DIY: How to reprogram a used cluster to match your car's mileage, VIN and coding

[jicaino]

Wow man, thanks for this invaluable contribution

[blackknight530i]

Wow man, thanks for this invaluable contribution

No problem!

- - - Updated - - -

I've added additional information for clearing the error codes in the hex before flashing and on M35080 chips, to clear the saved mileage stored for service (I think tire pressure monitoring intervals or something). I don't think they are necessary, but it does make the cluster more virgin than before. I can also add in information to set the ZCS code to nothing, but it's not really necessary since this is easily changed in PA Soft or NCS Expert.

[jicaino]

Sent you a PM with a question about PASoft, as mine works almost 100% except for the FGNSTR (or something like that, the VIN) writing. It's grayed out.

[blackknight530i]

Sent you a PM with a question about PASoft, as mine works almost 100% except for the FGNSTR (or something like that, the VIN) writing. It's grayed out.

Already replied by email.

Sent from my SM-N910V using Tapatalk

[jicaino]

Well I'll be damned, I didn't get it. Tried to read the PM to check if I had mistyped the address but I don't see it in sent items. just in case, it's jicaino at gmail dot com.

[blackknight530i]

Well I'll be damned, I didn't get it. Tried to read the PM to check if I had mistyped the address but I don't see it in sent items. just in case, it's jicaino at gmail dot com.

Could be because it was a zip file, but I clicked on your email address in your PM to send it. I'll put it on my Google drive and send you the link.

Sent from my SM-N910V using Tapatalk

[jicaino]

Thanks a lot!

[Southern740iL]

Anyone still have knowledge on this subject? I am about to embark on this. I have my original cluster, which has some sort of issue where its grounding and causing battery light to remain on. My E38 is a 98, so I have the older 93S66 chip. Some state just swapping them and thats all. Need additional info

[blackknight530i]

Anyone still have knowledge on this subject? I am about to embark on this. I have my original cluster, which has some sort of issue where its grounding and causing battery light to remain on. My E38 is a 98, so I have the older 93S66 chip. Some state just swapping them and thats all. Need additional info

In the DIY I show you how to swap a new chip for the 93s66 clusters. You could also buy a newer cluster with a m35080 chip and replace it. No need to keep such an old cluster. PM me and I can help you with other options as well.

Sent from my SM-N910V using Tapatalk

[Durden]

Does anyone have a preferred spot to purchase the new m35080 EEPROM chips? Getting ready to dive into this and I believe it's my last missing piece.

[blackknight530i]

Does anyone have a preferred spot to purchase the new m35080 EEPROM chips? Getting ready to dive into this and I believe it's my last missing piece.

M35080-3 chips are easy enough to find on eBay, but M35080v6 or -6 are near impossible to find and be reliable. Pretty much all the ones I had bought have constant programming errors. I bought an eraser for m35080vp/v6 chips and just reuse the original chips from the clusters and that works perfect 100% of the time. If you want me to erase yours for you, you can send it to me.

Sent from my SM-G950U using Tapatalk

[djb2]

Has anyone traced what the m35080 programming tools are doing to set the chip back to the factory state?

I recently ported some of my older m35080 programming code to Arduino with the goal of making it easy for people to put together their own one-off cluster programming tool. Right now it runs on a more expensive Arduino Mega and uses a real Pomona clip. I've ordered the parts to verify that it works with $2 Mini-Pro boards and $3 SOIC-8 clips. But the "cheap and cheerful" approach doesn't work as well when you to solder in a new cheap. (And "new" might just mean "old chip erased by someone in China".)

[geargrinder]

Paul has given all the hex edit nitty gritty in this thread...

http://www.bimmerforums.com/forum/sh...VIN-and-coding

[djb2]

That explains a small piece of the layout of the EEPROM, and it doesn't describe how to clear the m35080.

The m35080 is documented to only allow increasing the value in the first 16 words of memory. Once the count reaches maximum (0xFFFF or 65535), no further changes can be made to that word. The remainder of the first half of the EEPROM may be changed without constraint, while the second half may only be written when the write enable pin on the chip is enabled.

There is likely a test-only mode where those first 16 words may be tested by the factory, and then initialized to 0. That procedure is not documented. It appears that information was leaked or discovered, and is used by these proprietary programmers to clear the EEPROM while still on the board. That's the programming information I'm looking for.

It's easy for me to use my SMD rework station to remove a SOIC8 from the board and replace with a new one, but someone just wanting one-time fix for their own car isn't going to do that.

[geargrinder]

Aaah. I see. You're trying to reverse engineer the eraser function, I thought you meant how to re-set an EEPROM read.

The datasheet makes that sound impossible, but as you say seems like somebody has fingered it out if the purpose-built programmers can do it..

[djb2]

Aaah. I see. You're trying to reverse engineer the eraser function, I thought you meant how to re-set an EEPROM read.

The datasheet makes that sound impossible, but as you say seems like somebody has fingered it out if the purpose-built programmers can do it..

The chip must have the capability to initialize the data. After fabrication the memory cells aren't fully written. The memory might all read high or low, but there won't reliably be a full charge/discharge in the cell and the setting might change with age. The factory needs to reset the "increment only" words, and probably tests each memory bit individually to verify that it can be set to '0' or '1' without influencing the surrounding memory.

