Clause(article) 1 comrade Sypport-and
 

 

 

How to win shchitok device BmW

In our heavy Russian conditions, when there is no access to firm details and the diagnostic equipment, it is necessary to be content "kolenkoj" and spare parts from disassembly.

One of the big problems arises at replacement and repair shitkov devices. I shall describe some nuances below.

 

1. BMW525i Simens ROM X2402PI

This machine has very whimsical character, for the first time we have collided(faced) such problem when to us there has arrived the machine with dead shitkom, with inscription CODE pleasing an eye. Running forward, I shall tell, the reason in long ignoring inscription INSPECTION, and chasikov before the person of the driver.

Example of an insertion of the chip:

The name of machine BmW 520

VIN code WBAHB51040GG33360

The indication of a speedmeter of 38874 miles

The note:

neisp. The gauge tempeatury and tahomet, rings a buzzer

    0000

    61

    60

    53

    10

    12

    0F

    FE

    FF

    DB

    78

    8D

    6C

    16

    02

    FF

    FF

    0010

    FF

    FF

    FF

    FF

    FF

    FF

    FF

    FF

    00

    00

    08

    35

    93

    61

    D0

    FF

    0020

    00

    00

    00

    00

    00

    00

    00

    00

    47

    47

    33

    36

    00

    01

    03

    5A

    0030

    00

    00

    00

    00

    00

    00

    00

    00

    05

    42

    FE

    4E

    24

    10

    01

    C5

    0040

    00

    00

    00

    00

    00

    00

    00

    00

    26

    00

    00

    00

    00

    00

    00

    00

    0050

    09

    8A

    68

    67

    69

    7A

    DB

    65

    BD

    31

    00

    00

    00

    00

    00

    00

    0060

    63

    F4

    00

    00

    00

    00

    00

    00

    39

    40

    60

    80

    9F

    BF

    DF

    FF

    0070

    64

    F4

    00

    00

    00

    00

    00

    00

    B7

    B5

    AC

    9A

    83

    65

    3C

    17

    0080

    65

    F4

    00

    00

    00

    00

    00

    00

    CD

    80

    00

    00

    00

    00

    00

    00

    0090

    66

    F4

    00

    00

    00

    00

    00

    00

    5F

    42

    2E

    15

    0B

    00

    00

    00

    00A0

    5D

    F4

    00

    00

    00

    00

    00

    00

    29

    4B

    73

    9A

    B5

    C2

    3E

    02

    00B0

    5E

    F4

    00

    00

    00

    00

    00

    00

    78

    00

    00

    21

    E0

    2E

    88

    8A

    00C0

    5F

    F4

    00

    00

    00

    00

    00

    00

    DD

    01

    36

    01

    29

    03

    CC

    07

    00D0

    60

    F4

    00

    00

    00

    00

    00

    00

    00

    00

    00

    00

    00

    00

    00

    00

    00E0

    61

    F4

    00

    40

    51

    20

    00

    00

    00

    0C

    00

    00

    00

    00

    61

    20

    00F0

    62

    F4

    00

    00

    00

    00

    00

    00

    01

    11

    10

    10

    00

    00

    00

    39

It is revealed:

In cells

0028 47 47 33 36 00 vin GG33360

0018 00 00 08 35 93 61 number shchitka 8 359 361

003C 24 version of a key

001F FF an attribute of mile / km FF of mile of 06 kms

002F 5A a code protsesora; When not 5A parpriz vysvechivaet CodE

0098 5F 42 2E 15 0B parameters of the thermometer

00A3 00 00

00B3 00 00 the Data inspekshion and oil service

00C3 00 00

00D3 00 00

0008 A divider of a tachometer (1C - 3000 ABOUT, BC - 500 O, 5C - 900 O at revolutions of the engine 800)

0060 63 F4 00 to

0070 64 F4 00 younger 2 kms of a speedmeter

0080 65 F4 00-

0090 66 F4 00

00A0 5D F4 00

00B0 5E F4 00

00C0 5F F4 00 0x00F45F = 62559 km - actual kilometrazh, without taking into account a younger part

