Cars / e34 / Electronics / Dash Plug Coding for BMW

Dash Plug Coding for BMW

Article by: DIAKOM

Applies to: e32 and e34 models.

In our difficult Russian conditions, when there is no access to branded parts and diagnostic equipment, you have to be content with the spare parts from disassembly.

One of the big problems arises when replacing and repairing instrument shields.I will describe some of the nuances below.

1. BMW 525i Siemens ROM X2402PI

This car has a very capricious character, for the first time we encountered such a problem when a car came to us with a dead dash computer.

Looking back, I would say, the reason for the problem is the long ignoring of the INSPECTION interval by the owner.

Here is an example of a chip firmware:

1993 BMW 520 (e34)

VIN code: WBAHB51040GG33360

Speedometer: 38874 miles

Note: Unfulfilled temperature sensor and tachometer, buzzer rings

Revealed:

In cells:

0028 47 47 33 36 00 vin GG33360

0018 00 00 08 35 93 61 plate number 8 359 361

003C 24 key version

001F FF mile / km sign FF miles 06 km

002F 5A processor code;When Not 5A Parprise Flashes Code

0098 5F 42 2E 15 0B thermometer parameters

00A3 00 00

00B3 00 00 Inspection and Oil Service Data

00C3 00 00

00D3 00 00

0008 tachometer divider (1C – 3000 OB, BC – 500 OB, 5C – 900 OB at engine speed 800)

0060 63 F4 00 ┐

0070 64 F4 00 │ lower 2 km speedometer

0080 65 F4 00 –

0090 66 F4 00

00A0 5D F4 00

00B0 5E F4 00

00C0 5F F4 00 0x00F45F = 62559 km – actual mileage, excluding the younger part

00D0 60 F4 00

00E0 61 F4 00

00F0 62 F4 00

L– high speed

L ———– the lower digits of the speedometer

For comparison, a ROM dump was taken:

1990 BMW 524 TD (e34)

VIN code: WBAHA51020BA80166

Speedometer reading 180 177 km

From this dump, the line was rearranged:

0088 00 2B 73 8C FF

After the permutation, the thermometer worked correctly

It must be remembered that all changes in the data lead to the appearance of error 05 – false programming, which you cannot eliminate.

The second trouble, which crawls out around 6-7 years of the car’s service, the excess of the number of EEPROM recording cycles, here automatically rests on the purchase of a new chip, as the chips of other manufacturers categorically or quietly refuse to work.

2. BOSCH BMW 730 ROM 9346

Firmware example:

0xDF, 0xE1,0xE3,0xE5,0xE7,0xE9,0xEB, 0xED │ 0xEF, 0xF1,0xF3,0xF5,0xF7,0xF9,0xFB, 0xFD – the senior bits of the long counter.An increase in byte of 1 increases the mileage by about 8000 Km.

003C, 003B, 003A – 58592 body number

1st letter at 3D lower nibble 5-B, 7-C, 9-D, … fG

2nd letter at 3C high nibble 1-A, 2-B, 3-C, … 7-G

No surprises were found, but who knows.

3. BMW 316- 318 1994

EEPROM 93LС56

mileage counter 215 740 Km

engine number 387413 1

body number 37204 4

0000 02C8 FD37 006E 788D A2CC 83E8 8721 0B5C

0010 0050 1400 3714 5325 8B4B BC70 EF9D 210D

0020 4F30 9671 0202 0202 2350 01C0 2850 FF50

0030 3111 9227 B054 D854 E77F DBFF A000 0000

0040 13 10 3874 0022 7204 55C 3 04FF 143C 111A

0050 0000 0000 0000 0402 FFFF FFFF 4077 2991

0060 C72B 1115 0000 0044 0000 0000 0000 3200

0070 0000 0000 3610 FFFF FFFF 47FF A739 FF00

0080 F6E3 F6E4 F6E4 F6E4 F6E4 F6E4 F6E4 F6E4

0090 F6E4 F6E4 F6E4 F6E4 F6E4 F6E4 F6E4 F6E4

00A0 FFB0 FFB0 FFB0 FFB0 FFB0 FFB0 FFB0 FFB0

00B0 FE1F FE1A FFA2 FFFF FFFF FFFF FFFF FFFF

00C0 FFFF 7806 591A 5B6A 00F0 0000 0000 0000

00D0 0000 0000 FDEE 0F0F FF0F FFFF FFFF FFFF

00E0 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF

00F0 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF

0042, 0043, 0040 – engine number

0049, 0046, 0047 – body number

0081, 0083, 0085, 0087 …. 008F, 0091, 0093, 0095, 0097 …. 009F – the senior bits of a long counter.An increase in byte of 1 reduces mileage by approximately 8,000 km

0080, 0082, 0084, 0086 …. 008F – the middle digits of the long counter

ROM, from address 0000 to address 0060 is protected by a checksum.Any change in this area leads to the inscription PPPPPP on the indicator.

Adr 0060: C72B – 2 byte checksum correction word

The checksum is calculated as XOR of 2 byte values ​​from address 0000 to

address 005F and in the place with address 0060 gives the value 7F7F

Example 02C8 ^ FD37 ^ 006E ^ …. ^ 2991 ^ C72B = 7F7F

Sample binary file adjustment program “xor.cpp

This program corrects the dump for the control number 0x7F7F, but it must be taken into account that there may be other control numbers.

Calculate this number before making changes, so as not to have big problems.

4. The most mysterious part of the chip is the connector named HML 075 F

M / C HML075F is apparently a PLM with integrated FLASH.

M / C is read as a 256×16 memory area, with art and ml bytes being read the same way.It also contains a re-writable inspection area, and a hardware mileage counter with auto-save data in EEPROM

An example of firmware for the 292985 km speedometer is given below.

All data is represented by one byte, becauseit makes no sense to repeat the second identical byte, which however is required to be read, otherwise data will be skipped.

Table 1:

Area 0040 – 0050h inspection, is read and written as 8 bytes of information multiplied by 4 (0040 – 0047; 0047 – 004F; 0050 – 0057; 0058 – 005F) interrelated areas, writing any byte in any area will lead to a change in the corresponding byte in other areas .

This is the only area writable:

Area 0080 – 00BF: service, changing information leads to the failure of the panel to work with the chip.

Area 00C0 – 00DF directly speedometer.Accumulation of readings on clocks at the input of CLK (455 pulses per 100 m).

Decoding speedometer example:

There was an attempt to wind the speedometer by transferring it through 0 by applying CMOS level pulses at a frequency of 100 kHz to the CLK input (equivalent to a speed of 60,000 km / h).

The first attempt was successful, but all subsequent attempts to stop the mileage counter at a value of 299,960 km (300,000 internal value).

To work with this type of panel, two emulators were made, one on the PIC16C84 (swing up to 12 MHz), the second on the ATMEL AVR90S2313.

Examples of programs in the corresponding .asm files.

Emulator on ATMEL AVR 90S2313 2313EM.ASM

Emulator on PIC16C84 16C84.ASM

Note: the emulator on the PIC is convenient when repairing the panel on the table, so as not to pull the chip out of the connector, but it does not wind the mileage, it does not write it.

And for real professionals, we recommend the kit shown in the figure below:

Well, that’s it, I end here, because on this topic you can write for a long time.Good luck.

For additional information, contact Diakom at the following:

Diakom-Auto: 22, Chehova, Taganrog, Rostov-Don reg., Russia, Tel: (8634 315187)

support@diakom.com.ru

Leave a Comment

Your email address will not be published. Required fields are marked *

*