Alarm control unit removal

[pacificjuha]

My apologies if this has been already covered, could not find it yet...

I have some connection issues between the key fobs and alarm control unit (ACU). Key fobs do send the signal as inspectedby 'Keyfobrepair'. Regardless of this, Porche dealer could not get the connection to work between the key fobs and the car.

Next step I have planned is to remove the ACU from under the seat, open it to see if there is water damage. After what I do find there, the decision for next step is to be made.

The question:

Before I remove the ACU, the plan is to disconnect the car battery ground, remove the frunk lid lock latch hook (to make sure the frunk does not lock) and after these remove the ACU.

Should I take something else in to consideration to make the ACU re-connecting bck to car to go as smoothly as possible (besides not to misplace the radio code)?

[½cwt]

You can take the cover off with the unit in place.  This will let you see the general condition and you'll see white corrosion residue on the board if it has been damaged.  I was very lucky with min in that it only took out the circuit that powers the interior light and vanity mirror lights (took aged to find with help of circuit diagrams from Richard Hamilton and several emails back and forth to track it back to the alarm module) and I was able to bypass this failure with a fly lead.  I did take out the board and cleaned it the contract cleaner to give it as extended a life as possible.  For mine I did what you you say except the bonnet catch as its an older car so have a mechanical release.  There is a point at which the keys stop talking to the car as the codes can run out or similar JMG Porsche have written up on the 986 alarm system extensively but I can't find the item at the moment.  Like you I had a key repaired which then transmitted again but I've never been able to get it linked again.  Ended up with key new from Porsche.

[iborguk]

https://www.jmgporsche.co.uk/index.php/menu-articles/menu-news/itemlist/tag/key

[pacificjuha]

1 hour ago, iborguk said:

https://www.jmgporsche.co.uk/index.php/menu-articles/menu-news/itemlist/tag/key

This was a good one, thank you!

[Simon_S]

I spent the summer sorting alarm issues. I had three simultaneously.

1 Non functioning key. 2 Waterlogged alarm. 3 Dodgy boot lid sensor

The non functioning key is either a fault with the fob or the alarm does not recognise it any more. You have ruled out the key. The internet is full of methods which claim to reconnect the key to the immobiliser. I've come to the conclusion that the vast majority of them are just claims. The Porsche workshop manual lists just one way to resync the key:

1 Switch on ignition with valid key and transponder

2 Switch off ignition

3 Remove key from steering lock

4 Operate transmitter within 6 seconds after the key has been removed.

If you get no joy after trying this a method a couple of times for luck and you are happy that the immobiliser is ok then you are looking at a new fob from Porsche and recoding.

As you suggest, it is reasonable to want to check the immobiliser as best as you can to rule it out of the problem. The least invasive method is to use a code reader to see if there are any stored codes in the alarm module. My alarm module was full of spurious codes for shorting wires etc. A strong pointer to water damage. If you don't have a code reader then a visual inspection can tell you a lot. I wouldn't recommend trying to do it in situ as you want to have a good look at the loom connector. This is prone to corrosion when water gets in and can cause issues even if the alarm module is ok. Removing the immobiliser module is quite easy but there are a couple of things to guard against. The first is that you don't want to set off the siren, so with the ignition key in position 1 disconnect the battery. To get to the immobiliser module you have to remove the passenger seat. There is an electrical connector under the seat which needs to be unplugged. In my early 2.5 there is no issue with this. There is no airbag in the seat and no connection to the seat buckle. I don't know for certain but in later cars I suspect the connector will be part of the airbag system. This needs treating with respect. Allow some time for capacitors to discharge before disconnection and be wary of turning on the ignition as you might end up with an airbag light. Once you have removed the seat it is quite easy to unplug the immobiliser. Take it right out of its plastic box and look at both sides of the circuit board for signs of water ingress. My personal opinion on drying out boards is that in some cases this might be possible but a circuit board which is live and in the presence of water will deteriorate very quickly due to electrolysis. And some of that damage will not be visible. You can try drying it out but its a long shot. The other thing that needs checking is the loom connector. You can actually open the connector and look at the pins themselves. It may be possible to clean them but sometimes corrosion can track up inside the insulation so any particularly bad connectors are probably best replaced, along with a few cm of the loom for that particular pin.

If you end up in a position where it looks like the immobiliser is irreparably damaged, the cheapest method of repair is to have the eeprom removed and soldered into a second hand immobiliser. This cost me £100 and is much better than buying a second hand immobiliser/ecu set, as the immobiliser remains matched to the car. If you have read the JMG Porsche doc I'm convinced this is what they rather mysteriously refer to when they talk about repairing waterlogged modules. Theoretically all you need is a soldering iron and a solder extractor to DIY. In practice it's delicate work. Of the £100 I paid to get this done only about £35 was for the work, the rest was for the second hand immobiliser so it was a no brainer to pay somebody experienced to do the work.

For completeness a word on spurious alarms and dodgy sensors. I appreciate this was not part of the OP's question but there may be one or two people reading this post who have that problem in the future. When you have a nuisance alarm the first thing to do is silence the siren/alarm horn to allow you to investigate the problem without waking the neighbours. With the key in position 1 unplug the siren and alarm horns which are positioned to the left and right of the battery under the scuttle covers. The alarm will still trigger and the indicators will flash but at least you can still use the car. The quickest way to resolve a random alarm triggering issue (after checking for water ingress and low battery voltage) is to get the alarm event module read. If you don't have Durametric this is a point where you might consider it to be worth buying. It cost me just over £100 to have a Porsche indy read the event module. Money I would rather have put to a Durametric. Hindsight is wonderful!

