BECM DIRECT MEMORY (SM035)

BECM DIRECT MEMORY - System Overview

Although there is already a Module (SM022) which provides full diagnostic access to the BECM (Body Electric Control Module) fitted only to the P38 Range Rover (1995 to 2002 Model). There are a number of core pieces of information that the BECM is by design, unable to reveal through the normal diagnostic connection under the control of a one time usage software lock, and also the ability to change some others. This limitation effectively prevents re usage of salvage or otherwise used BECM’s as well as trial substitution. It also forces replacement of the BECM in many circumstances when there is actually nothing wrong with it. Despite high development costs, and expectations of low volumes of sales, we have produced this module which allows for direct connection of a Vehicle server to the Microprocessor of the BECM and thereby direct read and write access to all stored memory in it. Besides offering a full memory save as Hexadecimal in a HTML page capabilities as well as the ability to re load and write pages back, which can be handy for those wanting to experiment with swapping bits round, this module also provides a settings page identical to the SM022 one except all of the previously empty boxes such as EKA (Emergency Key Access) code and the Fob Code which is used to validate the correct remote key fob are now populated. In addition it is now also possible to alter previously read only values such as Odometer (Miles / Kilometres travelled) and VIN numbers. Naturally of course the one time lock function can also be reversed. In addition the State of both the Alarm and the EKA lockout delay can be read and altered which is very useful as in an Armed or EKA locked out BECM there is no way to be able to communicate with it through the diagnostic connection and if there is no way to disarm the BECM it is otherwise a catch 22 situation which is usually circumvented only by replacement with a new BECM.

For security purposes the help pages themselves are not included here and on the Vehicle explorer system are only installed on correctly licensed systems. The instructions detail how to remove the BECM from the vehicle and dismantle it to gain access to the logic board. There are two versions of the board and two different types of processor and the instructions include step by step pictorial explanations on how to connect the Brown CPU lead to the board for both versions. Please note that the software automatically detects the processor version fitted and handles their differences transparently to the user.

SM035 - BECM DIRECT MEMORY - System Help file

Version 1.22

BECM DIRECT MEMORY - Known Fitments

Vehicle makes, models and variants known or believed to be using this vehicle system, required diagnostic lead and degree of known compatibility.

Vehicle Make	Vehicle Model	Vehicle Variant	Diagnostic Lead
Land Rover	Range Rover MKII (P38)	ALL	Brown CPU Lead

SM035 - BECM DIRECT MEMORY - Diagnostic Capabilities (Settings)

