top of page

CAS3 RECOVERY/Cloning

FRM3 Footwell Module
FRM3 Footwell Module

Overview

CAS3 (Car Access System) module is used in

  • 1 Series - E81, E82, E87, E88

  • 3 Series - E90, E91, E92, E93

  • 5 Series - E60, E61

  • 6 Series - E63, E63

  • X5 - E70

  • X6 - E71, E72

​

Problem

It can randomly fail, the main failure happens on hardware level.

​

Symptoms of failed CAS3 is, it is not sending signal to starter anymore.

Code present at this point is:

A0C1 - CAS: Output, Terminal 50

​

Solution

We can clone them to working used CAS3 module, it will be plug and play.

How it works

You will need to send us original CAS module,

​

We will Clone it to other same type CAS module and send it back. It will be a full clone of your original CAS.

CAS3 module is located on top of the pedals, behind plastic cover. It has 2 connectors.

​

There are few types of CAS2 and CAS3 MCUs (Processors):

  • BMW CAS2     MC9S12DG256 with MASK 2K79X

  • BMW CAS3     MC9S12DG256 with MASK 0L01Y

  • BMW CAS3+  MC9S12XDP512 with MASK 0L15Y

​

One type of CAS can not be Cloned to other type, MCU and Masks should match.

What is CAS Module and what it Does?

​

Control module Car Access System - CAS

The CAS serves as an antitheft alarm system and enables the start of BMW vehicles.
A transponder chip is integrated in each of the vehicle keys. A ring coil is fitted about the ignition lock. The transponder chip is powered by this coil from the CAS control module. This means that no battery is necessary in the key. The power supply and data transfer take place in the same way as a transformer between the loop antenna (coil) at the ignition lock and the transponder chip.
The key then sends data to the CAS control module. If these data are correct, the CAS control module enables the starter by means of a relay located in the control module and additionally sends a coded start enable signal via a interface to the DME/DDE. These procedures may result in a start delay of up to half a second.
 

Components

Interface to DME/DDE
The CAS control module sends a coded enable signal to the DME/DDE via CAN network or direct interface depending on EWS version.

The engine cannot be started before this signal has been transferred.

Engine control module (DME/DDE) with coded start enable input
The engine control module (DME/DDE) only enables engine start if a correct enable signal is received from the CAS control module.

​

EWS-DME/DDE interface

EWS3 mode

EWS3 mode has 16bit ISN stored both in CAS3 and DME/DDE (Examples are MS45, MSV70, MSS65, etc).

Besides ISN Identical random codes also are stored in the CAS control module and in the DME/DDE control module.

The value of these codes changes after every start procedure. Start enable only takes place if the code sent by the CAS control module matches with the code stored in the DME/DDE control module.
The control modules are allocated only during initial programming of the DME/DDE control module. The engine control module then adopts the rolling code of the CAS control module, process called Synchronization.

EWS4 Mode

In case of EWS4 mode there is no rolling code stored in CAS and DME/DDE. ISN (or S/K aka Secret Key) is 128bit long which is 16Bytes and it never changes.

Key identification and start procedure

The following procedure takes place after inserting the vehicle key in the ignition lock:

  • The transponder in the key is powered via the loop antenna and sends the key data to the CAS control module.

  • The CAS control module checks the key data to ensure it is correct and only then sends an enable signal to the starter.

  • EWS3 mode - The CAS control module sends the random code to DME/DDE. There, the random code is checked against the saved random code; if they match, the fuel injection is released.

  • EWS4 mode - The CAS control module compares ISN (S/K Secret Key) with DME/DDE, same as in EWS3 mode, if they match, the fuel injection is released.

  • After the engine has started, the CAS control module generates new key data (random code) and transfers them to the transponder in the key.

  • In case of EWS3 mode A new random code is also created and stored in the DME/DDE control module.

Fault recognition in engine control module

The following faults are monitored in the engine control module:

  • Interface, i.e. line to CAS control module: In this case, the check is carried out in order to establish whether a signal is received and whether this signal is not subject to excessive interference.

  • Random code or ISN (S/K) A check is conducted as to whether the random code which is sent by the CAS control module matches with the value stored in the DME (DDE) control module.

Engine start is inhibited if a fault is detected.

bottom of page