If you don't want to fork out for Durametric or having your event code read then there is a way to do some simple investigation by ruling out some of the microswitch sensors. Many of the alarm inputs are from microswitches, An alarm event is triggered when the microswitch closes, connecting that particular alarm input to earth. This means that simply unplugging an alarm microswitch fools the immobiliser into thinking that that particular zone is closed. So if you unplug a sensor and the alarm stops triggering randomly then the unplugged sensor is suspect. In fact I have not bothered to change my boot lock yet and have been driving the car for a couple of months with it unplugged.

There is a more sophisticated version of this method you could use if you have a Porsche workshop manual (a couple of quid from Ebay) which gives the immobiliser pin outs. I haven't done this but there's no reason why it won't work. You can actually disconnect alarm inputs by removing pins at the immobiliser connector plug and taping them back (This is what I have done with my boot lock). No wires need to be cut and everything can be restored when you want to. The advantage of doing it like this is that you can disconnect the alarm sensors in groups to see if he problem resolves (then restore them) very quickly. This is much faster than disconnecting sensors one at a time where they plug into the car's loom. And you don't have to go searching for connectors behind door cards etc.

Finally bear in mind that the alarm system does a lot more than just reading the inputs from a few microswitches. Disconnecting sensors may not point conclusively to a problem, and you will end up back with needing to  read the alarm codes/event module.

Hope this helps someone.

[pacificjuha]

5 hours ago, Simon_S said:

I spent the summer sorting alarm issues. I had three simultaneously.

1 Non functioning key. 2 Waterlogged alarm. 3 Dodgy boot lid sensor

The non functioning key is either a fault with the fob or the alarm does not recognise it any more. You have ruled out the key. The internet is full of methods which claim to reconnect the key to the immobiliser. I've come to the conclusion that the vast majority of them are just claims. The Porsche workshop manual lists just one way to resync the key:

1 Switch on ignition with valid key and transponder

2 Switch off ignition

3 Remove key from steering lock

4 Operate transmitter within 6 seconds after the key has been removed.

If you get no joy after trying this a method a couple of times for luck and you are happy that the immobiliser is ok then you are looking at a new fob from Porsche and recoding.

As you suggest, it is reasonable to want to check the immobiliser as best as you can to rule it out of the problem. The least invasive method is to use a code reader to see if there are any stored codes in the alarm module. My alarm module was full of spurious codes for shorting wires etc. A strong pointer to water damage. If you don't have a code reader then a visual inspection can tell you a lot. I wouldn't recommend trying to do it in situ as you want to have a good look at the loom connector. This is prone to corrosion when water gets in and can cause issues even if the alarm module is ok. Removing the immobiliser module is quite easy but there are a couple of things to guard against. The first is that you don't want to set off the siren, so with the ignition key in position 1 disconnect the battery. To get to the immobiliser module you have to remove the passenger seat. There is an electrical connector under the seat which needs to be unplugged. In my early 2.5 there is no issue with this. There is no airbag in the seat and no connection to the seat buckle. I don't know for certain but in later cars I suspect the connector will be part of the airbag system. This needs treating with respect. Allow some time for capacitors to discharge before disconnection and be wary of turning on the ignition as you might end up with an airbag light. Once you have removed the seat it is quite easy to unplug the immobiliser. Take it right out of its plastic box and look at both sides of the circuit board for signs of water ingress. My personal opinion on drying out boards is that in some cases this might be possible but a circuit board which is live and in the presence of water will deteriorate very quickly due to electrolysis. And some of that damage will not be visible. You can try drying it out but its a long shot. The other thing that needs checking is the loom connector. You can actually open the connector and look at the pins themselves. It may be possible to clean them but sometimes corrosion can track up inside the insulation so any particularly bad connectors are probably best replaced, along with a few cm of the loom for that particular pin.

If you end up in a position where it looks like the immobiliser is irreparably damaged, the cheapest method of repair is to have the eeprom removed and soldered into a second hand immobiliser. This cost me £100 and is much better than buying a second hand immobiliser/ecu set, as the immobiliser remains matched to the car. If you have read the JMG Porsche doc I'm convinced this is what they rather mysteriously refer to when they talk about repairing waterlogged modules. Theoretically all you need is a soldering iron and a solder extractor to DIY. In practice it's delicate work. Of the £100 I paid to get this done only about £35 was for the work, the rest was for the second hand immobiliser so it was a no brainer to pay somebody experienced to do the work.

Hope this helps someone.

Fantastic, thank you Simon_S! This is very informative - I'll pull out the Immobilizer and have a close look at it as you describe. Both keys have not worked since I burchased the car 1,5 years ago - issue was already with the previous owner. i have made sure that there has not been any water under the carpets at the time I have had the car. Also during last winter and now again, i have installed an 'passive airdryer bag' in to the car floor next to the immobilizer (drying the bag in every two weeks).

