Diagnostic and Coding 101

[SilverIris]

After much searching on multiple BMW forums, Youtube and Google, and getting exponentially more Acronym Soup/Treadmilling with less and less clear answers, I'm asking for help. This is from the perspective of a rather green BMW owner, but one well-versed in items like hex editing, wiring, electronics, etc.

I have a 2001 750IL that has been the victim of previous owner incompetence. The mechanical issues are relatively straightforward to correct, such as a window regulator needing replaced, lock rod disconnected from the trunk latch, etc. But when we go into the more technical issues, here comes the San Francisco Bay Fog...

As stated, the previous owner was outgunned and started throwing parts at the car, hoping to fix things. End result is that he made issues worse. For example, the cluster was replaced at some point with one that has ~6k miles more than stated. Tamper dot is ON as a result Now I have to get the correct mileage from the LCM and re-sync the cluster to match.

Since my other E38 (2001 740I, in proper working order) came with a 20-pin Pac-man Diagnostic to OBDII adapter, I thought I'd give it a go with my cheap ELM327 bluetooth adapter since it worked fine on my 740I to perform normal OBDII stuff and with the adapter to see ABS fault codes too...

Got no result on the 750IL on either the 20-pin or the dashboard OBDII connector. The ELM327 refused to connect to the car through the following Android apps on my Amazon Fire tablet:
Car Scanner
ELM327 Identifier (identifies what ELM327 you are using, STILL failed to work)
Torque (Lite)
BimmerCode
Carly (for BMW)

More often than not, it would lose connection to the tablet as well and refuse to re-pair again. So I repeated the process in my known working 740I and the same result. Carly wanted an update, so I did that. Still refused to connect to the car. I gave up on the ELM327 at that point (yesterday, 9/23/2019).

So, time for new hardware. I had previously read about PA Soft/BMW-Scanner, downloaded it and it stalled out because of no hardware. The proper hardware/cable isn't too expensive ($~15 on Ebay), so not really an issue. Watched a demo on Youtube and found it to be rather interesting by being able to turn off DRL (which I believe are activated on the 750IL) and other useful features too. But the problem is that it can only blank out the cluster's odometer, not write a value to it. I come from a hex editing/code hacking background. In my late teens/early 20s, I dabbled in modifying Super NES and PS2 save files to find neat hidden features, so I'm used to going "under the hood" and writing my own values to make it do what I want. So no-go on what I need, start looking at other software packages.

Now it gets even murkier...
As seen here, https://www.bimmerfest.com/forums/sh...d.php?t=561237 ,Now we have PA Soft/BMW-Scanner (whose site www.bmw-scanner.com is now dead), INPA, EDIABAS, NCSExpert, NCS Dummies, DIS/GT1, EasyDIS, & Progman, ITSA and probably a LOT more that I'm not aware of. Not to mention the number of different cables/hardware. DCAN, K+DCAN, modified Volkswagen KLL, PA Soft and probably even more.

It seems like EVERY SINGLE piece of software requires different hardware/cables and there is no clear-cut answer on which seemingly-identical cable(s) work with what piece of software. Add in the Acronym Soup problem and the average new owner gets treadmilled into buying more and more hardware, software and get nothing accomplished.

There is no excuse for this mess of misinformation running rampant in this day and age. If one person, having never touched a Eunos Cosmo in person before, can translate the ENTIRE wiring diagram service manual from Japanese to English, make it searchable in both languages, bundle it up in a tidy PDF package in 8 weeks and know more about it than even Mazda does, why haven't we fixed the BMW Diagnostic and Coding Mess in the past 18 years since the E38 ended production??

In the words of Lewis Black (in regard to the ozone layer) "We have men, we have rockets, we have saran wrap...FIX IT! And don't come back 'till ya do."

[alberttm]

What is the question?

[SilverIris]

The question is...

How do you make this s**t work??? We NEED a guide for newbs that distinctly spells out the whole process from start to finish for a relatively common task that requires a K+DCAN cable, such as turning off DRL

The car in question is a 2001 E38 740I in proper working order. Has no issues with connecting to an ELM327 OBD2 reader via the OBD2 port or 20-pin Pac-Man connector via an adapter.

