I am also now not 100% sure about whether it has OTPROM or standard EPROM - the datasheet I have shows the 68HC711 as being OTPROM, but I think the 68HC11 which the BECM uses might still be normal EPROM. It is a KA4 version (again from what I've previously found on the web from prior research) and one of the chips I have on a logic board shows CFN3 at the end of the string of digits printed on it. Which would then make the details MC68HC11KA4CFN3, which is a 3MHz chip with 24K of Custom ROM.

From what I was looking at, it looks like it might be a viable option to use bootloader code into the RAM to then be able to have access to the rest of the memory, which sounds like it is viable from what jacckk mentions.

The ROM appears to be in the memory addressing of $A000 to $FFFF. I have a document which has the memory mapping if that's useful to anyone? Assembly code and programming things like that is a bit beyond my skillset at the moment!

Regarding the EEPROM and vehicle data... I am somewhat hesitant to share a lot of that at the moment, as the last time I shared BECM info that I had spent a lot of time working out an researching - it was supposedly in exchange for some information back my way.. which, you guessed it... never materialised...

I am happy to share if others have something to share (like a usable ROM dump from the BECM...) as the work on decoding how the BECM stores the vehicle data took me a LONG time to work out. I am all for demystifying things, but if there is an aim there to build a cheap way of programming BECMs - then it isn't really in my interest to just hand over what I've worked hard on, especially when I spent the money on the Faultmate/BECM CPU modules - which is ultimately how I worked out the coding for vehicle info. What I will say though (and the biggest reason it took so long to work out how it's all stored) is that most of the vehicle options are stored in 5 Hex Bytes, and each bit of binary (40 binary bits / 10 Hex Nibbles) modifies part of the overall vehicle settings. Other parameters such as mileage, build date, EKA, immobiliser code, and fob codes are all stored separate to the vehicle information, and are also stored in different formats, depending on what piece of information it is...

You also don't technically need to put it back in the vehicle to read the changes (on nanocom for example) as it is possible to power the BECM up on the bench and connect to it using a nanocom out of the vehicle. It's how I bench test any BECM's I've worked on before they get shipped back to owners.

I doubt asking Land Rover about any secret BECM info will do any good... other than the blunt 'NO' I imagine that they would give, I doubt they actually have any plans/info/code kicking about anymore - especially as I would imagine that the BECM was designed, build, programmed etc externally to Land Rover themselves - with the production line programming probably being done to vehicle specification by the BECM manufacturers, or by a Testbook on the production line.

I'm interested to see if the ROM can be read - and if someone is able to dump that, and willing to share that, then I'm happy to send a copy of the disassembler/macro assembler programs over which I managed to find online..

gordonjcp wrote:

Martyuk wrote:

Yes, it would be lovely to be able to add some new features to the BECM, to add in some functions that over the years of experience of having a P38, we've all found would be useful... like and over temp warning on the dash, or a low coolant alert... And I'm actually pretty sure it would be possible, as I'm sure there are a couple of spare digital input pins on the logic board... the issue is being able to get a copy of the original coding, so that you could write the additions into it, and all of that, before reprogramming the CPU with it... Since there's not even a circuit diagram of the boards, yet alone someone kicking about with a copy of the BECM code, and the software to amend it, we are unfortunately a bit stuck...

What's the processor used in them, and how big a ROM does it have? It can't be that hard to disassemble it...

Uses a Motorola MH68C11KA series MCU. Runs at 3MHz from memory, and has 640 bytes of EEPROM (Which is party used for the vehicle ID/specifications... and I've managed to decode all the bytes of info that relates to vehicle settings etc. There are other bytes of EEPROM used, but no idea what for!

The datasheets I have shows 24K of OTPROM for the version that I think the BECM uses..

I don't see why there is so much hype about the BECM either... and I've probably dug into them more than most P38 owners... hell, I've got about 2 of the bloody things sitting in the garage, and most of them still work...

I've seen a few random errors/faults but most of them that I've seen that are actually dead are usually due to something external affecting the BECM - like drowning it...

Yes, it's 20 year old technology (probably more than that - it was obviously in the first production vehicles back in late 1994 and something like this isn't just thought up overnight, so from conception/design to building it was probably a couple more years...) but for what it is, it isn't actually THAT scary inside. I had the (dis)pleasure of working on a late Classic a few months ago, and you know what - I'll take a P38 with a BECM any day... everwhere you look in those things, there's another couple of fuses and relays shoved in a corner. At least on a P38 there's only 2 places to look at, and due to the serial links to various outstations (which again, even though there isn't documentation on these and how they work, are pretty reliable unless you actually have a wire fault) mean that the wiring looms are a lot smaller than the anaconda of copper that is wrapped around the under dash area on the classic... sod trying to trace a faulty wire in that!

