Security System Fault Diagnosis
The designers of the Range Rover 4.0/4.6/P38A went overboard in the alarm and security department, presumably thinking that thieves would be keen on stealing such an expensive vehicle. Little did they realize that it would be one of the fastest depreciating vehicles ever, and the alarm system would merely be another electrical headache for owners. I have heard horror stories even about quite new Range Rovers being immobilized for weeks in the shop with alarm system problems. This page is an attempt to summarize accumulated owner knowledge on how the system operates, what the most common failures are and how to recover from them. Because the security system is so abominably complex and obscure, a better understanding of how it is supposed to operate should make fault diagnosis much easier.
Main System Components
- BeCM, incorporating a Theft Alarm Unit (Z163) -- part of the BeCM (under right front seat).
- Remote Handset.
- Emergency keys (supplied with later model vehicles only).
- RF Receiver (in loadspace under right rear parcel shelf) 315 MHz (North America), 433 MHz (UK and ROW).
- Passive Immobilisation Coil (component Z270, surrounding the ignition switch barrel) 1996 & later NAS & some other markets.
- Driver's Door Lock and "CDL" (Central Door Locking) switch.
- Door lock actuators and "door open" switches on other doors, rear hatch and fuel filler.
- Window and sunroof actuators and sensor switches.
- Ultrasonic Volumetric Sensor (located at top of "B" pillar inside the vehicle).
- Inertia Switch (behind right footwell trim panel) shuts off fuel and allows unlocking after a crash.
- Under-hood alarm klaxon, and/or Battery Backed Up Alarm Sounder ("BBUS" -- some markets 1996 & later).
Central Locking and Alarm Arming
Central locking of all the doors can be done several different ways:
- Pressing down either front sill locking button with the doors closed will lock all doors.
- "Slam locking" (pressing a sill locking button and then closing the door) will lock all doors -- only on vehicles up to mid-1996.
- Locking the driver's door with the key.
- Pressing the lock button on the remote.
- "All Close" locking: Holding the key in the lock position for over a second also closes the winndows and sunroof.
In cases 2 through 6 above, the alarm is armed to the "perimetric" mode in which it will be set off by opening any door, window, the rear hatch or the hood/bonnet. Engine cranking is disabled and and electronic engine immobilization is activated (more on this below).
In case 7, the "superlocking " mode energises an additional motor in each door lock actuator which disconnects the sill locking buttons so they cannot be used (e.g. by a burglar) for unlocking. If superlocking was done by the remote, and the windows and sunroof are closed, the ultrasonic volumetric alarm will also be activated. (If done by the key, a press on the remote locking button is still required before the volumetric alarm will be activated). In this mode, the alarm will be set off if any movement of a person or animal is detected inside the vehicle.
Whenever the alarm system is armed (or, on 1996 and later models when passive immobilization is enabled -- see below -- when the ignition key is removed), the engine is immobilized. In this state, the Engine Control Module (ECM) will not operate normally unless it receives a mobilization code from the BeCM. Furthermore, if some clever thief jumpers the starter solenoid and manages to turn the engine over, it will do no good because a crank signal is detected by the engine ECM (via the engine crank sensor which is normally used to time the ignition and determine engine speed). This information is sent to the BeCM which puts an "ENGINE DISABLED" signal on the message center on the dash and continues to make it impossible to start the engine.
On 1996 and later models (UK, Europe? and some other markets, but not North America or Australia), the system was "improved" by adding a so-called "passive immobilization" feature (enabled in North America and some other markets) that activates engine immobilization whenever the key is removed from the ignition, regardless of whether or not the vehicle is subsequently locked or the theft alarm armed. A "passive immobilization coil" was added around the barrel of the ignition switch to trigger a code from the remote handset when it is inserted in the ignition, enabling remobilization (see remobilization section below). Presumably the theory behind this "improvement" is that a thief cannot start the vehicle even if you forgot to lock it and he can turn the ignition switch on without a key. (NOTE: This wonderful feature also requires you to leave the key in the ignition when changing the battery to avoid immobilization. See Battery Replacement page ).
Photo above right by Ron Beckett, showing ignition switch barrel on a 1995 model, with no passive immobilization coil but with "key in" switch and wiring clearly visible. Cobwebs are due to this photo being taken in a partially dismantled vehicle at a wrecker's yard.