So I acquired a K+DCAN cable, downloaded "Mike's Easy BMW Tools", installed it (including configuring the cable for Com1 and Latency Timer 1) and everything's set to go now. Did a bench test, INPA sees the cable properly, we're all set now.

Run out to the car, plug it in and open up Tool32 (EDIBAS) to get things rolling. Open up FindECU, it spits out an error. INPA can't see the car and spits out an error message in half-german/half-gibberish, repeat with Coding Tool. NCS Expert can't connect and spits out error messages in German, same things with NCS Dummy and WinkFP. And Dr.Gini refuses to open because of a Microsoft .Net issue that I already fixed...

I also bought a PA Soft/BMW-Scanner 1.4.0 cable, haven't messed with it yet

[alberttm]

I just wonder how a person with HEX editing background could get so confused. If you have that deep knowledge, you must be able to turn EWS off from ECU on bench. What is exactly confusing you? There is a cable and software for it. There are things INPA can do, NCS can do and so on. Just use the original installation. Can I ask you if you have checked the COM assigned to your cable, is it actually COM 1? But I think you have already checked that. My only recommendation will be, clear all, and get a clear installation of original BMW Standard Tools, let the PC assign any COM to your cable, just select the same COM during BMW Standard Tools installation. Don't use modifications such as NCS dummies, and all other enthusiast modifications which all based on original soft, I believe they will have many bugs.

[SilverIris]

I just wonder how a person with HEX editing background could get so confused. If you have that deep knowledge, you must be able to turn EWS off from ECU on bench. What is exactly confusing you? There is a cable and software for it. There are things INPA can do, NCS can do and so on. Just use the original installation. Can I ask you if you have checked the COM assigned to your cable, is it actually COM 1? But I think you have already checked that. My only recommendation will be, clear all, and get a clear installation of original BMW Standard Tools, let the PC assign any COM to your cable, just select the same COM during BMW Standard Tools installation. Don't use modifications such as NCS dummies, and all other enthusiast modifications which all based on original soft, I believe they will have many bugs.

Just because one is familiar with hex editing does not mean they are familiar with editing in this specific application. There is always a "Roadmap" for each device's code and the first step is to establish/create that "Roadmap". For example, Legend of Zelda: Link to the Past on Super NES has a distinct pattern for its Y-button equipable items.

Address 7EF340 points to the Bow. A value of "00" for this address means the location is empty. "01" gives you a Bow with no arrows, "02" is Bow and Arrows, "03 is Bow and Silver Arrows". The next Address, 7EF341, is for the Boomerang. 00 is empty, 01 is the Blue Boomerang (normally found in Hyrule Castle) and 02 is the Magical Boomerang (from the Fairy near Zora's Domain). Lather, rinse and repeat for the Hookshot, Mushroom/Magic powder and so on...

Super Mario RPG works the same way, but if you try to use this logic in Chrono Trigger, it doesn't work because the code structure is completely different. In Chrono Trigger, each item slot has two addresses and values. The first one's value identifies the item, the second is the quantity of the item. Some games' health meters count up from 0 to 255, others work backwards ("damage taken" logic). It all just depends on how they "mapped" out the code. But anyway, let's get back to the subject at hand.

K+DCAN Cable is on Com port 1. Laptop is an old install of Windows 7, but there is merit to starting fresh as you suggested. The PA Soft/BMW-Scanner hardware works with no drama so far. Scanned both 740I and 750IL and got a log file on both as a baseline to work from. As I go through it, I'm taking notes and adding them to the guide I'm writing.

What exactly is "ADFG"? I came across "Write ADFG" in the Reprogramming section of PA Soft when focused on the IKE (Cluster). I know that FGSTNR is Fahrge Stell Nummer (Chassis Number in English AKA VIN Number). Would ADFG mean "Aufbauen Daten Fahrgestell" as in "Assembly Data for Chassis"? Seems like quite a bit of confusion stems from the German acronyms.

