[GL071]

Hi Guys,
thought I would help us all demystify this link to a TCB/ATM and the embedded SIM card that is in these cars, to ultimately help anyone who's interested in going the whole way, part way or the emulator way.

So firstly - why would you even trust my post?
Well, for the last 12 years I’ve worked in the automotive and carrier (Telco) industry working on autonomous driving projects, infrastructure to support connected cars and C-V2X technology.

More to the point, I’m in the automotive electronics industry now working on this very technology, and i've worked in teams and designed, built and integrated many of these platforms for carriers.

The fundamental underpinning to any of this is a car that has a SIM connected to a mobile network and is integrated into vehicle software and sensors around the vehicle.

Myth 1 busted - you cannot use a 3G device on a 4G network. I dont knwo if the TCB is 3G only , or some running change made them 4G. But if a TCB or any device is 3G it can never operate on a 4G network. 3G & 4G very different, both in their signal propogation & transmission and the way they attach and live on a cellular network.
The other thing to be careful of, depending on what goes on in your specific country - is in the case of a SIM swap from TCB to ATM, not all carriers will allow that. They can segregate SIM's by their identity from attaching to specific networks, so just keep that in mind.

Because I am also looking to replace the TCB in my F15 with an ATM, I’ve been reading in forums quite often about the confusion of:
"how does BMW know what SIM I have in the car, and why is it linked to my VIN"
“Why cant I just put any SIM in a TCB/ATM”
" Why can’t you just change the VIN of a donor ATM and make it the same as in my car so I can keep my connected services?".

This is a very complex process layered in technology, security and commercial agreements - security being the biggest one. However I’ll do my best to explain the process in most general concepts, but there is always more than 1 way to skin a cat.

So let me start at the beginning.
VIN & ICCID/IMEI - When an OEM like Harman, Continental, Ficosa, LG (and many others ) make an ATM, DCM, TCB they solder in a SIM card at the production line.
That SIM card comes from a supplier like G&D or GEMALTO for example.
When a car company wants to do this, they work with their local carrier to cut a deal on voice, data & SMS for the connected cars.
Once that deal is done, the local carrier will order a whole bunch of hermetically sealed solder in SIM cards on a big reel/roll and ship them to the manufacturer of the ATM/TCB.
Or depending on the SIM card supplier, they may have cut a deal with, lets say Harman, then Harman give the local carrier the SIM identities to load into their local mobile phone systems, otherwise known as SIM management platforms.
The dominate global players here are Cisco & Ericsson (probably goes without saying for those in and around the IT industry)
Each of these SIM cards has a serial number & a phone number, but in the carrier world its known as an ICCID/IMEI.
OK - so up to this point we've got a SIM in a black box but no link to anything.

Next - There is a platform (I mentioned earlier) that every mobile carrier in the world has to manage this SIM (turn it on, off, give it access to services such as internet, and bill the person who paid for the sim in the first place.)
The platform has a record of each SIM's ICCID/IMEI.
Every carrier in the world has one or more of these platforms if they don’t they cant have a mobile phone network.
So now, depending on the carrier or SIM supplier, the carrier would know BMW Australia for example has ICCID/IMEI range 001~100,000 (I’m making up that number)- and these SIM cards are reserved for BMW connected drive customers.
Or pending supply arrangements - the other way around - BMW Australia, working with HARMAN would inform the local carrier of their choice , to expect ICCID/IMEI ranges 001~100,000 to pop up on their network at some stage, and when they do, please activate them and give them some internet and what ever else we've asked for, and bill us in our local currency at the rates we’ve agreed.

