OVER CRANKING

[handsomejackuk]

I’ve cloned EWSs using an AK90+ which is a tool used for making keys.

When you make a new key the EWS has to be updated with the new key details. But the hardware can also be used to make a straight EWS copy.

Now BMW as best as I know do not remove the EWS to add a new key. And I’ve been wondering how they do it. Perhaps DIS then.

There are 2 parts to the EWS memory. The software and the key/car ID details. You could possibly use a hex editor to merge a software update with the key data.

Just speculating here on what I do know. It’s not a straight answer to your question I know.

I never used DIS before.

Rob,

just reading this... I think BMW have a database of the firmware that is written to every bmw ews and module that is ever produced and this is freely available to bmw dealers. and i think maybe this data can be extracted from a vehicles vin code with a decoder.. that someone has hacked / leaked... so when you ask for a key from bmw they just go to the database and get the key code data from there... also locksmiths seem to be able to decode this data from just the vin with an isn number whatever that is...

we/ others.. as people that dont always go to the dealers have found ways around this by extracting the data and reverse engineering the hardware... not always in the correct manner...but its all a giant learning curve... and there are ways around it....

does the ews data need to be updated after making a new key...?

I thought all the key data was held on the ews. and once the bin file was saved, other keys could be made, the only reason for updating the ews data would be to disable stolen keys or if the maximum number keys 10 I think has been reached and a new key code needed to be generated...

off to bed food for thought...

Al...

 

[mrscalex]

First of all Southernboy is in the hands of an expert so no need to worry.

I believe all Z3 EWSs use the later chip type. Possibly not the very earliest cars - I can’t remember now. There are various EWS types across all BMWs, earlier and later than the 3D in the Z3 so I believe the warnings are primarily for earlier BMWs. All the EWSs I’ve looked at back to 1998 cars have the ‘safe’ chip.

The normal procedure is to update the EWS every time you make a new key. Possibly you can bypass this by blocking out all 10 keys the first time you look at the EWS.

 

[Southernboy]

I am confident that the files are to be copied, not altered or changed in any way. From what I have gathered OD46J seems to be a significant code.. what it refers to I have no idea, but I will ask lots of questions later this morning when I go to have the files copied to the USB stick.
Please bear in mind that I am literally 100% ignorant when it comes to chips / coding etc etc.. I did find an excellent source on one of the USA BMW forums with a link to download all the BMW tools software. It only required connecting cables to then have the facilities to do diagnostics on the car.
I considered downloading these programs, but then rejected the idea since I don't understand the language, terminology or general geekspeak when people discuss these things.
The worst that can happen now is I end up having to go to the dealer for a new unit and let them fit / program etc... At least with the route I have chosen, I will have learnt a little, and that is more than I would get from the dealer.

 

[mrscalex]

I’m guessing MDU stands for Master Data Unit. But anyhow it’s the main chip in the EWS and is what the OD46J is.

Southernboy may not be an IT techie but together with a local guy with an AK90 and a global expert from another forum, supported by myself through PM, he worked out a very sensible approach.

With the greatest of respect to Southernboy and handsomejack, I’ve spent several hours responding and thinking through options this week and as I’m up to my eyeballs with other stuff I’m ducking out of this thread until Southernboy has an update from his expert.

I’m all for knowledge sharing and people learning to do stuff for themselves but the EWS whilst conquerable is not for the faint-hearted and requires many hours of homework and/or assistance to get up to speed.

 

[Southernboy]

I’m guessing MDU stands for Master Data Unit. But anyhow it’s the main chip in the EWS and is what the OD46J is.

Southernboy may not be an IT techie but together with a local guy with an AK90 and a global expert from another forum, supported by myself through PM, he worked out a very sensible approach.

With the greatest of respect to Southernboy and handsomejack, I’ve spent several hours responding and thinking through options this week and as I’m up to my eyeballs with other stuff I’m ducking out of this thread until Southernboy has an update from his expert.

I’m all for knowledge sharing and people learning to do stuff for themselves but the EWS whilst conquerable is not for the faint-hearted and requires many hours of homework and/or assistance to get up to speed.

PM sent....

 

[handsomejackuk]

looks like my ews is a version 2 which i knew about with hardware version 02 software version 02 looks like the mcu is a 2d47j so i think this may be one of the older ones out there bear in mind the car is a february 1998 model.... not going to commit to reading the ews yet until i do a bit more research in to whether its an otprom i suspect it is..

 

[handsomejackuk]

all sorted spare transponder programmed with the ak90... tried in car worked first time.. success... hardest part was getting the cable for the ak90 to connect to the ews and read the full file as only had a partial read 9 times out of 10 at least i got a backup now of my ews...

 

[mrscalex]

all sorted spare transponder programmed with the ak90... tried in car worked first time.. success... hardest part was getting the cable for the ak90 to connect to the ews and read the full file as only had a partial read 9 times out of 10 at least i got a backup now of my ews...

