Welcome Guest. ( logon | register )   
FAQ Member List Albums Today's Posts Search

PointedThree :  Vans, Trucks, SUVs and Other Forums : W163 M-Class : Flaky AAM?

Page 1 of 1 1
Flaky AAM?
Topic Tools Message Format
Author
Posted 10/17/2006 12:30 AM
Wolfgang

Date registered: Dec 1899
Location:
Vehicle(s):
Flaky AAM?

cmitch - 10/16/2006 7:24 PM

They had the flaky and expensive sporadic AAM (all activity module) problems.



Hello Mitch. What is the problem with your "flaky and expensive sporadic AAM" in your 1999 ML430?

I have the original AAM and dont remember ever having a problem with mine.



#49127
Top of the page Bottom of the page
Author
Posted 10/17/2006 10:37 AM
cmitch
Expert




Date registered: Apr 2006
Location: Ala-Tenn
Vehicle(s): 2002 ML320, 2005 S430 4Matic, 2010 F150 Super Crew
Posts: 3412
2000
RE: Flaky AAM?

Mine, so far is not giving any more trouble but some owners on BW and other forums have been talking about this. Parkrog, a member at BW is really sore about his and is attempting a class action lawsuit against MB over the AAM's. I noted on my VMI that ours had been 'worked on' by the dealer when the first owner had it (I'm not sure it had been replaced, though likely it was). They quit recognizing keys and the dealer sells a new key to program in and it loses it's programming as well. After 8 keys, kiss the AAM goodbye and a new one is over $3,000. As I noted in the above thread, some guys are being told AFTER their warranty is out that the AAM is bad and requires replacement-on their dime! I've alreay lost one key and so far, the two I have are still okay, 1 year later. I know for a fact that 5 keys have been exhausted on mine (I have two, lost one to programming,1st owner lost one and had another replaced because of programming.). I'm keeping my fingers crossed because I have no more than three keys left and that would be bad to lose them.

I noted you had links in your web site about AAM's but I couldn't find any references to keys losing programming in the AAM.

#49175 - in reply to #49127
Top of the page Bottom of the page
Author
Posted 10/17/2006 11:04 AM
cmitch
Expert




Date registered: Apr 2006
Location: Ala-Tenn
Vehicle(s): 2002 ML320, 2005 S430 4Matic, 2010 F150 Super Crew
Posts: 3412
2000
RE: Flaky AAM?

Here's some related tech info on the 98-99 AAM:




Attachments
----------------
Attachments 316 HO AAM, Key replacement 98-99.pdf (99KB - 241 downloads)
#49179 - in reply to #49127
Top of the page Bottom of the page
Author
Posted 10/17/2006 1:44 PM
Wolfgang

Date registered: Dec 1899
Location:
Vehicle(s):
RE: Flaky AAM?

cmitch - 10/17/2006 7:37 AM

I noted you had links in your web site about AAM's but I couldn't find any references to keys losing programming in the AAM.



At one time there was more info about the key system including the AAM and immobiliser on the site. But I have removed most of it since it is part of the theft protection system. The manufacturer has also removed it on their site.

Some guys have figured the system out and stolen cars by making false keys. For example according to some press reports a kid made some S-Class keys and drove off with a new S-Class. When police used TeleAid to locate the car, and drove up to it, in a Frys' parking lot, it turned out to be yet another stolen S-Class, which he had also apparently succeeded to make keys for and change its identity.

So it is not likely that MB will make it easier to enable new keys for example by letting you simply install a new AAM and immobiliser without also requiring a new engine ECU or lockset. Requiring the new ECU is what makes it expensive, since the AAM using the part number of the document you posted costs just $187.87 and the immobiliser $89.25. If those were the only components required then the thief willing to spend some $300 could potentially just install a new AAM and immobiliser and drive off with your ML...

With the present system, the thief at a minium must also figure out how to install a new ECU or fool it, increasing the theft protection.

Not that anyone would like to steal a preowned '99 ML - but that's another question.

