Key replacement...

[Fx323i]

I would say this:
1. The key needs to be checked in the ignition by live data of EWS (eg. INPA or BMW Scanner 1.4 is very good for checking this). If it transmits and the VIN, key no. and solid part of the key code is OK, then it is repairable in the EWS data if you know what you are doing.
2. Repair by AK90 is possible if the key belongs to the EWS unit and only the rolling code in the key is damaged - eg. by attempting to start with a flat battery, which can be easily achieved (the problem is, that the EWS unit changes the rolling code in itself, sends the new code to the transponder to rewrite, but because of the flat battery the rolling code is not rewritten - because the electromagnetic waves from the aerial do not reach the transponder due to flat battery. The problem is, EWS unit does not verify if the data was transmitted to the key properly and after a number of rewrite cycles the rolling code is so far away from the EWS, that it is not accepted anymore).
3. All versions of AK90 software have tick boxes to check whether the key is used. On some versions this check box does nothing, so it is better to adjust the bin file with EWS Editor software. If checked, you can uncheck and write back. Then the key acts like new from the factory and the first time you put it in the ignition with a good working battery in the car, the key reverts back to working.
4. It is not possible to use ANY used key (which belonged to another EWS unit) to work with your EWS unit because there also is a password to the shadow memory of the transponder, which is different in every EWS. So even if you are able to pull the solid code from the transponder, you are unable to see the password. The password can be pulled from the EWS which belonged to the key and write it to your EWS, but then you are not able to mix keys from different EWS units anyway.

This is just a brief description, the problematic itself is more complex, but I hope this helps a little to understand what the problem is.

Also, not all EWS units are the same. There basically are three possible MCU masks with EWS3. These are: 2D47J, which sometimes is a pain to read/write because they are read protected. Most common are 0D46J which were used in all EWS3 units from 9/99 to 8/2005, Starting with 9/2005, there were EWS4.3 with MCU mask 2L86D used, also if the EWS3 was replaced with a new one after 9/2005, it is replaced with EWS4.3 with mask 2L86D. This newest mask requires either an EWS4.3 jig as a further equipment for reading/writing or soldering in the circuit.

Nevertheless, using Chinese clones is not always safe and you need to know what you are doing anyway. I have worked with thousands of EWS units for over 8 years so I might not consider myself an expert, but I think I know quite a lot. I also help people with engine swaps, which sometimes get more difficult in the terms of long-term running ability (eg. EWS3.3 equipped DMEs with keeping the EWS working in another chassis using EWS3D units from later Z3 and E36 compacts as these EWS3D units have a k-line interface by themselves so that in case they lose sync, it is easily syncable with INPA cable).

PS: Changing and rolling code is a problem of my translation as I am not an English native. English is my second language, I never lived in an English speaking country :-) so I am sorry if this is wrong. I might use the term "random code" instead, which is more native to the problem.

[geargrinder]

Ha. I knew you'd give us the gnarly details. That mostly matches what I thought I knew, but interesting details to learn - especially the bit about the re-setting the key slot to new in the EWS, and the confirmation that dead-battery can kill the write and that the write is not confirmed! I knew the bit about the 'known static password' and the 'changing code' for sure but that was a really good description of the whole system.

Just to confirm, the key stores 3 pieces of data, right?

1. VIN (or technically is it ISN?)
2. A fixed 'password' for that key
3. changing code provided at every start

All three must match what the EWS has in its memory to allow start, and once a virgin key is flashed the first time, the first 2 things can't be changed, which is why you can't re-use used key transponders, yes?

And yes re: the language - in English documents, BMW calls the DME/EWS a "rolling code" since both devices store the code and each device knows how to "roll forward" independently in order to create the security... Whereas the key code is a one-way, the key is 'dumb' and just gives that same code back to the EWS at the next startup, therefore, it is called a "changing" code (or password... sometimes they call it a password too I think... at least in the English docs - I'm sure its totally different in the original German!)

Also re: language - you did an excellent job describing the system there so I don't think you have too much to worry about with your English... And I do think you are an expert for sure...

[Fx323i]

Basically, the key for EWS system stores:
1. VIN
2. Soild part of code, which is not changing
3. Password for retreiving data from the transponder's shadow memory
4. Random codes obtained from EWS to send back to verify
5. Starting with some version of EWS, if I remember well, it is HW03 SW05, it stores also the mileage of the car. Basically if you have a "diamond" shaped key from the factory, it for sure stores mileage. With older versions of EWS/key the same part of data contains "some code" which is not mileage.

EWS module stores: VIN, checksum for VIN, odometer (from HW05 SW03 if I remember well), password for communication with transponders in the key, part number, HW and SW versions, some internal data like coding, bus, date of manufacturing, manufacturer, for each of 10 keys: Fixed code, variable code, if the key is used or not, if the key is enabled or disabled. Then there is coding information like GM, SA, VN (basically there is a backup of central coding key for the whole car in this unit), and for communication with DME/DDE there are a password, sync code which has 3 parts (including checksum) and an attribute. That is pretty much it.

