E61 CAS3+ 01L15Y Remote Problem
Register
Page 1 of 2 12 LastLast
Results 1 to 15 of 28
  1. #1
    Member

    Join Date
    Oct 2019
    Location
    North America
    Posts
    83
    Thanks
    41
    Thanked 28 Times in 24 Posts
    Downloads
    0
    Uploads
    0

    Post E61 CAS3+ 01L15Y Remote Problem

    Hi Everyone!

    I'm new to the forum and I can't seem to find much information on this particular problem, but I have been learning about this system from posts here and there from people sharing tiny nuggets of information.

    I'm hoping some kind soul here will find this problem interesting and help me out.

    Background:

    My father recently bought a 2009 E61 535i, after he got it home he realized the remote didn't work. The car only came with the single FOB and key. We checked the battery first [car has Keyless entry - doesn't work either].

    The used car place sent him to a BMW software "expert" that said there were no faults in his car and that the FOB was bad and he needed to buy a new one from BMW and then sent him on his way. And that was the extent of their help on the issue.

    My path so far:

    - I got ISTA/D to check for myself [already had K+DCAN interface]. There were faults in various modules but none in the CAS module or Comfort Access module.

    - I built a small arduino circuit to check the remote, it is transmitting *something* on 315Mhz when buttons are pressed.

    - Checked the diversity antenna module [under spoiler]. No water infiltration there at least, 12v present on 8 pin connector.

    - Took out the CAS module, part # is 61.35-9147227-01, Key FOB ID: 5WK49147 / 315MHz ( KEYLESS )

    - Dumped the CAS eeprom and flash with an R270 which I bought to help diagnose this problem.

    - Did some exploring in my eeprom with a hex editor and found *some* of the pertinent data locations. Remote and Immo keys seem to be the same in my eeprom.

    - Bought a cheap mini zedbull to be able to check transponder info using EFFL free software.

    ... continued next on post.

    *Disclaimer: I'm not a locksmith and do not intend to become one (so no expensive specialized tools will be bought if I can avoid it), but I like BMW's and enjoy repairing things myself for friends and family. *
    Last edited by weld88; 28th November, 2019 at 12:49 AM. Reason: Added details

  2. #2
    Member

    Join Date
    Oct 2019
    Location
    North America
    Posts
    83
    Thanks
    41
    Thanked 28 Times in 24 Posts
    Downloads
    0
    Uploads
    0

    Default

    The keys in spots 2 & 3 seem to be tagged as keyless, their status is 02 5B 00 and 12 5B 00

    extacted_key_info.jpg

    I found conflicting version #s in my eeprom:
    F6E: 00 00 09 14 72 27 [repeated 3x]
    FD0 : 01 [last 7 characters of VIN]
    FD8 = 20 11 04 19 manufacturing or last coding date maybe [ 2011 04 19 ]


    FDC: cas part # ??? 00 00 09 23 70 46 <===== Has this unit been flashed / modified with the incorrect file?


    I have found the leaked CAS3+ editor on these forums and opened up my eeprom in it :

    cas3_screenie.jpg

    My "working key" is in spot 2, I was able to read the data using the Crypto Lo & Hi from the cas dump:

    ID 2B 29 F1 96
    crypto lo 8C E4 0D 89
    crypto hi 0E 2C
    cfg / pass C8 81 C3 BC

    Here is the User page data on the key:
    user 0 15 43 31 75
    user 1 58 02 75 02
    user 2 FF 2B 1C 08
    user 3 FE 00 00 78

    So my questions are:

    1) Is there a way to verify that this CAS module / FW is correct for 315Mhz and Comfort access ? The date in the eeprom is after the car manufacturing date... Is this from a dealer update or tampering ?

    2) Is it possible to verify if the issue with the remote is simply incorrect user page data? ie: incorrectly programmed by someone


    Last edited by weld88; 27th November, 2019 at 10:26 PM. Reason: Added image

  3. #3
    Member

    Join Date
    Oct 2019
    Location
    North America
    Posts
    83
    Thanks
    41
    Thanked 28 Times in 24 Posts
    Downloads
    0
    Uploads
    0

    Default

    Reserved -
    Last edited by weld88; 27th November, 2019 at 10:24 PM. Reason: n00b editing error!

