Aloha all,
I was nor sure just where to post this, as I believe it needs to be posted EVERYWHERE!
Recently, I was directed by KCR (Thank you!) to a bloke named Simon.....
He has come up with a nifty postage stamp sized board which, when inserted into the Bosch engine ECU will send the mobilisation
code needed for the fueling and ignition to function. There are 3 wires to solder on to the board and one pin lead to clip.
Install takes about 15 min start to finish. He needs to know the mobilisation code as it is pre programmed into the chip.
He can provide the chip preinstalled into an appropriate ECU which just needs to be swapped in. No soldering skills needed.
There is also a jumper to install at the Becm to disallow it having a say as to cranking, which it does indeed
disallow in an alarmed and immobilised state.
With this device installed, I proceeded to annoy the Becm by locking with the fob, and unlocking with the key in the door.
Normally, this will trigger the alarm and immobilisation mode will be activated needing either the EKA or a push of the button on a working fob.
To my utter delight, I found that the engine started just fine and there were no notices on the dash. All systems worked fine as well.
Of note, the dashboard alarm Led does continue to flash as if the alarm is going off. As I have unplugged the sounder,
this is the only indication I have that there is anything going on. I believe sounder can also be disabled in Becm with Nano....
I then locked the car with the key, and waited 2 minutes.....The Becm goes to sleep, so no unwanted battery drain.
I got 2 of these and will install in the Borrego tomorrow.
The peace of mind this will bring to me with regard to wife and friends using the trucks is priceless! No worries about the dreaded
"Engine immobilised, enter EKA or press fob" message to them when far from me and the Nano (Also, always seems to happen on a dark and stormy night) :)
I believe this little board could keep a good number of very nice P-38s out of the Knackers yards!
Especially considering the difficulty / expense involved in getting replacement fobs now.
Oh, yes, I do not work for or with Simon. Please contact him if you have questions. He is now registered on this forum, so should respond.....He is "PsiDOC"
I shall continue to report on performance as needed, but so far? FLAMING BRILLIANT!!!!!
Cheers, Simon!!
Tom

Sounds good! I've been lucky and only had one instance where the immobiliser kicked in - and I didn't even know why. Exactly as you say, it's the sort of thing that dents your confidence.

I've a few things to get through yet before this will be a priority for me, but it'll be on the list sooner rather than later.

Good morning all.
Firstly, donmacn, if I can help out, drop me a message when you are ready.
Now, on with the introduction.
I am the Simon mentioned above and yes the immobiliser on the P38 THOR, GEMS and DSE can be bypassed by emulation.
By emulation I mean I have designed a small (22mm x 22mm)electronic board that can be fitted inside the ECU and connected via 3 wires that will send the correct encrypted code to the ECU so the ECU is happy and will run without the need for interaction with the BECM.
The project mentioned by Bolt above was actually done for an off road competition vehicle that the owner wanted to fit a P38 4.6 Thor engine into, so I was thrown the challenge to make it standalone.
I already had the D2 Thor and GEMS ECU standalone solution in place so we could have gone down that route using a D2 ECU from the USA Spec 4.6 D2 or swapping over to a GEMS unit, but neither of those were ideal, so I looked into the P38 THOR ECU to see how it ticked.
A lot of people say the D2 Thor and the P38 THOR ECUS are identical. They are not. There's a lot of changes in software and some in hardware between the 2 and even across different revisions of the same ECU there are differences.
This little project took over 12 months to crack with the difficult bit being finding the first crack in the armour. After that first in road on the encryption, it took a week to get a finished solution out for initial testing, which went well and is still out there competing to this day..
After unveiling the project to the public on social media with a bench test video demonstrating the ECU being happy, I was immediately messaged by 3 people saying "That's impossible! It can't be done!" Errr... Ok... I guess I have done the impossible then 🤣🤣.
Well I guess the proof of the pudding is in the eating and I now have ECUS in the USA , Europe and Malaysia all working standalone on my humble little boards.
It was only when I was talking to one of the P38 specialists here in the U.K. that I realised that the BECM can be somewhat of an Achilles heel on the P38 that can leave you stranded for numerous reasons and I daresay you know a lot more than I do on that subject. Well this little board (and a wiring mod for the starter motor engage request) will mean the BECM is not involved with the running of the engine at all so irrespective of the BECM status, you'll always get the car to start and drive, which may give some a bit of peace of mind.

