Car On-board diagnostic system

How to repair BMW E90 series FRM3 with xprog

Publié le 8/02/2018 à 05:54, Aéroport de Paris - Roissy Charles-de-Gaulle
Mots clefs : XprogXprog-mxprog boxxprog m

There is a problem that many people have heard about (and many have also met with it). Your BMW completely refuses outdoor lighting (more precisely, the passing beam and dimensions with the ignition on, but we can not control it), front windows do not work, central locking, interior light either. When diagnosed, the FRM does not communicate. In the mean time, a lot of errors are associated with the connection to this ecu.

The fact is that the failure of the FRM3 module is due to the failure of the eeprom area in the microcontroller (MC9S12XEQ364) controlling this unit. And eeprom dies gradually, until the changes in it reach a critical mass. And then the module works until it needs data from the machine … reboot, whether it’s connecting a diagnosis or removing the battery terminal (trying to start on a weak battery is equivalent to removing it).

Everything can be done much easier! Coding and programming is NOT NECESSARY. The internal memory of the microcontroller MC9S12XEQ364 stores its native eeprom! It is encrypted in the memory area called D-flash, counting which it is possible to completely restore the FRM3 unit’s performance by retaining all ecu coding changes (for example, turning off errors on fog lights when installing Chinese xenon). This saves time, money and time.

The main thing is to correctly consider D-flash, so as not to destroy it. Here’s to you a small step-by-step guide, how to do it with xprog m box ecu programmer:

We remove the ecu from the car and put it on the table. Here it is:

xprog-repair-frm3-1

look inside:

xprog-repair-frm3-2

The connection points have long been known to all …

xprog-repair-frm3-3
connected to xprog

xprog-repair-frm3-4

Run xprog software, select the mcu “MC9S12XEQ364”. We will read d-flash.

xprog-repair-frm3-5

Press the “new” button, then “read”. The partition error will pop out, do not get scared, just ignore it.

xprog-repair-frm3-6

click “ok”. the following window pops up:

xprog-repair-frm3-7

Do not change anything! (“number of sectors for eeprom” = 0; d-flash = 32768; eeprom = 0) click “ok”. Go to the process of reading d-flash.

Then restore eeprom from d-flash. Open the resulting file in xprog. for checking, scroll to the very end of the file, there should be in the open form the number of the car to which the unit belongs.

xprog-repair-frm3-8
click “devices” select “MC9S12XEQ364_EEE”.
Before writing the resulting file, MANDATE EEPROM AREA! MANDATORY!
for this we press the button “erase”. again an error on partition. Only this time you need to specify the size of eeprom
number of sectors for eeprom = 16
d-flash = 0
eeprom = 4096.
click “ok”. the eeprom area is erased. then “write”. wait for the end, put the ecu on the car, enjoy the work done.

 

Disclaimer:
The tutorial here is translated from Russian and just for education purpose. Credit to evg3n175. You are at your risk.

http://www.obdii365.com/producttags/xprog.html

How to read BMW EWS3 2D47J key data with Xprog

Publié le 25/01/2018 à 08:37, MONTMARTE
Mots clefs : XprogXprog m

It is a BMW E38 year 1997 with EWS3 immobilizer. So, 1997, e38, as I understood there M52 with 1 VANOS.
We are going to read the great and terrible MC68HC11EA9 with a 2D47J mask.

bmw-EWS3-2D47J-1 bmw-EWS3-2D47J-2

The car does not start.

When connected to the immo, I immediately got a very fast heating of the ELMOS chip on the board, up to 60 degrees and above (as indicated by the laser thermometer), and naturally the unit does not react to the key with the key, just as the indicator LED does not indicate that the unit is connected , well, in short, a 100% corpse.

Since the processor is encrypted, and the machine is far away, and you can not dump the dump, so first I try to get by with small blood and reanimate the board, namely, to change the often failing, the aforementioned, microcircuit.

bmw-EWS3-2D47J-3

She did not give a substitute for the results. The same heat. Which means only one thing – the end card, and then we have two ways – either to transplant the processor to a live board, or to read the dump and fill it into the normal and secure EWS3 block with the 0D46J processor mask, which I did.

bmw-EWS3-2D47J-4

bmw-EWS3-2D47J-5

Read data with Xprog v5.55 box programmer

bmw-EWS3-2D47J-6

All successfully read

bmw-EWS3-2D47J-7

General view of the scope of work

bmw-EWS3-2D47J-8

On the BMW EWS3 EWS4 test platform, the unit was seen, the key was identified, the relay worked.

Today I was informed that after the EWS-DME synchronization the car successfully left the service station on its own.

http://www.obdii365.com/producttags/xprog.html


Mes albums

Où suis-je actuellement ?



Rubriques

Mes amis

Sites favoris