[alberttm]

I still think the problem is software part. Just get another BMW Standard Tools installation. Regarding Pa soft, never used it, Inpa and Rheingold did all I needed so far, once used NCS expert, got an error trying to code, just needed to clear FSW man file in work folder, then coding was done. I believe PA Soft BMW scanner is actually remake of Tool32 with user friendly interface. When mentioning your background, I meant a person like you can figure out the logic of things, rather than just following the instructions without seeing the overall process. When I got error with NCS mentioned above, I found the solution which is not mentioned in any instructions, in instructions you always have "ideal conditions", nobody will mention that you go to work folder of NCS and see if there is a left over FSW man file which is conflicting with your file, but understanding the logic that NCS needs a "blank" clean file to perform reading of coding data guided me to check the man file, and when I open it I see there are left overs data of installation, car with GM 12345678 and etc.

[SilverIris]

Very astute observations. To borrow a proverb from Meitantei Conan "With a keen eye for details, one truth prevails.". I am still getting my bearings in PA Soft, having successfully recoded the 750IL's LCM to turn off Daytime Running Lights. While doing so, I documented the entire process from start to finish so a new owner can understand it in the real world, including making backups before changing anything. No different than the way I train new hires.

As for INPA, Rhinegold, NCS Expert, etc, it sounds like you are better equipped than I am to write a beginner's guide for them. Would you be interested in collaborating on it?

[alberttm]

I believe there are already hundreds of guides on the net. Just google for coding with NCS, or for instance for Rheingold there is the original manufacturer user guide which is for Ista-D, since Rheingold is actually Ista-D, the user guide can be easily applied to Rheingold. In many cases you will have DIY instructions for a particular job (for example how to code LCM), but it would be very hard to make instructions for all the possible jobs one might imagine. And the instructions are for most common issues known. There are not many instructions for Tool32, probably most of them will be about how to register new battery, but that is the case you need Tool32, there are many things one CAN do with Tool32, but not many one WILL do in real life. After all, they are engineering level programs (Inpa, NCS, Winkfp), not for everyday use. You are doing the DIY instructions for Pa Soft on how to turn off DRL, imagine someone after reading your instructions, tells you that he wants not to turn off, but to turn on his DRL, and ask you to make a new instruction for that as well), or one tells you he wants his interior lights soft off, and so on. One guide I could write is how to understand what is car diagnostics and coding, and programming. And my first recommendation would be, don't play with any program unless you really need to solve a particular issue. I know people having no issue with car, and then they read a few things about WinKfp, they buy K+Dcan cable, and try to "update" their ECU, from their PC user background they might think update is always good, but updating car ECU is not the same as updating our antivirus on PC, and they end up with bricked ECU) Sad, but true) The poor won't know that for programming you need more serious cabling like GT1, beside that you need a stable voltage, and besides all ask yourself "Do I really need to do it?"

[SilverIris]

Excellent points alberttm, but I think you may have missed the concept on the guide I'm working on. I agree 110% that writing an end-all, be-all manual for PA Soft would be quite ridiculous, excessively wordy, a bit overbearing and nowhere near concise and to the point. In other words, like a Helicopter parent and that is completely the opposite of the goal here.

What I'm writing for coding modules is a straightforward no-nonsense guide to get new owners up to speed on the process, under known, controlled conditions, then let the reader branch out into other areas on their own by connecting the dots for themselves and seeing what's similar and different on their own terms. I call this idea "seed logic".

After covering how to turn off DRL, I put in a short section for undoing the changes made, spelling out that enabling DRL is just going through the process again, but checking the box instead. As for other items like interior lights soft off, it would be the same process, just a different box to check/un-check before clicking "write".

There's a running joke about Mazda RX-8's compared to their predecessor, the FD RX-7. "Still driving a RX-7? It's time to "upgrade" to an RX-8...". I definitely get where you're coming from. Turning on/off DRLs is one thing, updating an ECU is a completely different animal. There's no way I would personally attempt to update an ECU's software unless I knew the process inside and out and had a shop such as Lerich Motorsports (an authorized Dinan dealer*) hovering over my shoulder, babysitting me through the whole process. If it were a Mazda Rotary ECU, it would be either Isami Amemiya (owner of RE-Amemiya, creator the REDOM modified ECUs) or Aaron Cake (a legend in the Rotary community) walking me through the process.
*This is not an advertisement for this shop, just an illustration that the voice of proven experience guiding a new owner will yield excellent results.

[SilverIris]

While reading the backup file I pulled from the IKE (which was improperly replaced, so different VIN/mileage...), I found something interesting...