[Simon_S]

If your immobiliser is OK and using the method above you cannot sync the keys then it is new fob time. There is no cheap way to do this other than to buy new from Porsche because you need the code that comes with the fob to program into your alarm. Getting a second had fob that matches your car with the code label is next to impossible. A new fob from Porsche cost me £180 and that was after I asked for a discount. The next thing you need is for the fob to be coded to the car. There is a charge for this and not everyone can do it because you need codes specific to your car to program the immobiliser which are held by Porsche. I had my new fob coded for nothing as part of the immobiliser repair. My eeprom was read and I was given the immobiliser codes for future reference. Good service! PM me if you want to be put in touch. 

[pacificjuha]

On 11/23/2020 at 11:05 PM, Simon_S said:

If your immobiliser is OK and using the method above you cannot sync the keys then it is new fob time. There is no cheap way to do this other than to buy new from Porsche because you need the code that comes with the fob to program into your alarm. Getting a second had fob that matches your car with the code label is next to impossible. A new fob from Porsche cost me £180 and that was after I asked for a discount. The next thing you need is for the fob to be coded to the car. There is a charge for this and not everyone can do it because you need codes specific to your car to program the immobiliser which are held by Porsche. I had my new fob coded for nothing as part of the immobiliser repair. My eeprom was read and I was given the immobiliser codes for future reference. Good service! PM me if you want to be put in touch. 

I got the ACU out today and Looks like the ACU is fine - does not have any sign of moisture in it. Also the pins on the connectors and plastic box is super clean inside out.

Both, the ACU and fobs were replaced on 2015 by previous owner due to water damage in old unit. So, the current unit looks real good maybe for a good reason.

It is just amazing that the keys do not communicate with the ACU - not even with the attempt by Porsche dealer... Could there be any other fault possibilities to check before ordering a new fob from Porsche dealer?

[Menoporsche]

On 11/23/2020 at 1:47 PM, Simon_S said:

I spent the summer sorting alarm issues. I had three simultaneously.

<snip>

What an awesome post.

[Simon_S]

Thanks Menoporsche, I can't claim all the credit. Ian @ mdbdiagnostics gave me a lot of free advice and did my eeprom swop/coding. He has no connection to me. I recommend him unreservedly.

Pacificjuha I cannot see any telltales of water damage. Personally I think you have got to the end of what you can do yourself, particularly if you have no diagnostic software. Before you go to Porsche to get a new fob coded to your car it might be worth phoning Ian for advice on what he can do. There's enough info in this post to Google him.

[pacificjuha]

3 hours ago, Simon_S said:

Thanks Menoporsche, I can't claim all the credit. Ian @ mdbdiagnostics gave me a lot of free advice and did my eeprom swop/coding. He has no connection to me. I recommend him unreservedly.

Pacificjuha I cannot see any telltales of water damage. Personally I think you have got to the end of what you can do yourself, particularly if you have no diagnostic software. Before you go to Porsche to get a new fob coded to your car it might be worth phoning Ian for advice on what he can do. There's enough info in this post to Google him.

Thanks Simon_S, I'll contact Ian for advice

[pacificjuha]

Today was an interesting day -  had a chance to disturb buch of my neighbors with a Boxster alarm going off constantly...

Car is 2001 Boxster with manual trasmission.

Battery was disconnected (the ground was not connected). Front trunk lid was open adn I did put the ACU back in the car under the seat. Connected the plugs in this order -> blue, black and antenna. All seemed fine for now.

Placed the key in the ingnition adn turned it to 1st position.

Connected the battery ground. Interior lights came on immediately BUT the frunk light did NOT come on... it was working fine before I disconnected the battery ground and removed the ACU. The bulb is fine - just tested it.

Tested the frunk lid actuator befoere closing the frunk lid and it worked fine (installed a brand new frunk lid actuator during thos summer). Then closed the frunk lid and re-opened fine it with the frunk lid actuator button.

Then closed the drivers door and activated the central lock / alarm. Otherwise all went as normal, but alarm light did not start to flash on top of the dash as usual - alarm indicator light stayed completely non lit, but radio alarm light did stat flashing.

Next I disarmed the alarm / opened the door lock by turnign the key on the door and then opened the door -> this triggered the alarm immediately. The frunk nor trunk did not open anymore adn I could not get the car quiet. I waited the alarm to go silent after the 'normal' alarm time. It worked, but it was silent only few seconds untill it started going off again. Turnign the kay in the ignition did not do anything to help on turnign the alarm off. All lights in the dash lit up as usual when I turned the key, but car did not start nor the engine turn at all as the key was turned to the 'start' position.

Only way for me to get the car quiet was to disconnect the black connector from the ACU.

I'll try to find time next week to open the frunk with the emergency cable in the fenderwell to disconeect the battery.

Do you have any idea what went wrong here... why the alarm started to go off and messed up the ACU re-installation???

I'm lost with this case and prefer not to disturb my neigbors more if anyhow possible. All and any help would be most appreciated.

[½cwt]

@Richard Hamilton - any ideas?

[Richard Hamilton]

What is the battery voltage?  Sounds like it might be low to me.

[Simon_S]

When you locate the emergency frunk release might be worth attaching some rope to it. Cable tie the rope to the loom at the back of the indicator. you will then be able to pop the frunk simply by removing the indicator and pulling the rope.