Other projects I have done are the L322 BMW 2926cc Diesel and the L322 BMW 4.4 petrol ECU both standalone as well as the TD5.

Any questions as all about what I can do, please post here or drop me a message and I'll be happy to explain further.
You can also see the P38 and others being demonstrated on my youtube thingy.
https://www.youtube.com/channel/UCwKSHm0fu3k5WX5whp0H6MA

Cheers.
Simon

Hi Simon, looks interesting - how does your solution compare/contrast to the BBS Sync-Mate ?

Similarly I recall a BECM/ECU Sync 'three-wire-connection-to-ECU-on-a-chip' device from OZ ( a few years back now ) - are/were you familiar with that ?

Dave,
In all honesty, it's completely different solution to the Synchmate.
That's basically a box of tricks that re-synchronises the BECM to the engine ECU immobiliser code in the event the BECM throws a sulk.
The way mine does it is by sending the immobiliser code from the emulator board fitted inside the engine ECU, thereby removing the need for the BECM all together. There is a small wiring mod needed to remove the starter motor crank request from the BECM as well to make it truly standalone, but that is simply a case of joining 2 wires together so the ignition key on position 3 (engine start) is then fed directly to the starter motor relay and the engine turns over irrespective of the BECM status.
It's also worthwhile mentioning that all my emulators have the relevant immobiliser code for that unit programmed in non volitile flash so it cannot forget the code like the BECM has a tendency to do.
I am not familiar with the OZ chip device, however I have heard about it. I am sure that was for the GEMS ecu and possibly very similar to the way I do the GEMS ecu myself. The THOR however is a completely different encryption to the GEMS, so whilst the emulator is the same hardware (I standardised it right across the range), the software in the microcontroller (programmable chip on the board) is completely different between the GEMS, P38 THOR, DSE and D2 THOR.

Thanks for the extra information Simon, makes sense, and thanks for persevering with your solution too. These proprietary LR protocols are all rather tricky... (Whilst trying to investigate them myself I could not quite work out if this was deliberate on their part - ie. protectionist - or accidental... but suspect it is/was a mixture of both ?!)

Dug around a little and yes that OZ device is GEMS-only:
http://labtronxcomau.businesscatalyst.com/labtronx-products/mobi4

Ah that does indeed look like the GEMS solution I actually do as well. Granted the security code will be different as there's 65000 or so of them and the board is a different shape but they will be similar. Maybe I should get one and scope the output just to see what security code they do use.
On the subject of the protocols they are obfuscated and some are encrypted as well, however all are very robust protocols which are thoroughly error checked.
It's just sadly LR always seem to drop one single clanger (BECM) in what could have been a brilliantly reliable system.

IIRC the (simpler) GEMS ECU just accepts a 'universal' code of some kind (FFFF ?) and the OZ device simulates this (?).

There are quite a few protocol-dabblers on here too, particularly via the OBD (also a mess of proprietary /semi-compliant protocols). I tried to develop a ISO9141-based system/box to turn off my (persistent) SRS light. My own 'success' was "limited" however - as it needed my PC connected permanent to work.... Overall I decided it was best to rely on the Inspired Amateurs (notably Storey Wilson) or The Professionals (BBS) !

The BECM is so inherent to the P38 design that it was a REALLY BIG design clanger for LUCAS to drop on us 25 years ago..... and then they also stuck it in a place where it can/could get wet too !!

