Register New Key Fobs - DIY NVIS NATS

[Dario_BCS]

The currently registered fobs of the push button start 2011 Leaf were stolen. Is it possible to register new fobs without proprietary tools?

One plan is to put the BCM into a state that might be called 'auto-program' mode. This state might be similar to the result of 'erase all registered keys' by many a scanner. Then, by so far unknown steps, register the new fobs. Does anybody know how it was done at the factory?

My approach was to directly edit eeprom data. So far I have built an Arduino based SPI eeprom programmer, desoldered the 95640 eeprom from the VCM, and extracted a hex file of all 8192 bytes. Only obvious human readable data is the VIN # starting at decimal address 448.

Instead of reading the manual first, I think I now have to get into the BCM. Can anybody enlighten me how to recognize the registered keys in the eeprom data? ... or maybe another approach to the problem?

[VStar650CL]

I doubt the BCM even uses a discrete EEPROM, I believe they all use flash onboard the main processor. IIRC some of the SEC's (prehistoric ancestor of the BCM) used EEP, but I think you'll need a programmer that knows how to talk to the BCM microcontroller. That probably means buying a development system from ST or whoever else happened to make the chip. Good luck, I personally wouldn't even consider trying it.

[Dario_BCS]

Ok, got the 95640 eeprom back on the VCM PCB. Next, I would like to bench test the VCM, at least to the point of reading the CAN bus. Turns out the VCM performs a gateway function between the EV System CAN (high voltage and drive system ECUs) and the 'standard' CAN (7 or so ECUs), and therefore has 4 CAN pins. Trying to wake up the VCM, 12 volts applied to pins #1 PWR(on) and #6 PWR(batt) pins, and #4 and #8 to GND.
Current draw PWR(batt) was ~0.3 mA, PWR(on) briefly ~90 mA settling in a second to ~55 mA.
But CAN traffic on any of the 4 pins did not appear. Anyone know what other signals I might need to apply to wake the VCM up on the bench?

The BCM was a very easy to open, and remove the at least double sided PCB. IC7 with 'RL76' marking, might be a BRL93L76RF (aka 93C76), 8-pin SOP, 8Mbit, Microwire (strict subset predecessor of SPI, 3-wire half-duplex, mode 0, 2 MHz), if it is a true 3-wire - select, clock, and shared input/output, might need bit banging to read, GND at pin #5 leads me to believe that IC7 is the BR93LXXRF variant, rather than the BR93LXXR. Further, high resistance across Dinput pin #3 and Doutput #4 indicates IC7 probably communicates not as a true 3-wire, but via the now better known 3-wire, aka SPI. Can anyone confirm 'RL76' is an eeprom and can be read in circuit? ... meanwhile, back to bench testing the VCM.

[VStar650CL]

To wake the VCM up, you probably also need an ignition signal on pin 21 and a valid interlock signal on pin 23.

I won't comment on the rest except to say that reading bit-bang memories is always easy, decoding what the data means is -- well -- not Hemingway. Good luck.

[Dario_BCS]

Waking up the 2011 Leaf VCM for bench testing required supplying 12 volts to 3 pins (1,6,21) and ground to 2 pins (4,8). The combined current was 130 mA, once awake and generating CAN signals on both busses, the EV System CAN and the CAN for the rest of the car. Confirmed by viewing well formed CAN signals by oscope on the four bus lines. A DMM DC voltage was also seen as 3.1v and 1.9v.

[Dario_BCS]

Thanks VStar650CL, the 2011 Leaf VCM started outputting CAN signals without the interlock (23) signal. Deeper testing may reveal the importance of the high voltage interlock signal.

[VStar650CL]

The other end of the EV CANbus is the LBC, which also contains the other terminator resistor. They work together. The interlock showing open will cause the VCM to tell the LBC to kill both LB relays and shut down almost everything that requires a HV supply. I wasn't sure if the VCM would go online without a good interlock and a response from the LBC, but apparently it will.

[Dario_BCS]

BCM (body control module) opened much easier than the silicon sealed VCM.
On the bench, the BCM's CAN was active for only 10 seconds after each power up.

