Using CGDI to Program A New Key for BMW X5 (E70)
Symptom: have just one key fob and emergency key, and I just had my first experience with locking the key in the car.
To learn more about the Comfort Access system and the ins/outs of replacement hard keys and key fobs.
I plan on buying some hard key blanks and getting copies made of the one that I have in my possession. I am looking into what my options are for getting additional key fobs.
My question is: anyone have confirmation of which key fob is used on BMW X5 E70s?
I was coding the ’13 to add the trailer towing module; used ISTA/P and an ICOM. Worked fine. After digging around and not finding any key-specific options for the E70 LCI in the programmer I switched to the diagnostic tool ISTA/D.
I found two useful documents:
FUB-FUB-VOD0203FBE606132001
Service functions
Renewing control units
The following points must be borne in mind when the CAS or the engine control unit are renewed:
– If a CAS control unit is renewed, it must be ordered using the vehicle identification number (VIN). Following installation, that
starting value must be adjusted to the engine control unit. This starting value adjustment is performed using the service function ”DME/DDE – CAS calibration” in the BMW diagnosis system.
– If the engine control unit is renewed, the drive-enable code must be transferred from the CAS to the engine control unit following installation. This procedure is also performed using the service function ”DME/DDE – CAS adjustment” in the BMW diagnosis system.
– After the adjustment of the EWS and engine control unit, these are mutually linked. It is not possible to replace one of the two control units as a test.
DME/DDE – CAS adjustment
In the case of a new engine control unit, the service function ”DME/DDE – CAS adjustment” in the BMW diagnosis system is used to read the EWS drive-enable code from the CAS and transfer it into the engine control unit. This means that the engine control unit and the CAS control unit are mutually linked.
If the engine control unit is already linked to the CAS, the service function is used to perform a starting value calibration. This means that the random code calculation between the CAS and the engine control unit is adjusted.
A start calibration is required if there is a variance in the rolling codes caused by the influence of errors in the two control units.
As of EWS4, a start calibration is no longer required.
Locking the remote key/spare key
The service function ”Remote key/Lock/Enable Key” in the BMW diagnosis system can be used to lock or enable remote key keys or spare keys.
The locking is recommended when a remote key or a spare key is lost or stolen. With a locked remote key (or spare key), engine start is not possible. The functions of the remote key are also locked.
A remote key or a spare key can only be locked if the remote key or spare key has been used at least once and it is not inserted in the ignition lock.
To perform the service function, it is required that a valid and enabled remote key or a valid and enabled spare key is detected in the ignition lock.
Activating of a new remote key
Insert the new remote key in the insertion slot and hold in this position until the remote key locks into place. This can take up to ten seconds. After locking, wait another five seconds. The remote key is then ready for use.
If the remote key is a replacement for a lost or defective remote key, the old remote key still has to be blocked using the service function ”lock/release” (see above). To use the Car/Key functions, the service function ”Personalization number” has to be run.
FUB-HIL-SCM0902HI-6100003
For each vehicle, the Car Access System (CAS) manages two different numbers for the remote control belonging to the vehicle and for each spare key.
Key number
The key number is part of the key detection. As a maximum of 10 keys can exist for one vehicle, the key numbers 1 to 10 are stored in the CAS. The key number cannot be changed.
The key number is transferred to the CAS when the remote control is operated. If the key is in the ignition lock, the key number is read by the CAS directly from the transponder (memory chip) in the key.
In the CAS, each key number is only present once. If required, the key number can be used to block a key in the CAS. To do so, the service function locking and security functions – remote control/key – lock/release is available.
Personalisation number
The personalisation number is vehicle to call up the Key Memory settings in the vehicle. On unlocking with the remote control, the remote control transmits the personalisation number to the CAS. The CAS forwards the number across the data buses to the other control units. On receipt of the personalisation number, the individual control units implement the settings set in the Key Memory.
All in all, 3 different Key Memory settings can be coded per control unit. This is why the personalisation number can have the values 1 to 3.
On vehicle delivery, the key number and personalisation number of the two remote controls delivered are the same. However, the personalisation number can be changed using the service function locking and security functions – remote control/key – personalisation number .
If other keys are ordered or if a key is replaced, the service function mentioned can be used to enter a personalisation number in the range from 1 to 3.
If a new personalisation number is assigned, the Key Memory settings for the individual control units must be coded with the CIP program for this number.
