can easily get locked out. When the power comes back on, the BeCM seems to try to return the vehicle to the locked state. At least one owner has reported that after gaining entry to his dead car with the manual key unlock, he put the key in the ignition and then went out and hooked up the battery jumper cables. Immediately, the vehicle locked him out. If all your keys are inside the vehicle at this point the situation is fairly bleak. So DON'T leave your keys in the vehicle if you get out. If you absolutely have to, at least leave the door or window open.
"Remote Battery Low" Message:
When you get the "Remote Battery Low" signal on the message display, take heed and renew the battery, especially if yours is a 1996 or later model with passive immobilization. On these models, if the battery dies entirely, the remote will not be able to transmit the code to the ECU to remobilize the vehicle and allow starting. (See procedure below under "weak reception from remote handset" before you give up though).
For battery replacement procedure see Key/Remote Problems and Solutions Page
Inoperability of Remote Due to Interference:
In the UK, a different frequency (433 MHz) from that in the US (315 MHz) is used for remote locking and several owners have experienced trouble using the remote to lock or unlock the vehicle when parked in places where a lot of radio interference is present, such as at airports. Joe Jeffrey reports a similar problem at his Petrol/gas filling station where there appears to be a magnetic field generated by an LPG pump which seems to interrupt not only the handset signaling the locks but also the handset talking to the BeCM when inserted into the ignition switch, preventing the car from starting. (He managed to get around this problem by manually locking the vehicle with the key in the door lock when he gets out at the station and then everything works fine when he gets back in).
The same radio frequency is also used for many remote control devices in Europe and Australia and there is the possibility that these devices may cause interference. A fix is now available (2004) from the UK dealer network in the form of an improved RF receiver, part number YWY500010, which is less subject to interference.
:shifty: Security/Alarm System Operation & Diagnosis 4.0/4.6/p38)
Introduction
Main System Components
Central Locking and Alarm Arming
Engine Immobilization
Unlocking, Disarming and Remobilization
Remote Handset Synchronization
EKA (Emergency Key Access)
Alternative Disarming Procedure
Security System Fault Diagnosis
More Information
Request for Input for This Page
Introduction
The designers of the Range Rover 4.0/4.6/P38A went overboard in the alarm and security department, presumably thinking that thieves would be keen on stealing such an expensive vehicle. Little did they realize that it would be one of the fastest depreciating vehicles ever, and the alarm system would merely be another electrical headache for owners. I have heard horror stories even about quite new Range Rovers being immobilized for weeks in the shop with alarm system problems. This page is an attempt to summarize accumulated owner knowledge on how the system operates, what the most common failures are and how to recover from them. Because the security system is so abominably complex and obscure, a better understanding of how it is supposed to operate should make fault diagnosis much easier.
I would like to thank Ron Beckett for helping compile and edit this page. If you can contribute additional information PLEASE email me!
Main System Components
BeCM, incorporating a Theft Alarm Unit (Z163) -- part of the BeCM (under right front seat).
Remote Handset.
Emergency keys (supplied with later model vehicles only).
RF Receiver (in loadspace under right rear parcel shelf) 315 MHz (North America), 433 MHz (UK and ROW).
Passive Immobilisation Coil (component Z270, surrounding the ignition switch barrel) 1996 & later NAS & some other markets.
Driver's Door Lock and "CDL" (Central Door Locking) switch.
Door lock actuators and "door open" switches on other doors, rear hatch and fuel filler.
Window and sunroof actuators and sensor switches.
Ultrasonic Volumetric Sensor (located at top of "B" pillar inside the vehicle).
Inertia Switch (behind right footwell trim panel) shuts off fuel and allows unlocking after a crash.
Under-hood alarm klaxon, and/or Battery Backed Up Alarm Sounder ("BBUS" -- some markets 1996 & later).
Central Locking and Alarm Arming
Central locking of all the doors can be done several different ways:
Pressing down either front sill locking button with the doors closed will lock all doors.
"Slam locking" (pressing a sill locking button and then closing the door) will lock all doors -- only on vehicles up to mid-1996.