  4. #4
    Member

    Join Date
    Oct 2019
    Location
    North America
    Posts
    83
    Thanks
    41
    Thanked 28 Times in 24 Posts
    Downloads
    0
    Uploads
    0

    Default

    ..........
    Last edited by weld88; 27th November, 2019 at 10:54 PM. Reason: n00b fail

  5. #5
    Top Poster

    Join Date
    Jun 2010
    Posts
    117
    Thanks
    9
    Thanked 41 Times in 24 Posts
    Downloads
    3
    Uploads
    0

    Default

    First check Fuse of Diversity. And check Power and Ground for Diversity?
    And BMW E61 often has wiring harness broken!
    Last edited by hojo25; 27th November, 2019 at 10:28 PM.

  6. The Following User Says Thank You to hojo25 For This Useful Post:

    weld88 (27th November, 2019)

  7. #6
    Member

    Join Date
    Oct 2019
    Location
    North America
    Posts
    83
    Thanks
    41
    Thanked 28 Times in 24 Posts
    Downloads
    0
    Uploads
    0

    Default

    Quote Originally Posted by hojo25 View Post
    First check Fuse of Diversity. And check Power and Ground for Diversity?
    And BMW E61 often has wiring harness broken!
    Hi, thanks for the reply! Yes, I have power at the diversity under the spoiler. I read that damage to this wiring harness is also common.

    ISTA/D can communicate with CA module. Everything else on the tail gate is working fine, middle brake light, glass opening button, radio antenna.

    I used info here:
    https://www.newtis.info/tisv2/a/en/e...ceiver/iXemIfC

    However, I just realized I did not trace the wire completely back to the CAS unit plug [X1018] pin 33.

    cas-diversity-connections.jpg

    I will have to kick myself if that is the problem !

  8. #7
    DK Veteran

    Join Date
    Mar 2018
    Location
    UK
    Posts
    1,001
    Thanks
    403
    Thanked 308 Times in 259 Posts
    Downloads
    8
    Uploads
    0

    Default

    Check is the your existing key is genuine

    if your car was AKL and somebody programed chinese key is normal that remote doesnt work

  9. The Following User Says Thank You to Manta1600 For This Useful Post:

    weld88 (27th November, 2019)

  10. #8
    Member

    Join Date
    Oct 2019
    Location
    North America
    Posts
    83
    Thanks
    41
    Thanked 28 Times in 24 Posts
    Downloads
    0
    Uploads
    0

    Default

    Quote Originally Posted by Manta1600 View Post
    Check is the your existing key is genuine

    if your car was AKL and somebody programed chinese key is normal that remote doesnt work
    Thanks for the reply!

    If that is the case, can the Chinese key be repaired so it will work? ie: by correcting the user page data? That at least, I could do with my mini zedbull.

    I have a few photos of the board inside, case was glued/welded shut, had to be cut open.
    original_fob-1b.jpg

    If it's not an original, it seems to be better quality than most, at least compared to the pictures I see online. All the test points are nicely gold plated. Can anyone confirm from that photo ? I only have photos of that side of the board apparently.

  11. #9
    Top Poster +

    Join Date
    Jun 2019
    Posts
    242
    Thanks
    159
    Thanked 81 Times in 66 Posts
    Downloads
    0
    Uploads
    0

    Default

    Quote Originally Posted by weld88 View Post
    Hi Everyone!

    I'm new to the forum and I can't seem to find much information on this particular problem, but I have been learning about this system from posts here and there from people sharing tiny nuggets of information.

    I'm hoping some kind soul here will find this problem interesting and help me out.

    Background:

    My father recently bought a 2009 E61 535i, after he got it home he realized the remote didn't work. The car only came with the single FOB and key. We checked the battery first [car has Keyless entry - doesn't work either].

    The used car place sent him to a BMW software "expert" that said there were no faults in his car and that the FOB was bad and he needed to buy a new one from BMW and then sent him on his way. And that was the extent of their help on the issue.

    My path so far:

    - I got ISTA/D to check for myself [already had K+DCAN interface]. There were faults in various modules but none in the CAS module or Comfort Access module.

    - I built a small arduino circuit to check the remote, it is transmitting *something* on 315Mhz when buttons are pressed.

    - Checked the diversity antenna for damage, seems fine. No water infiltration there at least, which apparently happens sometimes.

    - Took out the CAS module, part # is 61.35-9147227-01, Key FOB ID: 5WK49147 / 315MHz ( KEYLESS )

    - Dumped the CAS eeprom and flash with an R270 which I bought to help diagnose this problem.

    - Did some exploring in my eeprom with a hex editor and found *some* of the pertinent data locations. Remote and Immo keys seem to be the same in my eeprom.