As I am down to just 1 key, the one that was delivered with the car, I am going to see if I can perform the personalization functions on that key and ‘look’ and ‘lock/remove’ any others that may be in the system.
If this works out I think I will try my luck with the 315MHz keys that can be had in the grey market.
Experience user’s suggestion:
Give it a try, but I’m 99.9% sure that won’t work. The CAS comes pre-programmed with 10 key codes which are tracked by the dealer, two of those slots are filled at the factory if I recall correctly. One more limitation is that if your E70 has comfort access, only two comfort access keys can be assigned at one time (would require ISTA to deactive the lost or dead CA key before the new one is activated).
The way the gray market keys works is by violating this part of the document you cited “The key number is part of the key detection. As a maximum of 10 keys can exist for one vehicle, the key numbers 1 to 10 are stored in the CAS. The key number cannot be changed.” It turns out that aftermarket tools *can* change the key number. They read the key blank and modify the key number in the CAS. On vehicles that have had the CAS firmware upgraded to 3+ (encrypted CAS), a downgrade is required for this process to work. One more note is that on the E70, the CAS also authenticates the transmission – which has not been cracked in the case of the LCI – so if a “craigslist special” coder bricks your CAS you’ll be in a bad way. Sorry if this isn’t completely accurate as this is from memory.
Had previously purchased a recycled key it was a 315Mhz transmitter placed in a new case with a new key blank. The key I bought is stripped of its ID and needs to program with something like your CGDI BMW or VVDI BMW programmer.
Using ISTA-P/ISTA-D did not reveal options for me to get the key working but I did find how to assign the different key slots and personalization options in these menus. So if I can get the key to register then I can probably get the CAS personalization options to work with the different keys I hope to have.
I have been hunting for hardware options to deal with the key and your recommendation of the CGDI BMW programmer is another option.
I will be doing this myself rather than paying someone else to do the work. I need more than 1 key and the dealer has already quoted me something like $550 for 1 key. That kind of money puts me close to buying the equipment I need to do the work myself.
Best tips to use with CGDI BMW:
Your key personalization should work perfectly once the new key is added in the CAS. Do be aware that newer CAS firmwares must be downgraded to work with those aftermarket programmers. My 2007 E70 and my dad’s 2013 E70 both require that downgrade which I have yet to attempt; my understanding is that it should only be done with a proper power supply attached to the vehicle although CGDI does have the downgrade capability included. There are some articles out there on how to modify old HP server power supplies to work for car programming and I’m going to try it out. Also, not to scare you, the E70 LCI is rather unique in that it’s the only E-series vehicle that came with the 8HP transmission. Unfortunately, both the 6HP in the older E70s and the 8HP in the LCI have a security code (ISN) that the CAS verifies. CGDI can reset read/reset the ISN in the 6HP but is unable to work with the 8HP as far as I know… which means if you were to totally brick your CAS, retrofitting a replacement may get expensive.
Read this from user @DNK76:
Read CAS with the VVDI Prog, EEPROM and FLASH programmer,
then you can lower the software version anyway,
the most important with CGDI is a voltage higher than 13.8V
I noticed how the voltage within 12V is flash lowering version fails.
Without a copy of the software (eeprom and flash) do not start the downgrade in e70 / e71
– Good to know: With a backup, a bricked CAS can be restored.
Finally! Update
There are a number of key programming options and following Cyrix2k’s recommendation to buy the CGDI BMW is likely what I will do. I have just been setting back dollars for this purchase and it is lagging behind some others with higher priority.
I was able to acquire a PC recently and get it provisioned for this endeavor as the one I was using for the task was tapped out for other missions. I recently performed some successful coding with NCS Expert and loaded ISTA D/P packages with the relevant daten files on the fresh one. Before I pursue the key issue further I need to get some time and run through both of those tools to confirm they work as well as they did on my other machine.
I also want to replace the battery as the original from 6/2013 is still in the car and it makes me a bit nervous to do much else with a 7 year old heart in the car’s electrical network.
I have a deutronic power supply/charger which I have used with the car to maintain the appropriate system voltage during programming; once I get the battery replaced I am not concerned about throwing bricks at the car from an electrical perspective. The downgrading of CAS and other monkey business gives me some pause, but I am working up the confidence to push forward as I take stock of what I have and better understand the process involved with the programming.
Good luck with your own efforts!