queenmonkey said:
When I got mine back I tried using it but it didn't work! Of course, I had no idea I needed to reset/resync the key. I found this on the internet:
http://www.jmgporsche.co.uk/index.p...les-maintenance/item/234-996-986-alarm-primer
Quite different to the reset process I read in one of the links in an earlier post. Regardless, the long winded process in the JMG article took me 3 or 4 tries before the car suddenly responded to the key button presses.
Glad it helped. The reset procedure listed there was found through reverse engineering the software in the alarm control unit (ACU).
The problem is that Porsche (as a company) do not even completely understand the ACU, because it has four elements, designed by four companies, each who do not release information of how their part works.
You have Delphi who integrated each companies circuits onto one board, and software into one plug together package.
You have Megamos who designed the immobiliser side of the ACU (Software and hardware ACU and transponder ring hardware), and only released a circuit diagram and compiled code to Delphi to integrate it, and Megamos talked to Bosch to agree on a data format bitstream for the DME for programming the immobiliser code, and again for the bitsteam to compare with the stored code.
You have Microchip corporation, who designed the radio remote side of the key heads, wrote the software for the ACU remote control side, which again was precompiled to a agreed memory space with Delphi, with reserved I/O.
And as touched on, Bosch, who with the DME just liased with Megamos on the datastream via obd from the ACU for programming and comparison.
Each company is especially cagy about the system, which is similar to a system made for VW/Audi (But we have not reverse engineered those to compare)
We have to be careful about what information we release, as Porsche/VAG did slap legal restraints on some accademics who wrote a paper on how to clone keys in this system using off the shelf equipment, as well as how the way this kit worked, could be used to bypass the systems, and Porsche/VAG were happy to spend about £400k on the legal sledge hammer to shut them up.
But I can let people know some snippets, such as what is included within the article, where it does not publish the many exploits which can be used, but can provide some useful information to owners of cars with this system.
We have also helped at some point, most of the UK main dealers with technical support on ACU and key issues... It is not our core business, but more something we reverse engineered due to a lack of documentation.
For the purpose of this post, here is some information. Which can vary for the 3 distinct generations of 986/996 ACU's
If the car has not been used in a while, it does stop listening for the remotes, this is to save the car battery, this does change between the three generations of ACU hardware and software.
To wake up the ACU on these units, there is one method which is universal, which is the one listed in our article... Timing is everything, so you might need to try it two or three times to get it to work. Some generations are much more simple to wake up, but this method works with all.
The remotes use a challenge response system, meaning the code is never completely transmitted by radio. Instead the ACU and key head have a small chat about the 24 byte code that they both share, asking cryptic questions along the lines of "What is the 5th digit multiplied by the sixth digit, divided by the first digit"... The question is shortened to something like "5" meaning preset question "5", and the answer will be a short binary burst, and the answer compared to the stored data, and then the other unit will have a chance to ask a question, until both units are satisfied with the answer.
Each key head starts with its own unique code of 24 bytes. This is changed, one digit at a time, in a pre defined method, to make it so the same code is not used twice. This happens without the ACU and Keyhead discussing the change. This is the rolling code.
The keys will roll their codes many many times, but the software in the ACU can only roll it a set amount of times. This means you can have a key which has rolled the code again, but the ACU has hit its maximum amount of changes the software can handle... Which leaves you with a key which still flashes, but the ACU refuses the code (still stuck on the previous one).
So if you have a key which flashes, but no longer unlocks the car, it could be that the ACU has exhausted its softwares methods or sequence of code rolling... Or it just needs resetting with the method in the article.
Every time the button on the key head is pressed, without it managing to talk with the ACU it will increase a counter, if it happens too many times, the key remote will lock itself out and can not be reset, in these cases, depending on what generation of key it is, it may or may not flash the remote LED... So whatever you do, don't let you kids play with your keys out of range of the car, if they press the button too many times, the key remote is useless and can not be reprogrammed. Likewise, be careful of key fiddling in your pockets.
The key head can crash, which was the subject of a Porsche Cars of North America TSB, regarding warranty key replacement. To reset a crashed remote, remove the battery, flip it over (which shorts out the two contacts) which forces the NV flash ram in the chip to clear, but retains its code and software. So an unresponsive key can sometimes just need this method of reset performing.
The batteries, as mentioned here are widely available off the shelf and no special urgency or sequence is required to change them, so you can take your time.
The most typical electrical failure is people using their nails to press the buttons, which can apply sideways force to the microswitches, which breaks the microswitches or solder joints in the remote. The microswitches are relatively easy to replace with a soldering iron, but you are better off using a solder-rework station of the hot air type.
The second most common is split button rubbers, which allow damp into the key head, or cause people to prod deeper into the button to operate it, which often results in the most common failure mode above.
Genuine key head tops with the button rubbers are available from Porsche for about £20 or so, Chinese ones are available for less, but as someone mentioned they are made of a semi flexible plastic, rather than a hybrid of plastic and rubber assembly, which makes the copies stiffer to use.
Off the subject of the remote key heads slightly....
Please don't buy alarm kits from ebay, usually containing a key head, or key heads, and ACU and a DME.. They do work out cheaper than buying a pair of keys and programming, or a replacement ACU or replacement DME.. But when you need something simple like one key programming, it is almost impossible to get hold of the security codes to program it, because they are coded to a different car, now crushed.. There is no official way of getting around this as the units are designed to be programmed once and then protected from re-programming with the car security data.
We can get around it, saving the working key data, and changing everything else to match what your car should have, or even turning the data back into virgin new genuine unit data so it can be programmed by a Porsche computer diagnostic (PST2, PIWIS, PIWIS2 etc) but the better plan is just to buy new genuine parts and get them programmed correctly in the first place.
Anyway, I hope this corrects a few myths and misconceptions with Porsche 986 and 996 alarm systems.
I am not usually in here, I just popped in looking for any images from Simply Porsche and noticed this thread had us mentioned. But will try to come in more often as there seems to be issues needing resolutions. Besides, I am an enthusiast too.
All the best
Jon
![M@r]{](/data/avatars/s/33/33392.jpg?1711542458){kind=avatar}
Porsche 991: 2011-2019
Porsche 997: 2004-2012
Porsche 996: 1997-2005
Porsche 993: 1993-1998
Porsche 964: 1989-1993
Porsche Carrera 3.2: 1983-1989
Porsche Carrera SC: 1977-1983
Porsche 930 Turbo: 1975-1989
Porsche Early 911: 1964-1977
Porsche Carrera GT
Porsche GT1
Porsche 959
Porsche Macan : 2013-
Porsche Panamera : 2009-
Porsche Cayman: 2005-
Porsche Cayenne: 2003-
Porsche Boxster: 1997-
Porsche 968
Porsche 944
Porsche 924
Porsche 914
Porsche 912
Porsche 904
Porsche 550
Porsche 356 Speedster
Porsche 356