Unlocking, Disarming and Remobilization
The theft alarm is disarmed by pressing the unlocking button on the remote. The RF receiver located in the right hand side of the loadspace conveys this signal to the BeCm which decodes it and, if the code is correct, unlocks the doors and disarms the alarm. On 1995 models, the vehicle is then in an unarmed state.
On 1996 and later models with passive immobilization enabled (UK, Europe? but not North America or Australia), if the key is not inserted into the ignition within 30 seconds of unlocking with the remote handset or EKA procedure (see below), the BeCM reverts to the immobilized condition. The engine remains immobilized until the remote/key is inserted into the ignition, closing the "key in" switch and activating a "Passive Immobilization Coil" (Z270) around the barrel of the the ignition switch. The electromagnetic field from this coil excites a receiving coil in the remote key handset. If the remote is acting normally (for example, does not have a dead battery), it will then transmit a mobilization signal to the BeCM via the RF receiver. The BeCM then disarms the vehicle and remobilizes the engine.
On all models. when the unarmed state has been achieved, the BeCM transmits a mobilisation code to the engine ECM commencing 48 milliseconds after the ignition is turned on, and until it receives a confirmation signal from the ECM telling it to illuminate the "Check Engine" light (as an indication of correct operation) and allows engine cranking when requested. In turn, the ECM enables engine fuelling and proceeds to allow all engine controls to act normally.
Remote Handset Synchronization and Desynchronization
The remote handset uses a "rolling code" algorithm, meaning the code is changed every time remote locking or unlocking is performed. The BeCM stores the code sequence in its RAM and has a capture range of 100 codes after the previously received value, so should be able to remain synchronized with the handset unless more than 100 attempts have been made to operate the remote while out of range, or the remote's batteries are removed or die, or the vehicle's battery dies or is disconnected. That is the theory -- in real life it seems to lose synchronization more often, such as when the vehicle's RF receiver has been activated by other spurious sources of 315 MHz (or 433 MHz in other markets) transmissions.
Resynchronization is accomplished by performing a key lock or unlock within 30 seconds of requesting a remote lock, superlock, or unlock. The BeCM senses the change in state of the "CDL" (Central Door Locking) switch in the driver's door to initiate resynchronization.
On 1997 and later models (all markets?), "friendly synchronization" is provided whenever the key/remote is inserted into the ignition. The passive immobilization coil around the ignition barrel activates a pickup coil in the remote, causing the remote to transmit an unlock signal to remobilize the vehicle.
Resynchronization Exception Mystery :
The driver's handbook, shop manual and ETM all contradict their own instructions on resynchronization, stating that it cannot be achieved by the above procedures if the vehicle security system is "active" (Shop manual) or "armed" (driver's handbook). In this case, you have to resynchronize by the Emergency Key Access method (see below). These instructions do not make sense to me, since the alarm is nearly always armed if the vehicle is locked. Perhaps it means if the remote is desynchronized and the alarm has meanwhile been set off somehow, the EKA procedure has to be used for resynchronization. Or, perhaps the exception refers to when some malfunction is present. In any case, probably the best method of resynchronization is to first unlock the vehicle with the key so the alarm will be disarmed (if everything else is working right), then perform the synchronization routine.
If the usual Synchronization Procedure Does Not Work:
If after replacing batteries and attempting the usual resynchronization procedure it still does not work, you can probably get the remote to work again using a special procedure (formerly known only to dealers) that is used to program new remotes. See the section on "Replacing and Reprogramming Remote Handset" on the Replacement and Reprogramming page. above procedures,
Emergency Key Access ("EKA") Procedure
(Disarming Alarm & Starting Vehicle when Remote is Lost or Fails)
Overview and Instructions
The EKA procedure is provided as a back-up method of disarming the alarm and re-mobilizing the vehicle if all else fails. (For another equally good if not better method see the "Key in Position II" procedure below ). It uses a series of locks and unlocks with the key in the driver's door lock cylinder. From owner reports to date, this feature seems to be enabled on 1996 and later models in Europe, but not North America or Australia -- but see below for a generic EKA code procedure that works in North America.
