ISN read from EDC16C35

vladys · 28.03.2026

I need help reading ISN from eeprom or full data, (not working with CAS3 V1,3 ) I managed to extract backup from original DDE EDC16C35. EXTEEPROM 8KB and full data 2.5mb. I want to make the car run without errors with original DDE and CAS second. I am an electronics engineer and I don't want to make a mistake with the ISN code, I bought specifically to make my personal car a LAUNCH X431 PRO + X-PROG3 which does not have the option to read ISN from backup. I think the problem is with the original CAS3++ ISTAP, which was corrupted by someone else who said he could make me a new key and tried to rewrite the software in the original CAS, and it shows me FFFFF... when reading ISN from CAS "on the bench", now I have second DDE EDC16C35 and CAS3++ without second ISTAP from a 525d 3.0 2009 LCI same. The car is mine and I want to do it, as it has been sitting in the parking lot for over a year, any help is welcome, THANKS in advance.

vladys · Tuesday at 17:29

O added the original CAS. Check and read DTC from the attached document

Gemini · Tuesday at 17:29

vladys said:
O added the original CAS. Check and read DTC from the attached document

Unfortunately I cannot extract the actual DTC text from this PDF — the attachment data only shows the raw binary/encoded PDF structure (images and compressed streams). The actual fault code text is embedded in the compressed content stream and cannot be read from the hex preview alone.

I need you to do one of the following so I can analyze the DTCs:

Option 1 — Screenshot
Take a screenshot of the Launch Pro DTC report and upload it as a JPG/PNG image.

Option 2 — Type the DTCs
Open the report and list the DTCs manually. I need:

The DTC code (e.g., 480A, 4810, A0B4, etc.)
Which module reported it (CAS, DDE, ELV, FRM, KOMBI, etc.)
The description if shown

Option 3 — Text copy
If Launch Pro allows you to export or copy the report as text, paste it here.

In the meantime — what to expect with the original CAS3++ reinstalled:

Since you put the original CAS (9217853) back in, the module communication and VIN should now be correct across all modules. The remaining DTCs will most likely be:

DDE — ISN mismatch / immobilizer fault — because the DDE ISN was never changed, and if you previously attempted to start with the donor CAS, the DDE may have logged a tamper/mismatch event
CAS/ELV — steering lock fault — this was presumably the original problem that started everything
Historical DTCs from the period when the donor CAS3 was installed (VIN mismatch, communication errors across modules)

Please upload the DTCs in a readable format and I will give you the exact step-by-step fix for each one.

vladys · Tuesday at 17:33

I attached photo of DTC report

Gemini · Tuesday at 17:33

vladys said:
I attached photo of DTC report

Now I can see the DTCs clearly. Here is the full analysis for your 2009 BMW 5 Series (WBANX52050C292056, 248290 km) with the original CAS3++ (9217853) reinstalled.

DTC Analysis & Fix Plan

1. A0AA — CAS: Control-Unit Fault (Current)

This is the main problem. The CAS3++ itself has an internal fault. This confirms the CAS module is damaged — this is likely why you tried the donor CAS in the first place.

Possible causes:

Internal EEPROM corruption
Failed processor or power supply circuit inside CAS
Water/corrosion damage on the CAS PCB
Failed flash memory

Fix: The CAS3++ needs bench repair or replacement with another CAS3++ (not CAS3). A specialist can attempt EEPROM repair on the bench. If the hardware is physically damaged, you need a donor CAS3++ with matching hardware revision.

---

2. A11A — CAS: ELV Fault (Current)

The electronic steering lock (ELV) has a fault. This is very common on E60/E90 CAS3 modules and is often the root cause of the whole problem.

