We moved house over the weekend and spent our first night in the new place on Saturday. Sunday morning got in the car, turned the ignition on and the Message Centre came up with, Alarm Triggered, Ignition Tamper. Never seen that one before but didn't think too much about it. Got into it this evening and it came up with the same message. As I've not heard the alarm for quite some time checked it earlier by locking the car with one window open then pulling up the sill button and opening the door. Sounder is definitely working and I think I would have heard it as the car was parked under the bedroom window which was wide open (humping furniture on the hottest weekend since records began is not a fun game). Owners handbook says that Ignition Tamper is caused by "turning the starter switch on was the cause of the alarm system triggering". To me this means that the starter operating on it's own would cause this and according to some on RR.net, the starter operating when it feels like it is a sign of a failing fusebox. Fusebox was changed for a brand new one about a year ago, so unlikely to be that and I think I would have heard the starter turning the engine over. Anyone else ever come across this one? I'll wait and see if it gives me the same message in the morning.......

Now it is getting really weird. Found a receiver and tuned it to 433.95 MHz (which took some doing as most things are still in boxes) and found almost continuous bursts of data, so it looks like every neighbour for half a mile has a wireless weather station. Sat in the car and waited for the BeCM to go to sleep, which it did, but almost immediately the receiver picked up a burst of data and it woke up again. Then, while waiting to see if it would go back to sleep, the dash beeped at me and "Interior Lights Off" came up. Opened the door and sure enough, no interior lights. Turned them back on and left it for another day. Fortunately I've got the hoofing great Hankook battery on it so it won't go flat by morning but it definitely looks like I'm going to be in the market for a Gen 3 receiver.

Surely "Ignition Tamper" would be down to the ignition switch rather than the fusebox? The BECM reads the switch and decks a pin to pull the starter relay in, it's not wired directly.

Ahh, so it’s my bloody neighbour who used to wipe out my battery when I had the dse, he’s got weather station, temperature sensor, plus 2 more in each greenhouse think I need to find a signal jammer for a laugh.

I thought about that as I have the capability of producing a considerable amount of power on the frequency. Then realised that it would affect me too.......

And it would be a bit embarassing if the neighbour had the naus to put in a complaint to OFCOM :)
(although I guess you'd get to work from home that day!)

I work from home a couple of days a week anyway, a 15 minute job to do takes at least 3 hours to do the paperwork these days! Although it could be an amusing and simple case, or, better still, a really complicated one as the interference would go off whenever I went to investigate.

Got in it this morning and exactly the same, Alarm Triggered, Ignition Tamper. I'll try disconnecting the RF receiver for a couple of days to confirm it is an RF problem.

Found the source, an own goal, sort of. Checked the car this morning and still the same Ignition Tamper message. Got the spectrum analyser out of the works motor and found that my fob operates on 433.9675 MHz, but there was a very regular data burst on 433.9680 MHz so no chance of filtering that out. It was also very strong, like ridiculously strong, like -48dBm (for those that understand it) but weaker outside the house. House has a wireless thermostat fitted to the central heating system and it's that thing. Quite why it is sending a burst every few seconds even when the heating is switched off and the temperature is stable is anyone's guess but it is. Or it was, now I've taken the batteries out of it, it isn't. I'll need to look up how it is supposed to work, maybe it is expecting to get a reply from the boiler but as that is switched off it isn't so is constantly shouting to it.

There's other signals floating around in the band but at much lower levels so I suppose I now have to wait and see if has cured the Ignition Tamper message and will let the BeCM go to sleep and stay that way.

Enjoyed reading this, it almost puts a James Bond slant on diagnostics! Always been interested in radio but never been into it at anything like your level. I usually expect to see spectrum analysers in cars right next to the graphic equaliser ;-)

I believe that boilers that use a wireless link to thermostat usually have a wired thermostat option too. But then whether you chose to fit a wired stat or work on the car instead would depend on whether a wired stat would disable the bursts, necessary wiring route, cost of stat and wiring, whether you'd rather work on the car or boiler, if you think it better to upgrade the car's electronics so the same won't happen outside other houses.

Wireless stat here too but never had a problem with P38s in the yard - different frequency?

Checked a few minutes ago and no Ignition Tamper or any other messages, so switching off the stat had had the desired affect. Googled the stat and found the manual for it. It should send a burst every 10 minutes not every 20 seconds so whether the batteries are getting low of it is getting offended because the boiler is off, I don't know. However, there's no handshake, it transmits blind so it shouldn't matter if the boiler is off anyway. A bit more investigation needed but even every 10 minutes is still about 12 hours too short, I would have thought a burst whenever it needs the boiler turning on or off would be sufficient.

Virtually all the stats work on 433 MHz, I've found a couple of newer ones that run on 868 MHz but I suspect most that are out there are on 433 so the same frequency as a P38. I think the Ignition Tamper may be something to do with the actual code that is being sent (which is configurable in the stat) so I'll try changing that to start with. The main problem is that the burst of data wakes up the BeCM so that instead of the car drawing around 20mA when standing doing nothing, it draws a couple of Amps so the battery can go flat when left for a while. You may even have had a P38 battery go flat while working on it and put it down to the doors being left open or the battery just being a bit tired but it could well have been your wireless thermostat that caused, or at least helped, contribute to it.

I wonder how easy it would be to make a dangly dongle for the RF module that detects incoming pulses, decides if they look like plausible fob signals, and passes them on to the BECM? Probably Marty could wade in on this one, but it shouldn't be much harder than just detecting what looks like valid sync from the the fob.