Par for the course with the reads. I keep my thumb on it while it’s working and push down fairly firmly.

 

[Southernboy]

Nice going.

 

[handsomejackuk]

Par for the course with the reads. I keep my thumb on it while it’s working and push down fairly firmly.

needed a bit of a twist and thumb on it too i tried a clockwise twist no read anti-clockwise twist and bam read it all.. first few reads didnt even pick up the vin.. and i couldnt figure out why that was...

 

[Southernboy]

Well, the new EWS was posted on Saturday, and hopefully will be at my courier in London within a few days, and all being equal, I may get it by the end of the week or early next week. I then plan to take the car back to the local guy at Budler Motorsport and do the fitting outside his w/shop - just in case I run into a problem. It'll save having to pay for a tow truck to get it there if I fail to get things sorted for some reason.
I'm hoping it'll be a simple process and no further "programming / synching etc will be required, and the problem of the crank / no start will be finally and permanently resolved.

Meanwhile, yesterday some AH, pulled out of a side street and I was forced to hit the brakes so hard the tyres were screeching even with ABS working. What I then noticed was the fuel gauge had dropped to indicate the empty warning light.
Having replaced the ceramic card on the fuel level sensor last year, I was a little puzzled by this. So drained the tank, removed the fuel pump unit, and there it was - the ceramic card was cracked across the center. I guess the sudden braking pressed the float arm onto it with sufficient force to cause the two reading pins to crack the card... so, new card ordered from Holland $25 + shipping....
At least this is a task I'm very familiar with, and I have already decided that some sort of "base plate" behind the ceramic card will be introduced to avoid a repetition in future. Perhaps I'll use some epoxy putty to make a base and then lay the card on top of that, The OEM plastic base is a little convex under the card, so any pressure at the center of the card will be sufficient to crack it and break the circuit across the 2 printed circuits.

 

[Southernboy]

Well, the new EWS has departed London and should be here within a few days...
I'm hoping this will be a hassle free swap and more importantly, it finally sorts out the problem of the fault code preventing the car from starting.

 

[Southernboy]

Surprise !! arrived at 10 am local time.
I'll probably get organised to fit on Wed. and let you all know how the install goes.

 

[Southernboy]

So, just back after doing the installation - all keys working, car starts and it was a simple procedure to sync the EWS / DME. Took 3 minutes to do the entire install ........
Very pleased with the result.... and the overall cost was less than 30% of having gone to BMW... THANKS TO ALL FOR THE INPUT AND ADVICE.

 

[Southernboy]

I had an email from the great guru in Prague who helped me by programming the new EWS to my car before posting to me here in Johannesburg...
Below is the information he has sent me, which for all those who are aspiring to be knowledgeable about these matters should copy and save for their future reference. This type of good information doesn't come up very often and should be regarded as a treasure.

Hi Barry,

I found your thread on zroadster website, and I can see that there was quite a lot of information from other guys, some of these were some nonsense. If you need some more detailed info on what was going on, I can be of a help or provide you with some further information.


At first, for example, you were advised that the crank-no start situation can be caused by over-starting. Basically, this information is sort of correct, BUT it is not a protection for overstarting, but it only is a correlation. When multiple long start attempts are performed, the starter puts a strong current draw. This means, the on-board voltage during the starting attempts drops. As the rolling code needs to be matched between the EWS and DME and this is done via communication between these units, the voltage drop can cause that the data is sent on one side but not received on the other side (or not received correctly). After some starting attempts it can cause the ISN (rolling part) to be impaired and needs to be reset. In your case it was probably not the culprit as you had the problematic SW05 version of EWS3D, but this also can happen.


Attached please see the oscilloscope measurement on the EWS-DME signal line to compare the signal which is not OK (can be caused by voltage drop, EWS failure or EWS-DME wire damage). The other image shows the correct square-shaped signal.


Another thing is reading the key data by DIS - this is not possible. The DIS has only an ability to: sync the EWS-DME ISN and block the lost keys so that these won't work with the car anymore. Any attempt to change this data requires a working key inserted in the ignition switch, and this one can not be blocked by DIS. Some tools when improperly used can block also the key which is in the ignition, for example BMW Scanner 1.4 is able to do it (seen it).


The only official way to obtain new keys, EWS or ECU is from the dealership. In some cases with E31, E36, E38, E39 made in period (January 1995 to November 1997) even the factory has a problem with making the proper key because the data stored in the factory's database is incorrect as per TIS 00512101/0198.


The keys are stored as two codes according to VIN:

• HA code which tells the factory how to cut the key via CNC machine
• Transponder coding containing data about VIN etc. and then key number (1-10), solid part of the key number.

After ordering the key depending on the key blank, the factory cuts a new key and programs it to fit the EWS and locks with which the car left the factory. AFAIK there are several plants over the world able to cut and program the key and the factory orders them at the one closest to the customer. This information can be found in TIS.