OK, but how does a SIM card know where it's going to be in the world, i mean it could be anywhere?? - You are right, this is complex, and again defined in 3GPP specifications - but in simple terms, all carriers in the world have a global lookup database (there's a number of parameters they share) but suffice to say, when the SIM card connects to a mobile network in any country for the first time, it says to ALL the broadcasting carrier networks "Hi, I'm new, i dont have a home yet, here is my ICCID/IMEI, can you all please tell me which network i should be homing too?", and only 1 network will respond, and it will be the network that has the ICCID/IMEI of that exact SIM card in it's data base. It's in part how global roaming works too, when you use your phone in a foreign country. From that point the carrier network sends some setting over the air to the SIM (e.g. APN, SMS gateway addres etc etc) so it can function just like a locally purchased SIM card. This is part of the Global SIM alliance (another body :-), told you it was complex.

So up until now, it's been really helpful to the product makers to link a SIM to a serial number of an ATM/TCB.
So Harman (As an example) know when they make them, SIM number XYX has been soldered into ATM serial number 123, test, tick, activate - in a car, job done, send that list (data base to BMW) so they can then allocate to a vehicle VIN

Again depending on supply arragements and production location, the ATM.TCB maker may have the job of matching the ATM/TCB serial number, to an ICCID/IMEI & VIN - but either way, it's at that manufacturing point that the 3 elements come together.

This is important because SIM serial numbers & phone numbers are HIGHLY government regulated all over the world.
In the worst example BMW need to absolutely prove to any government body that their SIM's aren’t burner SIM's being used for bad purposes (part of the reason for solder in, as well as reliability)
Adding to that, once a SIM card is dead, it can NEVER be re-used. Technically yes it can, it's just software, but regulatory - no you cant, and if you do, it's big big fines, jail etc - varies around the world.
So the carrier and car maker have to be 150% on their governance game with these SIM's and where they are.

As an aside - it is amazing how the humble SIM is moving rapidly & broadly into the identity and authentication space - just go have a read of a few white papers on Gemalto's web site, then link that to pending software SIM (eSIM) solution coming down the road!! fascinating.

Now - Here's the link of the SIM to a VIN:
So to be on top of all that, and make the process of managing to build a car with a VIN, ATM serial number and an ICCID/IMEI, the platforms that manage the SIM cards use the vehicle VIN as the cellular authentication method - what's that??
OK, so think back to dial up modems, you need a username & a password.
There are many ways to configure this in a SIM management platform, but in general terms the way that the car maker and carrier are sure that it's your car connecting to the mobile network, is that the mobile network asks the ATM to please send the stored VIN of vehicle before it will open up access to internet, or voice or SMS etc. And it does this as part of a pre-auth cellular attach process. This is all very well documented in 3GPP standards, there are no secrets how cellular auth works - but this is how it works for auto makers, and for those in the networking world, think of it exactly like the PPP process. It’s an out-of-band check of your credentials.
Now in a 3G world, it literally is like dialup , but in a 4G world it’s a semi-permanent connection, where you always hold a NAT’d IP address with the carrier, but you DON’T hold an open cell/radio channel (and you never will, radio air space is very expensive government property). Think of 4G like being half attached to the network, in a way for users, it just speeds up the connection process, coz the radio network already has a signal to your ATM/TCB, it only really has to check your authentication credentials and pass you on to your cellular data connection (e.g. internet), that way the ATM/TCB radio air interface doesnt have to spin CPU cycles, and rapid current draw to negotiate bandwidth with cell towers, it's partially done. This is part of what makes 4G better on latency over 3G. 3G when idel, always lives in an R99-FACH state, and has to ramp up to speed. TCP timeouts where a real bummer in a 3G world.

So now lets look at the question around TCB/ATM swap.
You get an ATM from another car, put it in your car.
In the forums you will notice that you will be asked to change the VIN in your Headunit to that of the ATM - because ultimately as the cellular authentication process activates and sends you upward in the software stack to BMW servers, passing on your credentials (VIN), BMW servers will see a mismatch.
ATM>VIN>IMEI = Tick correct (you now have internet access and authority to connect to BMW servers)
ATM VIN>HU VIN>BMW SERVERS = computer says NO to consuming individual services.
So that means for ever and eternity, you must change your HU VIN to match the ATM, and you can only buy BMW connected services on someone else’s VIN (personally, not great for resale, but that's just me, and it's not very factory feeling) – or alternatively , as others have suggested on forums, try and find a donor ATM that has a lot of BMW services already connected (booked) – reprogram your HU VIN and you can start using them.