Locking the driver's door with the key.
Pressing the lock button on the remote.
"All Close" locking: Holding the key in the lock position for over a second also closes the winndows and sunroof.
"Lazy Locking" (Most UK, Europe? but not NAS or Australia) -- Holding the remote button for over a second also closes the windows and sunroof.
"Superlocking" with key or remote by a double turn of the key or double press of the locking button on the remote.
Auto Relocking will occur if the vehicle is unlocked but no door openings, ignition key insertion or turn-on, or movement inside the vehicle are detected.
In cases 2 through 6 above, the alarm is armed to the "perimetric" mode in which it will be set off by opening any door, window, the rear hatch or the hood/bonnet. Engine cranking is disabled and and electronic engine immobilization is activated (more on this below).
In case 7, the "superlocking" mode energises an additional motor in each door lock actuator which disconnects the sill locking buttons so they cannot be used (e.g., by a burglar) for unlocking. If superlocking was done by the remote, and the windows and sunroof are closed, the ultrasonic volumetric alarm will also be activated. (If done by the key, a press on the remote locking button is still required before the volumetric alarm will be activated). In this mode, the alarm will be set off if any movement of a person or animal is detected inside the vehicle.
Engine Immobilization
Whenever the alarm system is armed (or, on 1996 and later models when passive immobilization is enabled -- see below -- when the ignition key is removed), the engine is immobilized. In this state, the Engine Control Module (ECM) will not operate normally unless it receives a mobilization code from the BeCM. Furthermore, if some clever thief jumpers the starter solenoid and manages to turn the engine over, it will do no good because a crank signal is detected by the engine ECM (via the engine crank sensor which is normally used to time the ignition and determine engine speed). This information is sent to the BeCM which puts an "ENGINE DISABLED" signal on the message center on the dash and continues to make it impossible to start the engine.
On 1996 and later models (UK, Europe? and some other markets, but not North America or Australia), the system was "improved" by adding a so-called "passive immobilization" feature (enabled in North America and some other markets) that activates engine immobilization whenever the key is removed from the ignition, regardless of whether or not the vehicle is subsequently locked or the theft alarm armed. A "passive immobilization coil" was added around the barrel of the ignition switch to trigger a code from the remote handset when it is inserted in the ignition, enabling remobilization (see remobilization section below). Presumably the theory behind this "improvement" is that a thief cannot start the vehicle even if you forgot to lock it and he can turn the ignition switch on without a key. (NOTE: This wonderful feature also requires you to leave the key in the ignition when changing the battery to avoid immobilization. See Battery Replacement page).
Photo above right by Ron Beckett, showing ignition switch barrel on a 1995 model, with no passive immobilization coil but with "key in" switch and wiring clearly visible. Cobwebs are due to this photo being taken in a partially dismantled vehicle at a wrecker's yard.
Unlocking, Disarming and Remobilization
The theft alarm is disarmed by pressing the unlocking button on the remote. The RF receiver located in the right hand side of the loadspace conveys this signal to the BeCm which decodes it and, if the code is correct, unlocks the doors and disarms the alarm. On 1995 models, the vehicle is then in an unarmed state.
On 1996 and later models with passive immobilization enabled (UK, Europe? but not North America or Australia), if the key is not inserted into the ignition within 30 seconds of unlocking with the remote handset or EKA procedure (see below), the BeCM reverts to the immobilized condition. The engine remains immobilized until the remote/key is inserted into the ignition, closing the "key in" switch and activating a "Passive Immobilization Coil" (Z270) around the barrel of the the ignition switch. The electromagnetic field from this coil excites a receiving coil in the remote key handset. If the remote is acting normally (for example, does not have a dead battery), it will then transmit a mobilization signal to the BeCM via the RF receiver. The BeCM then disarms the vehicle and remobilizes the engine.
On all models, when the unarmed state has been achieved, the BeCM transmits a mobilisation code to the engine ECM commencing 48 milliseconds after the ignition is turned on, and until it receives a confirmation signal from the ECM telling it to illuminate the "Check Engine" light (as an indication of correct operation) and allows engine cranking when requested. In turn, the ECM enables engine fuelling and proceeds to allow all engine controls to act normally.
