[DBMandrake]

Although I feel a bit dumb after the fact, I thought I would pass this experience on for laughs and technical info obtained...

Today while out driving, our 2016 30kWh Leaf decided it was no longer recognising the key and started bleeting about it on the dashboard, and would not let the car re-start normally after I had stopped it. My first thought was the battery was flat in the key. Drat.

Luckily I remembered reading the section of the manual that says what to do if the key battery goes flat - and that is to hold the key close to the power button (which lights up when you do so) to read it passively RFID style. This worked and I was able to start the car and continue on.

Locking and unlocking the car was a bit of a pain, (I was a few stops from home) as it turns out that if you use the key blade in the drivers door it only locks the drivers door. Doh! I discovered however that if you press the door lock button in the drivers arm rest it locks all the doors (even with the door open!) and as soon as you swing the drivers door shut all doors in the car are locked. (Make sure your dead battery key is in your hand before doing this!!) I presume that it would not allow you to do this if it detected a signal from a key either inside or near the car.

I planned to test the spare key when I got home but before I could even get home the tyre pressure warning light came on on the dashboard and I had a sinking feeling this was a fault with the car not an actual puncture... the TPMS warning light was on but the information part of the screen was not indicating a specific tyre being flat. I pulled over and all tyres looked fine so I carefully drove the rest of the way home.

I put Leafspy on and sure enough no tyre pressures were being reported, and the spare key at home also did not work either for proximity or remote lock/unlock. Damn! At this point I was starting to suspect the 433Mhz receiver in the car was playing up, as both the remote key and TPMS systems work on 433Mhz as is common in most cars with RF remotes, so it makes sense they might share a common receiver and could therefore have a common failure mode. (After later finding the real fault I'm now sceptical that they do indeed share a receiver)

At this point I wasn't sure what to do. I've only had the car for a few weeks... so I decided to disconnect the 12v battery for 30 minutes to reboot all the ECU's. After the battery had been disconnected for that length of time I measured the 12v battery and it was 12.57 volts - which is good as the open circuit, rested terminal voltage of a 12v battery is 12.6 volts for fully charged. (12.2 volts for 50% and 11.6 volts for fully discharged)

Unfortunately all this suceeded in doing was erasing some of my settings like my climate and charge timers...

At this point I had resigned myself to the car having a problem and jumping on Google to see if anyone had had this issue before when I happend to check the glovebox and found this:



And the display was also blank. Instantly the penny dropped. RF interference!

Interference hadn't even crossed my mind as the problem had been present through an entire 10 mile journey across multiple stops so any interference should have been localised to one particular location. Unless I was carrying the source of interference with me everywhere I went in the car...Jeeze Louise...

Ok so why was it in the car in the first place ? Simple - this is the outdoor temperature sensor of my old weather system (now replaced with a much better one) and I've had it in the car for the last week so I can remotely monitor the interior temperature of the car in the mornings to see what it was before and after timed climate control...

Because it was rattling around a bit in the cup holder I'd thrown it in the glovebox and forgotten it was there.

So why cause problems now and not earlier ? The answer to that is interesting. Although some of these outdoor weather sensors work on the same frequency as the key and TPMS - 433Mhz (my new weather station uses 868Mhz) everything using 433 or 868Mhz is required to be designed to only transmit very brief infrequent bursts lasting a fraction of a second so that the chances of collision and interference are very small. After all the key and four TPMS sensors are also sharing the same frequency.

In normal circumstances this weather sensor would not cause any problems despite being in the car, and it was fine for a whole week. However the battery is getting a bit flat and the display had gone blank - in effect it had "crashed". It still had some power but was no longer functioning properly. And in this zombie state the 433Mhz transmitter was on continously sending out a carrier wave (or garbage modulation) and effectively working like a short range 433Mhz jammer, which just happened to be in the car quite close to the receivers in the car.

The car could no longer "hear" the key or TPMS sensors. The remote button press on the key relies entirely on 433Mhz to work, and the proximity detect also relies on 433Mhz for the "return channel", which is why proximity detect was also wiped out - the key could hear the probing from the car (which is a much lower frequency low power signal) and was responding, but the car couldn't hear the response from the key.

The only thing that worked was the low frequency low power RFID style signal which eminates from around the power button area. Lucky for me!

It's not the first time either that I've seen battery operated 433/868Mhz equipment lose its mind and start broadcasting continuous garbage which causes interference due to a low battery. It's totally against the license requirements on those frequencies to transmit continuously, but apparently this particular device does just that when the battery is marginal and the cpu locks up, causing the device to go into a zombie state with the transmitter stuck on.

As soon as I took the sensor into the house and for good measure removed the batteries, the car was back to normal and a drive around the block put out the TPMS warning light.

