Displaying items by tag: gt3
The Porsche security system in the Porsche Boxster 986 models (up to 2004) and the 996 models upto 2005 can be problematic. When faulty they can cause all kinds of strange behaviour, including winding windows up and down, the car not locking or unlocking with the remote or in some cases with the key even, as well as the car failing to start or any combination of these problems.
To help the Porsche community get to the bottom of problems they may be experiencing, we have written this 996/986 Security system 101 article.
Q: Do all Boxster 986 and 996 models have a factory fitted alarm and immobiliser?
A: All 986 and 996 models do have an immobilser, nearly all of them have a combined alarm and immobiliser (I am yet to see one of the rare ones which has the immobiliser only)
For the purposes of this security system primer, we will assume that all the 986 and 996 models are the versions with the combined alarm and immobiliser.
Over the last 20 years since we first started repairing the Boxster and 996 models, we have had to replace hundreds of key remotes and alarm control units, the details of the inner workings of both are an undocumented mystery with Porsche releasing very few details for obvious reasons.
Without having the proper Porsche PST2 (Porsche system tester two) official diagnostic computer, or one of the later PIWIS or PIWIS2 computers, normally only available at Porsche main dealers, or super-duber independents like JMG Porsche, a new alarm control unit or key remote can not be programmed to work with your car.
Even with one of these super amazing factory tools, you also need special numbers, unique to each car, to program the new control units, previously only available from the Porsche main dealer network.
By the time that 2015 rolled around, Jon Mitchell at JMG Porsche was getting a little bit frustrated. Previously every single component within a Porsche car he had intimate knowledge of just how it worked, from the software within the control units, through to the the engines and transmissions, what he did not like was that it seemed that there was a lack of information about the Porsche security systems, even through the official main dealer information systems... So he set about reverse engineering them which has unlocked all of their inner secrets, but for security reasons, only some of them will be ever released to the wider public.. Hopefully though, these details with help other Porsche technicians and Porsche owners understand the security systems in these cars a little better.
So, in essence, without giving too much away.. How does the system work?
There are three main elements to the security system.
- The Key with its key head remote (the black bit on the end of the key with buttons)
- The Key with its transponder (This is buried in the black plastic remote at the end of the key)
- The Key alarm and immobiliser control unit, both housed in a black plastic box, under one of the front seats, waiting for a bath (more on this shortly!)
The key remote head buttons, and the circuit board under them, along with a battery, are there to lock the car (also setting the alarm in the process) and to unlock the car (and unsetting the alarm in the process), apart from on some versions opening the front or rear luggage area, or in others opening the roof. This is all they do (in simple terms)
The transponder chip, completely unattached to the alarm remote other than being housed in the same black plastic blob with buttons, does one thing.. When you put the key in the ignition, a form of magic (known as inductive loop technology) causes the transponder to have a quick chat with the immobiliser side of the alarm control unit, causing the immobiliser to in turn have a chat with the engine management system, and allow the car to start.
The combined alarm and immobiliser control unit, sitting under one of the seats, apart from unlocking and locking doors, immobilising the engine, stopping the windows from working, allowing the windows to wind up and down, and in some models controlling what the roof is allowed to do, also has one other mission in life, detect water, and once detected, panic, act confused or even keel over and die.
Now to learn a bit more about what makes the alarm control unit to fail, before we move onto the remote controls and their problems.
Under the left hand seat (in a right hand drive UK spec car) sits the alarm control unit, which also houses the nerve centre of the immobiliser.. It sits in a slight depression of the metal floor of the car, which is a bit of a problem, because any water that makes it's way into the car will find that depression and fill it up, damaging the alarm control unit in the process.
Traditionally, the alarm system at this point, will be kaput.. It may still work a bit, it may be doing some strange things such as partially working, intermittently working or the car might just be acting possessed. The alarm might start going off for no apparent reason, the windows might start rolling up or down without you ever pressing the buttons, you might even come back to your car and find it locked, even though you were sure you had locked it, or the remote controls might stop working.