[sleuth255]

Thanks for this Fx323i. It doesn't sound like clearing the random code will be easy. Looks like I have a bit of research ahead of me while my AK90 is en-route.

[Fx323i]

If you had any trouble, just feel free to email me the dump you read from EWS, I can adjust it for you. Just keep in mind that having your dump also means that I could go get your car if I wanted, especially when I also saw how your key is cut. This basically means I would have keys from your car. (do not worry, this is just to inform you how important the EWS data is, in combination with a picture of your car's key...).

[sleuth255]

Thanks, I may just end up taking you up on your offer! Of course, if you do end up "relieving me" of my E39 it would force me to buy that M2 I've been drooling over...

[Fx323i]

Would be kind of too far away for me to go get your car. What I mainly wanted to say was that a picture of your key cut makes some people able to cut a key for your car and get away with it in zero time. A combination with full bin from ews basically means having a key from your car. So this is more like an information for you that posting things like this online is kind of dangerous.

[sleuth255]

agree.

[sleuth255]

Updating this thread. I was able to use the AK90+ to fix my key. Here's a note on this:
To fix a key with a bad changing code, put the key in the reader and select Test Key. That will give you the slot number assigned to the key (in my case this was slot 5). Now pull the EWS and use the AK90 to read it. Then choose write key and write back to the broken key by choosing the same slot. This will replace the changing code with the current code from the EWS and the car will start again.

It is not possible to select a different slot with anything other than a "virgin key" because the EEPROM is write once only for everything but the changing code.

...which brings me to my next challenge: coding. My new key works perfectly: it starts the car, and the remote functions all work. However, it is different from my other keys:

• pressing unlock once unlocks the driver's door, pressing again unlocks all doors (my original keys unlock all doors with a single press)
• when I unlock using the new key, the drivers side seat adjusts all the way back. Adjusting the seat, and then locking the car again has no effect on this behavior.

I remember telling the dealer to change my lock settings when I bought the car but I can't find an NCS Expert profile that has this option. I also can't find a profile that lets me add key #5 to the vanity seat settings (unlocking adjusts seats, mirrors, steering wheel tilt). The new key has always been this way and I think its because BMW normally codes the car after a new key is added and this one was simply ordered by my indie. This is I think what they are referring to when the say the key needs to be "coded" for $190 ish. It has nothing to do with the transponder being recognized or the car starting, rather it has to do with the two (and possibly other) settings I described above.

Thoughts?

[Fx323i]

1. The necessity of 2x pressing unlock is coded in GM5 as selective locking

2. The behavior of memory can be also changed by switching the order when programming remote (the order of remotes programmed is equal to the order od memory slots for seat adjustment) or eg. putting the same settings in all the memory seat positions. Otherwise only coding can help.

[geargrinder]

Thanks for that FX. I always wondered about that 'remote numbering thing' and how it decided which key was which, that makes sense that its the pairing process and that you can re-order them.

sleuth - The seat-memory-module (SM) and remote-locking-module (FZV IIRC?) are both 'child' modules of the GM so the GM is where the options are in NCS Dummy (you dont mean "NCS Expert Profile" - the profiles themselves don't have any 'options' they are just permissions-granting profiles).

That key is paired to one of the seat memory 'slots' based on the slot it has established with the GM, and that seat memory slot is now what is being restored every time you use the remote.

Your options are (I'm clearly only elaborating on what FX said already really) any of these:
- Figure out which seat memory slot is being 'restored' (probably #2 or #3 because I expect you have the settings you want to keep / use on #1...) and program your settings into that slot instead or just put your master settings in ALL the seat memory slots. (this won't fix the selective locking, otherwise known as 'ghetto locking' because that's a separate option that can only be done in the GM)
- Re-pair the remotes in the right order so that key you want to use is in the #1 spot (which almost certainly still has selective locking turned off already if it didn't used to work that way...)
- Get into NCS Expert and Dummy and turn off remote/seat-memory linking and selective locking altogether

If you're going to use the key/seat memory linking, its not a bad idea to label the key w/ the memory spot somehow, unless you're sure you'll always know which one is which i.e. the wife's key is on her keyring with 67 fobs and loyalty cards and charm bracelet knick-knacks, and you KNOW hers always gets programmed to #2, otherwise if you just have keys lying around 'naked' but want to use differential seat memory it can get annoying.

[sleuth255]

ahhhh, very helpful! Program order = slot order! I wasn't getting the relationship between "4 slots" mentioned everywhere in programming and my key in EWS slot 5. Thanks guys! Took 5 minutes to fix. I think its actually easier than we think: It seems to me that key based vanity settings only ever apply to the first 4 slots. In fact, I think it might only be the first two that are programmed to do this at the factory (my new key was the third key to be programmed when I originally did this). Key based vanity settings have no relationship to the memory settings on the drivers side door either but rather are saved against your key's slot position (determined by the pairing order per FX). Empirically, this is how it appears to be working although I haven't done the definitive test yet: with first paired key in car, program M1 seat setting. Now change the seat position and lock the car using the key (my research indicates that this is what saves the key based settings). Now unlock the door, and press M1. Seat position changes? (should be) Yes. Now press unlock on key. Seat position changes? Yes = key memory/door memory is not the same. I'll run this test later today.