The EWS contains ISN and keys data, I am not sure if it contains the VIN from the factory, and it definitely does not contain the central coding key. After getting the new EWS, it needs to get coded (transfer the central coding key from another unit storing it - varies by the car model) and synchronized to the DME.


The DME ordered from the factory is ordered as BASIC DME (or DDE in case of diesel) and comes unprogrammed. Does not contain VIN, ISN, maps, anything. After fitment in the car it needs to be programmed by the proper software (this can be found in the ETK as "programmed control unit" and in ISTA/P or GT1 you need to input the software number, mileage, VIN etc. After programming, the EWS gets married to the DME and using no diagnostic tool can be re-married to another EWS. Also the adaptations are reset during this process.


The only way to re-use the pre-used DME or DDE with another car (EWS) is:

• in case of EWS2 or EWS3/EWS4.3 in EWS2 mode - eg. E38/39 with M52 (not TU models), TDS and similar you can read the ISN from the DME with INPA and write it to the EWS also with INPA.
• In case of EWS3 you need to either read a full bin from the DME, find the ISN and write it to the EWS dump using AK90, xProg or similar, then sync. Or read a full bin from the DME/DDE, virginize it (meaning in a simplified way to change the ISN value to all FFs), then marry it to the EWS using diagnostic tool like if it is a new DME/DDE.

I also have read an opinion that EWS is a simple relay. This also is only partially correct. This was correct with the EWS1 system, which was fitted only in 1994. From January 1995 and on there is EWS2 and in some models since 3/1997, on other models since 9/1998 there was EWS3. Only E36 body cars fitted with engines coming from E46 (simplified explanation, basically M52TU, M54, S54) are fitted with EWS3D, which has the same connector like EWS2, but with a different pinout (does not have a separate Transmitter/Receiver module as all is included in EWS3D module like in normal EWS3 unit) and has a regular k-line (EWS3D has only K-bus for which the E36 chassis does not have a gateway). This way BMW was able to put all the EWS3 functionality in E36 chassis with an ability to be diagnosed and EWS synced with DME.


Feel free to share this information on the forum


If there are any other questions, let me know and when I have some time, I will answer.

 

[mrscalex]

Wow. Good info that and all taken aboard.

I hope, think, I wasn't one of the ones who supply duffed info. And I did always question the over-cranking thing. I've probably called the EWS a smart relay but wouldn't have referred to it as a simple relay. It's a box of tricks that ultimately operates an internal relay. So I think that's okay to call it a smart relay.

The most important part for me is the used virginisation which is how yours was done.

 

[Southernboy]

What is nice is the open invitation to ask for more info...

 

[Fx323i]

Hi all, I have registered to see how this thread is going as I am the one who did the Barry's EWS and shipped it to him.

Just to clarify, I just read through the thread and did not mean to offend anybody, just to clarify things

In this process there was no virginization as it would have required also the DME full bin read and adjusting the data in it and write it back. As I had the full data from the original EWS3D unit, it was way easier and more comfortable for Barry to transfer all the data from his original EWS to the new one.

To be clear, every time you do this kind of adjustment and virginization, it is connected to DME and not EWS. If you virginize the EWS (some tools call it virginization), it has empty data for ISN and central coding key, but this must then be adjusted manually. The synchronization of DME and EWS by diagnostic tool is only possible one way - DME is virgin and EWS is fully programmed. The opposite way is not possible via any diagnostic interface. The ISN must be stored in the EWS. If it is not (ISN is all FF in EWS), there is a possibility of one sync with DME, the car starts once and then there is crank-no start.

Also, doing changes in the EWS system (replacing the whole set of units DME+EWS+keys+locks) could cause future problems when you would like to order keys, EWS or locks at the dealership. I always try to do things as clean as possible and not to make any changes which would cause the customer future problems.

Through k-line (diagnostic) it only is possible to access a half of the EWS's memory (256 bytes of 512 bytes) which does not contain the ISN, key codes etc. In the DME it is possible to access only maps via diagnostic interface if it is not set in the boot mode (valid for MS42 ECU which is Barry's case).

 

[mrscalex]

Welcome to the forum! We've spoken previously about a year ago and it was me who suggested Barry contact you.

I'm tied up just now to try and take what you said on-board properly. But I will be re-reading it later and don't be surprised if I ask you some more questions as I'm very keen to have a good knowledge of this stuff.

 

[Fx323i]

Hi mrscalex,
it is possible that we talked. I talk about EWS to dozens of people every day as people are coming to me from the Czech Republic, Slovakia and surrounding countries and I did not even think of being this much "international". Making an EWS for a car which is over 8 thousand kilometers by air far away from me and having only one attempt without testing was kind of making me nervous :-D But once I saw the data I felt quite confident that transferring the data was possible and a good thing was, that I had the needed unit in my shelf.

If you had any questions, do not hesitate to ask. If I know, I am happy to share the information in some way. I will not do "how to do it" guides for people who have no idea what they are doing, but I welcome if someone is trying to find his way how to resolve the EWS issues.

Martin