Yes, it would be lovely to be able to add some new features to the BECM, to add in some functions that over the years of experience of having a P38, we've all found would be useful... like and over temp warning on the dash, or a low coolant alert... And I'm actually pretty sure it would be possible, as I'm sure there are a couple of spare digital input pins on the logic board... the issue is being able to get a copy of the original coding, so that you could write the additions into it, and all of that, before reprogramming the CPU with it... Since there's not even a circuit diagram of the boards, yet alone someone kicking about with a copy of the BECM code, and the software to amend it, we are unfortunately a bit stuck...

I've read a few times about people saying that they will build an arduino to replace the BECM - but so far, I've not seen anyone come close. It sounds like a bit of a minefield when you start looking at how the different systems interact. I have been looking at building a BECM testing station, and even that's a nightmare trying to map out all the inputs/outputs that need to be generated!

I have to say, whoever designed and implemented the BECM did a bloody good job - it's for the most part robust, doesn't seem to have random hissy fits of it's own accord (so the coding must be relatively 'bug free') and has lasted over 20 years with no major component failures either... Good luck with any newer vehicle having the same build quality in 20 years time!

I'm sorry - I didn't realise that you wanted the seats removed for cleanliness - I thought you were asking if they needed removing for access, or the job.

Next time I work on anyone's vehicle, I'll remember to buy some of the disposable suits that they wear for forensics.

My bad... try and help people out for a good price, and then get called dirty aswell... thanks guys!

Well, it's nearly got 1000 miles on it now, so it will soon be oil change time...

I will probably do the oil change in March when I am back from the next job due to head away again on Sunday for a couple of weeks) - and hoping to give it a bit of an all-over service - engine oil/filter, probably do the diff oils at the same time, and then also check/top up transfer case and the autobox.

The engine itself is running fine - fuel trims on petrol are all spot on, and it feels like it has a bit more pull to it, which is nice.
I tried giving it a bit of right foot a couple of weeks ago coming off a roundabout onto a dual carriageway/70mph stretch of the A419, and I couldn't get it to rev above 3K, even with my foot most of the way to the floor.. I don't think it's the engine though, but rather more the dumb autobox trying to hold it in a higher gear, rather than change down earlier and let the engine rev up.

I think I have most of the coolant/oil drips all sorted now (for the moment!) I ended up removing 4 of the sump bolts and putting a bit of sealant on the threads and refitting with a second flat washer, instead of the spring, as I think the threads of these go up into the bore for the cross bolts, and that was where the drips were coming from (it was the same pair of bolts on both sides of the sump)

Next step is to get the LPG all working again as it should... I have had it run on gas, and there are no sign of leaks which is good... but have a few issues to work out, but that will also be in March when I'm back.

When running on gas, bank 1 fuel trims are spot on - don't change at all, but bank 2 is all over the place. Yet I get misfires on Cyl 1,3,5,7 (bank 1). I have a feeling that the LPG injector wires might be back to front (though it's the way they have always been plugged up, so who knows!).. and I also think that there might be a couple of hoses with kinks in them on bank 1 (this side was pretty tight getting it all to fit when putting the upper plenum on). So my current thoughts are to swap the injectors from 2x banks of 4, to 2x banks of 2 - which will then nestle in a lot nicer in the gaps around the lower inlet, and this should then prevent any kinking of hoses/crushing of wiring.

I need to investigate the wiring where the petrol injector signals have been picked up, so I can work out if the LPG side is backwards (mine has the wiring all soldered/heatshrink in the vehicle loom, rather than the extra 'plug in' style).

Then it will be a case of setting it all up, getting it to auto calibrate, and see how she runs on gas...

I've noticed the target engine speed is higher on my Nanocom too when I look at the Motronic ECU. There's also a post on the Nanocom forums (which is unresolved from over a year ago) but also with someone saying that they are getting readings much higher than the actual rpm of the engine.

Looking at your picture, it looks like the 'target' rpm is about 4x what the actual rpm is... so my guess it that might be displaying the actual number of pulses per revolution rather the the rpm.

As far as I was aware, the sprag clutch inversion is normally a result of a skipping transfer case chain and when people still plant it and let it keep skipping.

I've often considered replacing the valve block with 4 individual valves - one for each corner... the biggest problem I can see is that even though you can get dual inlet/exhaust valves designed for air suspension, the wiring would need looking at, as the EAS system uses a single inlet, and exhaust valve for the whole system... whereas newer air suspension systems appear to have a dual purpose valve for each corner.

I have had a few thoughts about adapting the wiring from the EAS ECU to drive the system to allow for individual valves at each corner, and do away with the valve block completely - but haven't had time to actually do anything about it yet.

I would think that you would need to actually open up the ECU and trace where the voltage regulator is on the PCB and then apply the 5V to the output side of it (to do it properly)

I wouldn't have thought it would be too hard to find where it's located - it will be powered off the 12V pin somewhere, and probably have a couple of little smoothing capacitors near it.

My money is it being the rear left that has failed.

Is there a fault code for which one it thinks is faulty?

Washing up liquid...

OR boil some water, and dunk the end of the hose in it for a few minutes to soften it up. Makes getting them on a lot easier, and saved a lot of swearing from both myself and Nick when we were doing the plumbing part of the engine swap.

