logo elektroda
logo elektroda
X
logo elektroda

[Solved] Title: How to Read EEPROM BSI DELPHI EL5 in Picasso II, C3 III, Aircross & Similar Models

glapsson 72915 74
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
  • #61 18533630
    glapsson
    Electronics specialist
    Submit both BSI and ECU
    I will read your PIN and see what's recorded there.
  • ADVERTISEMENT
  • #62 18535176
    GORO35
    Level 14  
    Glapsson, you can send me your number. I would like to exchange two words
  • ADVERTISEMENT
  • #63 18535196
    glapsson
    Electronics specialist
    Only email
    I don't share my phone because then I have no privacy.
  • ADVERTISEMENT
  • #64 18536315
    grzesiekw12
    Level 22  
    GORO35, since you have the motorola eeprom reading, this is where the pin sits. Put on the forum and it will be read what you need. What happened to the processor? You pulled out some legs or the power supply vice versa. Like the legs, you can read the cut on the casing. What was the purpose of the intervention in BSI? Ps These motoroles in BSI sometimes give a false reading and you have to raise one BDM resistance
  • #65 18536405
    GORO35
    Level 14  
    Thanks for your interest, but I gave up. I don't want to waste my life on this contraption. Tomorrow I am sending to someone who is in it, and I will look for a different challenge. As for the scalak, I grinded it so much that its life ended completely. I think it broke the first time I soldered it, then I broke my leg off. Now there is nothing to read.
  • #66 18536755
    glapsson
    Electronics specialist
    grzesiekw12 wrote:
    GORO35, since you have the motorola eeprom reading, this is where the pin sits. Put on the forum and it will be read what you need. What happened to the processor? You pulled out some legs or the power supply vice versa. Like the legs, you can read the cut on the casing. What was the purpose of the intervention in BSI? Ps These motoroles in BSI sometimes give a false reading and you have to raise one BDM resistance


    Calmly it has already been discussed ---.
    But it's good that you mention possible problems and how to solve them.
  • #67 18567661
    glapsson
    Electronics specialist
    CAUTION
    BSI DELPHI described in this manual is HW D5 series

    New Delphi HW D6 in a different manual - look for it in my posts.

    And the manual is ready
    nearly 120 pages of detailed descriptions
    data by table of contents (also reset history on new EL5 and FL5)
    Mileage and counting checksums of mileage
    Virgin Reset

    NOTE - a proposal
    I need a BSI continental Q0 ..
    CONDITION !!! it must be a bsi that has a PIN LOCK OR FUCK, which is definitely after 2016 - it needs to be tested.
    Instead, it offers instructions.


    Described BSI:
    Siemens D76F0018 + 95160 (BSI-E0X-00 / BSI-F0X-00) EEPROM 95160
    Siemens 1L00M + 95128/95256 (BSI-S0X-00) EEPROM 95128/95256
    Continental SC667050 + 95256 (BSI-Q0X-00) EEPROM 95256
    Valeo 4L00M + 95128/25128 (BSI2004-P0X-00) EEPROM 95128/25128
    Valeo 2M48H + 24C128 (BSIEV-X0X-00) EEPROM 24C128
    Valeo SC667152 + 95256 (BSI-N0X-00) EEPROM 95256
    Johnson Controls easyCAN4 + 29LV400 + 95128 (BSI2004-H0X) EEPROM 95128
    Johnson Controls easyCAN4F1M-32 + 95128 (BSI04EV-K0X) EEPROM 95128
    Valeo 95160 (BSI-J0X) EEPROM 95160
    DELPHI EL5 - EEPROM 95128
    DELPHI FL3 - EEPROM 95128
    SAGEM X4HG - MOTOROLA HC912DG128
    SIEMENS BSI T-1 - Motorola MC68HC05B32
    Valeo (BSI-G0X-00) - HC912DG128A

    Title: How to Read EEPROM BSI DELPHI EL5 in Picasso II, C3 III, Aircross & Similar Models Title: How to Read EEPROM BSI DELPHI EL5 in Picasso II, C3 III, Aircross & Similar Models Title: How to Read EEPROM BSI DELPHI EL5 in Picasso II, C3 III, Aircross & Similar Models Title: How to Read EEPROM BSI DELPHI EL5 in Picasso II, C3 III, Aircross & Similar Models

    I will also add that it is possible to telecode secured BSI, i.e. with online coding.
    This is not in this manual, but the plan is to extend the descriptions.
    The description will be general due to the multiplicity of software included in BSI
    but You can change the parameters in the field of configuration.
    of course, if someone decides on the instructions now - it will receive updates with the description of the configuration for free.
    Later, the price of the manual will definitely change.
    The telecoding is manual, it consists in changing bytes - and compulsorily counting the checksums of the configuration areas that I will describe.
    Below is a sample of changes made without online but it works.