So - next challenge – I want to keep my VIN the same - ok I’ll just de-solder the SIM from my TCB and install it in my ATM:
Right now, I wont go into the electrical compatibility of the SIM between TCB/ATM nor the baseband radio stack and it's ability to decrypt the SIM key - lets just assume that all that is 100% OK, and you can freely do a swap.
Now - if I go and resolder the SIM from my TCB and put in to an ATM without any programming, it wont work. Why?
Well, the ATM has the VIN of the of another car, with the IMEI/ICCID from my TCB (mismatch) = no internet access.
So now you need to go and reprogram the ATM VIN with your original VIN.
Now it means when the ATM fires up a 4G connection, on your SIM, it will send the newly programmed VIN of your car along with the SIM ICCID as username & password and you'll be authenticated into the carriers network. Everything matches - you now have internet.

Now once the ATM receives that confirmation back from the carrier that you are allowed to use their network, it sets up all it's internal in car networking stuff, and passes an ethernet or USB (NDIS) connection to the headunit, and you can begin to talk to BMW servers.
The BMW servers of course are going to be asking for headunit VIN, which of course has not changed, it's the same VIN that it left the factory when it was made.
Thus you can continue to use connected services on your VIN of your car, because at that point of consuming booked BMW services the ATM is largely out of the picture – it’s done it’s job of ensuring the ATM & SIM card prove who they say they are. The ATM is now just like your broadband modem at home, passes data in and out of the car.

What might be the risks here?
Well very small, if the ATM goes faulty in the future, and a dealer replaces it, they might find firstly your car never came with an ATM :-), and/or the ATM serial number doesn’t match the VIN – who cares there is no laws on ATM’s & TCB’s. Some small Warranty considerations perhaps??

The bigger risk, is damaging the SIM as you de-solder and re-solder to the new ATM


Anyway - this would all be much easier with a diagram of flows and clouds and things - but I hope this goes some way to helping you understand the reasons and logistics behind locking a VIN to a SIM and how you want to approach your project of NBT EVO upgrades with connected services.

And remember - if you could care less about connected services, you don’t need any of this info, you'll be going the emulator route.

[Kraftwerk AG]

Thanks for taking the time to explaining this in layman's terms. I too am considering the upgrade to Fxx NBT EVO, so this helps me understand the process much more clearly, whether it's the "whole way, part way or the emulator way" as you mentioned.

[GL071]

Originally Posted by Kraftwerk AG

Thanks for taking the time to explaining this in layman's terms. I too am considering the upgrade to Fxx NBT EVO, so this helps me understand the process much more clearly, whether it's the "whole way, part way or the emulator way" as you mentioned.

You are most welcome :-)

I'll let you know how i go woth my SIM swap from TCB to ATM :-) Steve from COdeMyBimmer is going to help me out with recoding the ATM , seeing as though i'm completly new to eSYS & ISTA :-).

[Kraftwerk AG]

Subscribed. Best of luck to you!

[psyki]

Interesting, thanks for sharing your knowledge. I recently did a retrofit of an NBT Evo along with an ATM (and emulator) and I was able to register for connecteddrive services online, everything works great, full functionality.

I've read anecdotally that people have been able to swap a SIM from their TCB into an ATM and receive services but this is the first I've heard about programming the ATM. I was confused by this line where you are discussing the process of swapping the SIM:

Originally Posted by GL071

So now you need to go and reprogram the ATM VIN with your original VIN.

I was under the impression that it was not possible to change the VIN of the ATM itself. Isn't that what you're accomplishing by swapping the SIM?

[cfm56d7b]

Amazing post by GL071.

In theory, the ATM module can malfunction and the BMW dealer has the capability to reprogram the ATM with original VIN.

Is the following possible?