IKE Coding data ( M35080_-_1_(IKI) 6.942.178 hw:25 sw:21 ci:12 di:09 bi:15 )
01 : 04 00
02 : 00 00
03 : 8E FA
04 : FF FF FF FF FF FF FF FF 05 F0 84 B4 F4 84 DB FB
05 : 84 83 F5 84 7B F9 84 6E FF FF FF FF FF FF EF FF
06 : FF FF
07 : FF FF FF FF FF FF FF FF FF FF FF FF
08 : 7F 5C
09 : 75 70
0A : 33 14 FF FF 00 06 87 FF FE 5E FF 2C FE 3C
0B : 44 44 73 90
0C : 12 50
0D : 44 03 00 00 4B 20 81 04 DF 83 93 40 43 56 1D 04
0E : 28 46 C5 4F 14 06 18 FF FF FF
0F : 01 10
10 : 08 FF FA 4A 00 82 EE 24 CF FF
11 : DE 8B
12 : 11 DB 09 DE 96 21 00 28 30 A0 61 18 91 90 B1 D6
13 : 00 28 30 A0 61 18 8D 86 B9 E0 10 F0 05 07 04 02
14 : 24 00
15 : 79 18
16 : CF E0
17 : 56 A5
18 : A6 FF
19 : 1C 1A 0B 74 0D 48 58 00
1A : 17 FF 08 45 14 E8
1B : 27 0F
1C : 5E 32
1D : C9 4B
1E : C9 73
1F : 36 78
20 : 6A 7D
21 : FF 53
22 : F6 06 19 04 1F 04
23 : 01 FF FF 40 FD FF 00 00 FF FF FF FF

Look at line 0B and 0C. (44 44 73 90 and 12 50). This looks like ASCII encryption of the VIN number, DD73905 with a checksum (12). In this specific pattern, it "keeps" the numbers in the VIN, but uses normal ASCII to Hex conversion to make "DD" into "44 44". This is the exact same pattern found in U.N Squadron for the Super NES from late 1991. E38 began production in 1993 in Europe and it took time to make/code chips to set up production. Makes perfect sense that they'd use the same code setup.

Who knows, the odometer is probably hidden in there somewhere too...

[alberttm]

Frankly speaking I have no knowledge in that area (modifying binary files), but I can make use of sites like https://www.ms4x.net, there are ready to use modified bin ECU files with EWS delete which I needed recently. I got a key problem, now I want to flash ECU to delete EWS and this way the key problem will be solved. I only do search and learn on as needed basis. At this stage I don't want to go deeper, even though I understand the logic of things done with bin files. There are files you can play with in TunerPro if you are interested. You might know there is a well known issue with donor DME swap, the VIN must match with EWS and so on, so people play with bin file, find the strings for VIN and FF FF FF.... it))) and "virginize" ECU to plug and go at any car. With my BA in literature it is really tough task, but for you I believe will be more familiar, so you can find VIN, milage etc. in bin file and modify them, but yet still if that can be done with PA Soft, Tool32 why use the hardest way?

[SilverIris]

I'm still getting my feet wet and learning to fix the issues that come up as I go, so I'm reading as much as I can to properly understand the process and what could realistically go wrong before jumping in. Since the only odometer correction I've personally done was of the analog type (CA series Mitsubishi Mirage/Lancer), I want to understand exactly how PA Soft/Tool32/etc alter the binary file compared to what I pulled from the cluster beforehand. The consequences of screwing it up most likely involve a visit to a BMW dealership and a very unhappy wallet, both of which I very much would like to avoid. Unlike a video game, you can't exactly hit the "reset" button, tweak the code and run it again from a save state to jump right back to where you were...

Anyway, Timm asked that I upload the log file, so here it is:

---------------------------------------------------------------------------------------------------------------------------
BMW Scanner v1.4.0.7 (14.01.2009) - P.A.Soft, 2008 HW: V144Bn9 Time: 6:32:19 PM 9/28/2019
---------------------------------------------------------------------------------------------------------------------------


ZCS coding : /-------- IKE --------\ /-------- EWS --------\
Chassis : E38 E38
Model : 750iL 750iL
Type key : GJ03 GJ03
Engine : M73B54 M73B54
Gearbox : Automatic Automatic
VIN : DD73905 WBAGJ03461DD74777
ZCS GM : 44030000-K 44030000-K
ZCS SA : 208104DF83934043-V 208104DF83934043-V
ZCS VN : 1D042846C5-O 1D042846C5-O


