BMW M3 Forum
BMW M3 Forum BMW M3 Gallery BMW M3 Reviews BMW M3 Social Groups BMW M3 Chat M3Forum Sponsors >>
Loading


Mobile M3forum
Go Back   BMW M3 Forum.com (E30 M3 | E36 M3 | E46 M3 | E92 M3 | F80/X) > BMW M3 Discussions > E46 M3 (2001-2006) > Coding and Tuning
Tire Rack Buy Winter Tires Now!
Not a member? Register Now!
Register Gallery All Albums Garage Search Today's Posts Mark Forums Read Calendar FAQ

Coding and Tuning Discuss all avenues of coding and tuning here!


Reply
 
Thread Tools Display Modes
Old Mon, Sep-10-2018, 05:36:25 PM   #1
Kenny167
Registered User
 
Join Date: Aug 2018
Posts: 34
Reputation: 0 Kenny167 is on a distinguished road

United States




Default EEPROM questions

So I know there are a bunch of different EEPROM's used in the E46, and that some can be programmed with some tools and not with others. I was wondering about the EEPROM in the gauge cluster, because I know that the BMW scan tool (PAsoft 1.4 etc) can write the odometer and VIN to that EEPROM, but it seemingly can't be done with NCS and other such tools. This doesn't add up to me because both use the OBD-II port as their connection to the car? I don't get what makes the BMW scan tool special in this regard, does it communicate with some different bus or something? Depending on what it is that separates them, I'd like to see if it's possible to mod the K+DCAN cable or do something to NCS to allow for EEPROM writing.
Jump to top Kenny167 is offline   Reply With Quote
Sponsored Links
Register now and remove these ads
Old Tue, Sep-11-2018, 02:03:12 PM   #2
geargrndr
Working for Nefarious Porpoises
 
Join Date: Jun 2010
Posts: 836
Reputation: 0 geargrndr is on a distinguished road
Location: AndoverRockport MA & Intl

United States




Default Re: EEPROM questions

First of all to write the cluster you need to put a virgin chip in that's had the VIN & mileage cleared. Even PA Soft can't rewrite those things on a used chip. It can write VIN to other modules that aren't locked (ex: LCM) but not a cluster w/ the special 'security EEPROM'.

Virtually every car instrument cluster since the late '90's gets these EEPROM chips made (mostly) specifically for the auto industry that have a special "write once" memory area that can't under normal circumstances be overwritten... The VIN area generally can't be overwritten at all, and the mileage area can be written to, but can only be increased in numerical value. Some DME's use the exact same type of chips for the same reason.

To swap a cluster, the chip needs to be removed and erased with a special hardware eraser (or replaced by a brand new one), and then have a modified 'virginized' version of the flash written back to it. Google stuff like "BMW cluster M35080", there's loads of info on this.

Here's how its done on an E39 cluster, the E46 cluster won't be much different...
https://www.bimmerforums.com/forum/s...VIN-and-coding

Re: Cables/PASoft/NCS etc. yes you're entirely right in that regard that if the PASoft does it through OBD then other software should be able to, and the answer to that is Tool32.

You can write VIN/mileage via Tool32, its just that Tool32 is VERY much less friendly to figure out and use than NCS. NCS will never be able to write VIN/Mileage, forget about that, its not part of its capabilities That's like wanting to edit a spreadsheet in photoshop... it dont know how to do that... But Tool32 definitely has a 'job' for that.
Here's an example of using Tool32 to change a VIN in a DME...
https://www.ecuworx.co.uk/2016/02/26...f-with-tool32/

But honestly if you're going through all the pain of doing cluster virginization, its worth the ease-of-use factor to just grab a PASoft copy and use that - after you've replaced the chip with a VIN/mileage-erased version of course. Which means also having a chip programmer and perhaps an eraser because... oh BTW there's bogus M35080 chips out there that make this even more difficult so you can't just buy/trust the ones you see for sale on teh immerwebz for this kind of project...
__________________
2003 M3CicM6 TiAg
2002 540iT Sport Vortech S/C 6MT LSD TiAg
2008 Audi A3 2.0T DSG (hers)
1999 Cherokee Sport 4L (trailer-hitched in-law loaner bomber)