Remote Handset Synchronization and Desynchronization
The remote handset uses a "rolling code" algorithm, meaning the code is changed every time remote locking or unlocking is performed. The BeCM stores the code sequence in its RAM and has a capture range of 100 codes after the previously received value, so should be able to remain synchronized with the handset unless more than 100 attempts have been made to operate the remote while out of range, or the remote's batteries are removed or die, or the vehicle's battery dies or is disconnected. That is the theory -- in real life it seems to lose synchronization more often, such as when the vehicle's RF receiver has been activated by other spurious sources of 315 MHz (or 433 MHz in other markets) transmissions.
Resynchronization is accomplished by performing a key lock or unlock within 30 seconds of requesting a remote lock, superlock, or unlock. The BeCM senses the change in state of the "CDL" (Central Door Locking) switch in the driver's door to initiate resynchronization.
On 1997 and later models (all markets?), "friendly synchronization" is provided whenever the key/remote is inserted into the ignition. The passive immobilization coil around the ignition barrel activates a pickup coil in the remote, causing the remote to transmit an unlock signal to remobilize the vehicle.
Resynchronization Exception Mystery:
The driver's handbook, shop manual and ETM all contradict their own instructions on resynchronization, stating that it cannot be achieved by the above procedures if the vehicle security system is "active" (Shop manual) or "armed" (driver's handbook). In this case, you have to resynchronize by the Emergency Key Access method (see below). These instructions do not make sense to me, since the alarm is nearly always armed if the vehicle is locked. Perhaps it means if the remote is desynchronized and the alarm has meanwhile been set off somehow, the EKA procedure has to be used for resynchronization. Or, perhaps the exception refers to when some malfunction is present. In any case, probably the best method of resynchronization is to first unlock the vehicle with the key so the alarm will be disarmed (if everything else is working right), then perform the synchronization routine. If you can shed light on this mystery, please email me.
Emergency Key Access ("EKA") Procedure
(Disarming Alarm & Starting Vehicle when Remote is Lost or Fails)
Overview and Instructions
The EKA procedure is provided as a back-up method of disarming the alarm and re-mobilizing the vehicle if all else fails. It uses a series of locks and unlocks with the key in the driver's door lock cylinder. From owner reports to date, this feature seems to be enabled on 1996 and later models in Europe, but not North America or Australia -- but see below for a generic EKA code procedure that works in North America. Iif you have more information on this please email me).
The manuals are vague and contradictory on when EKA might be necessary -- the shop manual says it is if you lock the vehicle with the remote handset and then you lose the remote or it fails. (This is understandable on models with passive immobilization which cannot be started without the remote, but the manuals are enigmatic on why this could happen on vehicles without passive immobilization). You still need the key part of the remote, or one of the spare mechanical keys supplied in later model years.
According to the manual, if the remote has failed or been lost and you try to open the door with just the mechanical key, the alarm will sound twice. (Of course, this does not make sense because you should be able to get into all models quite satisfactorily with just the mechanical key. Perhaps they are referring to situations when the remote has malfunctioned in a way that upsets the BeCM, or the alarm has been set off for some reason). If you then try to start the car, the message center will display "ENGINE DISABLED PRESS REMOTE OR USE KEY CODE". (This part makes sense on vehicles with passive immobilization, as described above, or perhaps if the alarm has been activated).
Make sure the doors, windows and bonnet/hood are closed, get out and lock the car again with the key. (Note: on 1996 and later models, you have to turn the key to the lock position four times for this step if the remote handset was not used to lock the vehicle). Then turn the key the required number of times according to the following sequence. (At each step the side lamps warning light on the dash will light to show it has recognized the input).
To enter the first digit, turn the key the required number of times to the unlock position.
To enter the second digit, turn the key the required number of times to the lock position.
To enter the third digit, turn the key the required number of times to the unlock position.
To enter the fourth digit, turn the key the required number of times to the lock position.