# SCAN START
---------------------------------------------------------------------------------------------------------------------------
Unit BMWTNR HW SW-FSW CI DI BI/VI Date Odometer VIN ADFG Algorithm
---------------------------------------------------------------------------------------------------------------------------
DME -> 7.509.322 0E 51 01 11 32 09/01 - WBAGJ03461DD74777 - DME5.21 M73
DME2 -> 7.509.322 0E 51 01 11 32 09/01 - WBAGJ03461DD74777 - DME5.21 M73
EGS -> 7.507.426 2C 09 00 10 30 14/01 283400 km WBAGJ03461DD74777 000000 GS8.60.3 E38/E39
EWS -> 6.905.670 03 08 81 81 07 19/01 283408 km WBAGJ03461DD74777 FFFFFF EWS3
ABS -> 6.753.869 52 03 10 12 3C 18/99 - - - DSC5.7
LEW -> 1.094.143 07 02 01 01 60 19/01 - DD73905 004777 LWS5
A/C -> 6.901.314 11 17 04 02 07 19/01 - - 004777 IHKA E38 PU 98
SRS -> 6.900.727 40 30 10 08 00 11/01 - DD74777 000000 MRS3
IKE -> 6.942.178 25 21 12 09 15 46/06 283408 km DD73905 FFFFFF M35080 - 1 (IKI)
LCM -> 8.386.208 01 41 18 13 00 19/01 216200 km DD74777 - HC11PH8 - 1 (LCM3)
ZKE -> 6.913.524 21 23 05 21 09 19/01 - - FF4777 ZKE3 GM1
MFL -> 0.000.000 01 08 00 03 78 00/00 - - - MFL2
PDC -> 6.916.406 01 15 03 01 01 20/01 - - - PDC E38/E39/E46/E53
AIC -> 6.904.012 04 14 00 00 00 17/01 - - 240401 AIC
TEL -> 0.025.708 30 03 01 05 12 13/01 - - 000000 TEL2
SZM -> 8.380.337 50 F8 01 10 78 20/01 - - 000000 SZM E38
NAV -> 6.915.035 11 63 04 04 09 20/01 - - - NAV MK3
VMGP -> 6.915.035 11 63 04 04 09 20/01 - ....... 004777 VM Graph-part
BMBT -> 6.913.387 43 42 00 31 10 12/01 - - 000000 BMBT WideScreen
SHD -> 6.910.472 05 27 01 02 78 14/01 - - 144777 SHD E46/R40
LRA -> 8.375.964 D1 05 03 01 05 19/01 - - FFFFFF LWR2A
EML -> 1.430.168 40 23 01 23 33 16/01 - - - EML3 Siemens


# USER INFO FIELDS
---------------------------------------------------------------------------------------------------------------------------
Unit Date VIN Odometer Assembly Software Service Dealer Tester Program ver.
---------------------------------------------------------------------------------------------------------------------------
DME -> 22.05.01 WBAGJ03461DD74777 0 km 7.513.277 7.510.326 7.513.276 012321 42324 -
DME2 -> 22.05.01 WBAGJ03461DD74777 0 km 7.513.277 7.510.326 7.513.276 012321 42324 -
EGS -> 22.05.01 WBAGJ03461DD74777 0 km 7.509.006 7.509.007 1.000.000 012321 42324 -


# ERRORS IN UNITS
---------------------------------------------------------------------------------------------------------------------------
Unit BMWTNR HW SW-FSW ERRORS / SHADOW-MEMORY
---------------------------------------------------------------------------------------------------------------------------
DME -> 7.509.322 0E 51 no errors / 8 errors
DME2 -> 7.509.322 0E 51 no errors / 8 errors
EGS -> 7.507.426 2C 09 5 errors
EWS -> 6.905.670 03 08 6 errors
ABS -> 6.753.869 52 03 3 errors
LEW -> 1.094.143 07 02 4 errors
A/C -> 6.901.314 11 17 no errors
SRS -> 6.900.727 40 30 2 errors
IKE -> 6.942.178 25 21 5 errors
LCM -> 8.386.208 01 41 1 error / 6 errors
ZKE -> 6.913.524 21 23 8 errors / 8 errors
MFL -> 0.000.000 01 08 no data
PDC -> 6.916.406 01 15 no errors
AIC -> 6.904.012 04 14 no errors
TEL -> 0.025.708 30 03 no errors
SZM -> 8.380.337 50 F8 no errors / no errors
NAV -> 6.915.035 11 63 1 error / 4 errors
VMGP -> 6.915.035 11 63 no data
BMBT -> 6.913.387 43 42 4 errors
SHD -> 6.910.472 05 27 no errors
LRA -> 8.375.964 D1 05 no errors / 1 error
EML -> 1.430.168 40 23 10 errors