Edited by Wolfgang 10/17/2006 2:00 PM
#49191 - in reply to #49175
Top of the page Bottom of the page
Author
Posted 10/17/2006 3:17 PM
cmitch
Expert




Date registered: Apr 2006
Location: Ala-Tenn
Vehicle(s): 2002 ML320, 2005 S430 4Matic, 2010 F150 Super Crew
Posts: 3412
2000
RE: Flaky AAM?

So the Main Computer has to be replaced?? WOW! I wonder why it was changed in the 2000 model year. The materials I posted only apply to the 98-99 year.
#49199 - in reply to #49127
Top of the page Bottom of the page
Author
Posted 10/17/2006 3:54 PM
Wolfgang

Date registered: Dec 1899
Location:
Vehicle(s):
RE: Flaky AAM?

cmitch - 10/17/2006 12:17 PM

I wonder why it was changed in the 2000 model year.


Starting with MY2000 the drive authorization system is no longer integrated with the AAM and the AAM was split into two the AAM and EAM to accomodate more functions. It became easier to replace a faulty AAM or EAM.






#49203 - in reply to #49199
Top of the page Bottom of the page
Author
Posted 10/18/2006 4:44 PM
Noodles

Date registered: Dec 1899
Location:
Vehicle(s):
RE: Flaky AAM?

So if I understand correctly the 99 and pevious MY do not need the ECU replaced only the AAM and the immobiliser? Or did I just misinterperate the info and the ECU also has to be replaced?

And as Wolfgang pointed out the system has been cracked and re-flashing firmware with bogus machine code is not very hard. Part of my career used to to writing assembly code for automation in the materials handling industry. If somebody has the op codes of the processors used and the encryption algo figured out then the security codes in the vehicle are not going to stop resourceful thieves.
#49357 - in reply to #49127
Top of the page Bottom of the page
Author
Posted 10/19/2006 1:33 PM
bigcatny

Date registered: Dec 1899
Location:
Vehicle(s):
Re: Flaky AAM?

A determined thief CAN and WILL steal anything regardless of the security employed.
#49468 - in reply to #49127
Top of the page Bottom of the page
Author
Posted 10/20/2006 1:10 PM
rudeney

Date registered: Dec 1899
Location:
Vehicle(s):
RE: Flaky AAM?

Wolfgang - 10/17/2006 2:54 PM
cmitch - 10/17/2006 12:17 PM I wonder why it was changed in the 2000 model year.
Starting with MY2000 the drive authorization system is no longer integrated with the AAM and the AAM was split into two the AAM and EAM to accomodate more functions. It became easier to replace a faulty AAM or EAM.

 

Just to add some information here,  in MY2002, for all W163’s except the ML55, the ECM was added to the Drive Authorization System.  What this means is that not only does the DAS module (which is either internal to the AAM for MY1998/1999 or a separate plug-in component for MY2000+) have to validate the key’s code, the ECM does too.  The loophole that was allowing some MBZ’s to be stolen was that DAS was sending a simple “OK to start” command across the CAN bus to the ECM.  This signal could actually be duplicated by either replacing the AAM or DAS module or simply by hacking the CAN signals.  Now that the ECM also has to validate the key, a thief would have to replace both the DAS and ECM modules; hacking CAN signals or just replacing the AAM/DAS would not work.

 

#49682 - in reply to #49203
Top of the page Bottom of the page
Author
Posted 10/20/2006 5:46 PM
Wolfgang

Date registered: Dec 1899
Location:
Vehicle(s):
RE: Flaky AAM?

rudeney - 10/20/2006 10:10 AM

Just to add some information here...



To add some more info here. Regarding the protocol the ML uses to authenticate a key. Up to and including model year 2000 it uses DAS2b encryption. And starting with model year 2001 in those models using ME2.8, that means not the ML55, the protocol was changed to DAS3. A resourceful thief can break either one, as Noodles and bigcatny pointed out.




Edited by Wolfgang 10/20/2006 6:03 PM
#49738 - in reply to #49682
Top of the page Bottom of the page
Author
Posted 10/20/2006 9:57 PM
Wolfgang

Date registered: Dec 1899
Location:
Vehicle(s):
RE: Flaky AAM?