00D0 60 F4 00

00E0 61 F4 00

00F0 62 F4 00

L - the senior categories of a speedmeter

L -----------younger categories of a speedmeter

 

For comparison was taken damp the read-only STORAGE:

The name of machine BmW 524 TD

WIN code WBAHA51020BA80166

The indication of a speedmeter 180 177 km

    0000

    61

    60

    53

    10

    13

    0F

    FE

    FF

    BC

    78

    77

    55

    16

    02

    FF

    FF

    0010

    FF

    FF

    FF

    FF

    FF

    FF

    FF

    FF

    00

    00

    08

    35

    93

    62

    A0

    06

    0020

    00

    00

    00

    00

    00

    00

    00

    00

    42

    4C

    40

    10

    80

    01

    04

    5A

    0030

    00

    00

    00

    00

    00

    00

    00

    00

    78

    FF

    16

    02

    12

    38

    92

    A7

    0040

    00

    00

    00

    00

    00

    00

    00

    00

    25

    00

    00

    00

    00

    00

    00

    00

    0050

    04

    8A

    7A

    DB

    50

    00

    00

    00

    00

    00

    00

    00

    00

    00

    00

    00

    0060

    98

    BF

    02

    00

    00

    00

    00

    00

    39

    40

    60

    80

    9F

    BF

    DF

    FF

    0070

    99

    BF

    02

    00

    00

    00

    00

    00

    B7

    B5

    AC

    9A

    83

    65

    3C

    17

    0080

    90

    BF

    02

    00

    00

    00

    00

    00

    00

    2B

    73

    8C

    FF

    00

    00

    00

    0090

    91

    BF

    02

    00

    00

    00

    00

    00

    5F

    42

    2E

    15

    0B

    00

    00

    00

    00A0

    92

    BF

    02

    00

    00

    20

    00

    00

    29

    4B

    73

    9A

    B5

    C2

    3E

    02

    00B0

    93

    BF

    02

    00

    00

    00

    00

    00

    96

    00

    00

    31

    10

    27

    88

    8A

    00C0

    94

    BF

    02

    00

    00

    00

    00

    00

    DD

    01

    57

    01

    3E

    03

    F1

    06

    00D0

    95

    BF

    02

    00

    00

    00

    00

    00

    30

    91

    00

    00

    00

    00

    00

    00

    00E0

    96

    BF

    02

    80

    3E

    20

    00

    00

    00

    4E

    00

    00

    00

    00

    41

    25

    00F0

    97

    BF

    02

    00

    00

    00

    00

    00

    FF

    FF

    FF

    FF

    FF

    0A

    38

    97

From this dampa the line was rearranged:

0088 00 2B 73 8C FF

After rearrangement the thermometer has earned correctly

 

It is necessary to remember, that all changes in the data result in occurrence of a mistake 05 - false programming remove which you can not.

 

The second trouble which gets out approximately on 6 - 7 year of service of the automobile, excess of quantity(amount) of cycles of record EEPROM, here the automatic device rest against purchase of the new chip as chips of other manufacturers categorically or vtihorja to work refuse.

 

2. BOSCH BMW 730 ROM 9346

Example of an insertion

    0000

    11

    FF

    5F

    BF

    A8

    82

    D3

    47

    E2

    00

    13

    FF

    26

    8D

    4F

    73

    0010

    6E

    2B

    D3

    00

    4A

    16

    F9

    E9

    5A

    C6

    AD

    38

    53

    D0

    00

    78

    0020

    00

    00

    FF

    4F

    00

    1A

    FF

    00

    98

    78

    50

    35

    10

    12

    63

    AF

    0030

    CB

    EA

    20

    00

    CB

    69

    23

    03

    FF

    FF

    92

    85

    E5

    36

    95

    59

    0040

    31

    38

    FF

    08

    00

    6A

    D2

    F0

    D2

    FA

    D3

    04

    D3

    0E

    D3

    18

    0050

    D3

    22

    D3

    2C

    D2

    E6

    91

    EA

    32

    28

    FF

    FF

    91

    EA

    23

    47

    0060

    23

    46

    23

    46

    23

    46

    23

    46

    23

    46

    23

    46

    23

    46

    23

    46

    0070

    23

    46

    23

    46

    23

    46

    23

    46

    23

    46

    23

    46

    23

    46

    08

    FF

 