Possible causes:

ELV motor failure (most common)
ELV microswitch failure
ELV communication line broken inside CAS
CAS internal fault (A0AA) causing ELV to not initialize

Fix:

Option A: Repair the ELV motor/microswitch on the bench — a CAS specialist can replace the ELV components
Option B: Install an ELV emulator — bypasses the steering lock entirely
Option C: If A0AA is the root cause, fixing the CAS internal fault may also resolve the ELV fault

---

3. 9501 — SZL: Steering-Angle Sensor Not Adjusted (Current)

The steering angle sensor lost its calibration. This happens whenever the CAS is swapped or battery is disconnected for extended time.

Fix: Perform steering angle sensor calibration with ISTA/D, Launch X-431, or any tool that supports SZL calibration. Turn steering wheel full lock left → full lock right → center. Confirm with the tool.

---

4. 94C1 — SZL: Coding-Data Error (Current)

The SZL coding doesn't match the current vehicle configuration. This was likely caused by the donor CAS3 being installed (different FSV/configuration).

Fix: Re-code the SZL using ISTA/P or E-Sys with the correct FA/VO for your vehicle. After coding, the steering angle sensor calibration (9501) should also be repeated.

---

5. E2D6 — Message (Kilometre Reading, 0x330) Faulty, Receiver CON, Transmitter KOMBI (Current)

The controller (CON — likely the headunit/iDrive controller) is receiving an invalid mileage message from the instrument cluster. This can happen when:

The CAS was swapped and the mileage broadcast was interrupted
KOMBI coding is mismatched

Fix: This should clear after re-coding the vehicle with ISTA/P and performing a full FA/VO write. Clear DTCs after coding. If it persists, check KOMBI coding specifically.

---

6. CF35 — Messages From CAS, Receiver EGS, Transmitter CAS (History)

The EGS (automatic transmission) logged that it lost CAS messages. This was caused by the donor CAS3 swap (different communication protocol/VIN).

Fix: History fault — clear DTC. With the original CAS3++ back in, this should not return.

---

7. CF25 — Message (Seat Occupancy/Seat Belt) From SSFA, Receiver EGS (History)

The EGS lost seat occupancy/belt buckle messages during the CAS swap period.

Fix: History fault — clear DTC. Should not return.

---

8. CF2A — Message (Vehicle Mode) From SZM, Receiver EGS (History)

The EGS lost vehicle mode messages from the center console switch module during the swap.

Fix: History fault — clear DTC. Should not return.

---

9. A3B2 — Message Error (Terminal Status, 0x130), Receiver Instrument Panel, Transmitter CAS (History)

The instrument cluster lost the terminal status (ignition state) message from CAS during the swap.

Fix: History fault — clear DTC. Should not return with original CAS.

---

10. 9CC5 — LM: No Message, LIN (RLS) (History)

The light module lost communication with the rain/light sensor on the LIN bus. Likely unrelated to the CAS swap — could be a loose connector or intermittent RLS issue.

Fix: Clear DTC first. If it returns, check the RLS connector on the windshield and the LIN bus wiring to the light module.

---

Summary — Priority Order

A0AA + A11A (CAS fault + ELV fault) — This is your primary problem. The CAS3++ has an internal fault. Get it bench-repaired by a CAS specialist, or source another CAS3++ (NOT CAS3). If only the ELV is faulty, an ELV repair or emulator solves it.
94C1 (SZL coding) — Re-code SZL with ISTA/P or E-Sys after CAS is sorted.
9501 (Steering angle) — Calibrate after SZL coding.
E2D6 (Mileage message) — Re-code with ISTA/P, then clear.
CF35, CF25, CF2A, A3B2 (History faults) — Clear all. These are leftovers from the donor CAS3 period.
9CC5 (RLS) — Clear and monitor.

Bottom line: Your original CAS3++ has a hardware fault (A0AA). Fix or replace it with another CAS3++, then re-code the car and clear all DTCs. Do not attempt to use the CAS3 donor (6943834) — it will never work properly in this car.

vladys · Tuesday at 17:39

How can I repair the original CAS if I only have the backup from DME because the original CAS was corrupted? I attached the backups from both CAS and DME in the first post.