In the past, a kaput alarm would have had one cure... Drying out the water (if it had not done it anyway), solving the leak (often on Boxsters the roof drains) and replacing the alarm control unit and the key remotes, sometimes this could cost anything from £1500 upwards in parts and labour!
Following reverse engineering the security systems, we can in many cases repair the alarm control units (and the leak) and have you one your way again, without having to buy a new alarm control unit, key remotes and paying for programming, we can even do this remotely by post or courier.
Another solution, but one which is very much not recommended, would be to buy a used alarm control unit, keys and engine management control unit from a breaker.. However, this is a very big false economy, as you will no longer be able to unlock the immobiliser or engine management control unit to program a future alarm remote, which is inevitable, without then needing to buy a new alarm control unit, key remote and engine management system, or buying another set from a breaker and throwing the previous ones away. Not only this, but a Porsche specialist or main dealer will no longer be able to perform some specialist tasks to your systems, such as programming them with new software which is released on a regular basis (Such as for running the new fuels with higher ethanol content, as is happening right now!)
What kills the alarm control units?
Water usually. In particular with Boxster models you can almost garauntee that whenever it rains, we start to get calls from Boxster and 996 owners with either misfires, cars that will not start or car's which are behaving unusually.
Typically with Boxsters, 996 models with sun roofs or targa roofs, blocked drains or poor seals cause water to run often un-noticed under or behind the carpet and end up filling the small wells or depressions in the floor where the alarm control unit lives. Either killing it completely, or even just making it do unusual things such as the alarm going off intermittently, the windows doing odd things, the car not starting (either failing to run, or the starter motor not working) among many other failure modes.
In the rain when we get calls about a 996 or Boxster (or other models) misfiring, it is usually down to cracked coil packs.
Next, the remote controls can play up in a number of ways...
If you find your Boxster or 996 alarm has stopped remotely unlocking and locking the car via the buttons on the remote control, there could be a number of problems causing this apart from a bad alarm control unit.
The Remote Battery.
In the alarm key remote is a small battery, often, replacing the battery will solve problems with the buttons not locking or unlocking the car, try this first. If you have not replaced your batteries in a year or two, they probably need doing anyway!
The Remote control's computer chip has frozen or crashed.
A few years ago Porsche were so swamped with warranty replacements of the key remotes that they issues a technicial service bulletin (TSB) explaining how to reset a remote control which had crashed or frozen, the process is simple..
- Remove the battery from the key remote
- Insert the battery the wrong way round, flip it, so the writing is facing the other way. Do not worry, this will not damage the remote.
- Press the unlock button continuously while jumping on one foot for sixty seconds (Jumping on one foot is optional but helps pass the time and helps with fitness)
- Flip the battery back around the right way.
- Try the remote control again, if this works you can be sure that the remote had crashed/frozen and you successfully reset it.
The Remote control has become out of sync with the alarm control unit.
Through reverse engineering the software inside the alarm control unit, we were able to de-cypher how the alarm control unit and the key remote talked and how the rolling codes worked.
Rolling codes are not top secret information, they are used in just about every alarm system remote control in the world, both in systems designed by car manufacturers as well as with after-market car alarm system manufacturers. In essence, every time you use the remote control to lock or unlock the car, the alarm system and remote control have a little chat and do not disclose all the details of a very special long number that they both have stored, they just ask one-another mathematical questions about part or parts of the number, and if both of them feel happy about the conversation, they then agree to lock or unlock the car.. Once they have done this, they both take their number and encrypt it slightly to change it for next time, but without ever again disclosing to the other what the new number is.. It should always match as they will have mashed up the number is a very specific way. However, sometimes problems occur.
Potential causes of the alarm system and remote control going out of sync are numerous, they can include the weather, radio interference (such as even a taxi driving past with the driver using a two way radio) or even you being just on the cusp of being close enough or too far away from the car when you used the remote.