Recently Former...
1995.5 Audi S6 Avant (utility/winter billetturbobattlewagen)


Jump to top geargrndr is offline   Reply With Quote
Old Wed, Sep-12-2018, 04:55:31 PM   #3
NikolaiD
Registered User
 
NikolaiD's Avatar
 
Join Date: Oct 2008
Posts: 1,876
Reputation: 0 NikolaiD is on a distinguished road
Location: Chicago

Bulgaria




Default Re: EEPROM questions

This was years ago, but when I had to swap dead clusters on a car, I moved the little memory chip that holds the VIN and mileage over to another cluster and it just works.
Did the same thing for a non-m to M swap and it just worked. VIN and miles transferred over. Didn't need any programming.
__________________


MSS54 Error Codes
(work in progress)
Jump to top NikolaiD is offline   Reply With Quote
Old Wed, Sep-12-2018, 06:27:46 PM   #4
geargrndr
Working for Nefarious Porpoises
 
Join Date: Jun 2010
Posts: 836
Reputation: 0 geargrndr is on a distinguished road
Location: AndoverRockport MA & Intl

United States




Default Re: EEPROM questions

Quote:
Originally Posted by NikolaiD View Post
This was years ago, but when I had to swap dead clusters on a car, I moved the little memory chip that holds the VIN and mileage over to another cluster and it just works.
Did the same thing for a non-m to M swap and it just worked. VIN and miles transferred over. Didn't need any programming.
Yeah, needs to be same 'version' of cluster but apparently that's still OK across M/non-M versions... That really is the easiest way to do it.. .
__________________
2003 M3CicM6 TiAg
2002 540iT Sport Vortech S/C 6MT LSD TiAg
2008 Audi A3 2.0T DSG (hers)
1999 Cherokee Sport 4L (trailer-hitched in-law loaner bomber)

Recently Former...
1995.5 Audi S6 Avant (utility/winter billetturbobattlewagen)


Jump to top geargrndr is offline   Reply With Quote
Old Thu, Sep-13-2018, 02:49:21 PM   #5
Kenny167
Registered User
 
Join Date: Aug 2018
Posts: 34
Reputation: 0 Kenny167 is on a distinguished road

United States




Default Re: EEPROM questions

The reason why I made this thread is because I bought an E46 M3 that was a theft recovery, and was "totalled" since a bunch of the interior was gutted. The guy I bought it from bought another M3 that had rolled, and was only worth it for the interior. So all of the main internal modules are the original, but the gauge cluster is the only swapped part. I knew that the mileage was wrong before I bought the car, so I had done the research on if it was possible to correct. So, I can see that the FA and ZCS data on my cluster are completely corrupt, on INPA they show up as a random series of hex data essentially. I found this thread saying he had done it without changing out the EEPROM, and since the EEPROM chip has pcb traces tied to all 8 pins, that brought me to believe that it was possible to lift the EEPROM hardware write protection, and that's supported by the chip's datasheet, which says that pin 3 on the IC is the "write protect" pin, and that it's an active low. This isn't a "write once" chip by any means, all you have to do is lift that hardware protection, and then you can write to the chip no problem. There is also a software write protect, and this might be what prevents NCS from writing to the chip, but allows for PAsoft to do so. That post is about an older car that uses ZCS data mainly, so it's possible that it might not work... I feel there is absolutely a way to make the EEPROM writable. I have a bus pirate, and the chip uses SPI, so I might just take the chip off the board and program it myself using the datasheet and other sources, but if I can simply pull that hardware write protection high and write to the chip using PAsoft, NCS, or any kind of software, then I'd like to try that. I think my best bet is to tear apart a junkyard gauge cluster to figure out the pcb layout and see if it's possible to apply voltage to pin 3, or see if that's connected to anything else. If it's simply just tied to ground then the only way to "mod" the board to make it writable would be chopping the traces... I feel this is possible but need to do more research.