The immobiliser code in the GEMS is not universal. If it was you could just swap them out one for another and it'd be a plug and play part provided it was going on another P38. As it is, you have to sync the 2 up using a tool with dealership levels of coding (nanocom testbook etc), but then you know all this I am sure.
They have different codes ranging from 0000 to FFFF and all numbers in between. The immobiliser code is actually programmed in the BECM and programmed from the factory.
RE: The K-Line protocols, that's a nightmare in itself. I did do a bit of work in the TD5 protocols a few years ago for a small project which worked reasonably well, but since that, I have done nothing really on that side and let's face it, for the price of one of BBS's offerings compared to some units out there, they are pretty competitive price wise.
Can Bus is a different matter. Done a fair bit on the Can side of things with the BMW work I do.

Ah... I did not mean 'universal' in that sense, more like a 'master' code of some kind that the ECU would always accept (but not used on production models (?) This was around 10 years ago, and I also recall a "1111" pulse technique from back then, and (if so) that is very easy to do of course.

Also did some more (deeper) digging and the "FFFF" is/was part of the "FOUT" procedure (when sync was frequently lost) as further explained in this 20+-year-old document: http://rave.stringsandints.com/TestBook_LRNAFOUT.pdf

Dave, that's very interesting. I must admit I was unaware of that document and the procedure.
I can make this "F-Out" box using one of my emulators very easily. Infact it would take literally minutes to do with the way the code is set up.
Next time I have a GEMS in, I'll have a play with this.
Every day is a school day. 😀
Edit This seem to be for the USA spec GEMS, which I have never had a look at, so may / may not work on the UK spec.

The GEMS and Bosch systems basically work in opposite to each other.

GEMS listens for a code that is programmed into the BECM (which isn't hard-coded - it's a 16bit/ HEX value you can change it to whatever you want between 0 and 65535). The GEMS ECU then has the 'Security Learn' which basically tells the ECU to listen to the security code being received and then store that as the one that it should use. There were the issues as Davew mentioned where the GEMS ECU would 'forget' the code and lose sync with the BECM, and the fix was to reprogram the BECM code with 65535 and then tell the ECU to learn this.
The GEMS ECU would tell the BECM (via illumination of the Check Engine Light) that it had accepted the code, and a BECM which is set to GEMS would inhibit cranking of the engine unless it had seen the CEL signal back from the engine ECU.

The Bosch units - Motronic and EDC work opposite in the fact that their immobilisation code is stored in the engine ECU itself, and the BECM code is programmed to match this. The Bosch units don't provide feedback on a correct code via the CEL, so this check was programmed out of a BECM, and is the reason why when sync is lost on a diesel or a Thor, that it will still crank, but not fire up. The BECM firmware was changed to always allow cranking in Pos III (except if it was immobilised) as it has no idea if the engine ECU has accepted the code or not. It basically leaves the decision on whether the engine should start or not to the engine ECU.

I'm happy to see that there is a solution now for the Motronic ECUs - though they never seemed to suffer the problem with losing sync like the GEMS units did (well, definitely not to the same extent). I am sure you will get a lot of people snapping them up, because it seems to be the number one worry people have with P38's about it not starting or them being locked out....

One other side note.... I don't know how this affects insurance in the UK as regards to modifications etc - as you are technically removing the immobiliser completely... other than the steering lock, there is now absolutely nothing to stop you from hotwiring a P38 with this fitted is there?

I am somewhat of a purist though, and feel that if you have a well looked after system, then it works fine as it was intended from the factory. The big problem that I usually end up fixing for people with non-starting issues is BECM related - because it's the big bad box of horror stories... despite the fact that most BECM lockout issues are down to components external to that failing and there will have been warning signs long before it actually going into lockout (usually problems with locking/door latches). And why look after the system and have it work properly when you can just bypass all the security....