GENERAL SETTINGS

Alarm: The alarm can be either enabled or disabled if required. Disabling the alarm prevents the alarm from arming and stops all audible and visual activity whenever the vehicle is locked or unlocked. It does not affect the immobilization.
Alarm lights: This changes the method of visual output from the BECM used for the alarm activated / triggered.
Alarm noise: Different markets have different options of alarm sounding when the alarm is activated / triggered.
Arm/disarm: Changes the method of visual notification of alarm arming and disarming.
BECM Status: The BECM has an electronic lock that is designed to prevent access to some of its contents. All BECM's are locked in this way at the vehicle factory after they are programmed with the information specific to the vehicle they have been fitted in. However, replacement BECM's are supplied unlocked and all data can be readily accessed and changed up until the point when the unit is locked. This is currently an irreversible process so it is important to check the correctness of all information stored in the BECM before considering locking it. The status of the lock has no effect on any other operation of the BECM (i.e. it is perfectly acceptable to leave the status of the BECM unlocked for normal vehicle usage).
Cat amplifier / heater: For markets where catalyst amplifiers and heaters are used, mainly Japan.
Cruise: This indicates if cruise control is fitted or not.
Daylight running: Either headlamps or sidelights can be selected as the daytime running lights or the function can be disabled.
Drive: Denotes left hand drive (LHD) or right hand drive (RHD).
EKA: For the markets that do not use the Emergency Key Access (EKA) system.
EKA number: This is the Emergency Key Access (EKA) Number for this vehicle. Only available on unlocked BECM's (see BECM STATUS). Even if the EKA function is disabled (see PASSIVE EKA) and therefore not used, each BECM still has a number programmed into it. The number has to be 4 characters long, each character can be a number between 1 and 6, and the four numbers cannot be all the same.
EMS code: Only used on EDC and Motronic engine Management Systems (EMS). When the ignition is turned on, the BECM, providing it is in receipt of a valid mobilization code, from receiving an unlock signal from the correct key fob or having its EKA code entered, and is therefore not in an alarmed or immobilised state, sends a coded signal to the Engine Management System (EMS) ECU and in turn, the EMS ECU then compares against a code it already has stored in it. If the two codes compare OK, the EMS ECU allows the engine to start. This forms the basis of the immobiliser. If the EMS ECU or the BECM is replaced, the two codes will not match and it will not be possible to start the engine. It is therefore necessary to synchronise the codes in both the BECM and the EMS ECU. For EDC, a function can be found in the EDC section which gives the fixed code from the EDC ECU which must be entered here. For Motronic, any number can be used here as the Motronic ECU has a learn function located in the OTHER section which can be used to force it to learn this code.
Engine: Select between the later Motronic Petrol engine management which is fitted after 1999 and can be distinguished by the overlapping sausage effect of the intake plenum on the top of the engine. GEMS petrol engine management fitted before 1999 which can be distinguished by the flat topped intake plenum with the engine capacity shown on the top of the engine or the Diesel EDC engine management.
FOB code: For security this information is only available to be read or programmed on unlocked BECM's (see BECM STATUS). The fob code is a 3-part code, which uniquely identifies the family of key fobs (key 1, key 2, etc.) that go with this vehicle. Any key Fob, when pressed, transmits its unique electronic ID code (FOB CODE) in an encrypted format. The BECM of any vehicle within range of that key fob decrypts the received transmission and compares the FOB CODE that was received, against the FOB CODE that is stored here. If the two match, it will accept the key as valid and perform the relevant task (lock, unlock, send mobilize signal to engine ECU, etc). This FOB CODE is derived from converting the manufacturer's Lockset Bar code. This is a 14 digit alphanumeric number, which is printed on a label that accompanies every new key fob or lockset. When the vehicle was assembled at the factory and was first fitted with its new lock set, the Lockset Bar code was recorded along with the vehicles VIN number; this can be obtained from your local dealership by quoting the Vehicle's VIN number. If the Lockset Bar code given by the dealer is no longer correct for the vehicle (due to an earlier replacement of the lockset and where the kept records were not updated), there is then no alternative but to replace the lockset and use the Lockset bar code that comes with it. When you have the Lockset Bar code, do not attempt to enter this directly, but give this to the help desk who will then convert the Lockset Bar code into a the 3-part FOB CODE. This FOB CODE is then entered here. The FOB CODE can only be obtained by this method.
Fog lights: This denotes whether front fog lights are fitted to the vehicle or not.
Gearbox: This denotes whether the gearbox is manual or automatic.
Immobiliser: Turns on the passive (self) immobilize function in markets which use it.
Key warning: When enabled, the warning gong will sound continuously whilst the keys are in the ignition and the ignition is turned off.
Lazy locking: Changes the situations in which lazy locking is allowed.
Language: This defines the language used by the vehicle to signal messages in its information display. The last option refers to a translation book allowing any other language to be added in look up form.
Market: This is the flag that the BECM uses to see if it is used / configured. When a BECM is brand new it is not set and the display on the instrument pack will only show the message "Market not set". To stop this happening this value must be changed to set.
Mislock: Changes the method of notification of error on alarm arming between using the interior light or the alarm sounder.
Moisture detect: This enables the moisture detected warning facility.
Range lamp: This is used to enable or disable the hi or low range selector back lamp function.
Service light: In certain markets, legislation requires there to be a reminder light to service the engine after a certain distance has been travelled. Adding this feature also requires the bulb to be fitted to the service reminder position in the instrument pack. This will then illuminate (other than in bulb test) when the vehicle travels over 50,000 miles or 80,500 km from whenever the function was enabled.
Sounder: Different markets have different options of alarm sounders fitted that require different outputs from the BECM to operate. This allows correct selection.
Speed limit: This function changes the maximum limit between 100 or 120 at which the over speed warning function built in to the trip computer may be set.
Sunroof: This denotes whether an electric sunroof is fitted to the vehicle or not.
UK police: This selection allows the BECM to be configured to police specification. Setting this without the required rewiring of the vehicle and the addition of switches, may have undesirable effects.
Trip computer: This denotes whether a trip computer is installed in the vehicle or not.
VIN: The last six digits of the Vehicle Identification Number (VIN) that is unique to each vehicle. The designation for the remainder of the VIN is detailed in the relevant manual.
Window cancel: Some markets allow operation of the windows and sunroof for a period of time after the ignition is turned off and the door is opened; some have immediate cancellation of operation when the ignition is turned off and others have no cancellation at all. This allows the desired selection.
Wiper speed: These settings enables the windscreen wiper speed functions.
1 touch: This specifies which windows have one touch functionality.
BECM current alarmed status: This enables to set the BECM to alarmed or not alarmed status. Unknown will be displayed if the value stored in the BECM is not a valid value. You cannot set the status to unknown.
Current EKA lockout status: This enables to set the BECM to EKA lockout or normal status. Unknown will be displayed if the value stored in the BECM is not a valid value. You cannot set the status to unknown.