On this 2011 Leaf's BCM pcb, there is a Microwire eeprom marked 'RL76,' labelled as 'ic7.'
Using a BR93L76 datasheet and an Arduino I have extracted 1024 bytes.

Are key codes stored in the 'RL76?'
Can the eeprom be 'virginized?'
Is this not what commercial programmers do when asking to 'replace all keys?'
Which addresses specify key codes?
Are there other bytes that specify the number of keys registered?
If this eeprom can be 'virginized,' what would be the steps to get new keys added?

Intel HEX format
BR93L76RF EEPROM access with my massaged MicrowireEEPROM library.
Wiring: Uno/Nano(93xxx) COPI:11(3), CIPO:12(4), CK:9(2), CS:10(1) Clock period(us):2
EEPROM: Addr width:10 PAGES:512 x Page size:16 = bytes_memory:1024
Addresses first:0 count:512

Code: Select all

:10000000FFFFAADCAADCAADC6665666566654EEEC3
:100008004EEE4EEE00000000000000000000000070
:100010000000000200020002F77AF8EEF77AF8EE2C
:10001800F77AF8EEF87ACB31F87ACB31F87ACB3137
:10002000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE0
:10002800FFFFFFFFFFFFFFFFFFFFFFFFFFFFFEE5F3
:10003000000AFEE5000AFEE5000AFFFFFFFFFFFFE2
:1000380001430143FFFFFFFFFFFFFFFFFFFFFFFF3C
:10004000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC0
:10004800FFFFFFFFFFFFFFFFFFFFFFFFFFFF0000B6
:100050000000000000FFFFFFFFFFFFFFFFFFFFFFAB
:10005800FFFF0000FFFFFFFFFFFFFFFFFFFFFFFFA6
:10006000FFFFFFFFFFFF0009000B00030087FFFFFA
:10006800FCF0FFFFFCF0FFFFFCF0FFFFFFFFFFFFCE
:10007000FFFFFFFFFFFFD52DFF01D52DFF01D52D80
:10007800FF018093FF138093FF138093FF13D12D0B
:10008000FF53D12DFF53D12DFF53CE2DFF68CE2D21
:10008800FF68CE2DFF684E333041FF424E3330417A
:10009000FF424E333041FF424E333041FF414E3339
:100098003041FF414E333041FF41FFFFFFFFFFFF7B
:1000A000BDFFBDFFBDFF548F548F548F7ED87ED8C7
:1000A8007ED8302830283028411841184118100DC2
:1000B000100D100D0758075807580481048104815A
:1000B80064F264F264F29800B800B800100A100AFA
:1000C000100A504150415041A005A005A005004430
:1000C8000044004400A800A800A8FFFFFFFFFFFFAE
:1000D000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF30
:1000D800FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF28
:1000E000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF20
:1000E800FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF18
:1000F000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF10
:1000F800FFFFFFFFFFFFFFFFFFFF000100010001FF
:10010000EE8F118FEE8F118FF6CD128CFAEAF6CDAD
:10010800128CFAEAFC9AFE170117FC9AEB0F140FEF
:10011000000000000000000000000000FC9AFE1734
:100118000117FC9AEB0F140F00000000000000000C
:10012000000000000000000000000000FFFFFFFFD3
:10012800FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD7
:10013000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFCF
:10013800FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7
:10014000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBF
:10014800FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFB7
:10015000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFAF
:10015800FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA7
:10016000FFFFC0C0C0C0C0C1C0C0C1C0C0C0FFC0D0
:10016800C0C0004100000000004100000000000085
:10017000FF00004CA8000000FFFF000000FF00008F
:10017800000000A800A80000000000000000000027
:100180000000000000000000000000A800000000C7
:1001880000000000414141410000414100000000E1
:10019000000000000000000000000000000000005F
:10019800000000000000FFFFFFFFFFFFFFFFFFFF61
:1001A000003500000E00001300000E00001D0000CE
:1001A8000E00001F00000E00001006010F43FFFFA5
:1001B000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF4F
:1001B800FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF47
:1001C000FFFF00020010014000000000FFFFFFFFE2
:1001C800FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF37
:1001D000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF2F
:1001D800FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF27
:1001E000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1F
:1001E800FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF17
:1001F000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0F
:1001F800FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF07
:00000001FF