What I was referring to when I said "NCS profiles" are actually templates (.pfl files) that organize NCS capabilities and make it somewhat easier to use. I've attached a collection of them that I uncovered during my research if anybody is interested. Remove the pdf file extension and extract in your NCSEXPER\PFL directory to use.

I'm working on figuring out how to use NCS dummy also btw. It looks like proper initial setup using NCS expert is key. Having NCS in German doesn't help although I did recently uncover a NCS English translation file that changes the buttons and messages to English. I've attached it as well and it needs to go into NCSEXPER\CFGDAT.

[geargrinder]

Oh yes ncs profiles are critical! But you just need one that’s properly unlocked and grants permission to do what you need that’s all. Profiles don’t do anything for “how do I code xyz”.

Don’t waste anymore of your time with anything, before just downloading NCSdummy and opening it up and picking a few modules in it and see what it does. Your life will be changed. Doing anything else is a waste of time. And it is called NCS dummy for a reason because it is super easy to use.

You are not alone, for some reason way too many guys screw around for ages trying to figure out coding and put off trying Dummy for some odd reason. When in reality it is almost the first thing you should poke around in. You do need your NCS installation to be there along with all the data files. Dummy needs those things to work. But since it sounds like you already have that installed, you should be all good just pop in and open something like E39 GM3.C05 and see what it shows you. By itself you can’t do anything to your modules using it so it is harmless to poke around all you like until you’re ready to read a trace file off of the car and start editing it. Which is what you need NCSexpert for, because Dummy will not talk directly to the car, it only is a file manipulation and translation interface to the files that Expert uses. Oh and speaking of language, it has translation files for all of the values so it makes setting options but million times easier. Not to mention being mouse click tick boxes.

[sleuth255]

sounds good to me. NCS expert gives me the heebie-jeebies anyway. I'm not interested in bricking my BMW, or (more likely) inadvertently resetting everything back to factory defaults...

edit:

I ran the test and key based memory is indeed different from door based memory. The numbers on the door have nothing to do with the pairing order of keys. I learned something else too: Key based memory settings are only applied when unlock is pressed on a different key. So you actually need two keys to perform the test. You can change the seat settings all you want but the adjustment on unlock won't happen until a different key is used. So the seat will stay in the position selected by door memory as long as you're using the same key all the time.

[geargrinder]

NCSExpert won't brick anything but yes, if you click "code car" by mistake, it'll nuke it all back to factory.

And THAT is where a profile could be helpful. If you're worried you can use a 'read only' profile that won't let you make any changes. But as long as you're awake and paying attention and not dumb, you should be able to avoid that.

If the remotes don't correspond to the buttons then that's news to me, maybe that's just how I set mine so it 'seems to work that way' but you can set them seperately? But if that's the case I can't tell you how you push new seat memory settings into a key. I generally have the key-memory features all turned off, cuz the wife drives my car about once a year, but I could see where it'd be great for a real multi-driver car, esp for the seat + mirrors + climate control total reset.

[sleuth255]

Yeah, when you perform the test using two keys (I used first and second in paring order) it becomes clear. Locking the car with a key saves its settings so you can easily get to a point where you can hit unlock on either to change the seat position, then press M1 as well to see that all three can be set differently but that M1 is always the same no matter which key you are using. I did notice that climate control settings were part of key based memory, and it even looks like radio presets can change by key also.

[geargrinder]

Correct - all those things can be turned on/off in coding too - so you can have 'climate stay with the key but not radio' etc. etc.

[Fx323i]

Hi, seems I do not remember well about the memory. But I have not had my own BMW for over a year now so I can not check this. I think that we maybe misunderstood each other when I replied. If you set seat memory with the key by locking with a proper key after setting the memory, and do this for all the keys, then in case you would need to re-initialize the keys, you need to do it in the same order like before. This is how the memory functions are restored for each particular key properly.

Also, one more thing - I know about at least one thing in NCS Expert which can brick the car. If you have EWS2, meaning control unit type EWS2, EWS3 or EWS4.3, but the last two working in EWS2 mode, never ever try to change the coding to EWS3. There is no way to revert back without an external programmer and a lot of experience (or a backup of EWS data). But still, the EWS system is way easier to understand than CAS with its EWS3 and EWS4 mode, ISN/SK, encrypted versions and IstaP4*+ :-D

Regarding the coding of CKM, see this link: http://bavarianmachine.com/wp-bavari...6E52E53R50.pdf

[geargrinder]

I'm glad to not know anything about CAS. EWS3 is really pretty understandable, probably the most complicated bit is the details of the key transponder exchange, but its really easy to troubleshoot. I really not looking forward to having to learn newer stuff some day...