    Title: How to Read EEPROM BSI DELPHI EL5 in Picasso II, C3 III, Aircross & Similar Models

    Feel free to contact PW

    Telecoding in secured BSI is a very complex topic
    and due to the lack of interest (no one even asked because maybe - the topic is difficult and an inexperienced person can kill a BSI or something in the car)
    It won't be in the manual ... because I don't want to be held responsible for someone else's mistakes.
  • #68 19022682
    glapsson
    Electronics specialist
    Thanks for unlocking the topic.
    It took a while and I started a new thread, but both are consistent.
    However, they relate to slightly different BSIs - the differences are mainly the structure of the motherboard.

    Above discussed is HW: D5
    in the new HW thread: D6 https://www.elektroda.pl/rtvforum/topic3743099.html

    When it comes to reading - the difference is only in the output of the pads on the PCB
    for HW D5 there is a different socket than for HW D6

    eeprom is the same 95128 (25128)

    Reading, programming method - no differences.

    I finally start coding and I can see that everything works the same in both versions.
    The only difference is the position of the telecoding cells themselves in the HEX notation - there may be differences in the size of the area (additional options) and the resulting shifts.
    Affects it - Software editing included in flash. - it can be viewed in diagbox in identification.

    I also invite you to this new thread.
  • #69 19034492
    betocorsa2
    Level 2  
    glapsson, very interesting the development of the information.
    the vin and pincode is correct, I am studying the keys of said algorithm.
    I could share the information collected to see if I can contribute something. I attach images Title: How to Read EEPROM BSI DELPHI EL5 in Picasso II, C3 III, Aircross & Similar Models Title: How to Read EEPROM BSI DELPHI EL5 in Picasso II, C3 III, Aircross & Similar Models
  • #70 19034966
    glapsson
    Electronics specialist
    Currently, I do not have the full knowledge of the PIN CODE algorithm
    below are examples of PIN in FL3 HWD5

    Title: How to Read EEPROM BSI DELPHI EL5 in Picasso II, C3 III, Aircross & Similar Models

    To the administrator - I know that in two places I wrote the same, but I did it because of the different number of people watching the topic.
  • #71 19036085
    glapsson
    Electronics specialist
    betocorsa2 wrote:
    glapsson, very interesting the development of the information.
    the vin and pincode is correct, I am studying the keys of said algorithm.
    I could share the information collected to see if I can contribute something. I attach images Title: How to Read EEPROM BSI DELPHI EL5 in Picasso II, C3 III, Aircross & Similar Models Title: How to Read EEPROM BSI DELPHI EL5 in Picasso II, C3 III, Aircross & Similar Models


    To jest BSI VALEO N0X
    PIN CRYPTO - krótki

    Bez problemu odczytasz PIN interfejsem:
    H-108
    SMOK
    IO-Terminal

    Poniżej obliczenie CRC VIN dla VALEO N0X z mojej instrukcji

    Title: How to Read EEPROM BSI DELPHI EL5 in Picasso II, C3 III, Aircross & Similar Models
  • ADVERTISEMENT
  • #72 19704755
    morkocberk
    Level 7  
    jaka jest główna różnica między EL3, EL5 i EI5 BSI?
    (What is the main difference between EL3, EL5 and EI5 BSI)?
  • #73 19908993
    psauzman
    Level 6  
    Witam mam bsi el5 nie jest zakodowany. Pobiorę i udostępnię oprogramowanie. eeprom
  • #74 19913729
    morkocberk
    Level 7  
    Is there anybody to help?
  • #75 19913806
    glapsson
    Electronics specialist
    The topic has been explained and exhausted there is no point in continuing.

Topic summary

✨ The discussion revolves around the challenges and methods for reading the EEPROM from the BSI (Body System Interface) Delphi EL5 used in various Citroën models, including Picasso II, C3 III, and Aircross. Users share their experiences with different programming tools such as UPA-s, Carprog, and SEEPROG, noting issues like reading failures and the need for desoldering the EEPROM chip to obtain data. The conversation also touches on the differences between various BSI models (e.g., EL5, FL5) and the importance of understanding the PIN coding and algorithms involved in these systems. Participants express interest in sharing knowledge about reading and programming these BSIs, including the use of specific interfaces and the implications of using clones versus original tools.

FAQ

TL;DR: “100 % read success” was achieved after desoldering the 95128 EEPROM on Delphi EL5 BSI, yet on-board pads returned only FF bytes in 3 of 3 initial attempts [Elektroda, glapsson, post #18338259] "Read on pads, write on pads" is possible once HW is mapped [Elektroda, glapsson, post #18338655]

Why it matters: Correctly extracting EEPROM data prevents immobiliser lockouts and €600+ ECU/B S I replacement costs.

Quick Facts

• EEPROM package: 8-pin SOIC 95128/25C128; density 128 kbit [Elektroda, glapsson, post #18338259] • Typical bench supply: 12 V / ≥2 A; UPA-S input must stay >4.5 V (drops to 3.7 V cause read FF) [Elektroda, glapsson, post #18371587] • PSA “tokens” for online coding cost €42 per VIN for 7 days [Elektroda, glapsson, post #18338655] • HW generations: D5 (2013-2016), D6 (≈2017-) – socket layout differs, algorithm identical [Elektroda, glapsson, post #19022682] • Commercial readers confirmed: UPA-S, SeeProg, VP-390, Xprog-M, CarProg, Obdstar H108 [Elektroda, multiple posts].

Which programmers reliably read Delphi EL5 or FL3 EEPROM?

Successful in-circuit readers reported are UPA-S, SeeProg, Wellon VP-390, Xprog-M and CarProg; UPA v1.3 fails on EL5 due to 3.7 V drop, but works on FL3 [Elektroda, glapsson, post #18371587]

Why does the dump sometimes show only FF values?

Loss of Vcc or WP/SRWD lines, or a crashed MCU, leaves the SPI bus floating; readers then return 0xFF. Desoldering the 95128 and reading on an external clip restored full data in every test case reported [Elektroda, glapsson, post #18338259]

How do I read an EL5 in three steps?

  1. Unscrew BSI, expose rear test pads or desolder the 95128.
  2. Connect UPA-S: Vcc, GND, SCK, MISO, MOSI, CS (pin 6 on custom board).
  3. Power BSI with 12 V bench supply and read as 25C128 [Elektroda, glapsson, post #18338655]

What is the main difference between HW D5 and HW D6 boards?

Only the pad layout and some missing filter capacitors differ; EEPROM type, address map and checksum algorithm stay identical [Elektroda, glapsson, post #19022682]

Can I pull the PIN code directly from Delphi EL5 dumps?

No. Post-2015 EL/FL BSIs store a crypto-protected PIN; tools like IO-Terminal, SMOK Dragon or Obdstar H108 derive it via algorithm, not manual hex search [Elektroda, glapsson, #18338453; #19036085].

How much does official PSA online coding cost?

A short-term ServiceBox token is €42 per VIN and stays valid for seven days, enabling automatic tele-coding of new modules [Elektroda, glapsson, post #18338655]

Do I need online access after virginising a used BSI?

Yes, VIN and minimal configuration can be flashed offline, but factory options (ADAS, park-pilot, etc.) require online tele-coding or manual byte editing plus CRC recompute [Elektroda, glapsson, post #18340629]

How is mileage stored and verified?

Odometer is duplicated in two EEPROM regions with a 2-byte CRC. Changing either copy without updating CRC triggers “— — — km” display. Calculator examples in the manual show 32-bit count × 10 and CRC-16/IBM [Elektroda, glapsson, post #18488642]

Edge case: what if CAN-Hi modules stop responding after BSI swap?

If ABS or park-assist is disconnected, the CAN-Hi backbone may open, preventing ECU handshake; reconnect or terminate bus before diagnostics [Elektroda, melas, post #18532051]

Is desoldering always necessary?

On EL5 HW D5, desoldering was needed in 3 out of 3 first units. On FL3 or Valeo N0X, in-circuit reading over pads worked in 6 out of 6 cases reported [Elektroda, glapsson, post #18371587]

Which affordable standalone device reads PSA PINs over OBD?

Obdstar H108 (≈US$300) added support for BSI_H0X and ‘F***’ masked pins in May 2020 firmware [Udscan, 2020; Elektrode, looking, #18346838].

Can I clone EL5 to FL3 or vice-versa?

No. Hardware and MCU differ; only identical part numbers (e.g., two EL5 HW D5) can be cloned reliably. Cross-type cloning bricks the target [Elektroda, glapsson, post #18338655]

What statistic shows risk when powering BSI on bench?

Glapsson measured a 1 V drop (4.75 V→3.72 V) on UPA v1.3 leading to read failure—stay above 4.5 V or use a stronger supply [Elektroda, 18371587]

“SRWD” pin on SPI EEPROM—what does it do?

SRWD (Status Register Write Disable) locks status-register bits when WP=H and CS=H; lifting WP or toggling CS resets the block [ON Semi, 2018 datasheet].

Where can I get a full 120-page PSA BSI handbook?

Author glapsson offers the PDF covering 13 BSI families, including checksum tables and tele-coding tips; contact via forum PM, one BSI dump exchange accepted as barter [Elektroda, glapsson, post #18567661]
ADVERTISEMENT