Electronic Car Immobilization System
Electronic Vehicle Immobilization
The electronic immobilizer (EWS) is both an anti-theft device and start release.
The 4th generation EWS is an enhancement of the EWS used to date. This enhancement uses a new and modern encryption method.
Each vehicle is assigned a 128-bit secret code. This secret code is stored in a BMW database. This means that the secret code is only known to BMW.
The secret code is programmed and locked in the following control module:
- CAS control module (not E83)
The EWS is integrated in the CAS control module.
- EWS control module (only E83)
The E83 has an EWS control module, but no CAS control module.
- DME/DDE control module
When the secret code is locked in the control modules, it can no longer be deleted or changed. This means that each control module is assigned to a certain vehicle. The control modules mutually identify themselves with the secret code and the same algorithm.
In the 4th generation EWS, there is no direct line (EWS data line) between DME/DDE and CAS (not E83). The CAN data line (PT-CAN and K-CAN) and the K bus (also called CAS bus) are used for data interchange of the EWS signal. The K bus is used when an EWS signal cannot be sent on the CAN data line.
> E83: As before, data interchange between the EWS control module and DME/DDE takes place across the direct EWS data line.
Deployment of the EWS (4th generation):
Brief description of components
The following components are described for the EWS:
Remote control with integrated transponder chip
A transponder chip is integrated in every remote control; this can both transmit and receive. The data transfer takes place in the same way as a transformer between the loop aerial in the insertion slot or ignition lock (only E83) and the transponder chip. The remote control sends data to the EWS or CAS control module and receives data from it.
The authorization of the remote control for each vehicle is also coded in the transponder chip.
The EWS or CAS control module can manage a maximum of 10 remote controls that match the control module, i.e. a maximum of 6 remote controls can be obtained as replacements.
The EWS or CAS control module can identify the individual remote controls. This means it is possible to disable or enable individual remote controls. If faults occur during communication between the EWS or CAS control module and the individual remote controls, these are stored in the fault memory - separately for each individual remote control.
Loop antenna
The insertion slot for the remote control or around the ignition lock (only E83) is a ring antenna (coil) to query the transponder chip. The transponder chip and EWS or CAS control module communicate via the ring antenna.
Electric Steering Lock
On vehicles with an electrical steering interlock, this is supplied with electrical current after authentication by the CAS. Only now can the steering be unlocked or locked. An engine start is only permitted when the electrical steering interlock has been unlocked and secured.
EWS data line
> E83
The EWS control module and DME/DDE mutually authenticate one another across the EWS data line.
Selector-lever position "P" or "N" with automatic transmission
On vehicles with automatic transmission, start release is only given by the EWS or CAS control module of the selector lever is in position "P" or "N".
The following control modules are involved in the electronic immobilizer (EWS):
CAS: Car Access System
> not E83
The CAS control module is the master control module for the EWS. The EWS is integrated in the CAS.
The secret code is stored in the CAS control module and is secure against manipulation.
The CAS control module is attached to the bus on the K-CAN (body CAN) and the K bus (body bus).
The CAS control module is the interface to the insertion slot for the remote control.
EWS control module
> only E83
The EWS control module is attached to the K bus (body bus).
The EWS control module is the interface to the ignition lock.
DME/DDE: Digital Engine Electronics /Digital Diesel Electronics
The DME / DDE control module only enables the engine start if a correct enable signal is received from the EWS or CAS control module. The secret code is stored in the DME/DDE and is secure against manipulation.
JBE: Junction box electronics
> E70, E81, E82, E87, E88, E90, E91, E92, E93, R55, R56
The JBE is the data interface between the PT-CAN (Powertrain CAN) and K-CAN (body CAN).
KGM: Body Gateway Module
> E60, E61, E63, E64
The KGM is the data interface between the PT-CAN (Powertrain-CAN) and K-CAN (body CAN).
KOMBI: Instrument cluster
> E83
The instrument cluster is the data interface between the PT-CAN (Powertrain-CAN) and K bus (body bus).
EGS: Electronic transmission control
> only E70
The Electronic Transmission Control (EGS) is integrated in the 4th generation EWS as another immobilizer. The EGS control module is attached to the K bus.
The transmission function is only enabled when the CAS control module and EGS control module authenticate one another.
CA: Comfort Access
With optional extra 322 "Comfort Access": An identification sensor is required instead of the usual remote control. The identification sensor also performs the usual functions of the remote control.
The control module for Comfort Access (CA control module) controls the vehicle interior aerials and the vehicle exterior aerials. An ID transmitter scan is carried out. At the same time, the FBD receiver is activated for any ID transmitters which may respond (FBD: remove control service).