I don't think I'll be putting that thing back in the car any time soon.

 

[srichards]

I had one of those remote sensors as well. I'm now wondering what havoc I could cause duck taping one to someone else's car

It is an interesting point about TPMS and other things that use the same frequency as I'd imagine there are loads of random devices that could cause TPMS or keys to fail.

 

[DBMandrake]

I had one of those remote sensors as well. I'm now wondering what havoc I could cause duck taping one to someone else's car

It is an interesting point about TPMS and other things that use the same frequency as I'd imagine there are loads of random devices that could cause TPMS or keys to fail.

Any normally functioning 433Mhz device will not cause a problem because it transmits in very short infrequent bursts, as that is the license requirement for using those frequencies. (And a LOT of devices use 433Mhz, even things like soil moisture sensors...)

However if it "goes rogue" and starts transmitting continously due to a fault (in this case a flat battery) then it can cause major problems for other devices in the vicinity sharing the same frequency. It would also be trivial to design and build an on-purpose 433Mhz jammer with considerably more jamming range than this device probably has.

 

[Aragorn]

Reminds me a bit of the issues folk had with the old P38 Range Rover back in the day (i have one and the same issue has bit me, these issues are largely well understood now, but back in the day less so...)

The P38 was a early 90's car with overly complicated body control ECU, one of the first cars with such a system. The RF transmitter runs on 433, but the reciever side had a quirk... Whenever it detected "a signal" it would packetise the data and send it to the BECM over serial to check if it was a valid key or not. This process would wake the BECM (shifting it from a low power state to a full power state drawing over an amp of current). The BECM then stayed awake for 10minutes before returning to sleep.

Ofcourse, put the car anywhere near anything transmitting on 433 at regular intervals, be it a wireless thermostat, weather station like yours or burglar alarm, and the BECM would basically just stay on, continuously, drawing an amp or more. That could often mean simply parking the car overnight would result in a flat battery the next day. Such wireless devices are far more common nowadays, but back in the 90's the weather station was the leading cause of flat range rover batteries 😂

Eventually land rover produced a new receiver module, which had a basic micro onboard, which looked at the received data and ran a sanity check on it: "does that look like a key transmission?". Only forwarding the data if it was indeed a key. This largely fixed the problem, but it was a fairly expensive "fix" and there wasnt a recall or anything done, if you wanted the new module, you had to fork out for it. My car ofcourse doesnt have the upgraded reciever, and it seemed my boiler stat also runs on 433, which had the interesting effect that the battery would go flat overnight if you left it parked infront of the house, but not if you left it parked at the side...

 

[Bungle]

Reminds me a bit of the issues folk had with the old P38 Range Rover back in the day (i have one and the same issue has bit me, these issues are largely well understood now, but back in the day less so...)

I seem to remember the quick fix for this was to cut the antenna wire, it meant you had to stand next to the car for the remote to work but it made the receiver system deaf so it didn't pick up as much from the surrounding area. The other big issue in the late 90's and early 00's was the Dolphin Tetra system which transmitted just below the 433MHz band but receivers in cars often had limited filtering and although they didn't try and interpret the signal it would desensitise the receiver so it wouldn't work. Hence the many stories in the papers at the time of car parks where cars would not start until they had been towed out (and hence moved further from the transmitter).

 

[Aragorn]

Yeah i unplugged the antenna on mine initially, usefully its on its own connector, but being a 25 year old landrover product the remote has given up now, so i've just unplugged the whole receiver unit now.

 

[solar]

My son had a similar issue with his Prius car alarm going off all the time when he moved house. Must have been something transmitting nearby and interfering.

Could not help smiling this week whilst at the garage waiting for my Leaf's MOT to be done. A flashy new Tesla glides in and stops. Driver asks for his TPMS sensor to be fixed. As he drove off to the bay to have this done a great clicking was heard. The sensor was detached inside the tyre and rattling around randomly. I do wonder how good a new manufacturer like Tesla is at screwing cars together.

 

[solar]

However if it "goes rogue" and starts transmitting continously due to a fault (in this case a flat battery) then it can cause major problems for other devices in the vicinity sharing the same frequency. It would also be trivial to design and build an on-purpose 433Mhz jammer with considerably more jamming range than this device probably has.

Someone living near me was caught by Air Traffic Control’s detector van as aircraft flying over his house, which was on an airport approach path, were picking up interference. Turns out that his TV aerial amplifier had gone faulty and was broadcasting through the aerial. Normally there are huge fines for infringing ATC frequencies (it’s pirate radio stations that usually get done for it) but, as it was unintentional, he was just advised to buy a new amplifier.