I do think the possibility of running the Motronic ECU as standalone is great, as it opens up the possibility of using the engine/ECU in standalone environments which previously was only confined to the using the GEMS version... I'm a big fan of the Rover V8 and the thought of being able to use it in other projects - but with the later engine management systems is quite food for thought....

Though lately my interests have been elsewhere...

Aloha Marty,
Long time no hear.....Understand you are busy down south, so thanks for chiming in.
I hear you about a "Properly maintained" system not needing any kind of work around.
Sadly, I see way too many very nice examples of P-38s in the breakers yards here on the west coast.
5 just in the last week!
I do know there are reasons for this aside from immobiliser issues, but a few of the folks I have contacted
to find out why they were hauled off indicated lock out/ immobilisation as the "Final straw" (I collect receipts I find in the cars that have names and numbers....So far, no one has gotten upset....)
If this board, which is dead easy to fit keeps even a few out of the wreckers yards, that is a good thing.
In my personal case, I have 2 2002s which have everything working perfectly, and they are box stock.
However, my wife drives one and has been immobilised by her now gone 2000 a few times in the past.
Knowing that that cannot happen to her is a great relief for me! She loves the P-38, but if she gets stranded far from home, it will mean a rescue, and probably a new car without the issues..........
As for theft?? Are these beasts really theft prone? I know values are going up, so onward, it could be more of an issue. A secret switch somewhere would thwart most thieves.....
I am installing SPDT high rel mini toggles to switch this circuit in and out as needed.
SOP is use the fob, and no issues, but just in case......
Cheers Mate!
Tom

Martyuk wrote:
I do think the possibility of running the Motronic ECU as standalone is great, as it opens up the possibility of using the engine/ECU in standalone environments which previously was only confined to the using the GEMS version... I'm a big fan of the Rover V8 and the thought of being able to use it in other projects - but with the later engine management systems is quite food for thought....

Morning Marty.
Thanks for the input and yep. 100% correct. Up until I got to work on the P38 THOR I had never seen a security system where the engine ECU was hard coded and the security module has to be programmed to match the engine ECU. I had always worked with ECUs that you match to the security so to me it was a bit like the tail wagging the dog, but there we are and there it is. Been a fun project if a little frustrating at times.
The exact reason why this was developed was for a standalone solution for competition. I must admit I envisaged it being used in engine swaps / kit cars etc but not in the P38. It was only after talking to a P38 specialist and a few others on my social media that I have ended up here via Bolt.

Yeah, I've been back in NZ now since late October last year.... I was only originally planning on being here for 6 months - but as covid has played out, I've ended up staying here longer and longer.. I do have to come back to the UK at some point (either November this year, or maybe end of January 2022 depending on if work pans out in the USA).

I've been lucky that up until a couple of weeks ago work/life had been pretty busy - but we went back into full lockdown due to covid Delta getting out into the community (we were previously totally covid free in the whole country). So being at home with no work again (and not even any RR bits to work on here!!) I've had to push a few plans again...

I did take a jump to the dark side a couple of months ago and bought a RR out here aswell - though as a first for me I skipped the P38's on offer and took the plunge on a 2006 L322 - the 4.2L Supercharged model... in my typical style, it needed a LOT of work and is currently in getting the transmission rebuilt - and is unfortunately tied up there during lockdown - so can't wait for restrictions to ease so they can finish that and I can get it back and try to do a few road trips!

Re the Thor ECU stuff - it is strange that it was hard coded to the ECU on the P38s - as on the D2 which also used the Motronic ECU, it was the other way around still - the Disco BCU had the code in it, and you then do a security learn on the ECU... I have no idea why they mixed it around on the P38 though....

All this electronics is way over my head, but as for the differences between my P38 and my D2 I’ve always been amazed (even disregarding that one is GEMS and one Motronics). I expected to have all kinds of spare parts for my D2 when I got it, as I had previously stripped a wrecked P38 for a lot of spares.