The CAS control module is the master control module for all functions run by the Comfort Access optional extra.
System functions
The following system functions are described for the EWS:
- Control of the electrical steering interlock
- Start enable
Control of the electrical steering interlock
During the unlocking procedure, an authentication procedure is run between the Car Access System (CAS) and the electrical steering interlock. The electrical steering interlock may only commence unlocking after a positive result in the authentication procedure. For safety reasons, the electrical steering interlock is not supplied with current while the vehicle is being driven. The electrical steering interlock is only supplied with voltage for the unlocking procedure or locking procedure.
Start enable
If the identification data is correct, the CAS control module activates the starter motor via a relay in the control module. At the same time, the CAS control module sends the DME control module a coded release signal for the engine start. The DME control module only enables the engine start if a correct enable signal is received from the CAS control module.
After inserting the ignition key in the ignition lock or the remote control in the insertion slot, the following sequence begins:
- The transponder in the ignition key or in the remote control is supplied with energy via the ring antenna and sends the key data to the EWS or CAS control module.
- The EWS or CAS control module checks the correctness of the key data and only then enables activation of the starter by the DME/DDE.
- The DME/DDE uses a random number and the secret code to calculate a request. The DME/DDE sends this request via the CAN data line (PT-CAN and K-CAN) and the K bus (also called CAS bus) to the CAS control module.
- The CAS control module uses the request and the secret code to calculate the response. The response is sent by the CAS via the CAN data line (PT-CAN and K-CAN) and the K bus (also called CAS bus) to the DME/DDE.
- The DME/DDE itself also calculates the response that the CAS control module expects. The DME/DDE then checks the response received from the CAS control module to ensure it matches the response it has calculated itself.
If the responses match, the engine start is enabled.
Identical changing codes are stored in the control modules; their value changes after every starting operation. The changing code is formed from a random number and the secret code.
Notes for Service department
General information
Calibration of engine management system with electronic immobilizer
With the introduction of the new EWS (4th generation), the calibration between the engine control module and electronic immobilizer is no longer required.
- 6-cylinder petrol engines
The elimination of the calibration takes effect with the engine control modules MSV80 and MSD80 as of 06/2006.
- Diesel engines
Elimination of the calibration takes effect with the engine control modules DDE7 as of 03/2007.
- M-GmbH engines
The elimination of the calibration takes effect with engine control module MSS60 as of 06/2007.
From this point onwards, certain control modules can only be replaced with control modules specifically ordered for each vehicle.
NOTE: Procedure in the event of a defective control module.
If the CAS, EWS (only E83) or DME / DDE is defective, a certain procedure must be followed.
The required control module must be ordered exactly for the vehicle. This requires the vehicle data (vehicle identification number).
An EWS calibration is not necessary after renewing the control module.
> E70
When replacing the Electronic Transmission Control, a calibration is necessary. During calibration, the CAS control module transfers an individual code to the EGS control module. This individual code is required for the authentication procedure to enable the transmission function.
IMPORTANT: A trial replacement of the control modules with secret code is not possible.
Spare key
Spare keys can only be obtained through a BMW dealer with BMW Parts Service. There, one of the 6 spare keys is programmed to match the vehicle. This key is not a copy of the lost key, but rather a new key.
A total of no more than 6 spare keys that match the fitted EWS control module can be manufactured and delivered.
If a new key is inserted for the first time in the ignition lock, there is a noticeable start delay of 1 to 2 seconds. Thereafter, the starting operation must be without any delay.
Lost keys must be blocked via the diagnosis. Refer to "Special features of the diagnosis program".
CAUTION: Each request for a key is documented so that inquiries from insurance companies and authorities can be followed up.
Reprocurement after loss of all remote controls or ignition keys
If all remote controls or ignition keys are lost, a new EWS or CAS control module is required.
Service functions
Blocking / releasing remote controls or ignition keys
It is possible to electronically block or release individual remote controls or ignition keys via the diagnosis (service functions).
IMPORTANT: Electronically blocked means that both the starter and the engine control module are not enabled for a start. It must be borne in mind that an electronically blocked ignition key still fits mechanically, i.e. all flaps and door can still be opened.
Display of the remote controls or ignition keys used in this vehicle
Here, it is displayed whether each individual ignition key (remote control) managed by the EWS or CAS control module has already been detected at least once by the EWS or CAS control module, i.e. it is possible even in the case of older vehicles to recognize how many remote controls or ignition keys have already been used in this vehicle.
No liability can be accepted for printing or other faults. Subject to changes of a technical nature