Gemini · Tuesday at 17:39

vladys said:
How can I repair the original CAS if I only have the backup from DME because the original CAS was co...

This is a critical situation. Let me clarify what you have and what is possible.

What You Have

Original CAS3++ (9217853) — corrupted/faulty (DTC A0AA confirms internal fault)
Donor CAS3 (6943834) — wrong generation, cannot be used
DME/DDE backup — this contains the ISN from the original engine ECU
CAS backup — but you said the original CAS was corrupted, so this backup may also be corrupted

The Key Question

When you say "backup from DME" and "backup from CAS" — I need to know exactly:

What tool did you use to read the CAS backup? (VVDI, Xhorse, Yanhua, Carprog, CGDI, other?)
What was read — full flash, EEPROM (93C86), or both?
When was the CAS backup made — before the corruption happened, or after?
What tool did you use to read the DME/DDE?
What was read from the DME — full flash, EEPROM, ISN area only?
What is the DME/DDE part number and type? (EDC16? DDE7? MSD80? MSV70?)

Why This Matters

Scenario A — CAS backup was made BEFORE corruption

If you have a clean EEPROM backup from the original CAS3++ taken before it failed, then:

A CAS specialist can source a new/used CAS3++ with the same hardware revision
Write your original EEPROM data onto the new CAS3++ — this transfers VIN, ISN, key data, ELV status
The ISN will match the DME because it's the original data
Re-code with ISTA/P, calibrate SZL, clear DTCs — car starts

Scenario B — CAS backup was made AFTER corruption

If the backup was taken from the already-corrupted CAS, the EEPROM data may be partially or fully damaged. In this case:

The ISN inside the CAS backup may be unreadable or corrupted
You would need to extract the ISN from the DME/DDE and write it into a replacement CAS3++
The key data may be lost — you would need to program new keys
The VIN can be recovered from other modules (KOMBI, EGS, etc.)

Scenario C — You only have the DME backup, CAS backup is unusable

This is the hardest scenario but still recoverable:

Extract ISN from the DME backup
Source a donor CAS3++ (same hardware revision as 9217853)
Write the correct VIN (WBANX52050C292056) into the donor CAS3++
Write the ISN extracted from DME into the donor CAS3++
Program new keys to the donor CAS3++
Re-code entire vehicle with ISTA/P
Calibrate SZL, clear all DTCs

What I Need From You

Confirm which scenario applies — was the CAS backup taken before or after the fault?
Upload or share the CAS and DME backup files if possible — I can check if the ISN is readable in both
Tell me the exact DME/DDE type (part number from the label on the ECU)
Tell me what read tool was used and whether it was full read or EEPROM only

With this information I can tell you exactly how to extract the ISN and what needs to be written where to get the car running again.

vladys · Tuesday at 17:53

I attached the original CAS backup after bricked, and original DDE backup-ul. Can you extract the 32 code ISN from DDE backup?

Gemini · Tuesday at 17:54

vladys said:
I attached the original CAS backup after bricked, and original DDE backup-ul. Can you extract the ...

Good, I can see all the files. Let me analyze what you have.

What You Have

CAS3++ backup (taken AFTER bricking):

EEPROM: eprombmw525.bin / eprombmw2.bin — 4 KB (93C86) — both files are identical
Flash: flashbmw525.bin / flash2bmw.bin — 512 KB — both files are identical
Key data: multiple exports from a tool (VVDI/Yanhua/CGDI)

DDE (EDC16C35) backup:

FULL_DATA — 2.51 MB (IntFlash 512 KB + ExtFlash 2 MB + ExtEEPROM 8 KB)
EXTFLASH — 2 MB
INTFLASH — 512.5 KB
EXTEEPROM — 8 KB
All reads done twice — good for verification

DDE Identification

From the EXTEEPROM I can read:

Bosch HW number: HS1037500774
Bosch SW number: 1037376616
Production dates: 24-08-09 / 27-08-09
VIN partial: C292056 (matches WBANX52050C292056)

This confirms it is your original EDC16C35 — Bosch MPC563/565 based ECU.

ISN Location in EDC16C35

On the EDC16C35, the ISN is stored in the external EEPROM (EXTEEPROM), not in the flash. The ISN area is located at offset 0x0040–0x007F in the EXTEEPROM dump.

Looking at your EXTEEPROM data at that range:

Code:

Offset 0x0040: 00 00 C1 E7 A3 38 4C 9F 18 B7 2C F0 00 8D 01 00
Offset 0x0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FA 18
Offset 0x0060: F2 19 83 49 65 7E B7 25 EE 89 8D 4F D7 2A 0C 96
Offset 0x0070: 45 BE 18 F3 5A 74 3C 06 56 3B 3D E3 72 53 F2 DF

This is the ISN block 1 (primary). There are two more copies at 0x0080 and 0x00C0 (backup copies).

The Problem — Encrypted ISN

The EDC16C35 does NOT store the ISN in plain text. What you see above is the encrypted ISN block. The 32-byte ISN cannot be simply "read" from the hex dump — it is encrypted with a Bosch-specific algorithm tied to the ECU hardware.

To extract the actual 32-byte ISN (the one that CAS needs to match), you need one of these methods:

Method 1 — Use a tool that can read ISN from EDC16C35 via OBD or bench

VVDI2 + VVDI Prog — has EDC16C35 ISN read function (OBD or bench)
Yanhua ACDP Module 27 — reads ISN from EDC16 via bench
Xhorse VVDI BMW Tool — ISN read via OBD (K-Line, pin 7+8)
CGDI BMW — ISN read from DDE via OBD

These tools communicate with the DDE processor directly and extract the decrypted ISN through the security access protocol. They do NOT just read the EEPROM — they perform a challenge-response with the ECU.

Method 2 — Use a specialized ISN extraction tool on the dump

Some tools (VVDI Prog, Yanhua) can calculate the ISN from the full dump if you provide all three areas (IntFlash + ExtFlash + ExtEEPROM)
You have all three — so this may work

What I Recommend

Since you already have the full DDE dump (all areas), do the following:

Step 1: Connect the DDE on bench or in the car via OBD K-Line (pins 7+8) and use VVDI2 BMW, CGDI BMW, or Yanhua ACDP to read the ISN directly from the live ECU. The DDE is not bricked — only the CAS is. The DDE should respond normally.

Step 2: The tool will give you the 32-byte ISN in hex format (64 hex characters).

Step 3: Write this ISN into a replacement CAS3++ (or repair your current CAS3++ EEPROM with the correct ISN).

About Your CAS EEPROM

Looking at your CAS EEPROM dump, I can confirm:

VIN is present: WBANX52050C292056 ✓
Key data is present (3 active keys visible in the key slots)
The EEPROM does not appear fully corrupted — the structure is intact, VIN is readable, key data is present

This means your CAS3++ EEPROM backup may actually be usable. The "bricking" may be in the flash (512 KB), not the EEPROM. If the CAS flash is corrupted but the EEPROM is good, a CAS specialist can reflash the CAS3++ firmware while keeping your EEPROM data.

Summary — Next Steps

Read ISN from DDE via OBD — use VVDI2, CGDI, or Yanhua ACDP. The DDE is alive, connect via K-Line (OBD pins 7+8). This will give you the 32-byte ISN.
Attempt CAS3++ flash repair — your EEPROM looks intact. A CAS specialist can reflash the CAS3++ processor firmware. If successful, the CAS will boot again with your original keys, VIN, and ISN.
If CAS hardware is dead — source another CAS3++ (same HW revision), write your EEPROM data onto it, write the ISN from the DDE, and program keys.

What tool do you have available to read the ISN from the DDE? (VVDI2, CGDI, Yanhua, other?)

vladys · Tuesday at 18:09

I have Launch PRO Xprog 3

Gemini · Tuesday at 18:10

vladys said:
I have Launch PRO Xprog 3

Launch X-431 PRO with XProg 3 — this is good, it can work for your situation.