- Customer buys ATM as a part from the dealer
- Customer asks the dealer to program ATM with customers vehicle VIN; dealer may say no ...
- The the customer moves SIM from TCB to ATM module (all caveats acknowledged)
- ATM and NBT Evo head unit are installed in the 2015 BMW X5 to continue using Connected Drive services after February 2022

[Kolianovskyi]

Originally Posted by psyki

Interesting, thanks for sharing your knowledge. I recently did a retrofit of an NBT Evo along with an ATM (and emulator) and I was able to register for connecteddrive services online, everything works great, full functionality.

I've read anecdotally that people have been able to swap a SIM from their TCB into an ATM and receive services but this is the first I've heard about programming the ATM. I was confused by this line where you are discussing the process of swapping the SIM:

I was under the impression that it was not possible to change the VIN of the ATM itself. Isn't that what you're accomplishing by swapping the SIM?

What is emulator and why do you need it?

[428iSoCal]

Originally Posted by GL071

I'll let you know how i go woth my SIM swap from TCB to ATM :-) Steve from COdeMyBimmer is going to help me out with recoding the ATM , seeing as though i'm completly new to eSYS & ISTA :-).

GL071, how did the swap and programming go? Were you able to complete the project? Please give us an update.

Thank you

[Napas]

Hi,

Thank you so much for the explanation

Question :
I have retrofit NBT Evo + transfer the esim from tcb to atm, connected drive services on, able to apps, login my connected drive user/password, even EVO was able to fetch my email mailbox - all fine at this level.

But remote services do not work
I don't seem to be able to send commands from BMW to my car anymore, even location does not work, or any commands from the app.

Do you have any idea on the why?

Suspicious that the imei of the atm box is not register to my car on BMW services and its generating this not sure.

[cfm56d7b]

Originally Posted by Napas

Hi,

Thank you so much for the explanation

Question :
I have retrofit NBT Evo + transfer the esim from tcb to atm, connected drive services on, able to apps, login my connected drive user/password, even EVO was able to fetch my email mailbox - all fine at this level.

But remote services do not work
I don't seem to be able to send commands from BMW to my car anymore, even location does not work, or any commands from the app.

Do you have any idea on the why?

Suspicious that the imei of the atm box is not register to my car on BMW services and its generating this not sure.

TCB and ATM devices have different IMEI numbers. While the esim card was moved from "one phone to another", BMW is not aware that the esim card is in a new phone. Vehicle specific services will not work until BMW completes the assignment of the esim card to the new IMEI in ATM unit.

Worth contacting BMW in your region and explaining that the TCB has been replaced with ATM unit.

[Napas]

Originally Posted by cfm56d7b

TCB and ATM devices have different IMEI numbers. While the esim card was moved from "one phone to another", BMW is not aware that the esim card is in a new phone. Vehicle specific services will not work until BMW completes the assignment of the esim card to the new IMEI in ATM unit.

Worth contacting BMW in your region and explaining that the TCB has been replaced with ATM unit.

I will try to ask BMW to update, hope they do!
Thank you

[Kolianovskyi]

Originally Posted by Napas

Hi,

Thank you so much for the explanation

Question :
I have retrofit NBT Evo + transfer the esim from tcb to atm, connected drive services on, able to apps, login my connected drive user/password, even EVO was able to fetch my email mailbox - all fine at this level.

But remote services do not work
I don't seem to be able to send commands from BMW to my car anymore, even location does not work, or any commands from the app.

Do you have any idea on the why?

Suspicious that the imei of the atm box is not register to my car on BMW services and its generating this not sure.

I have the same with my original tcb. RTTI, online search, weather, sos, works well. But remote services do not.

Connected drive support just saying there is a glitch and sos malfunction and I have to go to a dealership. Then a dealership says, well, do you have an error? Malfunction? Button does not work? No, nothing like that? Then what can we do here?

Stupid assholes.

