E61 CAS3+ 01L15Y Remote Problem

[weld88]

Hi Everyone!

I'm new to the forum and I can't seem to find much information on this particular problem, but I have been learning about this system from posts here and there from people sharing tiny nuggets of information.

I'm hoping some kind soul here will find this problem interesting and help me out.

Background:

My father recently bought a 2009 E61 535i, after he got it home he realized the remote didn't work. The car only came with the single FOB and key. We checked the battery first [car has Keyless entry - doesn't work either].

The used car place sent him to a BMW software "expert" that said there were no faults in his car and that the FOB was bad and he needed to buy a new one from BMW and then sent him on his way. And that was the extent of their help on the issue.

My path so far:

- I got ISTA/D to check for myself [already had K+DCAN interface]. There were faults in various modules but none in the CAS module or Comfort Access module.

- I built a small arduino circuit to check the remote, it is transmitting *something* on 315Mhz when buttons are pressed.

- Checked the diversity antenna module [under spoiler]. No water infiltration there at least, 12v present on 8 pin connector.

- Took out the CAS module, part # is 61.35-9147227-01, Key FOB ID: 5WK49147 / 315MHz ( KEYLESS )

- Dumped the CAS eeprom and flash with an R270 which I bought to help diagnose this problem.

- Did some exploring in my eeprom with a hex editor and found *some* of the pertinent data locations. Remote and Immo keys seem to be the same in my eeprom.

- Bought a cheap mini zedbull to be able to check transponder info using EFFL free software.

... continued next on post.

*Disclaimer: I'm not a locksmith and do not intend to become one (so no expensive specialized tools will be bought if I can avoid it), but I like BMW's and enjoy repairing things myself for friends and family. *

[weld88]

The keys in spots 2 & 3 seem to be tagged as keyless, their status is 02 5B 00 and 12 5B 00

extacted_key_info.jpg

I found conflicting version #s in my eeprom:
F6E: 00 00 09 14 72 27 [repeated 3x]
FD0 : 01 [last 7 characters of VIN]
FD8 = 20 11 04 19 manufacturing or last coding date maybe [ 2011 04 19 ]


FDC: cas part # ??? 00 00 09 23 70 46 <===== Has this unit been flashed / modified with the incorrect file?


I have found the leaked CAS3+ editor on these forums and opened up my eeprom in it :

cas3_screenie.jpg

My "working key" is in spot 2, I was able to read the data using the Crypto Lo & Hi from the cas dump:

ID 2B 29 F1 96
crypto lo 8C E4 0D 89
crypto hi 0E 2C
cfg / pass C8 81 C3 BC

Here is the User page data on the key:
user 0 15 43 31 75
user 1 58 02 75 02
user 2 FF 2B 1C 08
user 3 FE 00 00 78

So my questions are:

1) Is there a way to verify that this CAS module / FW is correct for 315Mhz and Comfort access ? The date in the eeprom is after the car manufacturing date... Is this from a dealer update or tampering ?

2) Is it possible to verify if the issue with the remote is simply incorrect user page data? ie: incorrectly programmed by someone

[weld88]

Reserved -

[weld88]

..........

[hojo25]

First check Fuse of Diversity. And check Power and Ground for Diversity?
And BMW E61 often has wiring harness broken!

[weld88]

First check Fuse of Diversity. And check Power and Ground for Diversity?
And BMW E61 often has wiring harness broken!

Hi, thanks for the reply! Yes, I have power at the diversity under the spoiler. I read that damage to this wiring harness is also common.

ISTA/D can communicate with CA module. Everything else on the tail gate is working fine, middle brake light, glass opening button, radio antenna.

I used info here:
https://www.newtis.info/tisv2/a/en/e...ceiver/iXemIfC

However, I just realized I did not trace the wire completely back to the CAS unit plug [X1018] pin 33.

cas-diversity-connections.jpg

I will have to kick myself if that is the problem !

[Manta1600]

Check is the your existing key is genuine

if your car was AKL and somebody programed chinese key is normal that remote doesnt work

[weld88]

Check is the your existing key is genuine

if your car was AKL and somebody programed chinese key is normal that remote doesnt work

Thanks for the reply!

If that is the case, can the Chinese key be repaired so it will work? ie: by correcting the user page data? That at least, I could do with my mini zedbull.