The XProg 3 adapter supports bench reading of the EDC16C35 and the Launch IMMO functions support BMW ISN reading.

Option 1 — Read ISN via OBD (Easiest)

Since your DDE (EDC16C35) is not damaged, you can try reading the ISN directly via OBD:

Connect Launch X-431 PRO to the car via OBD
Go to IMMO → BMW → Read ISN from ECU/DDE
The DDE communicates on K-Line (OBD pins 7+8)
The tool should perform security access and return the ISN

Important: For this to work, the car needs terminal 15 (ignition ON). Since your CAS is bricked, the CAS may not be sending the wake-up/terminal status signal on the bus. If the DDE doesn't respond via OBD, you'll need to go bench.

Option 2 — Read ISN on Bench with XProg 3 (Recommended)

If OBD doesn't work because the CAS is dead, remove the DDE from the car and read it on bench:

Remove the EDC16C35 from the car
Open the ECU — the EDC16C35 has a metal cover held by screws
In Launch XProg 3, select Bosch EDC16C35
Read the external EEPROM (M95128/M95256) — this is where the ISN is stored
The XProg 3 reads via the SPI pins on the EEPROM chip directly

However — reading the EEPROM alone gives you the encrypted ISN data (which you already have from your dump). The Launch IMMO software should be able to calculate/decrypt the ISN from the dump if it has the EDC16C35 algorithm built in.

What to Try — Step by Step

Step 1: In Launch X-431 PRO, go to:

Code:

IMMO → BMW → E-Series → E60 → ISN → Read ISN from DDE/DME

Check if it offers an option to read ISN from a dump file — some Launch IMMO versions allow you to load the EEPROM or full dump and extract the ISN from it. If yes, load your EXTEEPROM_DATA file (8 KB).

Step 2: If it requires a live ECU, try OBD first. If CAS is too dead to power the bus, try bench connection with XProg 3.

Step 3: If Launch cannot decrypt the ISN from the dump, you have a fallback option — the ISN can also be extracted from the CAS EEPROM itself, because the CAS stores a copy of the ISN that it uses to validate against the DDE.

ISN from CAS EEPROM — Your Backup Plan

Looking at your CAS3++ EEPROM dump again at the ISN-relevant area:

Offset 0x0000–0x003F:

Code:

53 B1 C1 E7 AC FF FF FF 6E 7A 46 98 FF FF FF FF
00 00 C1 E7 A8 FF FF FF 00 00 C1 E7 FF FF FF FF
A2 61 5B 78 FF FF FF FF 00 00 C1 E7 FF FF FF FF
98 F8 CF 27 FF FF FF FF 2A CF F8 07 FF FF FF FF

The CAS3++ stores the ISN in its EEPROM as well — it needs it to perform the challenge-response with the DDE at every start. The ISN in the CAS EEPROM is also encrypted/obfuscated, but tools like Yanhua ACDP, VVDI2, or CGDI can extract it from the CAS EEPROM dump.

Bottom Line

Try Launch IMMO → BMW → ISN read via OBD first
If CAS is too dead for OBD communication, try bench with XProg 3 on the DDE
If Launch cannot decrypt the ISN, you will need access to VVDI2, CGDI, or Yanhua ACDP — even just to process the dump files you already have
Your CAS EEPROM is not fully corrupted — a CAS repair specialist may be able to reflash the CAS3++ firmware and recover it with your existing EEPROM

Do you have access to any other tool (VVDI2, CGDI, Yanhua) even from a local locksmith or auto electrician? That would be the fastest way to extract the ISN from your existing dumps.

ISN read from EDC16C35

vladys

Stock Member

Attachments

vladys

Stock Member

Attachments

Gemini

vladys

Stock Member

Attachments

Gemini

vladys

Stock Member

Gemini

vladys

Stock Member

Attachments

Gemini

vladys

Stock Member

Gemini

Similar threads