I think what allows the EEPROM to be written to is the fact that the ZCS data matches the rest of the car. I know the car checks this when attempting to do the "mileage reset" in INPA, and it throws an error code because of it. I think if you correct the FA/ZCS data to match the car, you'll be able to write to the odometer. From there, writing 0 to the odometer and doing a software reset must put the cluster in "virgin" mode, since it thinks the car has just rolled off the line, allowing you to write the VIN and then with corrected ZCS/FA data, the checks for writing to the odometer pass successfully, and allows the EEPROM's hardware write protect to be lifted and therefore written to. This is just a theory but it makes sense.

Last edited by Kenny167; Thu, Sep-13-2018 at 03:04:20 PM.
Jump to top Kenny167 is offline   Reply With Quote
Old Thu, Sep-13-2018, 03:15:05 PM   #6
geargrndr
Working for Nefarious Porpoises
 
Join Date: Jun 2010
Posts: 836
Reputation: 0 geargrndr is on a distinguished road
Location: AndoverRockport MA & Intl

United States




Default Re: EEPROM questions

I've given you all the real proper information (read the E39 thread I give you) but you seem to be obsessed with finding stuff that just tells you what you want to hear, and not what the facts actually are. Your own derpderp thread link (millenial much? too impatient to actually read all the details of the thread you linked? LOL) explains that the only clusters that PASoft can easily rewrite like that are the early ones.

And... Sorry man, you're reading the datasheet optimistically and selectively. Assuming we're talking the M35080... (and we are) - from the datasheet:

Quote:
Protection of the First 32 Bytes
The first 32-byte page is organized as 16 words
(two bytes each). The initial content of each word
on this page is 0000h. When writing to byte-pair, a
logic comparator verifies that the new two-byte
value is larger than the value currently stored. If
the new value is smaller than the current one, no
operation is performed. It is impossible to write a
value lower than the previous one, irrespective of
the state of W pin and status register,
as indicated
in Table 6.
No software or hardware pin protect will unlock that functionality.

You have to erase the chip to zero to start over.

Now you CAN erase those chips using a special eraser and/or programmer that has that functionality but a lot of generic chip programmers can't do it. There's some magic handshake of pins and voltage (probably some higher voltage than regular...) that allows a chip erase. I looked around for a while to figure out what exactly the chip erasers do to erase them, but couldn't find it out on the internet aside from the usual douchebags off hand comments like "of course its trivial if you know what the tricks are (But I'm a douchebag so I'm not going to tell you what the tricks are)".

So yeah... you need to erase the chip in an eraser and that can't be done in-circuit, you gotta pull it out. Or just buy a new blank one.
__________________
2003 M3CicM6 TiAg
2002 540iT Sport Vortech S/C 6MT LSD TiAg
2008 Audi A3 2.0T DSG (hers)
1999 Cherokee Sport 4L (trailer-hitched in-law loaner bomber)

Recently Former...
1995.5 Audi S6 Avant (utility/winter billetturbobattlewagen)


Jump to top geargrndr is offline   Reply With Quote
Old Thu, Sep-13-2018, 03:39:40 PM   #7
Kenny167
Registered User
 
Join Date: Aug 2018
Posts: 34
Reputation: 0 Kenny167 is on a distinguished road

United States




Default Re: EEPROM questions

Ok, this is what I was trying to understand, and you pointed out the info that I was looking for (but clearly didn't see), but this doesn't mean it's impossible. The incremental area of the memory is 000h-01Fh, and is only 2 bytes, do you know what's stored on there? If it's just the mileage then I can increment it up since the actual mileage of my car is higher than what it currently reads. I could also correct the mileage by setting the "K_ZAHL_WEHL" or whatever in the cluster so that my mileage increases rapidly, so I only have to drive for a little bit to correct it. But if the VIN number is stored in this area then yes, this is impossible without erasing the chip.
Jump to top Kenny167 is offline   Reply With Quote
Old Thu, Sep-13-2018, 06:27:11 PM   #8
geargrndr
Working for Nefarious Porpoises
 
Join Date: Jun 2010
Posts: 836
Reputation: 0 geargrndr is on a distinguished road
Location: AndoverRockport MA & Intl

United States




Default Re: EEPROM questions

OK then you may be on to something... but I wouldn't guarantee it...