I use Nissens part number 70220 for vehicles that I convert. It is like the P38 matrix - in that it has plastic end tanks which are crimped to the metal heater core part (like the radiator has - except tanks are top/bottom)

Instead of having the metal pipes through the firewall, you replace these with a couple of bits of standard coolant hose (if using the 70220 then the outlet fit 19mm hose nicely - which is the same as the pipework in the P38 engine bay, so no additional reducers etc) and some clamps of your choice.

I had to tweak my clamps up after a month or so as things settled in, but with a bit of thought on clamp positioning, you can get it so you only need to take the footwell trim and the drivers knee panel off to get in to tighten them up.

Ultimately it's up to you - I went with the heater core swap as when I went in to do my O-rings when I first bought the vehicle, I pulled out nearly new O-rings, and found the plastic lip on the heater core itself was damaged - so figured I'd swap it when it came out and then not have O-ring issues ever again...

AFAIK the pipes are the same size, yes - just different configuration from where they come off the engine and back into the return/bypass lines..

The I think you've answered your own question then...

If it's not leaking or any sign of fresh coolant when it's running, then leave it unit it starts leaking... if it does. Just take extra care when doing other plumbing work not to bash the metal pipes about too much.

if you're doing it on your own, then taking the top of the dash off to get the heater core out and put an Audi one in can be done leisurely in a weekend - especially if you have a pre-freed up heater box to refit where the flaps have been looked at and everything regreased etc. So if you do get a leak from the O-rings, then you can address that at a later time - when it's warmer.

Have you actually looked at it whilst it's running yet? Or are we all jumping to conclusions about changing the O-rings again without ACTUALLY seeing if it's leaking now?

I guess it depends on what 'T' piece they have used...

The hoses on the Thor ones at least are about 19mm ID - so a 20-16-20 should give a nice tight fit... Or LPGshop.co.uk have 19-16-19 versions aswell..

I replaced both of mine with metal years ago - feels a lot more sturdy now! Just need to add up the sizes of CT clamp I need now and to swap all of them!

It's got to be worth investigating the ground issue, or something along those lines.

Did you check the heater resistance just across the sensor? I wonder if it's worth checking it at the ECU - in case the wiring is a bit worn and upping the resistance?

From memory the sensors are grounded by the ECU - and just looking at RAVE, they all end up in the same connector - C0635 at the engine ECU (sensor wires, plus heater grounds) so that might also be worth a look at too...

I seem to remember awhile ago with your O2's being a problem that you were sent the wrong ones by a seller? Did they end up sending the correct sensors in the end? And were they genuine ones when they arrived?

I've gone back to parallel plumbing too. I swapped to series plumbing previously, and due to where my vapouriser is, either way I have pipework across the back of the engine to it - but figured that it would be better.

To make it neat, I used a solid metal 90 degree elbow, as the hose run would have just kinked it to get it around the back of the engine neatly. The result - a luke-warm cabin as there wasn't enough flow through the heater matrix.

Mine was plumbed in parallel when it was installed, back in 2008, and I never had an issue with it cooling off the vap. I finished off the LPG plumbing today so I can get it set up to run on gas again with the new engine, and the reducer was still warm when I touched it, about an hour after getting home - so I really don't think it's going to freeze over in my case.

I've done my plumbing so that the hoses run around the back of the engine and are lower than coolant tank. Also as most reducers are 16mm, and the RR hoses are 19mm if you use the 19-16-19 T pieces available, then you don't have any extra pipe reducers either.

I now have a nice hot cabin again :) (sorry Morat - not rubbing it in! - we'll have yours sorted soon!

Moisture detect doesn't do anything. The option is there, but to my knowledge it was never implemented. There isn't a moisture sensor anywhere on the vehicle.

My guess it was one of the features that was planned, but never actually made it to production!

Or just keep it in the same thread so we can keep track of it, so we aren't trying to reply in 2 or 3 places every time...

Be careful not to measure/put multimeter across the actual sensor pins on the bosch sensors.. I'm sure I killed my old pair doing that, since they generate the voltage themselves.

I'd also check heater resistance, and maybe even voltage getting to heaters when it's switched on.

What live data does nanocom show for them, do they ever heat up enough to start switching?

I've unplugged the bosch ECU without disconnecting the battery as Sloth says. No I'll effects, just got home from 230 miles in the last 2 days... so I don't think it fucked the ECU up.

Sync.. read from Motronic ecu, program into BECM on last page of Alarm settings, not forgetting to hit 'write settings' on the main page.

If you are worried about/want EKA of current BECM, go into the bottom settings page (can't remember off top of my head exactly what it's called) and scroll across to page where it says VIN... read numbers and they're the last 6 digits of the VIN that becm is from. Call land rover, explain it has replacement becm, and see if they can pull up the EKA for that particular vehicle.

I really doubt you will have any problem as long as it's unlocked/disarmed when the power is taken off.