0xDF, 0xE1,0xE3,0xE5,0xE7,0xE9,0xEB, 0xED 0xEF, 0xF1,0xF3,0xF5,0xF7,0xF9,0xFB, 0xFD - c categories of the long counter. The increase bajta on 1 increases run approximately by 8000 Kms.

003, 003B, 003A - 58592 number of a body

1- the letter to the address 3D younger half-byte 5-B, 7-C, 9-D... f-G

2- the letter to the address 3C the senior half-byte 1-A, 2-B, 3-C... 7-G

Surprises it is not revealed, but who knows.

 

3. BMW 316-318 1994 EEPROM 93L56

The counter of run 215 740 Kms

Number of the engine 387413 1

Number of a body 37204 4

0000 02C8 FD37 006E 788D A2CC 83E8 8721 0B5C

0010 0050 1400 3714 5325 8B4B BC70 EF9D 210D

0020 4F30 9671 0202 0202 2350 01C0 2850 FF50

0030 3111 9227 B054 D854 E77F DBFF A000 0000

0040 1310 3874 0022 7204 55C3 04FF 143C 111A

0050 0000 0000 0000 0402 FFFF FFFF 4077 2991

0060 C72B 1115 0000 0044 0000 0000 0000 3200

0070 0000 0000 3610 FFFF FFFF 47FF A739 FF00

0080 F6E3 F6E4 F6E4 F6E4 F6E4 F6E4 F6E4 F6E4

0090 F6E4 F6E4 F6E4 F6E4 F6E4 F6E4 F6E4 F6E4

00A0 FFB0 FFB0 FFB0 FFB0 FFB0 FFB0 FFB0 FFB0

00B0 FE1F FE1A FFA2 FFFF FFFF FFFF FFFF FFFF

00C0 FFFF 7806 591A 5B6A 00F0 0000 0000 0000

00D0 0000 0000 FDEE 0F0F FF0F FFFF FFFF FFFF

00E0 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF

00F0 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF

0042, 0043, 0040 - number of the engine

0049, 0046, 0047 - number of a body

0081, 0083, 0085, 0087. 008F, 0091, 0093, 0095, 0097. 009F - c categories of the long counter. The increase bajta on 1 reduces run approximately by 8 000 Kms

0080, 0082, 0084, 0086. 008F - average categories of the long counter

the read-only STORAGE, from 0000 address up to 0060 address it is protected by the control sum. Any change in this area results in inscription RRRRRR on the indicator.

Adr 0060:C72B - 2 a byte word of correction of the control sum

The control sum is calculated as XOR 2 byte values with adr 0000 up to

005F address and in a place with 0060 address are given with value 7F7F

Example 02C8 ^ FD37 ^ 006E ^.... ^ 2991 ^ C72B = 7F7F

Example of the program of updating of a binary file "xor.cpp"

The given program corrects damp under control number 0x7F7F, but it is necessary to take into account, that there may be other control numbers. Count this number before modification, that not poimet' the big problems.

 

4. The most mysterious shitok with the chip in a socket by name HML 075 F

/C HML075F represents on seen PLM with built - in FLASH.

M/C It is read as area of memory 256x16, and st and ml bajty are read equally. It(she) also contains copied area inspection, and the hardware counter of run with autopreservation of the data in EEPROM

Example of an insertion for a speedmeter of 292985 kms it is given below.

All data are submitted one bajtom since there is no sense to repeat the second identical byte which however is obligatory to reading, differently there will be a miss(passing) of the data.