The manuals are vague and contradictory on when EKA might be necessary -- the shop manual says it is if you lock the vehicle with the remote handset and then you lose the remote or it fails. (This is understandable on models with passive immobilization which cannot be started without the remote, but the manuals are enigmatic on why this could happen on vehicles without passive immobilization). You still need the key part of the remote, or one of the spare mechanical keys supplied in later model years.
According to the manual, if the remote has failed or been lost and you try to open the door with just the mechanical key, the alarm will sound twice. (Of course, this does not make sense because you should be able to get into all models quite satisfactorily with just the mechanical key. Perhaps they are referring to situations when the remote has malfunctioned in a way that upsets the BeCM, or the alarm has been set off for some reason). If you then try to start the car, the message center will display "ENGINE DISABLED PRESS REMOTE OR USE KEY CODE". (This part makes sense on vehicles with passive immobilization, as described above, or perhaps if the alarm has been activated).
Make sure the doors, windows and bonnet/hood are closed, get out and lock the car again with the key. (Note: on 1996 and later models, you have to turn the key to the lock position four times for this step if the remote handset was not used to lock the vehicle). Then turn the key the required number of times according to the following sequence. (At each step the side lamps warning light on the dash will light to show it has recognized the input).
- To enter the first digit, turn the key the required number of times to the unlock position.
- To enter the second digit, turn the key the required number of times to the lock position.
- To enter the third digit, turn the key the required number of times to the unlock position.
- To enter the fourth digit, turn the key the required number of times to the lock position.
Turn the key to the unlock position to unlock the doors. The alarm will now be partially disarmed; if you try to open the hood the alarm will sound. After five incorrect attempts (3 for 1996 and later models) at this procedure, the BeCM goes into a 10 minute lockout mode (30 minutes for 1996 and later models), during which time the message center displays "KEY CODE LOCKOUT" and further attempts at EKA will not work.
The EKA code is supposed to be on your "security card" but I don't have one for my vehicle and Staffan Tjernstrom, who first alerted us to this information, mentions that getting it probably involves knowing your dealer very well, and maybe a few pints of good beer! Alex Rudd informs me that he has used the EKA method to recover from alarm problems, and that in the UK you can present or fax your owner's log book (or email a photo of it) to a Range Rover dealer to prove ownership, and they will give you the code.
Update February 2005. Confusion between LHD and RHD vehicles has been reported regarding this procedure. Alex Rudd from the UK reports "I have seen quite a few versions of using the EKA code on the net, most of which are wrong (I know, I've tried them all, and waited hours during the EKA Key Lockout session!). The correct one to follow is the version from the Range Rover handbook, which starts the key code entry on the clockwise turn - most of the others I have read refer to starting on an anti-clockwise turn, which then doesn't work." I think this contradiction is due to the difference in key lock direction between LHD and RHD vehicles (Alex's is a RHD model). This was confirmed by Ian Gibree who had to use the EKA on his Dutch-plated LHD Range Rover when interference from a cell phone tower stopped his remote from working. He used the procedure in his handbook starting withteh anti-clockwise turn and it worked. Thus it seems that the first turn should always be to the "unlock" position.
Careful if your BeCM has been Replaced: Now that some owners have changed the BeCM in their vehicles, be sure you have the right key code for your vehicle before you try this procedure. Alex Zahariev reports (May 2009) trying it on his 95 model with the correct code for his VIN, but after a few tries he got the "Key Code Lockout" message and the shop had to physically cut the door open. It turned out that his BeCM was a replacement from a later model salvage vehicle and had been changed when his 95 had been flooded.
Generic EKA Procedure on NAS Range Rovers
The EKA feature does not seem to be enabled on US vehicles, or some Australian ones, and is not mentioned in their owners' handbooks (but see "rest of world " section below). However there does seem to be an abbreviated version of the procedure available on NAS models, intended to be known only by Land Rover dealers and using a generic code (1515) for all vehicles. One US owner with a 2000 Range Rover had his vehicle stranded with a dead battery and no remote available, but when jumpering it got the message "Engine Disabled, Press Remote". Since he did not have a remote, he managed to reactivate the vehicle using a variant of the EKA procedure
that the dealer confided -- the dealer was fairly sure that almost all NAS P38's have the same EKA code, which is:
lock 5 times,
and then lock 5 times.