CODING DATA

Coding Data 1-40: 40 blocks of programmable data stored in the ECU to control its functionality for specific variations of vehicle. There are a number of hexadecimal digits, each digit separated by a comma. Re-entered parameters should be entered in an identical format to that which is read. Changing this values can produce unknown alteration in the functionality of the ECU, damage the ECU or even damage your car.

SM035 - BECM DIRECT MEMORY - Miscellaneous

Instructions for connecting Vehicle Server directly to BECM CPU:

Step 1 - Disconnect the vehicles battery.
Step 2 - Locate BECM Module, which is large box with finned metal lid located under right hand seat.
Step 3 - Using a T50 Torx bit, remove the four right hand seat mounting bolts.
Step 4 - Disconnect all multi plugs from the BECM.
Step 5 - Unscrew the plastic duct on top of the BECM and remove it.
Step 6 - Undo the three 8mm nuts from the four ring terminal connections on the outer face of the BECM (next to the fuses) and pull off the ring terminals. Keep an eye on their order so that they are put back in the right place later.
Step 7 - Undo the 10mm nut to the left of the 3 that were just removed in step 5.
Step 8 - Undo the three 10mm nuts that hold the BECM to the floor of the vehicle and remove the BECM.
Step 9 - Using a T10 Torx bit remove all 8 of the course threaded screws around the edge of the aluminium lid.
Step 10 - Using a T10 Torx bit remove all 11 of the machine thread screws towards the middle of the aluminium lid and remove the lid.
Step 11 - Locate the 4 grey ribbon cables with bright red header connectors coming up around the edge of the large PCB, which is known as the power board.
Step 12 - Carefully unplug each one of the 4 connections by pulling up on the red header connector, which separates. Be careful to pull up evenly on the connector ends only to avoid bending any pins as it comes off.
Step 13 - Bend the ribbon cable backwards so that the disconnected header connector is hanging outside of the BECM 's outer case.
Step 14 - Lift the power board up and hinge it 180 degrees on its wires, which are all at the side with the Fuse box until it is upside down and out of the way.
Step 15 - Using a T10 Torx bit unscrew the 7 screws, which hold down the large PCB in the bottom of the BECM box. And remove the board. This is the Logic Board.
Step 16 - Turn the logic board over and locate the main Central Processor Unit (CPU), This is the Large Chip located towards the corner of the logic board opposite the connectors with a symbol on it which resembles an M in a Circle. (The Motorola Logo).
Step 17 - Turn the board round so you are looking at the CPU with the Motorola Logo upside down, closely examine the area of board just below the CPU and slightly to the left comparing it with the diagnostic connector picture to determine if the board is a Mk 1 board or a Mk 2 board.
Step 18 - Using the relevant picture as a guide, solder the wires of the brown lead as shown in the picture to the connection points indicated on the Logic board. You may need to scrape some of the clear covering off the connection points on the board first and might even have to add some extra solder to the connection points to make a good connection. You might also have to re trim the ends of the wires on the diagnostic lead, cutting it back and re tinning it to keep it tidy and help to make a good connection.
Step 19 - Connect the other end of the lead to the vehicle modem and select read settings.
Step 20 - You will see a screen of values identical to the one seen when reading settings via the vehicles diagnostic connector, with the exception that you will be able to see and adjust all of the values previously not possible on a locked BECM. You will also be able to set the locked status to unlocked.
Step 21 - Desolder the wires before putting the logic board back into the BECM.