    - Bought a cheap mini zedbull to be able to check transponder info using EFFL free software.

    ... continued next on post.

    *Disclaimer: I'm not a locksmith and do not intend to become one (so no expensive specialized tools will be bought if I can avoid it), but I like BMW's and enjoy repairing things myself for friends and family. *


    LOLs your looking far too into this!! Not everything can be fixed by pushing buttons


    Estate Car ? ALL Estate cars will suffer from a bad Diversity box. Crappy German engineering. After 'hojo25' advice, go remove spoiler and magic box is there. Either water ingress or bad wiring. .....Call an Auto-Electrician


    Else, not estate - Well I've seen key's frequency jump around. .... Basically call a locksmith to do another key
    Last edited by fred77; 27th November, 2019 at 11:56 PM.

  12. #10
    Top Poster

    Join Date
    Jun 2010
    Posts
    117
    Thanks
    9
    Thanked 41 Times in 24 Posts
    Downloads
    3
    Uploads
    0

    Default

    At Diversity 8 pin connector 12V must be present. And that was not checked. Wiring harness can not be checked so synonymous because you must first remove the metal bracket. And the fuse was not tested.

  13. #11
    Member

    Join Date
    Oct 2019
    Location
    North America
    Posts
    83
    Thanks
    41
    Thanked 28 Times in 24 Posts
    Downloads
    0
    Uploads
    0

    Default

    Quote Originally Posted by hojo25 View Post
    At Diversity 8 pin connector 12V must be present. And that was not checked. Wiring harness can not be checked so synonymous because you must first remove the metal bracket. And the fuse was not tested.
    diversity_connector_X13911.jpg
    You mean this 8 pin connector under the spoiler? Yes, I verified I have power here between pin 1 and 5. That was 2 months ago actually. I did this before I even ordered any of the CAS/ Hitag tools.... Having experienced similarly degraded wiring on my older E39's in the trunk lid harness. In fact when that connector is unplugged, the car loses all radio reception!

    Diversity-N8a_module.jpg
    The module had no signs of water damage, it was very clean and dry.

  14. #12
    Member

    Join Date
    Oct 2019
    Location
    North America
    Posts
    83
    Thanks
    41
    Thanked 28 Times in 24 Posts
    Downloads
    0
    Uploads
    0

    Default

    Quote Originally Posted by fred77 View Post
    LOLs your looking far too into this!! Not everything can be fixed by pushing buttons


    Estate Car ? ALL Estate cars will suffer from a bad Diversity box. Crappy German engineering. After 'hojo25' advice, go remove spoiler and magic box is there. Either water ingress or bad wiring. .....Call an Auto-Electrician
    Maybe I am looking too deep, but I did start with wiring, fuses, and an inspection of the module under the spoiler.

    To own an older BMW, you have to be able to troubleshoot electronics if you aren't willing to spend a fortune.

  15. #13
    DK Veteran
    dijo's Avatar
    Join Date
    Apr 2010
    Posts
    843
    Thanks
    271
    Thanked 326 Times in 252 Posts
    Downloads
    6
    Uploads
    0

    Default

    Post here Cas dump and Hitag screen from key...

  16. The Following User Says Thank You to dijo For This Useful Post:

    weld88 (28th November, 2019)

  17. #14
    Member

    Join Date
    Oct 2019
    Location
    North America
    Posts
    83
    Thanks
    41
    Thanked 28 Times in 24 Posts
    Downloads
    0
    Uploads
    0

    Default

    I've attached the EEprom and flash I dumped [Passwd by request]. I'm really not comfortable giving out full details of my fathers *working* immobilizer info online in the clear.

    Here is the key data from EFFL, I forgot to save a screen shot but made a record of the info:

    2B 29 F1 96 SN/ID
    8C E4 0D 89 Crypto/ISK Lo
    00 00 0E 2C Crypto/ISK Hi
    C8 81 C3 BC TMCF/PSW


    15 43 31 75 user 0
    58 02 75 02 user 1
    FF 2B 1C 08 user 2
    FE 00 00 78 user 3
    Attached Files Attached Files

  18. #15
    DK Veteran
    dijo's Avatar
    Join Date
    Apr 2010
    Posts
    843
    Thanks
    271
    Thanked 326 Times in 252 Posts
    Downloads
    6
    Uploads
    0

    Default

    ----------------------
    my mistake...
    Last edited by dijo; 29th November, 2019 at 12:02 AM.

 

 
Page 1 of 2 12 LastLast

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •