How to Retrofit a Bluetooth TCU to your car

Hi Ace, are you guessing the hex values or do you have some reference info re you're settings?

Hi Burgermeister,

In the first instance I was 'experimenting' with them (guessing if you like) to see what change did what. As time has gone by I have been slowly coming to an understanding of what the codes do and what a change will affect. So I am slowly but surely developing a database. I know now which lines of code affect what, but it is working out the many variances that is taking longer.

It would be so much easier and quicker if I had a reference list to work from, but after seeing what Politby has posted, it has prompted me to think in a new direction.

Ace

Shame we can't get a source code dump from BMW

BTW, we s/w engineers don't call them hex pairs, each pair = 1 byte (or 8 bits)

I am a SW Engineer but I was trying to make it easy for those following this to understand.....

If only we could get a source dump .......

I wonder if BMW watch these posts and enjoy seeing us suffer...... or are they getting nervous as we get closer?

If I talk to techy....... I get tooooooooo many 'please explains' in my PM box.

Ace

lol, I hear ya...Just don't mention upper/lower nibbles and you'll be fine

Originally Posted by stuartjohn24

Hi politby,

Thanks for that, I will read the MMI this weekend and have a look. Im using INPA and DIS on my macbook using a virtual machine inside a virtual machine which is pretty slow! So im setting up a old computer in the garage at the moment purely for diagnostics etc...

A VM inside a VM? So you're what, running a Windows VM in VMware Fusion on the Mac and then running VMware Workstation or VirtualPC in that VM? Cool, but why?

I've been working in virtualization for 6 years and only just now found the occasion to use it personally... to be able to run old 16-bit BMW software on a modern O/S...

Rather incredible that no one at BMW has leaked these specs, in all these years. Makes me wonder what they are threatened with if they did...

Originally Posted by AceFX

Good morning Politby.........it's got cold here now....now snow....bit it's down to 16.7 C.

Well at least we are mosquito free

I hate mozzies

Originally Posted by politby

A VM inside a VM? So you're what, running a Windows VM in VMware Fusion on the Mac and then running VMware Workstation or VirtualPC in that VM? Cool, but why?

I've been working in virtualization for 6 years and only just now found the occasion to use it personally... to be able to run old 16-bit BMW software on a modern O/S...

Rather incredible that no one at BMW has leaked these specs, in all these years. Makes me wonder what they are threatened with if they did...

Yeah pretty much! I gave up on windows as a main OS many years ago! I have virtual box running on the mac which has a copy of windows running on it, this runs the INPA and the diagnostic head emulator, I then have VMware running inside the windows virtual machine to run the dis software. It does actually work but just very slowly!

I don't have any windows capable machines at home, I'm looking to get something setup purely for diagnostics and coding.

Well it was worth a try but unfortunately it did not work in my case.

I recoded the MMI - BLUETOOTH_HANDY to "aktiv" (equivalent to changing the command line as Ace did) and it had absolutely no effect. MMI looks exactly the same and the only Bluetooth setting is the on/off toggle.

Then I also coded the PORTABLE_BT parameter to "aktiv" in the TCU. That didn't do anything either.

Strange that NCS Expert would report those parameters as codeable when they have no effect.

So I have to conclude that the TCU in my car does not support any other bluetooth functionality other than pairing with the BMW handset in the drawer. Unless there are more, less obvious, code changes needed.

I used INPA to interrogate the TCU and despite being a facelift car my 750i has a TCU manufactured in Dec 2003. I guess BMW had to get rid of old parts.
It does have the Bluetooth sticker with the pairing code and the car came with the pairing code card which is still in the glovebox.

Maybe I was just unlucky to get a facelift car with an old TCU, so I am real interested in hearing from stuartjohn24 and rostman about their TCUs and coding results.

Hi,

Shame to hear you haven't had much luck so far!

I have just been playing with this NCS Expert, I haven't used it before but managed to get the hang of it and read the coding information from a few units.

I still have the original re-facelift MMI but decided to have a look at what options are codeable.

The telephone related options that I can see are as follows:

ECE_TELEFON
nicht_aktiv not active
* aktiv active
US_TELEFON
* nicht_aktiv not active
aktiv active
TEL_WDCT
nicht_aktiv not active
* aktiv active
TEL_BLUETOOTH BLUETOOTH TELEPHONE
* nicht_aktiv not active
aktiv active
TEL_US_BUSINESS BMW BUSINESS TELEPHONE (USA)
* nicht_aktiv not active
aktiv active
TEL_US_PROFESSIONAL BMW PROFESSIONAL TELEPHONE (USA)
* nicht_aktiv not active
aktiv active
TEL_EXPLORERLISTE
nicht_aktiv not active
* aktiv active

I have no idea what ECE_TELEFON is, there also appears to be business and professional versions of the US phone option, is that for the BMW branded phone that goes into the armrest?

It would be interesting to see what activating the TEL_BLUETOOTH option does, can options conflict? like if the ECE_TELEFON is say for the phone in the drawer what will activating the bluetooth option do?

One other thing, when you read the coding you get the hex dump pop up and the line ACe refers to is there 3002, I understand he is using the 4 in 1 lead with dashsoft which looks like a copy/hacked version of carsoft/PA soft v2.1.0?

Obviously NCS expert converts the hex into a readable trace file showing what options are coded etc... isnt it simpler using NCS expert and NCSdummy to change the options rather than changing the hex values directly to see what they do?

Or have i got this all very wrong!

Originally Posted by stuartjohn24

I have no idea what ECE_TELEFON is, there also appears to be business and professional versions of the US phone option, is that for the BMW branded phone that goes into the armrest?

I'm pretty sure ECE means a European market version, U.S. market models are labeled US, such as this one listed on eBay. Note this one has an ESN rather than an IMEI number on the label which tells you it is a CDMA unit, not GSM. So it would be useless in most of the non-U.S. world.

I have seen three basic TCU variants, Europe (or rest of world) GSM, U.S. CDMA, and U.S. GSM. I see no reason why the latter should not work in other GSM areas as well.

One other thing, when you read the coding you get the hex dump pop up and the line ACe refers to is there 3002, I understand he is using the 4 in 1 lead with dashsoft which looks like a copy/hacked version of carsoft/PA soft v2.1.0?

The hex dump you get is the NETTODAT.TRC file which is a hex representation of the FSW_PSW.TRC file. I am not sure if they say exactly the same thing or if the NETTODAT file contains more options.

Obviously NCS expert converts the hex into a readable trace file showing what options are coded etc... isnt it simpler using NCS expert and NCSdummy to change the options rather than changing the hex values directly to see what they do?

You need NCS Expert whichever way you want to code. NCSdummy does not code, it just reads and translates the information. Essentially you edit the NETTODAT or FSW_PSW trace file, save it as .MAN and feed it to NCS Expert which performs the actual coding. It is pretty well explained here.

Believe it or not I found a TCU for sale at a local salvage yard, coming out of a 2007 E66. It was only ~150 euros so I placed an order immediately. Pretty cheap compared to the ones listed on the German eBay. I should get it in a couple of days. Part number 84109149615.

Hopefully the wiring is the same so I won't have to rebuild the connectors. Maybe I can convince Ace to share how he coded his new TCU for his VIN.

If that does not work, I will give up.

Originally Posted by stuartjohn24

Hi,

Shame to hear you haven't had much luck so far!

I have just been playing with this NCS Expert, I haven't used it before but managed to get the hang of it and read the coding information from a few units.

I still have the original re-facelift MMI but decided to have a look at what options are codeable.

The telephone related options that I can see are as follows:

ECE_TELEFON
nicht_aktiv not active
* aktiv active
US_TELEFON
* nicht_aktiv not active
aktiv active
TEL_WDCT
nicht_aktiv not active
* aktiv active
TEL_BLUETOOTH BLUETOOTH TELEPHONE
* nicht_aktiv not active
aktiv active
TEL_US_BUSINESS BMW BUSINESS TELEPHONE (USA)
* nicht_aktiv not active
aktiv active
TEL_US_PROFESSIONAL BMW PROFESSIONAL TELEPHONE (USA)
* nicht_aktiv not active
aktiv active
TEL_EXPLORERLISTE
nicht_aktiv not active
* aktiv active

I have no idea what ECE_TELEFON is, there also appears to be business and professional versions of the US phone option, is that for the BMW branded phone that goes into the armrest?

It would be interesting to see what activating the TEL_BLUETOOTH option does, can options conflict? like if the ECE_TELEFON is say for the phone in the drawer what will activating the bluetooth option do?

One other thing, when you read the coding you get the hex dump pop up and the line ACe refers to is there 3002, I understand he is using the 4 in 1 lead with dashsoft which looks like a copy/hacked version of carsoft/PA soft v2.1.0?

Obviously NCS expert converts the hex into a readable trace file showing what options are coded etc... isnt it simpler using NCS expert and NCSdummy to change the options rather than changing the hex values directly to see what they do?

Or have i got this all very wrong!

+1. Ncs is easier IMO.

Ece means Europe pretty sure tel means telephone. So.....

And if you want your iPod to show up like aces instead of cd1 through 6 all you do is code iPod list to aktiv in ncs and you are done. Just figured I'd share since I never ended up listing this in the past

Originally Posted by MakaveliFaison

And if you want your iPod to show up lice aces instead of cd1 through 6 all you do is code iPod list to aktiv in ncs and you are done. Just figured I'd share since I never ended up listing this in the past

More specific please! "iPod list"? Never seen that parameter anywhere. Which module?

Mmigt module. I did it to boeing750i's car when I installed his iPod adapter for him

Originally Posted by MakaveliFaison

Mmigt module. I did it to boeing750i's car when I installed his iPod adapter for him

Thanks. So add "iPod list aktiv" and code to the MMIGT?

Originally Posted by politby

I'm pretty sure ECE means a European market version, U.S. market models are labeled US, such as this one listed on eBay. Note this one has an ESN rather than an IMEI number on the label which tells you it is a CDMA unit, not GSM. So it would be useless in most of the non-U.S. world.

I have seen three basic TCU variants, Europe (or rest of world) GSM, U.S. CDMA, and U.S. GSM. I see no reason why the latter should not work in other GSM areas as well.



The hex dump you get is the NETTODAT.TRC file which is a hex representation of the FSW_PSW.TRC file. I am not sure if they say exactly the same thing or if the NETTODAT file contains more options.



You need NCS Expert whichever way you want to code. NCSdummy does not code, it just reads and translates the information. Essentially you edit the NETTODAT or FSW_PSW trace file, save it as .MAN and feed it to NCS Expert which performs the actual coding. It is pretty well explained here.

Believe it or not I found a TCU for sale at a local salvage yard, coming out of a 2007 E66. It was only ~150 euros so I placed an order immediately. Pretty cheap compared to the ones listed on the German eBay. I should get it in a couple of days. Part number 84109149615.

Hopefully the wiring is the same so I won't have to rebuild the connectors. Maybe I can convince Ace to share how he coded his new TCU for his VIN.

If that does not work, I will give up.

Ahh... Of course! I understand, so with you being in Sweden you have the same situation as me, It looks as though the facelift telematics unit is the one to go for and one obviously a GSM variant.

I will most likely have to upgrade the MMI first, as I doubt it will be compatible with the newer telematics unit.

That's right, I think the hex is exactly the contents of the coding memory and Ncs converts it for you, Ncs then converts the .MAN file back to hex when you code it.

I wonder if there is a way to convert the .MAN file back to hex so you can see the values that have been changed?

As long as I keep a backup of the original coding memory can I revert back if something goes horribly wrong?

Originally Posted by politby

Thanks. So add "iPod list aktiv" and code to the MMIGT?

No...you don't add that line. That line is already there. Just change it from nicht_aktiv to aktiv. And your done

Wow......



Ace

Originally Posted by AceFX

Wow......



Ace

Any Luck ???
I'm waiting Patiently
with my trunk dissembled , I didn't want to put it all back
together & then get a message from you .

G'day mate, I am at my farm now. I am looking at it now.....

I have to fly to Melbourne in a few hours but will do what I can right now.

Originally Posted by AceFX

G'day mate, I am at my farm now. I am looking at it now.....

I have to fly to Melbourne in a few hours but will do what I can right now.

Originally Posted by AceFX

Hi Burgermeister,

In the first instance I was 'experimenting' with them (guessing if you like) to see what change did what. As time has gone by I have been slowly coming to an understanding of what the codes do and what a change will affect. So I am slowly but surely developing a database. I know now which lines of code affect what, but it is working out the many variances that is taking longer.

It would be so much easier and quicker if I had a reference list to work from, but after seeing what Politby has posted, it has prompted me to think in a new direction.

Ace

Ace someone has already done all this hard work with NCS. When you read a module with NCS one of the files you get is an ASCII file called NETTODAT.TRC which has all the lines 3002 etc with values just like you can see in dash soft. NCS however also produces FSW_PSW file which has all this ASCII coding translated into english options that can simply be activated or deactivated. There is no need to reverse engineer with NCS. It is easier to code with the dashsoft gui but working with ASCII coding changes is problematic.

If you really want to understand which options are affected by which change you can read a module in NCS, save the NETTODAT.trc file created with your ASCII values, then you can make a change using the English options in the FSW_PSW.trc file and the write that change to the module. You can then read the module again and look at the newly generated NETTODAT file to see what ASCII values got changed to make the option changes you did in the FSW_PSW file. Since you would know what option you enabled in the FSW file you can compare your original and new NETTODAT file to find out what the ASCII changes were in all lines and positions for that particular option.

Edit* just noticed this was already explained earlier in the thread...please ignore.