In rare cases like this, the key remote or the alarm system may have mashed up it's code to a new version, without the other also doing the same. This is in effect what causes the remote and alarm going out of sync.
Anyway, as we mentioned, at JMG Porsche we reverse engineered the alarm system hardware and software, so discovered a little known and undocumented process to re-sync the alarm control unit and the key remote.. There is a proviso, if the two have gone out of sync by too many steps, the damage has been done and the two will never be able to be sync'ed up again, even with our amazing abilities at JMG Porsche.
The process to re-sync the remote key head is as follows.
- Put the key manually into the door lock (it does not matter if it is already locked or unlocked.
- Press the lock/unlock button and hold it in.
- Turn the key to the lock position and back to the middle position five times and return to the middle position one last time.
- Let go of the lock/unlock button.
- Press and hold in the lock/unlock button again.
- Turn the key to the unlock position and back the middle position five times and return the the middle position again.
- Let go of the lock/unlock button.
- Press the lock/unlock button in again and hold it in.
- Turn the key to the lock position and back to the middle position five times and return to the middle position again.
- Take the key out of the door lock and try the buttons.
If the buttons now work, you have successfully re-synced your alarm system control unit and keys! Well done, go and pat yourself on the back and drink a well deserved beer/coffee/tea/vodka (delete as appropriate) while you reflect on how the key remote might have gone out of sync... Are you a persistent key in pocket fiddler? or did you let your young son or daughter play with your keys? If so, stop it! Or at least now you know how to fix it if it happens again.
However, this will only work if the key remote and the alarm control unit have only stepped a couple of steps out of sync with the alarm control unit, if you are a supper "key in pocket fiddler" or your child has played with the buttons to such an extent that the codes have rolled more than a couple of times, then the key may now be so far out of sync, nothing will bring it back.
Faulty Remote Controls
They are pretty robust units really, but even a Porsche key head remote controls can eventually fail, here are some failure modes.
- Main circuit board failure - This could be as simple as a "dry joint" needing re-soldering, or a crack in the board which may or may not be repairable.
- Button failure - Usually the buttons fall apart because the plastic outer casings button area cracks, causing the button inside to move slightly sideways, rather than just in and out. These can be repaired with a new or used button soldered into the old ones location, and new upper outer shells are available to fix the actual cause.
- Water damage - The remote control key heads have a rubber seal, if when you change the battery this is not re-fitted or if it breaks with age, damp gets in and can destroy the remote. Usually you will see water damage on the circuit board.
- Designed in planned obsolescence - This I feel is a little bit naughty of the designers, or a very simple honest mistake in design. Once the code in the remote has rolled a pre set number of times, after literally hundreds of button presses, it will not be able to roll any more due to how the software was programmed. The alarm system however will continue to roll the code into infinity, so eventually they will go one step out of sync and the love affair between your remote key head and the alarm control system will be over forever.
What can JMG Porsche do to help?
Apart from writing this article so that owners, enthusiasts and even Porsche technicians can understand the system a little better, we have a few things that we can do in house to solve your alarm system problems.
What we and the Porsche main dealers can do, as well as probably a few specialists.
- Programming a new alarm key head remote to your existing alarm control unit.
- Programming a new alarm control unit along with new key head remote controls.
- Diagnosing a problem with the alarm control unit or key remotes.
What we can do that the main dealers can not do and potentially no one else in the world can do in some cases!
- Repairing and refurbishing your current key head remote
- Repairing and refurbishing your current alarm control unit
- Programming a new alarm control unit with your old key remote keys that worked with the old one
- Re-programming a used second hand alarm control unit to work with your car and your key remotes
- Re-programming an incorrectly programmed control unit to be a new virgin unit again, or with the correct data (Useful for other Porsche technicians who have hit the wrong button or experienced power failure during programming)
- Extracting and decoding the unique to your car's Porsche security data needed to program a new control unit, from an old dead control unit
- Extracting and decoding the unique to your car's Porsche security data when Porsche do not have it available (such as with the RUF manufactured Porsche models where Porsche do not have the right data)
- Programming a new alarm control unit on the bench, without ever seeing your car in person, we just need your old alarm control unit, keys and ideally your DME (Engine management computer) Which is useful for those who want to save the labour costs of a Porsche technician to remove the old control unit and fit a new one.
