Article by: DIAKOM
Applies to: e32 and e34 models.
In our difficult Russian conditions, when there is no access to branded parts and diagnostic equipment, you have to be content with the spare parts from disassembly.
One of the big problems arises when replacing and repairing instrument shields.I will describe some of the nuances below.
1. BMW 525i Siemens ROM X2402PI
This car has a very capricious character, for the first time we encountered such a problem when a car came to us with a dead dash computer.
Looking back, I would say, the reason for the problem is the long ignoring of the INSPECTION interval by the owner.
Here is an example of a chip firmware:
1993 BMW 520 (e34)
VIN code: WBAHB51040GG33360
Speedometer: 38874 miles
Note: Unfulfilled temperature sensor and tachometer, buzzer rings
Revealed:
In cells:
0028 47 47 33 36 00 vin GG33360
0018 00 00 08 35 93 61 plate number 8 359 361
003C 24 key version
001F FF mile / km sign FF miles 06 km
002F 5A processor code;When Not 5A Parprise Flashes Code
0098 5F 42 2E 15 0B thermometer parameters
00A3 00 00
00B3 00 00 Inspection and Oil Service Data
00C3 00 00
00D3 00 00
0008 tachometer divider (1C – 3000 OB, BC – 500 OB, 5C – 900 OB at engine speed 800)
0060 63 F4 00 ┐
0070 64 F4 00 │ lower 2 km speedometer
0080 65 F4 00 –
0090 66 F4 00
00A0 5D F4 00
00B0 5E F4 00
00C0 5F F4 00 0x00F45F = 62559 km – actual mileage, excluding the younger part
00D0 60 F4 00
00E0 61 F4 00
00F0 62 F4 00
L– high speed
L ———– the lower digits of the speedometer
For comparison, a ROM dump was taken:
1990 BMW 524 TD (e34)
VIN code: WBAHA51020BA80166
Speedometer reading 180 177 km
From this dump, the line was rearranged:
0088 00 2B 73 8C FF
After the permutation, the thermometer worked correctly
It must be remembered that all changes in the data lead to the appearance of error 05 – false programming, which you cannot eliminate.
The second trouble, which crawls out around 6-7 years of the car’s service, the excess of the number of EEPROM recording cycles, here automatically rests on the purchase of a new chip, as the chips of other manufacturers categorically or quietly refuse to work.
2. BOSCH BMW 730 ROM 9346
Firmware example:
0xDF, 0xE1,0xE3,0xE5,0xE7,0xE9,0xEB, 0xED │ 0xEF, 0xF1,0xF3,0xF5,0xF7,0xF9,0xFB, 0xFD – the senior bits of the long counter.An increase in byte of 1 increases the mileage by about 8000 Km.
003C, 003B, 003A – 58592 body number
1st letter at 3D lower nibble 5-B, 7-C, 9-D, … fG
2nd letter at 3C high nibble 1-A, 2-B, 3-C, … 7-G
No surprises were found, but who knows.
3. BMW 316- 318 1994
EEPROM 93LС56
mileage counter 215 740 Km
engine number 387413 1
body number 37204 4
0000 02C8 FD37 006E 788D A2CC 83E8 8721 0B5C
0010 0050 1400 3714 5325 8B4B BC70 EF9D 210D
0020 4F30 9671 0202 0202 2350 01C0 2850 FF50
0030 3111 9227 B054 D854 E77F DBFF A000 0000
0040 13 10 3874 0022 7204 55C 3 04FF 143C 111A
0050 0000 0000 0000 0402 FFFF FFFF 4077 2991
0060 C72B 1115 0000 0044 0000 0000 0000 3200
0070 0000 0000 3610 FFFF FFFF 47FF A739 FF00
0080 F6E3 F6E4 F6E4 F6E4 F6E4 F6E4 F6E4 F6E4
0090 F6E4 F6E4 F6E4 F6E4 F6E4 F6E4 F6E4 F6E4
00A0 FFB0 FFB0 FFB0 FFB0 FFB0 FFB0 FFB0 FFB0
00B0 FE1F FE1A FFA2 FFFF FFFF FFFF FFFF FFFF
00C0 FFFF 7806 591A 5B6A 00F0 0000 0000 0000
00D0 0000 0000 FDEE 0F0F FF0F FFFF FFFF FFFF
00E0 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF
00F0 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF
0042, 0043, 0040 – engine number
0049, 0046, 0047 – body number
0081, 0083, 0085, 0087 …. 008F, 0091, 0093, 0095, 0097 …. 009F – the senior bits of a long counter.An increase in byte of 1 reduces mileage by approximately 8,000 km
0080, 0082, 0084, 0086 …. 008F – the middle digits of the long counter
ROM, from address 0000 to address 0060 is protected by a checksum.Any change in this area leads to the inscription PPPPPP on the indicator.
Adr 0060: C72B – 2 byte checksum correction word
The checksum is calculated as XOR of 2 byte values from address 0000 to
address 005F and in the place with address 0060 gives the value 7F7F
Example 02C8 ^ FD37 ^ 006E ^ …. ^ 2991 ^ C72B = 7F7F
Sample binary file adjustment program “xor.cpp”
This program corrects the dump for the control number 0x7F7F, but it must be taken into account that there may be other control numbers.
Calculate this number before making changes, so as not to have big problems.
4. The most mysterious part of the chip is the connector named HML 075 F
M / C HML075F is apparently a PLM with integrated FLASH.
M / C is read as a 256×16 memory area, with art and ml bytes being read the same way.It also contains a re-writable inspection area, and a hardware mileage counter with auto-save data in EEPROM
An example of firmware for the 292985 km speedometer is given below.
All data is represented by one byte, becauseit makes no sense to repeat the second identical byte, which however is required to be read, otherwise data will be skipped.
Table 1:
Area 0040 – 0050h inspection, is read and written as 8 bytes of information multiplied by 4 (0040 – 0047; 0047 – 004F; 0050 – 0057; 0058 – 005F) interrelated areas, writing any byte in any area will lead to a change in the corresponding byte in other areas .
This is the only area writable:
Area 0080 – 00BF: service, changing information leads to the failure of the panel to work with the chip.
Area 00C0 – 00DF directly speedometer.Accumulation of readings on clocks at the input of CLK (455 pulses per 100 m).
Decoding speedometer example:
There was an attempt to wind the speedometer by transferring it through 0 by applying CMOS level pulses at a frequency of 100 kHz to the CLK input (equivalent to a speed of 60,000 km / h).
The first attempt was successful, but all subsequent attempts to stop the mileage counter at a value of 299,960 km (300,000 internal value).
To work with this type of panel, two emulators were made, one on the PIC16C84 (swing up to 12 MHz), the second on the ATMEL AVR90S2313.
Examples of programs in the corresponding .asm files.
Emulator on ATMEL AVR 90S2313 2313EM.ASM
Emulator on PIC16C84 16C84.ASM
Note: the emulator on the PIC is convenient when repairing the panel on the table, so as not to pull the chip out of the connector, but it does not wind the mileage, it does not write it.
And for real professionals, we recommend the kit shown in the figure below:
Well, that’s it, I end here, because on this topic you can write for a long time.Good luck.
For additional information, contact Diakom at the following:
Diakom-Auto: 22, Chehova, Taganrog, Rostov-Don reg., Russia, Tel: (8634 315187)