rangerovers.pub
The only place for a coil spring is up Zebedee's arse
Member
Joined:
Posts: 720

gordonjcp wrote:

So have we got an idea what sort of header the key receiver is looking for? Sounds like the sort of thing an "aftermarket" box could be created for.

Unfortunately it's not really the header that is the most significant part but the (proprietary) rolling code immediately behind it that counts !

Member
Joined:
Posts: 1306

I have some crude waveforms that I captured on my laptop from the fob transmissions on a few different key fobs - but I really need to get a logic analyzer to do it properly...

I think jackkkk managed to capture some transmissions with a logic analyser though - but on my crude capturings, the following was observed...

Fob Streams

As you can see, the start of each transmission (some of these were from the same fob, but a couple were from different fobs) is identical, and this is the only way I can think of that the Gen 3 receiver can filter P38 transmissions out from everything else without it being coded to the vehicle to decode the transmission. I'm sure jackkk tested this with a P38 fob and an L322 fob on a gen 3 receiver and got a data stream out from the P38 fob, but not from the L322 one.

Member
Joined:
Posts: 720

I have to admit that when I went through all this ( and all the associated hassle and inconvenience of course ) I eventually gave up and resorted to e-bay and used a " 12V RF relay 2CH " (at about a tenner with two fobs.....)

Although it meant I would have to carry an additional fob around at least I could use it for two really irritating p38 'features' so I can now, and with the press of a button:
1) Cut off the power to that garbage LR Gen 1 Rcvr. (and remove bogus RF BECM wake-ups and lock-outs etc)
2) Cut off power to the EAS relay whilst parked (and remove those BECM wake-ups and its 'overnight bag dance')

After all the lock-outs and flat batteries etc I really could not bring myself to buy a £300 LR rip-off Gen 3 Rcvr. due to their really dire original design/s !

Now also considering a 4CH device (eg. see ebay item 371891099809) so I can just flash my lights (and/or indicators) remotely too.....
(Note that this cheap Chinese RF/433 stuff often has quite a range and so may affect other Gen 1 Rcvrs. so must be used wisely !)

Member
avatar
Joined:
Posts: 7861

After almost 7 years of ownership and only having to resort to the EKA code three times, I've had to do it twice today! Seeing as it's a bank holiday weekend and I've got a few things to do around the house in anticipation of an engagement party here for my daughter in a couple of weeks, I went to the local Wickes. Locked the car with the fob as I always do, found they only had half of what I needed, came out and it wouldn't unlock on teh fob. Used the key in the hole and only the drivers door opened, no central locking. Used the Nano to enter the EKA code and set off for B&Q. As I would be passing my approved motor factors, pulled in there, synced the fob in the door lock and locked it with the fob. Bought a set of NGK BCPR6ES plugs to do the swap with Rutland Rover, unlocked car with the fob as normal and carried on to B&Q. Locked with the fob, went in and paid their extortionate price for the couple of things Wickes didn't have, came out and it wouldn't unlock on the fob again. Exactly the same as in Wickes car park. Out with the Nano again and drove home. Synced the fob again and I've since been out again and no problems this time.

I think I'm going to start carrying a spectrum analyser around with me to see if it is an RF problem. But if it is, why could I lock it but not unlock it?

Member
Joined:
Posts: 2312

Bit of corrosion in the unlock switch on the fob?
Batteries in fob getting tired?
Other similar fobs near to you transmitting while you were off shopping and confusing the receiver?
I'm going with an RF problem- maybe Wickes and B&Q have a special on wireless doorbells, garage openers or wireless smoke detectors?!
Do you have a Gen 3 receiver?

Member
Joined:
Posts: 1306

Because that's how the alarm system works - it's designed so that if you lock it with the fob and some cheeky bugger has managed to get a copy of the key blade - then if you lock it with the fob, it won't let you unlock with the key in the door without entering the EKA.

Any time you need the EKA to be entered, the drivers door only will unlock until the EKA has been accepted, so what it's doing is normal.

If you lock it with the key in the door, not the fob, then you should be able to go back an unlock it with the key in the door, with no problems.

Must be some form of crazy RF which is stopping your fob transmission to get through to the receiver and BECM..

Member
avatar
Joined:
Posts: 7861

I'm also thinking an RF problem which is why I'll be taking the small analyser out of the works van and bunging it in the car. I know if you lock on the fob you must unlock on the fob otherwise the EKA is needed but if the RF was there constantly, surely I'd have a problem locking with the fob too. Fob batteries are no more than 6 months old, the LED lights when either button is pressed and once I've re-synced, it works perfectly and has done everywhere else since.

and if I do find a constant signal on 433 from either Wickes or B&Q, I'll be raising a case at work so it can be turned off.......