# ERRORS DETAILS - DTC(hex)/PARAM(hex)
---------------------------------------------------------------------------------------------------------------------------
DME -> Shadow-memory:
6C/02 - Permanent supply
D9/94 - CAN-Timeout EML
EC/14 - CAN-Timeout EGS
D8/04 - CAN-Timeout ASC/DSC
D7/54 - CAN-Timeout DME
13/54 - CAN-Timeout EKAT
06/94 - CAN-Timeout IKE
94/82 - Wire fault DWA/EWS Input (Short circuit or Interruption)

DME2 -> Shadow-memory:
6C/02 - Permanent supply
D9/94 - CAN-Timeout EML
EC/14 - CAN-Timeout EGS
D8/04 - CAN-Timeout ASC/DSC
D7/54 - CAN-Timeout DME
13/54 - CAN-Timeout EKAT
06/D4 - CAN-Timeout IKE
94/82 - Wire fault DWA/EWS Input (Short circuit or Interruption)

EGS -> 80/B1 - CAN-Bus check
93/01 - CAN Throttle valve
82/E1 - CAN Timeout ASC
84/A1 - CAN Timeout EML
81/B1 - CAN Timeout DME

EWS -> 0F/FF - Power on reset
13/05 - Toleration of changing code increased, key 1
11/02 - Wrong password, key 1
10/01 - Wrong identification, key 1
0E/22 - DME changing code XOR-error
12/01 - Wrong changing code, key 1

ABS -> 1E/FE - Wheel speed sensor rear left, open circuit
61/F5 - Steering angle adjustment necessary
38/FE - CAN Error

LEW -> 10/8D - Watchdog
09/A9 - No CAN message (ASC)
0C/CD - CAN-Bus off
0B/CD - Wrong LWS-ID

SRS -> 12/88 - Fault lamp (AWL)
11/A2 - Power supply

IKE -> F0/84 - CAN-bus off
F4/84 - No CAN message
FB/84 - No CAN message (EGS1)
F5/84 - No CAN message (ASC1)
F9/84 - No CAN message (DMEL4)

LCM -> 28/01 - Thermal oil-level sensor defect
Shadow-memory:
53/01 - Engine oil pressure
58/0B - Engine failsafe program
59/0F - Transmission failsafe program
5F/31 - Check coolant level
94/1C - Rear left fog light
95/1C - Rear right fog light

ZKE -> A4/21 - Mirror, potentiometer vertical or cable, driver's door
DC/05 - Steering column angle: communication error
31/21 - Wiper motor blocked, reset contact, wiper relay
49/01 - Wire WI1 or wiper relay 1, open circuit
4B/01 - Wire WI2 or wiper relay 2, open circuit
01/01 - Fuse power window rear
02/01 - Fuse interior lights
82/01 - Cable Tacho A (speedometer) or IKE missing
Shadow-memory:
93/3F - Power up from the GM III
80/02 - DWA-Alarm: Terminal R
72/21 - Cable Tacho A (speedometer) or IKE missing
89/02 - DWA-Alarm: hood/bonnet contact
85/01 - DWA-Alarm: door contact, rear, driver's side
94/22 - Power up from the driver's door module
95/22 - Power up from the passenger's door module
8A/21 - DWA-Alarm: tilt alarm sensor

NAV -> 01/00 - Navigation computer

BMBT -> 01/1F - Watchdog reset
0B/1F - Connector monitor UB, open circuit
03/31 - Radio status telegram timeout
16/0D - EEPROM Checksum does not match with programmed value