Turn the key to the unlock position to unlock the doors. The alarm will now be partially disarmed; if you try to open the hood the alarm will sound. After five incorrect attempts (3 for 1996 and later models) at this procedure, the BeCM goes into a 10 minute lockout mode (30 minutes for 1996 and later models), during which time the message center displays "KEY CODE LOCKOUT" and further attempts at EKA will not work.
The EKA code is supposed to be on your "security card" but I don't have one for my vehicle and Staffan Tjernstrom, who first alerted us to this information, mentions that getting it probably involves knowing your dealer very well, and maybe a few pints of good beer! Alex Rudd informs me that he has used the EKA method to recover from alarm problems, and that in the UK you can present or fax your owner's log book (or email a photo of it) to a Range Rover dealer to prove ownership, and they will give you the code.
Update February 2005: Confusion between LHD and RHD vehicles has been reported regarding this procedure. Alex Rudd from the UK reports "I have seen quite a few versions of using the EKA code on the net, most of which are wrong (I know, I've tried them all, and waited hours during the EKA Key Lockout session!). The correct one to follow is the version from the Range Rover handbook, which starts the key code entry on the clockwise turn - most of the others I have read refer to starting on an anti-clockwise turn, which then doesn't work." I think this contradiction is due to the difference in key lock direction between LHD and RHD vehicles (Alex's is a RHD model). This was confirmed by Ian Gibree who had to use the EKA on his Dutch-plated LHD Range Rover when interference from a cell phone tower stopped his remote from working. He used the procedure in his handbook starting withteh anti-clockwise turn and it worked. Thus it seems that the first turn should always be to the "unlock" position. If anyone has further clarification of this please email me.
Generic EKA Procedure on NAS Range Rovers
The EKA feature does not seem to be enabled on US vehicles, or Australian ones, and is not mentioned in their owners' handbooks. However there does seem to be an abbreviated version of the procedure available on NAS models, intended to be known only by Land Rover dealers and using a generic code (1515) for all vehicles. One US owner with a 2000 Range Rover had his vehicle stranded with a dead battery and no remote available, but when jumpering it got the message "Engine Disabled, Press Remote". Since he did not have a remote, he managed to reactivate the vehicle using a variant of the EKA procedure that the dealer confided -- the dealer was fairly sure that almost all NAS P38's have the same EKA code, which is:
Unlock once
lock 5 times,
unlock once,
and then lock 5 times.
Aidan confirms that he found out from Land Rover that the normal EKA is not applicable to US spec P38A Range Rovers, but the generic "null" code (1515) is used. For example, when replacing a BECM it asks for the code and a null # is inputted (1515).
Ove Sognnes from Norway reports that this worked on his also: "Range Rover Norway didn't supply me with the correct procedure for opening RR when remote is lost, but you did. Thanks again. Your procedure works perfectly on my 97 range rover hse, open door, lock 4 times, then starting procedure. Smashing."
Alternative Disarming Procedure
Steve reports that an alternative procedure for getting the system out of disabled mode is to connect the battery when the key is in position II. If you try this please let me know the results!! (Mike Coleman reports he tried it on his UK model when he did not have the correct EKA code available, but it did not work for him).
Security System Fault Diagnosis
"ALARM FAULT" Message:
The most common cause of the "ALARM FAULT" message being displayed on the Message Center is failure of the ultrasonic sensor (located above and to the side of the driver's head) which monitors the interior of the vehicle for intruders. The BeCM does a check on this sensor every time you switch the engine off and get out. If it does not work 5 consecutive times it generates the fault message when you have tried to activate it by superlocking the vehicle. Replacement of the sensor is simple, but the problem can also be caused by a bad connection. The Ultrasonic Sensor Repair page gives more details on how to diagnose and solve these problems.
"ENGINE DISABLED" Message:
This is displayed if an attempt is made to crank the engine (e.g., by jumpering the starter solenoid) while the alarm is armed or passive immobilization is in effect. Try pressing the unlock button on the remote; if this does not work you will have to use the EKA procedure.
