Peugeot 206 2001 - BSI locked?

[king2]

Hello everyone!

I helping my friend to repair a car. Car was just shut down at a middle of a road and not wanted to start again (just not start, no ignition/spark).
After that car was "repaired" by some electrician, and now it not starts (as it was before), but odometer is also dead (shows no data, display backlight works), shows nothing on panel, except STOP sign and three upper lights.
At this moment electrician was magically disappeared and I started to understand what is going on.

I found Sagem S2000-25 ECU under the hood, unmodified (resin cover not touched on ECU), plus BSI Siemens T1 B2 with Motorola MCU inside (no EEPROM was found).

Power +12V exists on ECU, GND exists at all 4 points.
Ignition position of key gives secondary +12v to ECU, double relay clicks by both of its parts.
Switching key to next position rotates engine with a starter, I can see that crankshaft sensor is working (measured by oscilloscope at ECU pins), also at start of rotating two pulses exists on injector jets (one wide, second short, then silence).
No signal from ECU to spark coils on both channels.

We have tried to put another ECU (S2000-28, with immo off if I can trust seller), and tried to put another BSI (also with no effect, except radio-key not works after replacing BSI back).
Tried to read ECU with Launch diag tool, no connection to ECU, no errors in BSI (3 keys assigned, 0 keys auth'd). ECU can be read with EOBD protocol, no errors too.
We will bring Lexia next time when we will try to repair a car, but have not tried this yet.

I'm new to auto, but understand how is electronic works (have knowledge, but no experience).

Forums tells me that BSI can be locked by many reasons - battery dying, wrong ECU pin, or just because it tired to live on this planet.
I have bought X-Prog 5.55, but I have absolutely no idea how to connect to to BSI's Motorola (0D60J) without de-soldering it. But OK, this problem can be solved by de-soldering MCU.

Now, I have some questions, maybe someone here can be so kind to answer?

1. How to make BSI virgin at place? As I understand, this is the only way to unlock it?
The car is located relatively far from me, so I cannot read the dump, go home, ask for virgin dump, then go back to car to try, and so on.
I will be able to read and write EEPROM to Motorola with X-Prog, maybe someone knows method of modifying dump to make BSI virgin (or program that can do this with Siemens T1 B2)?

2. How to discover, was BSI locked or not? Lexia can help?

3. We have tried to measure voltage on LCD driver of instruments panel, I got 4 volts, so it has power.
We have tried to disconnect panel, and got error about "No connection to panel", so connection should be not a problem too.
At which conditions odometer panel can be blank?

4. At which conditions ECU can works this way? It receives signals from sensors, gives pulses to injector jets, it moves idle valve, but gives no spark.

5. Maybe symptoms described is known to you and you can give me some additional advice?

Thank you in advance!

[metercar]

1 no need bsi virgin only read with programmer to extract pin code and program new key with lexia or locksmith tool

2 lexia measuring parameters key learned and key present

3 bsi t1 is not miltiplexed with dash sure power failure or fuse

4 sounds a bad GND

5 with a immo off ecu car starts without bsi...looking power lines on main relay and interference on starter

[king2]

Thank you very much for answer!

1,2. So, you think that this is a key problem? BSI cannot see ID chip from key with its antenna?
But can car shut down if it lost the key on the road?

3. We have checked, there is +12 volts on dash, and some (different) voltages on CPU and LCD driver.. Is dash displaying something, when (for example) it cannot connect to BSI?

4. We have checked GND at ECU at load (5W lamp), all four GND pins are good. ECU can pull down injector jets, so it definitely have ground..


Additional questions:

5. Where can I find bus schematic of such car? What is connected to what. BSI, ABS, dash, ECU, OBD connector?
One CAN network for all of them, or something more complicated?

6. Can BSI work like a gateway for ECU? Launch cannot connect to ECU with if we select Peugeot, but can connect (I think via direct K/L-lines) with EOBD protocol.
Which method of diag ECU connection should be in Peugeot 206 2001, direct or via BSI as gateway?

7. I have heard that BSI can lock itself if it connected to ECU with wrong pin code (which is definitely happened when we exchanged ECU and BSI on this car), and Lexia doesn't help if BSI locks.
In which cases 'virgin' procedure can be required?

8. Do I need to desolder Motorola chip from BSI to read it with programmer, or somewhere there are instructions, how to do this without desoldering (places where I have to connect pins from X-Prog)?

Thanks!

[drz]

This bsi can't lock, with any bsi you must have dash working with ignition on, no matter what key used. Try switch on hazard lights, or lock/unlock to see if the bsi is not completely dead. If you have an immo off ecu, you don't need to do anything with bsi, just plug&play.

[king2]

I forgot to mention that we was able to connect to AL4 computer and see selector position (PRND) with Launch, but no indication of selector position on dash panel (no LEDs are lit, just snow indicator * is flashing).
Is dash panel receives odometer values from BSI and PRND status from AL4 computer? This is one common network or separate wires?
How data is flowing between all digital network components of Peugeot, maybe network schematic available somewhere?

Thanks, I just trying to get maximum amount of information before I will experiment again :)

We have:
- X-Prog 5.55
- TL866 programmer
- 2-channel oscilloscope
- Launch
- Lexia
- Multimeters

So we can look on network activity between modules, or something like this.

[king2]

At the end, it started after I made immo off for Sagem S2000-25 with Immokiller 1.10.

I still have absolutely no idea about what is going on.
If I turn ignition off and 'forgot' key in its place, BSI starts to making sounds about this. Same behavior if I remove the key itself, but leave ID chip near the antenna (and sound finished when I remove ID chip) - so I think BSI can see ID chip and read it.
With all this, BSI can see ECU status and display status as 'unlocked' (before immo off procedure).

So, ID chip can be read by BSI and enable start with ECU, but no start without immo off.

Lexia displays 2 keys assigned (not working), 1 radio assigned (not working even after assign procedure), and "0 keys auth'd" - even if ID chip is near antenna. With all this I still can turn on side lights, turn light and so on - so BSI is working.
Also, we have tried to make radio assign procedure with 10 sec pushing keys to light LED, then 1 press, and so on - without success. Radio central lock is not working :(

Can BSI 'forget' the key?
What does means "0 keys auth'd"? What is auth in BSI meaning?

Thanks!