It is as simple as that - on the surface. I've been working on one for ages, and know how to filter it. It took me a lot of research to find out what I thought was the best way of doing the filtering - but I had a slight advantage in the fact I probably have 20-30 working P38 fobs here, from different locksets, so I could capture data from all of them and compare it, to find the best way of doing it that would be universal, rather than unique for each lockset.

I think Jack was working on one solution last year, after he and I discussed it and I shared how I figured the best way of filtering it was. I think he even got a working solution - but I haven't heard anything more about it.

I've also shared the information with Sloth, as he has a mate who is good at coding, and from what I understand, they have a working solution aswell - which is undergoing a bit of refinement, and then will be ready for testing. It's being designed as a 'plug and play' solution, so it won't matter what receiver you have - it will go inline and filter the P38 fob signal out, and block everything else to keep the BECM asleep.

I had a go at coding one myself, and I could get it to receive the information as a serial stream, and even parse it, and retransmit it out - but the timing on the transmitted signal was out, compared to what came in - so even though the signal was identical, the timing between pulses wasn't correct, so it did nothing when it was plugged into the vehicle. On a logic analyzer, it looked pretty close - but not close enough.

Hopefully there will be a solution soon that will be available to the wider P38 community at a fraction of the cost of the LR version... hopefully I'll be allowed to sell them in my webshop...

That makes me wonder, could you just read in a different key and emulate an LR key? So that way you could use a remote locking fob that's relatively easy to get hold of instead of trying to repair or reprogram LR keys.

As Marty said I had a working prototype last year that would filter the incoming data then only transmit to the BECM if it passed some checks.

I had it running in my car for a while then I moved house and forgot about it.

No. Well yes, but to do so would mean defeating the rolling code and that is information that could then be used to defeat the alarm on any other P38, so is certainly not something we would be disclosing. You'd also need to keep your emulator in sync... I'm sure I'm theory it shouldn't lose sync normally.. but hey that's theory.

If you don't want to use original P38 keys, there are other ways to use aftermarket remote locking kits. You lose the extra functionality like superlocking, lazy locking/unlocking though.

gordonjcp wrote:

That makes me wonder, could you just read in a different key and emulate an LR key? So that way you could use a remote locking fob that's relatively easy to get hold of instead of trying to repair or reprogram LR keys.

Not easily - As Nick says, you would need to work out the rolling code for that, and whilst you could in theory build a box which is triggered by an external source (say another fob/RF unit). That would be more work though as you would have to program the box basically as a fob... And you'd then have to sync that... But it would also only have one valid fob code, so even if you had multiple other remotes controlling it, you would only have one fob ID the BECM sees.

In theory, cracking the rolling code would help with being able to program some form of aftermarket fob to replace the P38 one but be able to make it different to an existing key for example.

Gilbertd wrote:

Found the source, an own goal, sort of. Checked the car this morning and still the same Ignition Tamper message. Got the spectrum analyser out of the works motor and found that my fob operates on 433.9675 MHz, but there was a very regular data burst on 433.9680 MHz so no chance of filtering that out. It was also very strong, like ridiculously strong, like -48dBm (for those that understand it) but weaker outside the house. House has a wireless thermostat fitted to the central heating system and it's that thing. Quite why it is sending a burst every few seconds even when the heating is switched off and the temperature is stable is anyone's guess but it is. Or it was, now I've taken the batteries out of it, it isn't. I'll need to look up how it is supposed to work, maybe it is expecting to get a reply from the boiler but as that is switched off it isn't so is constantly shouting to it.

There's other signals floating around in the band but at much lower levels so I suppose I now have to wait and see if has cured the Ignition Tamper message and will let the BeCM go to sleep and stay that way.

When I checked my RF levels my wireless thermostat is on 933MHz, whatever is on 433, including my SWMBO installed wireless doorbell, is very powerful. It killed my old battery and I had the dancing locks and lights. I undid the antenna and now just use the handraulic method with the key in the lock.

If anyone is interested you can purchase a £10 ish dvb dongle (marketed as SDR's - software defined radio) and use software such as SDR console spectrum analyser on a laptop to check your RF levels. I also use it to see if my batteries in the key fobs need changing before they die on me and I have to reprogram the key fobs. I hate that job.

Mukiwa wrote:

When I checked my RF levels my wireless thermostat is on 933MHz,

I hope it isn't, that's in the middle of the O2/Voda downlink band. It'll be on 433 (most likely) or 868 if it's very new. My stat should, according to the manufacturers data sheet, transmit every 10 minutes (no idea why, I would have thought only when something needs to change would be quite sufficient) rather than every 20 seconds or so. I'll deal with it once it gets to the stage that the heating is actually needed. Probably screen part of it so it fires it's signal up the stairs to the boiler and not outside to the car. Be wary of what you see from an SDR, they are barn door wide on the front end and will see harmonics and spurious that aren't really there. Then again, having 32 grands worth of portable spectrum analyser as personal issue means I'm a bit spoilt......

SDR Tech is very cool though. One day, when I have some time... etc etc

Gilbertd wrote:

Mukiwa wrote:

When I checked my RF levels my wireless thermostat is on 933MHz,

I hope it isn't, that's in the middle of the O2/Voda downlink band. It'll be on 433 (most likely) or 868 if it's very new. Then again, having 32 grands worth of portable spectrum analyser as personal issue means I'm a bit spoilt......

You are correct - brain fart my end - I wrote it on the back 868.2MHz. I do see a lot of harmonics etc on the cheaper usb dongles, but I don't really have any interest at the higher frequencies I just like to see what I can see (hear) sometimes. It started when I wanted to use a pc as a tv server with Myth TV and grew from there!

I wish I had a spec anny that good hahaha. I have different SDR's and dongles and even one set up at my mum's house doing ADS-B because my dad is a plane buff. I showed him the maps and flight aware stuff and he spends hours watching it.