Aidan confirms that he found out from Land Rover that the normal EKA is not applicable to US spec P38A Range Rovers, but the generic "null" code (1515) is used. For example, when replacing a BECM it asks for the code and a null # is inputted (1515).
Ignatius Wong wrote in to say the generic 1515 code he got from this page also worked on his 1996 Discovery when it its alarm system froze everything and prevented him from turning over the engine. starting the vehicle.
Rest of World:
Kieran McCoey reports from Australia that in the case of his '97 build, '98 reg 4.0 rangie the EKA procedure does definitely work (here we are speaking of the method requiring a special code for each vehicle, not the generic code). "I've had to use it a few times, when inadvertently parked next to mobile phone towers. (In fact, there is a spot in a popular skiing town we frequent notorious for immobilising Land Rovers!)." The method he used is a little different from that described above. He describes the method given in his owner's handbook as follows: To initiate the procedure, one must first turn the key anticlockwise (locking the car) 4 times. The 4-digit EKA code can then be entered- first clockwise, then anti, etc. After all 4 numbers have been entered, turn once more clockwise to unlock the vehicle, disarm the alarm, and re-mobilise the engine.
Ove Sognnes from Norway reports that the generic code worked on his also: "Range Rover Norway didn't supply me with the correct procedure for opening RR when remote is lost, but you did. Thanks again. Your procedure works perfectly on my 97 range rover HSE, open door, lock 4 times, then starting procedure. Smashing."
Tip: Check Door Handle If Vehicle Will Not Accept Code:
Shaun Dale, an Autodiagnostician in the UK, had a P38 that would not accept the EKA code to re-initialise the system. The alarm made a beep every time he opened the driver's door. The problem was traced to a sticky/corroded driver's door handle. If the door handle is not fully retracted, the system will not accept the EKA. A squirt of WD40 or similar and a vigorous working of the handle enabled him to put the code in. This seems to be a relatively common symptom as it was suggested as a possible cause by a main dealer.
Shaun notes that when the vehicle is immobilized, diagnosis is rather hit and miss on early models such as the one he was working on. This is because the vehicle will not talk to T4 diagnostics if immobilised, whereas later models will.
Alternative "Key in Position II" Disarming Procedure
An alternative procedure for getting the system out of disabled mode is to disconnect the battery, and reconnect it with the key in position II. Steve Glover of New Zealand tried this with great success on his 1999 Range Rover Autobiography. "We recently lost the only key that worked by remote on the vehicle. Our second key had stopped working remotely on the vehicle a couple of years ago, our dealership told us it was impossible to fix and we needed to buy a new one. We used this key to try the “key turn method” of EKA but to no avail no matter how it was done it would not disarm the alarm. We then towed the vehicle home with the alarm tooting its head off. We kept trying the key turn method at home but [it had no effect]." Steve offer the following details of how he succeeded with the alternative "key in position II" procedure:
1/ Open the Vehicle manually with the key (the alarm will be going off the whole time) and open the bonnet (it is extremely Important to leave the bonnet and the door open or you may be locked out).
2/ Disconnect the main 12 volt vehicle battery.
3/ Put key in ignition and turn to position II.
4/ Reconnect the Battery.(window unset alarms will be going off)
5/ Start the engine then push the lock and unlock buttons on the key while the engine is running.
6/ Open and close all the windows to reset them.
7/ You are done.
For Steve, the method worked better than expected. It not only reset the alarm and engine immobilizer, it also made the second key work as a remote again! Steve even feels this method might be the first one you try instead of the EKA method. Mike Coleman reports he tried it on his UK model when he did not have the correct EKA code available, but it did not work for him. However Jimmy Kander reports that he tried it on his 1999 with great success: " I have a 99 black North American Range Rover. The stupid thing wouldnt start saying engine disabled, check remote. The key turning did not work, but disconnecting the battery and reconnecting it with the key in position 2 worked!"