Yeah... If the VIN matches and the cluster is lower than the LCM, then the mileage will get written up to match - EXCEPT - the algorithm for mileage write-up has some limit. So its really:
- If the VIN matches, and,
- cluster is lower than the LCM, and,
- difference is less than xxxxxkm (or whatever the # is)...
- then - write mileage up to match

Search around the actual mileage limit is out there in some threads.

So... in an ideal world all you'd change the VIN and then the mileage would magically write up. But you need to check what that limit band is...

Now I don't know if the E46 cluster allows you to write the VIN with Tool32 or PASoft but I'd try that first. There's always the chance its 'secured' in other software functions, and not just on the on-chip...

Now if you are past the band of "auto write up"...

From the E39 post I linked you to (which you really should read)....

Quote:
The other issue with the M35080 cluster is that you will not be able to manually set the mileage without having the LCM connected to the cluster unless you program the mileage using a M35080 programmer before soldering the chip onto the board. This is because PA Soft cannot write mileage to the M35080, even if it is zeroed out. That being said, I think you can use tool32 to program the freshly installed blank M35080, but I haven't tested that method, and I still think you need it in the car for it to download the correct mileage from the LCM.
So... the 'foolproof' way to do it is for sure to put a new or erased chip in there, write the VIN, and then let the BMW systems do the work. But you can try messing about with Tool32... just be prepared its not really a ton of fun and requires a lot of research and guesswork to figure out IME>
__________________
2003 M3CicM6 TiAg
2002 540iT Sport Vortech S/C 6MT LSD TiAg
2008 Audi A3 2.0T DSG (hers)
1999 Cherokee Sport 4L (trailer-hitched in-law loaner bomber)

Recently Former...
1995.5 Audi S6 Avant (utility/winter billetturbobattlewagen)


Jump to top geargrndr is offline   Reply With Quote
Old Thu, Sep-13-2018, 07:14:00 PM   #9
Kenny167
Registered User
 
Join Date: Aug 2018
Posts: 34
Reputation: 0 Kenny167 is on a distinguished road

United States




Default Re: EEPROM questions

So, I found this:
Screenshot_8.png
And it seems from this that there isn't really a way this would work... Then again I don't doubt there's a way to force it to write the VIN... But from this it seems like what I want to do won't work.
Jump to top Kenny167 is offline   Reply With Quote
Old Thu, Sep-13-2018, 08:31:47 PM   #10
geargrndr
Working for Nefarious Porpoises
 
Join Date: Jun 2010
Posts: 836
Reputation: 0 geargrndr is on a distinguished road
Location: AndoverRockport MA & Intl

United States




Default Re: EEPROM questions

So just do what I linked from the start.

Backup your cluster. Swap a new clean chip.

Then you’ll be able to match VIN and have the mileage downloD.
__________________
2003 M3CicM6 TiAg
2002 540iT Sport Vortech S/C 6MT LSD TiAg
2008 Audi A3 2.0T DSG (hers)
1999 Cherokee Sport 4L (trailer-hitched in-law loaner bomber)

Recently Former...
1995.5 Audi S6 Avant (utility/winter billetturbobattlewagen)


Jump to top geargrndr is offline   Reply With Quote
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump



All times are GMT. The time now is 03:25:45 PM.


Powered by vBulletin® Version 3.8.6
Copyright ©2000 - 2018, Jelsoft Enterprises Ltd.
M3Forum.com and M3forum.net is in no way sponsored, endorsed or affiliated by or with BMW NA / BMW AG or any of it's subsidiaries or vendors.
BMW and M3 (E90 M3 | E92 M3 | E93 M3 | E46 M3 | E36 M3 | E30 M3) are registered trademarks of BMW AG.
M3Forum Terms of Service
Copyright 1999-2017 M3Forum.com
Discussing Visualization of CAN data related to the e46 M3 in the Coding and Tuning Forum - Discuss all avenues of coding and tuning here! at BMW M3 Forum.com (E30 M3 | E36 M3 | E46 M3 | E92 M3 | F80/X)