The question is if there is simply an undocumented command, special bit timing, or a higher voltage needed to trigger the factory-only test mode. The command or timing could be checked by observing what the magic Chinese programmers are doing using Sigrok (free) and a under-$10 'logic analyzer'.

[geargrinder]

Yeah I have heard rumors that boosted voltage is what works for some stuff like this but I really don't know in this case. I know my generic programmer is supposed to be able to do it and it doesn't have any special hardware or anything except for if its a weird pinout version.

For doing it in-circuit, from the datasheet its clear you need to set the w pin to disable hardware protection if thats built in, would be important to know if that's possible for this implementation. The sheet I glanced at is nearly unreadably obtuse but I get what they are trying to say about it...

The other thing I seemed to find when I was trying to screw w/ my old cluster was that it seems like the pinouts are scrambled around on some of the OE versions vs the 'general trade' versions of the chip. Just another way they tried to have "security through obfuscation". Gee all we document is the vanilla pinout but really the OE's are using some mixed up version...

[djb2]

The m35080 pinout is unique. Almost every other SPI EEPROM has a standard pinout, but this part is obviously designed to prevent easy substitution.

I'm guessing that some of the problems people have had with FleaBay parts is that they are bad counterfeits. They must be standard EEPROMs that have had their original markings polished off and m35080 laser etched on them, without the counterfeiters realizing (or caring) that the pinout is different. I've been bitten badly by other re-marked parts.

The AVR chip used on the Arduino boards is great for this use. It works at 5V, the same as the instrument cluster, while most other modern chips are 3.3V or less. Almost all of the pins have high output drive, which helps when "in system programming" an EEPROM still mounted on a board. The signals end up partially powering the connected chips, or even needing to overpower their output pints.

[geargrinder]

agreed agreed. but not only the basic pinout is 'off beat', they also scramble the pins between the 3/6 and the V6/VP versions.

also totally agreed w/ fleaBay parts. yes the chinese chip slingers are famous for re-printing bogus numbers on used chips. sometimes they will work for various reasons (ex: the rebrand is only a speed variation and so they are only pushing the original foundries quality control buffer by uprating it to 60ns from 100ns or whatever, and the chip in application doesn't even approach its rating anyway...) but often they totally do not. I have also completely BTDT.

[Dakes12]

Hello guys ! I have got kind of emergency..
I have a used e46 Bosch cluster with m35080 chip. I ordered a new blank chip and I got stuck at the deleting old mileage from the old chip bin file.
Can anyone help me with the bin file to zero mileage and change the vin? I would like to zero before to install the backup on the new chip. I would like to sync the mileage with lcm.
Thank you!!!


Sent from my iPhone using Tapatalk

[blackknight530i]

Hello guys ! I have got kind of emergency..
I have a used e46 Bosch cluster with m35080 chip. I ordered a new blank chip and I got stuck at the deleting old mileage from the old chip bin file.
Can anyone help me with the bin file to zero mileage and change the vin? I would like to zero before to install the backup on the new chip. I would like to sync the mileage with lcm.
Thank you!!!


Sent from my iPhone using Tapatalk

I can help. Send me the file to mail@fixels.repair.

Sent from my SM-G950U using Tapatalk

[computiNATEor]

Bringing this thread back up.

Thank you, blackknight530i, for your clear and well laid out contribution. I’ve already synced the VIN and ZCS, but the cluster displays 156109 (no tamper dot) instead of 213150+. Attempting to write the zeroed out mileage EEPROM bin to the cluster results in “32 errors” in PASoft. And as dbj2 mentioned, I’m not willing to do all the soldering for a one time fix.

Do we have a way to reset the mileage without cluster disassembly? And if not, what would you charge, Paul? I’m looking to just have the mileage reset in my cluster. Feel free to PM me, or email me at Nate dot r dot jones at icloud dot com.

[blackknight530i]

Bringing this thread back up.

Thank you, blackknight530i, for your clear and well laid out contribution. I’ve already synced the VIN and ZCS, but the cluster displays 156109 (no tamper dot) instead of 213150+. Attempting to write the zeroed out mileage EEPROM bin to the cluster results in “32 errors” in PASoft. And as dbj2 mentioned, I’m not willing to do all the soldering for a one time fix.

Do we have a way to reset the mileage without cluster disassembly? And if not, what would you charge, Paul? I’m looking to just have the mileage reset in my cluster. Feel free to PM me, or email me at Nate dot r dot jones at icloud dot com.

Hey Nate,

The 32 errors are because you're trying to write the mileage to the section of the EEPROM that is locked. This is why you need to use a new chip or erase the current one and restore a backup with the mileage area zeroed out. No, there's no way to reset the mileage without disassembly, or else everyone would do that instead of sending it to me to be reset. I can't post any prices in this thread, so I'll email you with more info. It's not unreasonable.

[geargrinder]

^^^ quintuple thumbs for Paul’s work.

[computiNATEor]

Hey Nate,

The 32 errors are because you're trying to write the mileage to the section of the EEPROM that is locked. This is why you need to use a new chip or erase the current one and restore a backup with the mileage area zeroed out. No, there's no way to reset the mileage without disassembly, or else everyone would do that instead of sending it to me to be reset. I can't post any prices in this thread, so I'll email you with more info. It's not unreasonable.

I got your email; thanks! I will be using your services soon. I like to keep stuff off my credit card, so I have to wait for payday.