Security System Fault Diagnosis
"ALARM FAULT" Message:
The most common cause of the "ALARM FAULT" message being displayed on the Message Center is failure of the ultrasonic sensor (located above and to the side of the driver's head) which monitors the interior of the vehicle for intruders. The BeCM does a check on this sensor every time you switch the engine off and get out. If it does not work 5 consecutive times it generates the fault message when you have tried to activate it by superlocking the vehicle. Replacement of the sensor is simple, but the problem can also be caused by a bad connection. The Ultrasonic Sensor Repair page gives more details on how to diagnose and solve these problems.
"ENGINE DISABLED" Message:
"ENGINE DISABLED PRESS REMOTE OR USE KEY CODE" Message:
"KEY CODE LOCKOUT" Message:
This means you have made several wrong attempts to use the EKA procedure to remobilize the vehicle; wait 10 minutes (30 minutes for 1996 and later models) and try again; meanwhile carefully check the procedure and call your friendly Land Rover dealer to make sure you have the correct security code for your vehicle VIN.
False "IGNITION KEY IN" Message and inability to lock using remote:
If you keep getting the "IGNITION KEY IN" message when the key is not in, the BeCM thinks the key is in the ignition and is thoughtful enough not to let you remote lock the vehicle in case you lock your keys in. The microswitch that detects whether the key is in is probably staying in the "in" state because of the center of the lock barrel being a bit sticky. Often, just pushing on the center of the lock barrel will cause it to pop out, fixing the problem. Otherwise, just try reinserting the key and wiggling it in and out a bit to free up the mechanism. Alterenatively, you might try puffing (with an applicator) graphite powder into the lock. Usually it will free itself up -- this is much cheaper than buying a new lock.
Inability to Disarm Alarm due to Failed, Lost or Desynchronized Remote:
The security/central locking portion of the shop manual describes a process (known as "Emergency Key Access" or EKA) for disarming the theft alarm and remobilizing the vehicle in the event that the handset fails while the vehicle is in superlocked mode. Each vehicle has a four digit EKA code which is needed for the procedure. The code is entered by turning the key the required number of times in the driver's door lock according to a prescribed sequence. For detailed information on this and the recovery procedure see the EKA Procedure section above. It might be worth a try if you are having alarm troubles.
Vehicle Battery Death While Vehicle Locked or Superlocked:
If you leave the headlights on or for some other reason the battery dies while your vehicle is locked or superlocked, strange things happen to the alarm system.
This seems to be one of the conditions that sometimes upsets the security system and requires you to use the Emergency Key Access method (see key/remote problems) to "reboot".
Another is when you jumper the battery to start the car, you can easily get locked out. When the power comes back on, the BeCM seems to try to return the vehicle to the locked state. At least one owner has reported that after gaining entry to his dead car with the manual key unlock, he put the key in the ignition and then went out and hooked up the battery jumper cables. Immediately, the vehicle locked him out. If all your keys are inside the vehicle at this point the situation is fairly bleak. So DON'T leave your keys in the vehicle if you get out. If you absolutely have to, at least leave the door or window open.
"Remote Battery Low" Message:
When you get the "Remote Battery Low" signal on the message display, take heed and renew the battery, especially if yours is a 1996 or later model with passive immobilization. On these models, if the battery dies entirely, the remote will not be able to transmit the code to the ECU to remobilize the vehicle and allow starting. (See procedure below under "weak reception from remote handset " before you give up though).
Inoperability of Remote Due to Interference:
In the UK, a different frequency (433 MHz) from that in the US (315 MHz) is used for remote locking and several owners have experienced trouble using the remote to lock or unlock the vehicle when parked in places where a lot of radio interference is present, such as at airports. Joe Jeffrey reports a similar problem at his Petrol/gas filling station where there appears to be a magnetic field generated by an LPG pump which seems to interrupt not only the handset signaling the locks but also the handset talking to the BeCM when inserted into the ignition switch, preventing the car from starting. (He managed to get around this problem by manually locking the vehicle with the key in the door lock when he gets out at the station and then everything works fine when he gets back in).
The same radio frequency is also used for many remote control devices in Europe and Australia and there is the possibility that these devices may cause interference. A partial fix became available in 2004 from the UK dealer network whereby the stock RF receiver (Part # AFR1953) was superceded by a new one (YWY500010) which was less subject to interference, but did not completely cure the interference problem. Accordingly, this has since been superceded by an even newer design, part number YWY500170. Owners with this latest update have not reported any further problem.
Photo at Right: RF Receiver for alarm system, located on top of rear seatback support under right rear parcel shelf. It is accessed by removing the parvcel shelf trim. Rear seatback latch is at top right of photo. Note connection to window antenna at bottom of picture. Photo courtesy of Ron Beckett.
Unexplained Battery Drain:
Several owners have complained of unexplained battery drain when parked in certain areas like airports where a lot of RF energy is present, or in large parking lots where other vehicles with remote locking systems come and go. The problem is that the radio interference (and/or radio frequency energy from other peoples' remote locking handsets) gets received by the RF receiver which "wakes up" the BeCM from sleep mode, increasing its current drain to about one amp instead of a few milliamps. Paul Jameson of Avon Diagnostics reports that all remotes use the same frequency, and the Range Rover system does not bother to determine whether the code contained in the RF signal is a Range Rover one before waking up the BeCM. The battery can easily be dead after a few days of this. Meanwhile Jeffrey Upton came up with his own solution (he lives near Logan Airport in Boston and suffered this problem frequently). He disconnected the leads between the window RF antenna and the receiver. In this condition the remote still works fine as long as you are within a couple of feet of the vehicle, but the effect of external radio interference is eliminated! Andrew Walne came up with an even better idea -- installing a switch to control the RF receiver. See much more info on mysterious battery drain and Andy's cure on the Mysterious Battery Drain Page.
Weak Reception from Remote Handset:
As the battery in the remote handset dies the signal it produces will become weaker. If you want or need to use the remote habdset (eg to disable the alarm) when teh barttery is weak, it is worth knowing that the antenna for the RF receiver is at the front of the right rear querter window glass. Holding the remote close to this location or even against the glass will increase your chances of successful operation.
Failure of Remote Central Locking due to Fuse Burnout:
Richard Corbett reports that his remote central locking suddenly stopped working. His local RR repairer mentioned a similar problem where one of the main fuses (60 to 80 amp ones) was blown but arced over again & was continually making & breaking within the fuse. On initial inspection of Rochard's fuses all looked OK, but when he held them up to a strong light he could see that one of the ones that provides power to the BeCM (BeCM fuses 12 thru 15) was actually blown, discoloured the plastic holder slightly & was making & breaking contact. I replaced it, problem solvered.
Unsolicited Locking and Unlocking by Remote:
I have found that the remote can sometimes easily be trigered in my pocket just by touching or bumping it. TSBartel reports a similar issue: "My 2000 Range Rover 4.0 had a tendency to repeatedly lock and unlock the doors while driving and occasionally while parked. This problem has happened twice since I've owned the car. The service personnel swear the issue is not the key fobs, but each time I've replaced the batteries and button keys (both very inexpensive) the problem has stopped within a couple of days and stayed corrected for a couple of years. Try this before going on to other, more expensive approaches. The batteries and rubber buttons should be replaced every few (3?) years anyway. Change the batteries and buttons at the dealership, you may need to reset the code on the fob - which is quite simple." For detailed info on changing the batteries and nuttons, see the key/remote problems and solutions page.
No Response to EKA Code:
I have heard one case where entering the EKA code did not have any effect, due to a bad lock switch. Jacob Lund had an unexpected battery drain and after replacing the battery the engine was disabled/locked and the remote did not work. To enable the engine and start the car he tried the EKA procedure without success. Each time he tried to start the engine after having gone through the EKA procedure the "Engine Disabled" message came up. ALso, there was no response at all when he did the EKA procedure (no clicks, no lights blinking, no signals on the dashboard, etc) only the central locking system switching on and off. After four days at an authorized service shop with a TestBook, the problem turned out to be the lock switch (the one that recognizes the turns of the key when you "enter" the EKA code manually).
Symptoms that may be due to Fuse Box Problems:
A number of owners have reported problems (such as random cranking of the engine by itself, inability to start the engine, gearbox failure messages, error messages about the windows not set, and others) that might lead one to believe thre are alarm or BeCM issues, but have been traced to Engine Compartment Fusebox.bad connections and failures. These are addressed on the Engine Compartment Fusebox diagnosis and repair page.