Automotive electronics
HOME FORUM SHOP PROJECTS SERVICES INFO PAGES HOW TO ORDER CONTACTS
cartools

Some notes about EWS3 and EWS4

Overall:



Notes:

EWS3:

Necessary tools: CAScontrol, HTag


If ECU works on ISN (EWS3) and there is no 6HP EGS on car - no problems:


If ECU is EWS3 and 6HP EGS with activated EWS mounted on car:


You can use HTag emulator to test results, just “build” any already used and not blocked key.


EWS4:

Necessary tools: CAScontrol, Htag, EWS4 drive authorization unit, EWS4 8HP authorization unit (EWS4 emulators), CAN logger or MBcan tool for configuration purposes.


Some common situations from practice:


How to proceed:

  1. Status 0: no authorization request / response - verify connections and jumper settings!
  2. Status 1: authorized, SK is valid
  3. Status 2: invalid SK, no authorization
  4. Status 3: SK not defined - in case of EGS if key agreement take place and SK is most likely valid. After next power-on must go to status 1


EWS emulator

CAScontrol

dongle

HTag mounted into BMW key shell

Some custom built cable for 8HP EGS:

From EGS connector:



Other wires are not mandatory.


OBD connector:  for D-CAN adapter and / or MBcan for SK write.



It is possible to connect DCAN adapter and MBcan both to OBD socket using Y-cable.



Screen from Tool32:

Some things to know and understand:



SK in emulators:



EWS4 configurator:



It is possible to use configurator with both kinds of EWS4 emulators (EWS4 or EWS4 8HP).

Must note that into EWS4 emulator for ECU (which emulates CAS) you can store only SK_SERVER.


1BB4B267D4AC37BF700A1A7D924F6FAE *

14BBBD68DBA338B07F0515729D4060A1 *

11BEB86DDEA63DB57A001077984565A4 *

0FA0A673C0B823AB641E0E69865B7BBA *

0AA5A376C5BD26AE611B0B6C835E7EBF *

05AAAC79CAB229A16E1404638C5171B0 *

00AFA97CCFB72CA46B110166895474B5 *

3C939540F38B1098572D3D5AB5684889 *

39969045F68E159D5228385FB06D4D8C *

36999F4AF9811A925D273750BF624283 *

339C9A4FFC841F9758223255BA674786 *

2D828451E29A0189463C2C4BA4795998 *

28878154E79F048C4339294EA17C5C9D *

27888E5BE8900B834C362641AE735392 *

228D8B5EED950E8649332344AB765697 *

5FF0F62390E873FB344E5E39D60B2BEA *

5AF5F32695ED76FE314B5B3CD30E2EEF *

55FAFC299AE279F13E445433DC0121E0 *

50FFF92C9FE77CF43B415136D90424E5 *

4EE1E73281F962EA255F4F28C71A3AFB *

4BE4E23784FC67EF205A4A2DC21F3FFE *

44EBED388BF368E02F554522CD1030F1 *

41EEE83D8EF66DE52A504027C81535F4 *

7DD2D401B2CA51D9166C7C1BF42909C8 *

78D7D104B7CF54DC1369791EF12C0CCD *

77D8DE0BB8C05BD31C667611FE2303C2 *

72DDDB0EBDC55ED619637314FB2606C7 *

6CC3C510A3DB40C8077D6D0AE53818D9 *

69C6C015A6DE45CD0278680FE03D1DDC *

66C9CF1AA9D14AC20D776700EF3212D3 *

63CCCA1FACD44FC708726205EA3717D6 *

9C3335E0532BB038F78D9DFA15C8E829 *

993630E5562EB53DF28898FF10CDED2C *

96393FEA5921BA32FD8797F01FC2E223 *

933C3AEF5C24BF37F88292F51AC7E726 *

8D2224F1423AA129E69C8CEB04D9F938 *

882721F4473FA42CE39989EE01DCFC3D *

87282EFB4830AB23EC9686E10ED3F332 !!!!!!!! OK

822D2BFE4D35AE26E99383E40BD6F637

BE1117C27109921AD5AFBFD837EACA0B

BB1412C7740C971FD0AABADD32EFCF0E

B41B1DC87B039810DFA5B5D23DE0C001

B11E18CD7E069D15DAA0B0D738E5C504

AF0006D36018830BC4BEAEC926FBDB1A

AA0503D6651D860EC1BBABCC23FEDE1F

A50A0CD96A128901CEB4A4C32CF1D110

A00F09DC6F178C04CBB1A1C629F4D415

DD7274A1126AF179B6CCDCBB5489A968

D87771A4176FF47CB3C9D9BE518CAC6D

D7787EAB1860FB73BCC6D6B15E83A362

D27D7BAE1D65FE76B9C3D3B45B86A667

CC6365B0037BE068A7DDCDAA4598B879

C96660B5067EE56DA2D8C8AF409DBD7C

C6696FBA0971EA62ADD7C7A04F92B273

C36C6ABF0C74EF67A8D2C2A54A97B776

FF5056833048D35B94EEFE9976AB8B4A

FA555386354DD65E91EBFB9C73AE8E4F

F55A5C893A42D9519EE4F4937CA18140

F05F598C3F47DC549BE1F19679A48445

EE4147922159C24A85FFEF8867BA9A5B

EB444297245CC74F80FAEA8D62BF9F5E

E44B4D982B53C8408FF5E5826DB09051

E14E489D2E56CD458AF0E08768B59554

1EB1B762D1A932BA750F1F78974A6AAB

Example:


What we had:



What we did:



Now at each step (each possible SK) :



Note that key agreement is possible only at EGS startup and  is always initiated by EGS itself. If nothing happens, must clear EGS errors or make some larger delay between power OFF and ON.


As you can see, our correct one was located somewhere in the middle of entire list.

For each SK there is about 1 minute necessary. So in worst case overall process can take about one hour.


After key agreement procedure SK_SERVER is generated (common key) and stored into both EGS and EWS4 8HP emulator. You can read it out via configurator now.

© RobinDAB ‘2016