Not sure about the alarm issue. I did have a similar situation before I changed my immobiliser and battery. It was straight after taking the car out of storage in spring. so it could be a voltage issue as Richard suggests.

Suggest that when you get the frunk open you unplug the siren. The alarm horn is not so intrusive and has no independent power supply so at least if it goes off you can silence it by disconnecting the battery. If it isn't responding to the key then of those screw in battery battery you can buy on ebay would enable you to disconnect quickly without tools. Be careful if you fit one and keep it clean or you will introduce another low voltage issue. As I said in my previous post the alarm event log will record why it's going off. 

 

[pacificjuha]

3 hours ago, Richard Hamilton said:

What is the battery voltage?  Sounds like it might be low to me.

Thank you Richard. The car has been 'off duty' two weeks. What would be a good / normal voltage to look for in the battery?

Will the voltage measured in the cigarette lighter show real voltage, or would there be some 'stuff' between battery and the cigarette lighter that would lower the voltage level?

Regardless, I'll check the voltage directly from the battery as I get the frunk open later on this week or latest on the weekend.

[pacificjuha]

2 hours ago, Simon_S said:

When you locate the emergency frunk release might be worth attaching some rope to it. Cable tie the rope to the loom at the back of the indicator. you will then be able to pop the frunk simply by removing the indicator and pulling the rope.

Not sure about the alarm issue. I did have a similar situation before I changed my immobiliser and battery. It was straight after taking the car out of storage in spring. so it could be a voltage issue as Richard suggests.

As I said in my previous post the alarm event log will record why it's going off. 

 

Thanks Simon, will sort out the frunk cable issue... I contacted the PO adn he told his mechanic having installed a zip-tie to the cable to be a bit closer and easier to pull from... He had a dead battery 3-4 years ago...

The alarm event log is interesting to see, can Durametric read it?

[Menoporsche]

Some people here suggested rerouting the bonnet release cable (or extending it with rope, cord whatever) to behind the towing eye plate.

Whatever you do, test it a couple of times before putting it back together!

[½cwt]

39 minutes ago, pacificjuha said:

Thanks Simon, will sort out the frunk cable issue... I contacted the PO adn he told his mechanic having installed a zip-tie to the cable to be a bit closer and easier to pull from... He had a dead battery 3-4 years ago...

The alarm event log is interesting to see, can Durametric read it?

Key piece of information there, a dead battery 3-4 years ago on an occasionally used car.  Probably time for a new one, these 986s seem to get through them if not kept on a conditioner or used regularly.  Mine had a new battery less than two years ago but needed a jump start twice this year after standing for three weeks whilst I did work on it.

[pacificjuha]

11 minutes ago, ½cwt said:

Key piece of information there, a dead battery 3-4 years ago on an occasionally used car.  Probably time for a new one, these 986s seem to get through them if not kept on a conditioner or used regularly.  Mine had a new battery less than two years ago but needed a jump start twice this year after standing for three weeks whilst I did work on it.

You're right. The PO did not drive the car much during last 5 years. I have now driven it in a year over 20.000 km. Most likely the battery needs replacing and will get a new one by the spring before taking the car in to use again.

[Richard Hamilton]

1 hour ago, pacificjuha said:

Thank you Richard. The car has been 'off duty' two weeks. What would be a good / normal voltage to look for in the battery?

Will the voltage measured in the cigarette lighter show real voltage, or would there be some 'stuff' between battery and the cigarette lighter that would lower the voltage level?

Regardless, I'll check the voltage directly from the battery as I get the frunk open later on this week or latest on the weekend.

It should read the same on the cigarette lighter.  If it is below about 11.5V off load, it could be your problem.  Try turning the headlights on while you are measuring the voltage.  If it dips significantly, give it a good charge before you try any more detailed troubleshooting.

[Simon_S]

I don't have durametric so can't confirm that it reads the alarm event log.

Richard would you know?

[Richard Hamilton]

25 minutes ago, Simon_S said:

I don't have durametric so can't confirm that it reads the alarm event log.

Richard would you know?

I know it shows fault codes, but I don't know if it shows the two event logs.

[pacificjuha]

1 hour ago, Richard Hamilton said:

It should read the same on the cigarette lighter.  If it is below about 11.5V off load, it could be your problem.  Try turning the headlights on while you are measuring the voltage.  If it dips significantly, give it a good charge before you try any more detailed troubleshooting.

Fantastic, thank you Richard! This I can check most likely already tomorrow - will keep you updated.

[Indi9xx]

On 11/23/2020 at 1:47 PM, Simon_S said:

If you have read the JMG Porsche doc I'm convinced this is what they rather mysteriously refer to when they talk about repairing waterlogged modules.

Nothing too mysterious about it really.

As anyone in here who has had us repair a unit, typically there is a scale of economics where we will advise someone to have a new control unit if it is too far gone. But we do not tend to offer used units at all. The biggest reason is because finding a used unit with a guaranteed that it has never been flooded is tricky, and spending money obtaining them, swapping chips bench testing it and if then it is a good one, sending it off to a customer is not a guaranteed route to a reliable unit.

I really need to update the article on the website as trends have changed over the last couple of years.