Some more info. The drive authorisation scheme for a 1998 ML320. The key ring antenna reads the transponder code from the key and the drive authorisation system integrated with the AAM then authenticates with code via the CAN bus with the engine control unit (ECU). Once authenticated the car can be started. If the key is not authenticated one can still crank the engine, but it wont start.

#49764 - in reply to #49127
Top of the page Bottom of the page
Author
Posted 10/24/2006 4:42 PM
rudeney

Date registered: Dec 1899
Location:
Vehicle(s):
RE: Flaky AAM?

Wolfgang - 10/20/2006 4:46 PM
rudeney - 10/20/2006 10:10 AM Just to add some information here...
To add some more info here. Regarding the protocol the ML uses to authenticate a key. Up to and including model year 2000 it uses DAS2b encryption. And starting with model year 2001 in those models using ME2.8, that means not the ML55, the protocol was changed to DAS3. A resourceful thief can break either one, as Noodles and bigcatny pointed out.

You may be correct that the encryption protocol was changed to the DAS3 version in 2001, but DAS3 implementation was not completed until My2002 when the valet key was dropped.  The whole reason for the valet key under DAS2x was that it was used to program a virgin AAM at the factory.  For full “compliance” with DAS3, the ECM also has to validate the key’s code - not just accept the AAM’s validation with an “OK to start” signal.  Because of this, the AAM could no longer be programmed on the assembly line because there had to be a matching AAM *and* ECM installed in the vehicle, and field programming became too complex.  The pre-programmed AAM and ECM thus became part of the vehicle’s key set.  That’s when the valet key was discontinued.

As for a determined thief cracking the code, yes, that could happen, but it’s not going to happen in a dark parking lot in a seedy part of town.  It’s not like you could just plug in some sort of simple device and read the key codes or even duplicate them.  Well, I guess it’s feasible that such a device could be created, but the cost would be something out of the reach of the typical car thief.  My guess is that if you really wanted to steal a DAS3-equipped MBZ, it would be easier to steal the vehicle registration papers from the owner, then use them to claim yourself as a new owner and order a new key.

 

#50260 - in reply to #49738
Top of the page Bottom of the page
Author
Posted 10/24/2006 6:11 PM
Wolfgang

Date registered: Dec 1899
Location:
Vehicle(s):
RE: Flaky AAM?

rudeney - 10/24/2006 1:42 PM

the encryption protocol was changed to the DAS3 version in 2001, but DAS3 implementation was not completed until My2002



It's just a question how DAS 3 is defined. There are some MB mechancis who think none of the W163s has it because they lack the IR key.
For me it's simply the encryption protocol. But you are right, it took a couple years/steps to implement it progressively.

BTW, Mercedes could not believe either how easy it is to crack a DAS 3 W163, in a court case, and accused their legal opponent of fraud. So the
guy hires a pro who shows in front of running cameras how it's done, and it took less than 3 minutes. The episode aired on TV some time later.. UhUh.





Edited by Wolfgang 10/24/2006 6:13 PM
#50280 - in reply to #50260
Top of the page Bottom of the page
Author
Posted 2/23/2008 8:59 AM
cmitch
Expert




Date registered: Apr 2006
Location: Ala-Tenn
Vehicle(s): 2002 ML320, 2005 S430 4Matic, 2010 F150 Super Crew
Posts: 3412
2000
RE: Flaky AAM?

Well, lost another key on my 99 ML430. I guess I'm going to have to get another one. The batteries went down in the remote and when I replaced the batteries, it will not resynchronize. I've resynchronized it before with no problems but not this time.
#110987 - in reply to #49127
Top of the page Bottom of the page
Author
Posted 3/10/2008 3:14 PM
rudeney

Date registered: Dec 1899
Location:
Vehicle(s):
RE: Flaky AAM?

cmitch - 2/23/2008 7:59 AM Well, lost another key on my 99 ML430. I guess I'm going to have to get another one. The batteries went down in the remote and when I replaced the batteries, it will not resynchronize. I've resynchronized it before with no problems but not this time.