LRA -> Shadow-memory:
00/00 - Terminal 30

EML -> 86/B8 - Releasing error from main logic (error ECU)
00/00 - Error number 00
00/00 - Error number 00
00/00 - Error number 00
00/00 - Error number 00
00/00 - Error number 00
00/00 - Error number 00
00/00 - Error number 00
00/00 - Error number 00
00/00 - Error number 00


# SCAN END
---------------------------------------------------------------------------------------------------------------------------

The log I made while turning off the DRL produced this change:

Unit BMWTNR HW SW-FSW CI DI BI/VI Date Odometer VIN ADFG Algorithm
---------------------------------------------------------------------------------------------------------------------------
EGS -> 7.507.426 2C 09 00 10 30 14/01 82960 km WBAGJ03461DD74777 000000 GS8.60.3 E38/E39

Timm, what are your thought on this? Car had very dead batteries (3.5v and 5.8v) and was being charged at 10A (voltage reading was ~11.0v at start, ~10.6v when finishing)

[alberttm]

https://www.bimmerforums.com/forum/s...)-after-coding this is just exactly trhe case I mentioned above. Still think it's a good idea to write a kind of "before you play" guide ))

[SilverIris]

https://www.bimmerforums.com/forum/s...)-after-coding this is just exactly trhe case I mentioned above. Still think it's a good idea to write a kind of "before you play" guide ))

Just read the whole thread, sounds pretty scary. I've not played around with NCS Expert much, so I can't say how to avoid that scenario. Perhaps a list of modules that are "safe for newbs", "supervision highly recommended" and "requires extensive knowledge" is a good idea, based on the consequences of something going wrong?

I did spend an hour just exploring PA Soft last night on my 740I to get a better idea of what options are where, taking screenshots at every turn and downloading a copy of the Coding Data, memory and EEPROM files at every chance. It was mostly brought on because I was wondering how the car was set up in its current form (unaltered by me), typical of a 2001 740I made for the United States (NOT California)

This morning over coffee, I was looking around in the IKE files I got last night and discovered something neat. The FGSTNR (VIN number) is in one area, while the odometer is in another and written multiple times. 3 byte hex value, just like Money in Simcity on the Super NES. That led me to something else...

Since the odometer is part of the EEPROM, the car rewrites the entire EEPROM and checks itself multiple times as it rewrites it EVERY KILOMETER. Multiple Redundancy inside the IKE, plus the LCM redundancy on top of that. Whoever created this system is really good and I haven't even looked at the LCM files yet.

[SilverIris]

Now we're into the "meat" of the thread. As this situation is common for a new owner requiring a new IKE Cluster, I think it's time to address it.

The IKE Cluster in my 750IL was improperly replaced at some point and its odometer reads significantly higher (283k kms) than the LCM Light Control Module (216k kms, verified original to the car by build date). I understand that the odometer is also stored in the EWS (Immobilizer) and EGS (Transmission Control) and have read plenty on the procedure to correct these modules individually.

Since the previous owner did not code the new IKE Cluster to the car on installation, the Tamper Dot activated, triggering the LCM and IKE to stop talking to each other due to different VINs. Both IKE and LCM continued to record mileage drive, they just don't agree on the total number of miles/kms driven. As a result of the IKE reading higher, the EGS and EWS (both original to the car, so correct VIN) automatically assumed the higher odometer reading. This is normal behavior because the EGS and EWS always assume a "worst case scenario" when encountering conflicting odometer information.

Summary:
IKE: Wrong VIN, Wrong Odometer (higher than actual mileage)
EGS: Correct VIN, Wrong Odometer (due to re-sync with replaced IKE)
EWS: Correct VIN, Wrong Odometer (due to re-sync with replaced IKE)
LCM: Correct VIN, Correct Odometer

What is the correct order of operations in order to not "infect" the LCM or "re-infect" each other? Using PA Soft, I downloaded a backup of all of the EEPROMs and Coding Data throughout the car yesterday as a precaution in case something goes wrong so it can be rolled back to "pre-operation status" if need be.

[legoman67]

You cannot change the odometer reading through the diagnostic port. BMW was smarter then that and made sure that it was not possible, doesnt matter how many different cables and programs you have.

The only way is to read the eeprom data directly off the M35080 chip inside the cluster. Youll need a BDM tool to do that. At that point you can edit the hex file and write it back to the chip.