"ENGINE DISABLED PRESS REMOTE OR USE KEY CODE" Message:
This message can mean you have tried to start a vehicle that has passive immobilization (e.g., 1996 and later North American models) with a malfunctioning remote or a dead remote battery. Or for some other reason when you are trying to start the engine, the alarm system is still armed or is in a bad mood. The solution is to try the EKA procedure.
"KEY CODE LOCKOUT" Message:
This means you have made several wrong attempts to use the EKA procedure to remobilize the vehicle; wait 10 minutes (30 minutes for 1996 and later models) and try again; meanwhile carefully check the procedure and call your friendly Land Rover dealer to make sure you have the correct security code for your vehicle VIN.
False "IGNITION KEY IN" Message and inability to lock using remote:
If you keep getting the "IGNITION KEY IN" message when the key is not in, the BeCM thinks the key is in the ignition and is thoughtful enough not to let you remote lock the vehicle in case you lock your keys in. The microswitch that detects whether the key is in is probably staying in the "in" state because of the center of the lock barrel being a bit sticky. Often, just pushing on the center of the lock barrel will cause it to pop out, fixing the problem. Otherwise, just try reinserting the key and wiggling it in and out a bit to free up the mechanism. Alterenatively, you might try puffing (with an applicator) graphite powder into the lock. Usually it will free itself up -- this is much cheaper than buying a new lock!!
Inability to Disarm Alarm due to Failed, Lost or Desynchronized Remote:
The security/central locking portion of the shop manual describes a process (known as "Emergency Key Access" or EKA) for disarming the theft alarm and remobilizing the vehicle in the event that the handset fails while the vehicle is in superlocked mode. Each vehicle has a four digit EKA code which is needed for the procedure. The code is entered by turning the key the required number of times in the driver's door lock according to a prescribed sequence. For detailed information on this and the recovery procedure see the EKA Procedure section above. It might be worth a try if you are having alarm troubles.
Vehicle Battery Death While Vehicle Locked or Superlocked:
If you leave the headlights on or for some other reason the battery dies while your vehicle is locked or superlocked, strange things happen to the alarm system.
This seems to be one of the conditions that sometimes upsets the security system and requires you to use the Emergency Key Access method (see key/remote problems) to "reboot".
Another is when you jumper the battery to start the car, you can easily get locked out. When the power comes back on, the BeCM seems to try to return the vehicle to the locked state. At least one owner has reported that after gaining entry to his dead car with the manual key unlock, he put the key in the ignition and then went out and hooked up the battery jumper cables. Immediately, the vehicle locked him out. If all your keys are inside the vehicle at this point the situation is fairly bleak. So DON'T leave your keys in the vehicle if you get out. If you absolutely have to, at least leave the door or window open.
"Remote Battery Low" Message:
When you get the "Remote Battery Low" signal on the message display, take heed and renew the battery, especially if yours is a 1996 or later model with passive immobilization. On these models, if the battery dies entirely, the remote will not be able to transmit the code to the ECU to remobilize the vehicle and allow starting. (See procedure below under "weak reception from remote handset" before you give up though).
For battery replacement procedure see Key/Remote Problems and Solutions Page
Inoperability of Remote Due to Interference:
In the UK, a different frequency (433 MHz) from that in the US (315 MHz) is used for remote locking and several owners have experienced trouble using the remote to lock or unlock the vehicle when parked in places where a lot of radio interference is present, such as at airports. Joe Jeffrey reports a similar problem at his Petrol/gas filling station where there appears to be a magnetic field generated by an LPG pump which seems to interrupt not only the handset signaling the locks but also the handset talking to the BeCM when inserted into the ignition switch, preventing the car from starting. (He managed to get around this problem by manually locking the vehicle with the key in the door lock when he gets out at the station and then everything works fine when he gets back in).
The same radio frequency is also used for many remote control devices in Europe and Australia and there is the possibility that these devices may cause interference. A fix is now available (2004) from the UK dealer network in the form of an improved RF receiver, part number YWY500010, which is less subject to interference.