Table 1

0000

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

0010

7F

7F

7F

7F

7F

7F

7F

7F

7F

7F

7F

7F

7F

7F

7F

7F

0020

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

0030

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

0040

00

00

00

00

00

00

1D

FF

00

00

00

00

00

00

1D

FF

0050

00

00

00

00

00

00

1D

FF

00

00

00

00

00

00

1D

FF

0060

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

0070

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

0080

95

F6

C0

5D

B9

01

0A

05

4B

13

26

4F

6E

D3

FF

BF

0090

82

47

00

1A

00

3F

64

00

00

00

98

78

50

35

10

12

00A0

63

AF

CB

EA

25

05

CB

90

01

88

11

5F

A8

D3

E2

F8

00B0

14

EC

0E

D3

09

AA

05

7A

02

06

00

00

4E

55

AA

83

00C0

52

20

35

97

52

20

35

97

52

20

35

97

52

20

35

97

00D0

52

20

35

97

52

20

35

97

52

20

35

97

52

20

35

97

00E0

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

00F0

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

FF

 

The area 0040 - 0050h inspection, is read and written as 8 bytes of the information multiplied on 4 (0040 - 0047; 0047 - 004F; 0050 - 0057; 0058 - 005F) interconnected areas, record of anyone bajta in any area will result in change sootv bajta in other areas.

It is unique area accessible on record.

 

0040

00

00

00

00

00

00

1D

FF

00

00

00

00

00

00

1D

FF

0050

00

00

00

00

00

00

1D

FF

00

00

00

00

00

00

1D

FF

 

Area 0080 - 00BF: service, change of the information results in refusal of the panel to work with the chip.

0080

95

F6

C0

5D

B9

01

0A

05

4B

13

26

4F

6E

D3

FF

BF

0090

82

47

00

1A

00

3F

64

00

00

00

98

78

50

35

10

12

00A0

63

AF

CB

EA

25

05

CB

90

01

88

11

5F

A8

D3

E2

F8

00B0

14

EC

0E

D3

09

AA

05

7A

02

06

00

00

4E

55

AA

83

Area 00C0 - 00DF directly a speedmeter. Escalating of indications on steps on input(entrance) CLK (455 pulses on 100 ).

00C0

52

20

35

97

52

20

35

97

52

20

35

97

52

20

35

97

00D0

52

20

35

97

52

20

35

97

52

20

35

97

52

20

35

97

Example of decoding of a speedmeter

5

2

2

0

3

5

9

7

   
               

not used

- 40 km = to the counter of run

 

km x 10 000

 

km x 1 000

 

km x 100

 

km x 10

 

km x 1

 

km x 100 00

 

km x 0.1

There was an attempt smotki a speedmeter his(its) method perebroski through 0, submission on input(entrance) CLK of pulses KMOP of a level with frequency 100 kGts (it is equivalent to speed of 60 000 kms / ch).

The first attempt has passed successfully, but all posledujushie resulted in a stop of the counter of run on value of 299 960 kms (300 000 internal value).

For work with this type of panels two emulators, one on PIC16C84 (it is shaken up to 12 mGts), the second on ATMEL AVR90S2313 were made.

Examples of programs in sootvetstvujushih .asm files.

The emulator on ATMEL AVR 90S2313 2313EM.ASM

The emulator on PIC16C84 16C84. ASM

The note: the emulator on PIC is convenient at repair of the panel on a table to not pull out the chip from a socket, but kilometrazh it(he) does not wind, eeprom does not write.

And for the present professionals we recommend the complete set represented in figure is lower:

 

Well everything, on it I finish, for on this theme it is possible to write long and persistently. Good luck.

If at you remarks and additions under clause(article) will appear, I wait your letters on support@diakom.com.ru address. {support@diakom.com.ru}

 

 

Diakom-Auto: 22, Chehova, Taganrog, Rostov-Don reg., Russia, Tel: (8634 315187

_________________________________

Sergey Dmitriev - webmaster@diakom.com.ru

_________________________________