Keep in mind that the battery in the fob has absolutely nothing to do with the ignition system.  Think of the ML key as if you had a separate ignition key and remote control door lock fob that were glued together.  The battery only powers the remote control locking (RCL) portion.  The drive authorization (DAS) chip within the ignition key is actually powered by the RFID antenna in the truck’s ignition switch.

 

If the key will not start the truck, then it has become de-synchronized within DAS and will never again work.  There is one “connection” between DAS and RCL in the ML, and that is that a new or de-synchronized RCL fob can be re-synchronized as long as the key that it’s attached to can be recognized by DAS.  If that is the case, you can use the re-sync instructions.  So, if your key failed to start the truck, then it became de-synchronized within DAS.  If you then thought you’d change the battery in the fob, you cleared its RCL rolling code and thus it would need to be re-synchronized, but since DAS won’t accept the key, the whole thing is now toast.

 

#113468 - in reply to #110987
Top of the page Bottom of the page
Author
Posted 3/11/2008 10:30 AM
cmitch
Expert




Date registered: Apr 2006
Location: Ala-Tenn
Vehicle(s): 2002 ML320, 2005 S430 4Matic, 2010 F150 Super Crew
Posts: 3412
2000
RE: Flaky AAM?

rudeney - 3/10/2008 2:14 PM

cmitch - 2/23/2008 7:59 AM Well, lost another key on my 99 ML430. I guess I'm going to have to get another one. The batteries went down in the remote and when I replaced the batteries, it will not resynchronize. I've resynchronized it before with no problems but not this time.

Keep in mind that the battery in the fob has absolutely nothing to do with the ignition system. Think of the ML key as if you had a separate ignition key and remote control door lock fob that were glued together. The battery only powers the remote control locking (RCL) portion. The drive authorization (DAS) chip within the ignition key is actually powered by the RFID antenna in the truck’s ignition switch.

If the key will not start the truck, then it has become de-synchronized within DAS and will never again work. There is one “connection” between DAS and RCL in the ML, and that is that a new or de-synchronized RCL fob can be re-synchronized as long as the key that it’s attached to can be recognized by DAS. If that is the case, you can use the re-sync instructions. So, if your key failed to start the truck, then it became de-synchronized within DAS. If you then thought you’d change the battery in the fob, you cleared its RCL rolling code and thus it would need to be re-synchronized, but since DAS won’t accept the key, the whole thing is now toast.

 

Welcome back! Long time, no see!

The key will start the truck but it will not lock-unlock doors. According to the owner's manual, the key has to be resynced with the truck according to the outlined procedure. I performed the procedure 8 times and never got it to work but I've done it twice before, so I know it's supposed to work. What I've found out is that these keys, apparently, can only be resynced about 2 times, then they will no longer work locking or unlocking. I should have replaced the battery when I was having symptoms that it was going dead and then I would not have needed the resync procedure. Several on BW have stated in a thread that they lost their keys the same way and had to order another one. Even the dealer couldn't get them to lock, unlock.  

#113588 - in reply to #113468
Top of the page Bottom of the page
Author
Posted 3/12/2008 5:49 PM
rudeney

Date registered: Dec 1899
Location:
Vehicle(s):
RE: Flaky AAM?

cmitch - 3/11/2008 9:30 AM
Welcome back! Long time, no see!
The key will start the truck but it will not lock-unlock doors. According to the owner's manual, the key has to be resynced with the truck according to the outlined procedure. I performed the procedure 8 times and never got it to work but I've done it twice before, so I know it's supposed to work. What I've found out is that these keys, apparently, can only be resynced about 2 times, then they will no longer work locking or unlocking. I should have replaced the battery when I was having symptoms that it was going dead and then I would not have needed the resync procedure. Several on BW have stated in a thread that they lost their keys the same way and had to order another one. Even the dealer couldn't get them to lock, unlock. :confuzed:  