One thing we are seeing more often at the moment is where people send us control units and keys thinking the control unit is at fault as the remotes have stopped working, but where this is the only symptom, we are trying to catch them before they send us control units and asking them to disconnect their ignition switch and try the remotes again, as a faulty ignition switch, reporting to the alarm that the key is still installed, or there is even a small voltage leak to the ignition live or accessory wire can be seen as the ignition being switched on or in the accessory position by the alarm, which blocks it from listening to the remotes.

We never used to see this, as the previous more obvious ignition switch faults seemed to usually cause battery drains, radios staying on, but more recently there seems to be a different failure mode, which I suspect is a different failure mode of aftermarket ignition switches hitting the end of their lives.

Our process is as follows. (I will try to include details which will help people to solve their own problems here)

1 - Initial inspection.

The first thing we do is open up the alarm control units and check for visually obvious problems, such as corrosion, blown tracks, blown components and we have even seen many where the power connector legs have corroded away or have been blown apart! If corroded, they are drenched in a corrosion specific PCB cleaner, and then flushed with a matching pacifying cleaner, so they can be inspected properly. For this I like the Kontakt aerosol products available from Farnell (corrosive, pacifier and their PCC sprays) not cheap but the best I have found.

2 - Dry the boards

Any that are suspected as still being damp are placed into a dehumidifier over night to draw out any moisture. This could be done by owners with a food dehydrator.

3 - Bench testing.

Once we are sure there are no shorts likely to hurt the test bench, we move onto to connecting them up to the bench which we built ourselves which has the various DME type connectors and alarm control unit testers, which are connected to a power supply and fuse board and breakout points to test the electrical inputs and outputs, as well as providing life support to the control units. Most importantly this is connected to an old Porsche System Tester 2, which I find is better on these control units than the later PIWIS versions we use in the workshop (which we also repair if anyone ever needs one supporting).

3a - Erased eeproms.

On the test bench we start off looking at the fault codes, event and activation memory. But if it fails to identify the control unit, with anything spurious in the control unit identification stage, this is often the eeprom has erased. Daftly, the eeprom in these needs two pins to be grounded together to erase, which when they get water logged can happen. In these cases we will disable the CPU on the board so we can directly alter the eeprom without the process of powering it up also powering other parts of the control unit, stopping proper read and writes to the eeprom or corrupted data as the cpu tries to access it while we try to write it. In this stage we re-program the eeprom with some test data so we can properly communicate with it using the Porsche diagnostic.

If this is the only problem, we can program it again with reconstructed data, using the cars original factory immobiliser code, learning codes, but alas if the eeprom is erased then so is the rolling key data, so new keys will be needed (it is impossible to recover the remote data from old keys without the data stored in the acu, transponders are a different matter, but pretty useless apart from as a emergency key.

3b - Faulty relays.

This is probably the first phase of alarm control unit death, the relays although partially sealed have no protection against getting water inside them (and the water draining out of them afterwards) which especially is aggressive to the contacts within the relays which have usually burnt off their plating over the years anyway. We can spot these by manually activating the relays via the PST2. If we spot any which are not responsive, we then move onto using a logic probe on their inputs to see if the relay is at fault, or the CPU/PCB, tracing the fault back.

3c - Faulty CPU

If the fault is down to the CPU, it is usually the water ingress has shorted the processor and blown in the IO stages, which is usually pretty terminal for the unit, as the original CPU's were supplied to Delphi under licence and are not available on the aftermarket. We could harvest used control units for these, but the same problem with using used alarm control units can be a concern, if the chip has been drowned in the past, there is a chance it may work today, but might not work in the future, and with used units you really do not know what the history is. In this case we normally recommend a new alarm control unit. If the data in the original ACU is reasonably intact, we can recover the key data and convert it back into barcode data to program a new ACU with the original keys.

3d - Faulty minor components or PCB.

Some units have corrosion in the solder joints, which can cause all kinds of problems, if this is seen after the cleaning and drying phases, we can quickly re-flow solder joints to find out if the situation improves. But the worry is then if multiple joints might have corrosion which has crept past any dry joint cracks and might cause problems in the future. For this we advise the customer of the risks of proceeding with other repairs.

The many components on the boards are generally quite robust, but we do see some with on board components which have blown, which can be replaced, even the surface mount ones as we have a hot air solder rework station and the skill to use them (always amusing to see a newbie on one blow half the components off of a training board when first trying!) along with also the right thermal masking to keep heat away from other components.

The voltage regulators can be a problem, but usually by the time they have failed the CPU normally also has blown input output stages.

Generally there can be many ways of repairing these, but all the above stages of testing we include in a one off "bench testing and inspection" charge of £75.

Once the above tests and assessment has been performed, we give the customer the complete rundown of the results of testing, along with our advice as to any future risks to reliability and repair or replacement options.

There are some boards we get in and we scratch the bench testing phase, if the board is literally blown apart and looks like it has been almost or actually on fire.

Breakdown of success rates and routes to repair.

Probably about 30% are beyond economic repair, but we have options for these where a new ACU can be used and we can rescue and decrypt data from the old unit, to program a new one using the PST2. In other words turn the data into barcode data again, and program the keys as if they were new ones. Which still save the customer money over having the traditional repair of a new ACU and new key remotes.

Probably another 30% of them are questionable repairs. In other words we think we can repair them, but due to the water damage, the unit may not be reliable in the future, or the cost of repair is getting within 75% or more of the cost of a new unit. With this we often use the date of manufacture data to also help a judgement call on if it is worth repairing the unit based on age, condition and how badly drenched it seems to have been in the past (corrosion levels, burnt traces on the board etc)

Another 30% are repairable without any real concern of future reliability, often these will be units which look to be in relatively good condition, with only minor water marks on the boards and relays or other components found to be the main problem.

So you could say there are 30% we are happy to repair and guarantee, 30% where it is touch and go where the customer should decide (we can fix, but the future is unknown and can't be given a warranty) and 30% which are beyond repair with certainty.

Now some notes for the DIY'er who might want to do some things themselves, and some myth busting.

* De-soldering an eeprom off of an old board and putting it on a replacement "used" board.

This can be done, but you are taking a risk of the used board might have a dodgy history and may have some intermittent faults, in other words in the 30% zone where we would let the customer decide if we should go ahead with repairs... The board might work, but there is a risk that it might fail in the future. If it is yourself taking the seat out, doing the soldering, resoldering and installing, all you have to loose I guess is what you pay for the used ACU and your time. But for us time is money, and repairing a unit without a guarantee of a fully working reliable end result, the potential of an upset customer and a customer who might be paying someone else (such as a garage) to remove and refit units and seats, is not really something we want to get into as a business.

* De-soldering an eeprom off of an old board onto a brand new board.

The new boards have a 2 year garauntee from Porsche, and hidden in the data is the build date of the board. If you solder your old chip onto a new board, no matter how clean and perfect your soldering is, if you ever try to return it to Porsche under garauntee, the Porsche factory will know it is not the original chip and that things have been meddled with. Warranty voided, and the main dealer who tried to claim on it would have the claim denied, which could see them either not refunding you or chasing you for payment if they supplied you with another unit.

* De-soldering/soldering in any case.

As long as it is just your own time at risk, and a used unit is found for free or cheap, then this may be an option as you will only be risking your own time. But if the investment is higher, either your time, hassle, or even the cost of the donor or new unit, using even a hot air rework station has the risks of not only removing the chip, but also delaminating the pads on the PCB that the chip is soldered to. In my experience these boards are pretty poor quality when it comes to trace/pad thickness and material, you have to be really quite careful as just a little too much heat can see a pad or trace on the PCB lifting.

But if you are going to do it, flux is your friend, for de-soldering, cleaning up the board, and for soldering the new component. For a bit of learning on this a really good channel on YouTube is run by a chap called Luis Rossman, who runs an Apple laptop repair business in New York, his videos show him surface mount repairing boards, and are full of great tips for anyone trying to try this out for themselves.

* Keeping the barcode off of new keys, so they can be programmed again later if they are out of sync.

Once the barcode tag on a new key has been programmed and the key remote used to communicate with an ACU, that code is no longer going to work.

The keys remotes have a rolling code and the key code data is never completely transmitted, it is what is known as a challenge response system. The ACU and the Key have some pre programmed questions. So when you press your key button, it will introduce itself to the ACU, and the ACU will then transmit a question number, which may be as simple as "Question number 2" (in easy to understand terms), the ACU will know that this question is "Add the first byte in the code, to the 7th and then average it" and then will transmit that to the ACU with another question of its own.. The ACU will compare this answer with the data it has stored on the eeprom, and if correct will then work out the answer to the key remotes question and transmit the answer, with another question. All of this happens in a blink of an eye, and if the alarm and the key are satisfied they are talking to it's matched ACU/Key, the car will unlock or lock... And then both of them will scramble their code using an algorithm, which should see them both remaining in sync, with a partially new code, so anyone snooping on the code can not just transmit it.

The ACU can be hacked and the data reverse engineered to get the key data, but once the bar code has been programmed to a control unit, and the key remote used, that barcode is now useless, it can't be used later to re-sync the control unit and key.

* Getting the data out of the key remote.

There is no way of getting the current key data out of the remote control to program into the control unit. I have completely investigated this, and other than lapping away the top of the chip, exposing the silicon layer, using an electron microscope to read the state of each gate of the board would be the only way... Potentially useful if the data was of national importance in reverse engineering an enemies top secret technology... But way beyond the cost of the most valuable Porsche with this type of alarm system, or potentially any Porsche in existence.

* Putting the alarm control unit in a waterproof box.

If the Alarm control unit gets flooded, if it is not in a sealed box, my opinion is at least once the water drains away, the control unit will dry out... But putting it in a "waterproof box" risks the potential that it might not be completely waterproof against being immersed in water (a bit like a watch being water resistant, versus water proof to a certain depth for a certain amount of time... The risk is that if the box is 99.9% water proof, it may slowly let water in over the course of days or weeks that it is immersed in water, but once the water subsides at least without a box, the water will also drain out... But with a 99.9% waterproof box, if may let water in slowly, even if via capillary action through the wiring harness, and then that water is above the "tide line" and never drain out, exposing the PCB to water for days, weeks, months, depending when the problem is discovered.

For making the car less likely to suffer a future failure, we have some options open to people who have a unit repaired by us, including options of lacquering the boards for a little more water resistance, auxiliary drain kits and general advice. But in my opinion, waterproof boxes are a bad idea.

*  Eating carrots can help you see in the dark.

Actually I am just checking to see if you are still reading this. I think this was actually some propaganda spread during world war two to make the Germans think we were feeding our pilots carrots which made them see in the dark, when our secret radar technology was the real reason why we could find their bombers in the middle of the night... Ok so you are still reading.

* Just buy a used Alarm Control unit, DME and Key remotes as a set is a good idea?

So you go on ebay and send one of the Porsche specialist breakers between £250 and £400 for a set of an alarm control unit, engine management ECU (DME) and a key or a couple of keys.... Yes this will work... in the short term.

But there is a problem, you will have just locked yourself into a situation that once those keys stop working, you can't have a new one programmed to it.

To program a key to a alarm control unit you need what is known as IPAS codes, from the main dealer, or the ability to decrypt the alarm control unit data to extract the IPAS codes from the control unit.

Critically, the IPAS codes are the immobiliser code (16 digits) the alarm learning code (6 digits) and the DME learning code (6 digits)... For a specialist or main dealer to get these codes, to use with a Porsche diagnostic machine (The durametric can't code keys), they will need to request them, and unless you have the log book in your name for the right chassis number for those used control units, you are not going to get IPAS codes.

This means once those keys play up, you are completely up the creak as no one will be able to code the new keys to the alarm control unit you have.... Except for us, we can turn your DME, ACU into a virgin as new unit, and program the correct IPAS codes into them, and then program new keys to them... The main dealer method would require a new ACU, DME and new keys, a pretty expensive job.

We had some main dealers contact us because they had turned multiple new alarm control units and keys into "bricks", by trying to program them to a Boxster with a new alarm control unit, not realising the ACU, DME and Keys in that car were a set from a scrap car. One had turned 5 ACU's and 5 new keys into dead units by programming them (they can only be programmed once using main dealer kit) and with each unit they had talked to the factory who were also baffled why the car would not start afterwards. (We sorted them out by turning all the ACU's back into virgin units, as well as the DME, and then programming the DME and ACU to the correct IPAS codes for the car and sending it all back to them, getting them out of a hole to the tune of about £4,000... Some dealers had been in this situation and billed the customer for all these control units.

* If you find your key remotes do not work, DO NOT keep trying them, expecting them to work!

There is a bug, or design feature, in the 986/996 remotes, where if the remotes are activated many times, out of range of the ACU, or without the ACU answering, they roll the codes despite not making a connection. This can not be reversed and the new key code can not be recovered from the key remote (see above about electron microscope method!)

You can press them a few times, but there is a point where eventually they will roll the code. I have seen many examples where someone has let a child play with their remotes, and later find that they no longer lock or unlock the car, once I have seen them and tested them the answers in the challenge response system are wrong in both directions, as the ACU and key are dealing with different numbers.

One key remote I killed on purpose as a test while reverse engineering the alarm control unit software and developing my test bench, where I found with that specific generation and part number of remote took exactly 40 button presses to see the code roll without being in contact with the ACU.

Normally, if the buttons are pressed out of range, or with a dead control unit, the key will not roll it's code, but hit that specific remotes magic number of presses, and the key remote is as good as junk... It will still be talking, but now on a completely different key security code than your ACU.

Just be careful how many times you press the buttons out of range of the car, or when the car does not seem to be responding to key remote presses.

* What to do if the key remote does not seem to work, with it's LED flashing.

Try the battery reverse trick listed on the website article at JMG, this was originally in a Technical Service Bulletin, where the factory explained that unless this process had been tried, they would not accept warranty returns. If the chip on the remote circuit board crashes, flipping the battery not only removes power from the chip, but also drains all power from it, so once the battery is returned the right way round, it will see the chip powering up and not being in it's locked/crashed state.

Then try the re-synch technique on the website (JMG) which will do two things, take a stubborn ACU out of deep sleep, and re-train it if the codes still match (another bug/design feature)

The next thing I would recommend trying is reaching under the dashboard and disconnecting the ignition switch wiring connector and try the remote again. If it then works, the problem was/is the ignition switch has a voltage leak from permanent live to the accessory or ignition live positions. A new switch is needed.

If all else fails, take out the passenger seat (RHD, or drivers seat with a LHD car), and check the alarm control unit for any signs of water damage, as well as checking the fuse between the two connectors (this can sometimes blow, knocking out remote locking).

* What to do if the LED does not flash at all.

Replace the battery in the remote.

* What to do if the LED is illuminated as a solid light all the time, or is illuminated all the time a button is pressed (not flashing)

Take the battery out and try the flip trick. If this does not work the key remote needs repairing or replacing, we can test them. But the problem will not be an ignition switch, or the alarm control unit.

* The remotes have a finite life measured in button presses.

One thing we learned in reverse engineering the alarm control units and keys, the method for rolling the codes only work for a finite number of events. Depending on the model/part number/revision of the alarm control unit and key, both have a point where the codes will no longer roll on one but not the other, despite it being possible within the algorithm for both to continue rolling in sync. I think is what is known as "planned obsolesce" But don't panic, it is in the range of many tens of thousands of presses.

* Key servicing.

When we recover keys for a new control unit, because the customer is investing in a new control unit, programming etc, to give the new "package" of parts the best future, we often recommend complete servicing of the key remotes, this includes a new button side of the case (Genuine, stay away from the Chinese ones), a new rubber gasket, the circuit board cleaned and reflowed joints, new button microswitches if needed, new Porsche crest badge and everything cleaned. The result should be the keys lasting for many years to come. Moisture kills the key remotes, so once the buttons start to split, moisture gets in (even humidity) and causes havoc, but also worn key button parts of the case, as they distort in time cause the microswitches to be activated at an angle, rather than perpendicular, which damages the button microswitches.

This is not something you have to have the likes of us to do, you can do it all yourself as preventative maintenance.

* Transponders.... Everything you wanted to know but were afraid to ask...

Just about everything I have been talking about so far has been about the key-remote, the small circuit board inside the alarm which is designed to unlock and lock, and alarm and de-alarm the car.

For those who do not know, there is also the transponder, a small glass device, held inside the same plastic case of the key-remote, but this stores a specific unique code for that key remote.

Some of you might know it holds a 8 digit code, which can be seen on the screen of a PST2 or PIWIS variant dealer machine when programming a transponder.

What not many people do not know is it holds more data than this, and in particular, some of the transponder types used in the various key remotes can only be programmed once by traditional use of the PST2 or PIWIS variants. This is because once they have been programmed to a specific control unit, they set another digit in their code, which tells the dealer diagnostic machine that it has already been programmed to another control unit.

However hitting the hardware direct with the correct data stream will get around this, but it is beyond what the main dealers or even the Porsche factory, or Delphi can do. This is a bit of a hack. Porsche/Delphi/MegaMoss put this measure in place to make it so when an alarm control unit dies, the key remotes transponders can't be programmed to another car.

If you are lucky and your key remote is more than 12 years old, it will have a key remote transponder which can be programmed more than once to an alarm by a main dealer tool, however if the key remote is newer than this, then you will need a new transponder (which comes with a new remote, or you can buy them in the aftermarket)

The early first generation of Boxster alarm control units and key remotes (with a part number ending 260.00) are immune to this problem and the transponders/alarm control units can pair more than once.

These transponders work by inductive loop technology.. How they work is not really important for this text, but basically when the key is in the ignition, and switched on, a ring around the ignition barrel has a current passed through it in AC, which gives the transponder a wireless charge for a moment, so it can then transmit it's code.

* Can any of this text be used to steal a Boxster or 996?

No... I have omitted much information I learned from reverse engineering these systems, as there are security flaws, and Porsche know about them, which is why they squashed the PHD thesis from some other chaps in the UK who reverse engineered the key remotes and alarms, with a gagging order and a quarter of a million pound lawsuit.. Which is why I would never publish some features of the systems, not because I am being awkward when asked "How does X work"... But because telling anyone could expose our cars to being insecure, but also getting the full force of Porsche lawyers on my case!

* Who knows the full in's and outs of the 986/996 security systems?

I spent about 2 years reverse engineering these, with the help of a software engineer friend who automated parts of the decryption process (RIP Chris), but beyond that, I do not know anyone else who has gone into the electronic and digital/software side of them. I mainly did it because even the Porsche factory tech support did not understand them, and every time we programmed a new control unit we feared that one incorrect digit in an immobiliser code being input to a PST2/PIWIS1/2/3 would turn a upto £380 ACU into a doorstop.. So I wanted to make sure I could return them to default new setting, fix the ones which did not look so bad, and eventually learned more than I ever set out to learn.

I also discovered that there were five companies involved, each with their own secret technology, MicroChip-Corp and MegaMoss for the alarm and immobiliser electronics and software (separately, with neither knowing much about the other) Delphi for integrating the two electronics with a minimum of knowledge of the secrets, Bosch who integrated the engine management side and PST2 diagnostic machine (without knowing the secrets) and Porsche who just sell the parts, put them in new cars, so it was no wonder that none of the engineers even at the factory and R&D department could give me much information even off the record.

So there you go, anyone that is still reading, well done.

I just wanted to demystify and debunk as much as I could about these alarm control units and key remotes, there is so much "bull" floating around the internet about them, and general confusion even with main dealer techs.

But as there was a question about our being cryptic about the repair process, I thought I would let you all know the kinds of things we do to repair and test them without the car. No slight of hand, no used control units, just common sense electrical or software based repairs, with a healthy dose of being honest with customers when and when not a repair is a good idea in our opinion.

Used parts, by the nature of the beast, are for the DIY'er, where time is not money, and "worth a punt" where if things go wrong, all someone has lost is some of their time. Well done to whoever do it, but I can't put my name to it as a service to offer, too easy to end up getting the backlash from one going bad, even if you have warned them. We have done similar things for a couple of customers, where they have sent used boards, which often ends up with the replacements not passing bench testing, or failing sometime later. The thing to ask yourself, do the scrap yards know enough about the ACU's to be able to test them properly, and often the cars they break up have been in a yard for months while they clear insurance claims/auctions/arguments before they take them apart, so chances are high that one may have got very damp in that time.

Doing this is by no means a significant part of our business, but just a side effect of wanting to understand the undocumented and then when we had done that, found ourselves with something useful to offer in repairs, but if anyone else wants to use the information here to offer a similar service, it is not a problem for me, it's just something we do because we know now how to do it.

Any questions? (I might not be able to answer them all for security reasons as mentioned)