Verifying actual mileage
 

Good morning,

A friend of mine has seen a relatively low mileage at a dealers in Madrid. The car was imported to Spain from Taiwan.

An SG 2003 CSL with 26000 KM.

Given the low mileage and the mandarin paperwork actually tallying up. Are there are checks that can be done to assure the mileage being so low?

Thanks for any help

Yes, but it isn't easy and you need a specific software todo this. I am not aware of an easy way to check it. And if the guys who tampered with the mileage did an thorough job it will get tough.
Perhaps NZ_M3 will chime in, he knows all the bits and bytes on the csl ;)

Maybe a noob question but is it even possible the mileage could be tampered with?!

When you say thorough job of tampering with the mileage what do you mean? Is it's stored elsewhere on the car?

Thanks again.

No problem about the "noob" question. ;)
Yes of course its possible. The same holds true for virtually every car there is.
CSL's are just more prone to it, because when you can earn 30k $ with a few mouse clicks.. alot of people get greedy.

Yes, the mileage gets stored in various modules and cross-checked at startup. If they mis-match a indicator lights up. See Tamper Dot.

If you don't have the tools you can also ask your local bmw dealership to do a "used-car-check" for you. They can also look up the cars repair history, if its been serviced by a bmw dealer in the past.
You can cross check the BMW Repair History with the cars service book if they match. Also if there are any MOT/TÜV Records where the mileage gets recorded, check those too.

Thank you for your advice and taking the time to write up. Yes, the search for a low mileage CSL is not easy!

No Problem mate, good luck!

I'll give you guys a detailed summary what to check and how tonight when I have time to sit down and type it out!

The reality is if you really knows the ins and outs of the E46 chassis modules you will be able to fake mileage without being able to detect it - I will also let you guys know how this is done so you can look out for it.

Really looking forward to reading this, am sure there'll be a good few m3 and csl dealers/ sellers, quakeing in there boots ,to many multiple owner, low mile 14 year old cars to be believable in my opinion, ruins it for genuine cars and buyers..... :thumbs:

Ok so first things first

Two things to consider here:

1. Can the mileage be tampered with within the original modules?
- Yes absolutely! But it is almost always detectable if you know where to look.

2. Can you "freeze" the mileage of the car within the original modules and have it undetectable?
- again yes if you know what you are doing!!

I will address both below.

However - In my opinion the best way to determine if the mileage of a car seems consistent with the mileage shown on the cluster or key read out is to actually check the car over in detail by looking at things like:
- bushings - are they new if on a low mileage car?
- suspension? Check bolts that hold these assemblies - usually very obvious if changed and worn.
- undercoating - how much dirt build up in hard to clean places - under plastic sheilds, behind wiring covers, behind exhaust dust shields.
- look at the exhaust system - the higher the mileage the worse these look
- CV joints and boots - these are self explanatory and are perhaps the best indicators of true mileage of a car.
- lastly the seats. Lift the covering on driver and passenger seat and look at the foam on shoulder bolsters, hip bolsters and entry thigh bolsters. I can guarantee you that on a high mile car the blue memory foam on the csl seat bolsters (found around the shoulder and waist support area) will be ripped, and thr yellow type soft entry foam will also be ripped.

Part 1 tampering with mileage in original modules:

The E46 M3 CSL records mileage in the following modules only
- odometer/cluster clock under the motorola M35080V6 chipset
- Light Control Module in the eeprom
- EWS3 module Usually with 0D46J chipset
- keys - in the original remote key in the EML10030A immobliser chip or in valet key in the PCF7935 immobliser chip
- SMG module

That's it nothing else records mileage in our cars.
The dme keeps a record of mileage when it is updated so reading the UIF will give you those mileage on the date it is updated.

So how easy is it to tamper with these mileage? First you need to understand how it is updated!

The main recorder of mileage is the cluster and light module. These two modules check with each other every 50km-ish to see if the mileage matches. If it is more than this out the odometer triggers the tamper dot.

The ews module increments the mileage shown from the cluster and this is updated in the key each time it is used.

The smg module also pulls the mileage in an incremental update.

So how easy is it to change the mileage in each of these modules?
- some extremely easy. Here I will address each.

Light Module - provided it is not above firmware CI35 this module can be manipulated with tools like PA Soft to change vin and mileage easily. However without a matching cluster vin and mileage the tamper dot will show.

Smg module - this believe it or not has a reset function built in that allows the module to reset the recorded mileage and pull new mileage from whatever is shown on the cluster - again tools like PA Soft can reset this counter.

EWS module - quite a few tools out there now can manipulate this module and change mileage vin ect. Many of these tools however require you to remove the epoxy coating to the eeprom pins or ground one of the circuits. I only know of one tool that does not require this and is capable of manipulating this module through obd. So again reasonably easy.

Keys - the EML chipset in the original keys can be manipulated with an expensive tool. However this requires a security code to be broken before it can be done. And it does not always work. Cheaper tools can occassionally do it but again can be a bit hit and miss. The valet keys with the PCF chip can be swapped out for a blank one or rewritten with the right tools. What you will find with tampered cars is it will not have at least one original EML chiped key. Instead it will have clone keys that look like the real thing but carry the PCF chipset.

Instrument cluster/ odometer - can be completely disassembled and the motorola M35080v6 chipset swapped for a blank one. Or with the correct tool you can solder 7 lines to the back of the main cluster chip and manipulate the M35080v6 chipset that way. This however almost always leaves a clue and soldering tampering when you look on the back of the board. However with good equipment and soldeing tools this can be almost made undetectable.

So how do you check!?
- use INPA to check the cluster- if it has been disassembled by an amateur the needles might not be calibrated correctly. Under INPA there are functions that allow you to move the needles a certain preset degree - run these and you will notice uncalibrated cluster needles pointing at the wrong place when the function is run.
- pull the cluster out and check the back of the mainboard has no resoldering marks.
- make sure it has an original key that reads correctly on the official key reader at the dealership.
- pull the ews module under the dash and make sure the epoxy coating covering the main board and pins have not been Scratched away.
- use WINkFP to check DME and SMG module UIF (user information field) is consistent with mileage update and dates. You can almost always check. These with official dealer records.

I will do a separate post about "feezing" the mileage of these cars if there is a demand for it. But I am a little worried about posting this on a public forum just in case people use it to dupe mileage. So some feedback please if I should post this!!

Very thorough post as always. You first made it sound easy but im glad to hear some tampering would require soldering the PCB, i thought it was way easier.

Can the UIF be read without the flash counter...counting?
I dont remember it exactly but i think i only had the option to read it after i flashed the firmware? Could be wrong though.


About the Keys, i thought those don't track mileage on their own but rather dumps the current odometer mileage onto its "eeprom" everytime it is used?
At least thats what a BMW tech guy told me.


I really dont know what you are talking about :bigcry::bigcry:


As long as its not a guide on how to freeze it yourself but simply how to spot if it has been done to a car, i think its ok? If it isn't possible to tell only one part of the story maybe post it in the owners section?