What we can not do..
- Program any random key head remote to your car, it needs to have been previously working with the old control unit at time of failure
What we will not do, even if we can!
- Send you out a new alarm control unit and key remote for a car with just the chassis number unless you provide adequate proof of ownership (A legal authority document such as a log book/V5 (UK) title deed (USA) and a the address of this document has to match the postal address we will send it to.
- Educate or pass on what we have learned from reverse engineering the security systems to any third party other than the information on this page. A software engineer knows the decryption routines but does not know what they are for, an electronics engineer knows the methods to extract the required scrambled data but again does not know what the circuit boards do, and only Jon at JMG knows the full process and processes the repairs. Anyone trying to approach Jon asking or probing for more information will result in the Police being informed. No documents, printed or in data form exist to help anyone else crack the system, so unfortunately the exact process will die with Jon.
What can be done to protect a 986 or 996 from the alarm control unit getting water damaged in the first place?
- Good idea - Getting JMG Porsche to install their 9x6 alarm system drainage port modification to your floor, they let the water out, but do not let it in!
- Good idea - Getting JMG Porsche to install their 986 improved roof drainage system to your Boxster
- Good idea - Routinely check your roof drains for leaves and general debris which accumulate there and remove and clean them, or ask your specialist to do this a couple of times a year for you. It only takes half an hour to an hour in labour and can save you a fortune!
- Bad idea - Fitting a sealed box or bag around the alarm control unit, these rarely are 100% water tight and will often allow water in, but not let it out, so you end up with small amounts of water accumulating over time in the sealed enclosure, but with not enough ventilation for it to evaporate away, until eventually there is enough water to damage the control unit, which can happen in cases where the amount of moisture would not have been enough to cause damage on its own.
And what to never do?
Never, every buy a "set" or "kit" containing an alarm system control unit, DME (engine management computer) and key remotes from a Porsche salvage business and fit them to your car.
- The software in the DME may not be right for your engine, causing all kinds of unseen problems.
- The identity of your Porsche will not match the Porsche database IPAS Codes, meaning that you will NOT be able to program new keys without having to buy a new alarm control unit, DME and key remotes, at a massive cost. Which with a used key remote, is very likely to happen at some point, potentially very soon!
- You will not be able to have your DME reprogrammed over time, such as the roll out of high ethanol fuels which is happening now..
- Your Porsche identity in your control units will not match your car's actual chassis number, you may encounter insurance problems or even end up in hot water with the Police and have to prove the identity of your Porsche is that of the chassis number, such as via a VIC check, which your Porsche will fail due to chassis number mismatches in the various control units versus the number plates worn and the chassis number stamped into the shell. (There have been a number of Porsche that have ended up on Q plates and a dodgy HPI history due to this kind of problem!
A last amusing fact.
Someone at Porsche decided after the 996 and 986 models that perhaps putting the alarm control unit in a depression in the floor, likely to fill up with water was an especially bad idea, so in the 987 Boxster and Cayman models, as well as the 997 models, they moved it away from the floor level and renamed the system as the Porsche Access System (PAS)..
This was a great idea..
Until someone else at Porsche, potentially looking for a good place to put the new "Rear Body Control Unit" (that was a new feature of these cars), had a eureka moment and decided to put this control unit in this really useful empty place under the seat... So if you own a Porsche 987 Boxster, Cayman or 997 and are wondering why your rear lights are doing odd things (brake lights on all the time, reverse lamps on even when not in reverse) or the roof has an interest in suddenly moving up or down, even if locked in position, snapping control rods in the process, then your rear body control unit has probably flooded in exactly the same way that the old alarm control units used to on the earlier model... That is progress for you!