I have a few photos of the board inside, case was glued/welded shut, had to be cut open.
original_fob-1b.jpg

If it's not an original, it seems to be better quality than most, at least compared to the pictures I see online. All the test points are nicely gold plated. Can anyone confirm from that photo ? I only have photos of that side of the board apparently.

[fred77]

Hi Everyone!

I'm new to the forum and I can't seem to find much information on this particular problem, but I have been learning about this system from posts here and there from people sharing tiny nuggets of information.

I'm hoping some kind soul here will find this problem interesting and help me out.

Background:

My father recently bought a 2009 E61 535i, after he got it home he realized the remote didn't work. The car only came with the single FOB and key. We checked the battery first [car has Keyless entry - doesn't work either].

The used car place sent him to a BMW software "expert" that said there were no faults in his car and that the FOB was bad and he needed to buy a new one from BMW and then sent him on his way. And that was the extent of their help on the issue.

My path so far:

- I got ISTA/D to check for myself [already had K+DCAN interface]. There were faults in various modules but none in the CAS module or Comfort Access module.

- I built a small arduino circuit to check the remote, it is transmitting *something* on 315Mhz when buttons are pressed.

- Checked the diversity antenna for damage, seems fine. No water infiltration there at least, which apparently happens sometimes.

- Took out the CAS module, part # is 61.35-9147227-01, Key FOB ID: 5WK49147 / 315MHz ( KEYLESS )

- Dumped the CAS eeprom and flash with an R270 which I bought to help diagnose this problem.

- Did some exploring in my eeprom with a hex editor and found *some* of the pertinent data locations. Remote and Immo keys seem to be the same in my eeprom.

- Bought a cheap mini zedbull to be able to check transponder info using EFFL free software.

... continued next on post.

*Disclaimer: I'm not a locksmith and do not intend to become one (so no expensive specialized tools will be bought if I can avoid it), but I like BMW's and enjoy repairing things myself for friends and family. *

LOLs your looking far too into this!! Not everything can be fixed by pushing buttons


Estate Car ? ALL Estate cars will suffer from a bad Diversity box. Crappy German engineering. After 'hojo25' advice, go remove spoiler and magic box is there. Either water ingress or bad wiring. .....Call an Auto-Electrician


Else, not estate - Well I've seen key's frequency jump around. .... Basically call a locksmith to do another key

[hojo25]

At Diversity 8 pin connector 12V must be present. And that was not checked. Wiring harness can not be checked so synonymous because you must first remove the metal bracket. And the fuse was not tested.

[weld88]

At Diversity 8 pin connector 12V must be present. And that was not checked. Wiring harness can not be checked so synonymous because you must first remove the metal bracket. And the fuse was not tested.

diversity_connector_X13911.jpg
You mean this 8 pin connector under the spoiler? Yes, I verified I have power here between pin 1 and 5. That was 2 months ago actually. I did this before I even ordered any of the CAS/ Hitag tools.... Having experienced similarly degraded wiring on my older E39's in the trunk lid harness. In fact when that connector is unplugged, the car loses all radio reception!

Diversity-N8a_module.jpg
The module had no signs of water damage, it was very clean and dry.

[weld88]

LOLs your looking far too into this!! Not everything can be fixed by pushing buttons


Estate Car ? ALL Estate cars will suffer from a bad Diversity box. Crappy German engineering. After 'hojo25' advice, go remove spoiler and magic box is there. Either water ingress or bad wiring. .....Call an Auto-Electrician

Maybe I am looking too deep, but I did start with wiring, fuses, and an inspection of the module under the spoiler.

To own an older BMW, you have to be able to troubleshoot electronics if you aren't willing to spend a fortune.

[dijo]

Post here Cas dump and Hitag screen from key...

[weld88]

I've attached the EEprom and flash I dumped [Passwd by request]. I'm really not comfortable giving out full details of my fathers *working* immobilizer info online in the clear.

Here is the key data from EFFL, I forgot to save a screen shot but made a record of the info:

2B 29 F1 96 SN/ID
8C E4 0D 89 Crypto/ISK Lo
00 00 0E 2C Crypto/ISK Hi
C8 81 C3 BC TMCF/PSW


15 43 31 75 user 0
58 02 75 02 user 1
FF 2B 1C 08 user 2
FE 00 00 78 user 3

[dijo]

----------------------
my mistake...