Member
Joined:
Posts: 720

When I was investigating the problem with my Gen 1 Rcvr. I decided that if you just stopped/ locked the car (with the fob) it may be fine, ie. it would unlock straight away - but if I was away for a while and there were lots of other (433Mhz) RF signals present (such as in a large/full car park....) over a period of time it - the BECM - seemed to count these signals as re-entry attempts and then (after some largish number of these other signals) simply deny my RR RF fob unlock signals altogether..... and the best way to check this of course is to lock and then unlock immediately at those same locations where you noted this problem.

As previously stated the Gen 1. Rcvr. is so 'wideband' all kinds of RF signals could sometimes do this (if powerful enough) not just 433Mhz....
but I never resolved this issue entirely even after doing the usual 'modifications' such as changing the attenuation on the window antenna etc.

I would be very interested what you can see with your Spectrum Analyser: I just used a 'scope on the feed for Rcvr. to BECM and could often
see all kinds of RF stuff being picked up by my Gen 1. (and not just those 433 weather-stations and door-bells etc either !)

Member
avatar
Joined:
Posts: 7861

One day I'll get around to pulling the cover to see what receiver I have under there. As radio is work, I know where there is anything strong that could cause a problem and there isn't anything in either of those areas. The Wickes car park was virtually empty too and I've been there no end of times and never had a problem before even when the place has been packed. I wasn't in either place for more than a few minutes either.

Member
avatar
Joined:
Posts: 7861

davew wrote:

I would be very interested what you can see with your Spectrum Analyser: I just used a 'scope on the feed for Rcvr. to BECM and could often
see all kinds of RF stuff being picked up by my Gen 1. (and not just those 433 weather-stations and door-bells etc either !)

I've got two that are work issue, the cheap n cheerful disposable one like this http://rfexplorer.com/ and one of these http://www.keysight.com/en/pdx-x201902-pn-N9915A/fieldfox-handheld-microwave-analyzer-9-ghz ........ Should be able to see what is out there then.

Member
Joined:
Posts: 720

Would have been useful to have either of those hand-held Analysers when I was investigating this myself... !

For info. from my own experiences there seem to be two main types of RF interference that cause the Rcvr./BECM combo to play up (albeit inconsistently):

One is a steady (and powerful) RF signal (of any high frequency) which swamps the front end of the Gen. 1 and renders it 'uncooperative'

  • In one case it was a VHF Credit Card Authorisation system in a Petrol Station (and I was parked close to the dipole used for this system): The RF was present all the time (ie. not just when authorising) so there must have been a constant Carrier present too (?).

  • In another case, again VHF, I was next to a railway station - and it seems some of these have a private communication system for signalling station-to-station.

The other cases were mainly where there are lots of other cars (ie. 433 fobs) around, such as in a busy multi-storey car park. I never worked out exactly how many (presumed) 'entry attempts' it took to upset the BECM though. (At that time I even considered fitting a counter to the system but never got around to it.)

In fact I tried various attenuation, screening and/or passive filters on my Gen 1. to make it all more 'selective' and it improved the situation but only slightly. Still could not bring myself to pay £300 for RR's Gen 3. 'solution' to their dire design though..... Even their Gen 2. only puts the Rcvr. chip in a can (and that did not work for them either) !

The other thing that I could not quite understand is why this was not (apparently) a bigger problem in the US (Obviously it is 315Mhz there but FCC rules allow for much greater RF powers galore). I started to wonder if there had been some kind of Class Action involved so the later generation Rcvrs. were provided FOC..?

Member
Joined:
Posts: 720

Meant to add this link earlier for anyone unfamiliar with Gen 1/2/3 Receiver differences:

http://www.mez.co.uk/page12.html

See photos:

  • Left is the original (useless) Gen. 1. item...

  • Middle is the Gen. 2. (almost as useless) 'interim' one, available from 2004: The 'shielding' can around the RF chippery may have provided some limited protection against local higher-powered transmitters (and their harmonics) but it did not solve the more general problem....

  • Right is the Gen. 3 offering (originally £170, went out of production then reappeared 4 years ago at £300); This has 'smarts' to distinguish between genuine RR fob signals and (any other 433) 'imposters'

With the Gen. 1 Rcvr. using virtually any car's plipper resulted in pulses being sent off from the receiver to the BECM, thus waking it up and (frequently) confusing the security/alarm within...

Incidentally there are folks selling used Gen 3's for less than £200 on e-bay but get a photo of the 'guts' first before parting with any money...
or else you may just be paying £200 for a 'misleading' round green sticker....!