Thanks for the welcome back!  I still lurk around periodically just to make sure you boys stay inline! J
I am sure you are following the correct instructions, but just to make sure, this is how you re-sync a key:
Insert the key into the ignition and turn it to position 2.  Turn it back to position 0 and remove the key.  Within 60 seconds: press and hold the “LOCK” button, and while holding it down, press and release the “UNLOCK” button 5 times (about ½ a second per press).  Release the “LOCK” button, then press any of the fob’s buttons to complete the process.  This is for Oct. 1997 and later builds.  For earlier builds, it’s the same except for the key press sequence – press and hold “LOCK” and then press and hold “TRUNK” and hold both for 15 seconds, then release them and press any fob button twice to complete the process.  This should be done with all vehicle doors closed.
AFAIK, there is no “limit” as to how many times an RCL fob can be re-synced.  Basically what happens is that each time you press an RCL button, it sends a pseudo-random “rolling” code.  It is only pseudo-random because the next possible code can be calculated using a mathematical algorithm.  In fact it can calculate what the next possible 256 codes will be.  Upon receiving a valid code, the will now consider any of the next 256 possible codes as valid.  If your fob’s battery dies or if you  press a button more than 256 times when away from the truck, you will now start transmitting rolling codes outside of the AAM’s known valid set and thus the fob has become unsynchronized.  The re-sync process simple tells the AAM to accept the next incoming rolling code even though it isn’t one of those 256 that it would normally recognize.  Once it does that, it now has a new set of 256 possible valid codes it will accept. 
Keep in mind that this is a bit different from the rolling code system used by DAS.  It does not use a predictable pseudo-random rolling code.  Instead, the AAM chooses another rolling code at random and physically rewrites that to the RFID chip in the key.  If these ever get out of sync, there is no provision to correct it.  Even if you knew the rolling code that they key’s RFID chip now contains, there is no way to program the AAM to accept it.  Although you might find some mechanism for manually rewriting a new rolling code to the key’s RFID chip, there is really no way to know what the code is that he AAM expects.
So, if all this fails, my guess is that it’s a bad fob and not an AAM issue.   

 



Edited by rudeney 3/12/2008 5:50 PM
#113818 - in reply to #113588
Top of the page Bottom of the page
Author
Posted 12/5/2009 5:46 PM
texasdanml430

Date registered: Dec 1899
Location:
Vehicle(s):
Re: Flaky AAM?

so, does re-syncing the key just fix RCL issues? not DAS?

my truck wont start. 50 psi on the fuel rail, and fresh CPS.

keys lock and unlock the vehicle fine with remote control.

dead in the water, again

dan
#161461 - in reply to #113468
Top of the page Bottom of the page
Author
Posted 12/15/2009 10:36 AM
Mike's ML
Member


Date registered: May 2007
Location: Rhode Island
Vehicle(s): . 1990 190E 2.6, 1998 ML320, 2005 ML500SE
Posts: 25
25
Re: Flaky AAM?

My experience (twice in my 98ML) with a failed key / DAS is that the ML will start and run for about 1 second then the engine will die.
Mike
#162047 - in reply to #161461
Top of the page Bottom of the page
Author
Posted 2/28/2013 12:22 PM
ColoKarl
New user


Date registered: Feb 2013
Location:
Vehicle(s):
Posts: 1

Re: Flaky AAM?

This is an old thread - hopefully you guys are still here....

we have an ML430 (1999) that we have had for years.... unfortunately the prior owner(s) had lost all the keys - we had only the last one.... (I bet you know where this is going...)

SO - car is too good to scrap/part out but not worth spending over $3k for new computer etc.
We purchased an MLKEYProgrammer from overseas (Lithuania) together with new blades from Mercedes (from VIN) and old remotes for electronics plus new transponder chips.

We were able to program the chips - to key 1, 2, 3 and can verify with the real mercedes diagnostics... BUT car will not start. It looks like the first three lines in EEPROM were set to 0's ...

Any ideas?
#211797 - in reply to #49127
Top of the page Bottom of the page
« View previous thread :: View next thread »
Page 1 of 1 1
Forum Jump :
All times are EST.  The time is now 12:28:48 AM.

Execution: 0.392 seconds, 96 cached, 11 executed.