[TheShadow]

I’ll take a wild guess that you retrofitted with a first generation NBT EVO unit denoted with a HW 2.x designation (Hardware 2.x where x is a number) shown on the HU white label under the disc slot.

You will never get the HW 2.x units to do all these features without using the internet connection from your paired Smartphone.

Companies that retrofit love the HW 2.x units. Why any end user would spend the money to retrofit anything besides a HW 4.1 unit is just beyond me.
For anyone transplanting an eSim into an ATM, that’s a fool’s mission as those eSim accounts get disconnected (in USA) end of February 2022.

There remains only 1 tried, true and confirmed way to retrofit NBT EVO and ATM while making everything work long term.

[428iSoCal]

Originally Posted by TheShadow

There remains only 1 tried, true and confirmed way to retrofit NBT EVO and ATM while making everything work long term.

And that would be? I am intrigued Shadow. Please tell us?

Thank you

[psyki]

Originally Posted by 428iSoCal

And that would be? I am intrigued Shadow. Please tell us?

Thank you

Purchase a known good (used) ATM and retrofit it along with the NBT Evo headunit. Used ATMs that work are kind of unicorns as in most cases they've already been registered online and cannot be registered again to a different connecteddrive account. Practically impossible to tell if it will work before you buy unless you trust the seller has checked themselves.

[TheShadow]

The same seller @psyki got his from. As I said. One tried, true and proven method.

And that person worked through all possible issues such as the 3G sunset for over a year before helping a few out like me. Because of this forethought, our units were all 2017+ units and will continue working without skipping a beat.

[Napas]

Originally Posted by TheShadow

I’ll take a wild guess that you retrofitted with a first generation NBT EVO unit denoted with a HW 2.x designation (Hardware 2.x where x is a number) shown on the HU white label under the disc slot.

You will never get the HW 2.x units to do all these features without using the internet connection from your paired Smartphone.

Companies that retrofit love the HW 2.x units. Why any end user would spend the money to retrofit anything besides a HW 4.1 unit is just beyond me.
For anyone transplanting an eSim into an ATM, that’s a fool’s mission as those eSim accounts get disconnected (in USA) end of February 2022.

There remains only 1 tried, true and confirmed way to retrofit NBT EVO and ATM while making everything work long term.

HW 4.1 was used, this was one of my initial requests.
My NBT Evo is from a G30 German
I have internet access all Connected Services work fine, only My remote Services are having a problem and i'm suspicions of the teleservices also.

I'm in Portugal we have no issues with 2G + 3G + 4G + 5G started and the the former will continue.

[TheShadow]

Originally Posted by Napas

HW 4.1 was used, this was one of my initial requests.
My NBT Evo is from a G30 German
I have internet access all Connected Services work fine, only My remote Services are having a problem and i'm suspicions of the teleservices also.

I'm in Portugal we have no issues with 2G + 3G + 4G + 5G started and the the former will continue.

You answered your own question. Just as a Smartphone must be provisioned by the carrier to operate as a Hotspot, your pre-ATM TCB unit does not have the provision for those features as they were not offered on vehicles pre-ATM.

So by transplanting an eSim from your TCB to an ATM you get the features the TCB originally offered, but none of the newer features.

As I have stated, only 1 method tried and verified with multiple users.

[Napas]

Thank you Shadow.

I don't really look for the new services beyond what I had in terms of outstanding new features.
Wanted better integration with phone, multimedia features.


The remote services I have lost since the retrofit, still researching for possible solutions 😏
It seems the imei is the issue, and there is no way to fix it.
Also trying to find more info on a custom TCB changed to work with EVO.

[Adrian_CRG]

Contributing to this as i did few SIM swaps for both my cars and few customers.
ATM comes in few versions, there is 3G and 4G ATM as well as roof mounted and trunk mounted. As far as i saw trunk version can be 3G and 4G while roof version is 4G only.

I swaped my TCB SIM to a 3G ATM trunk version without any issue and did this for about 5 cars. All Connected Drive Services are working including Remote Service as in CD Cockpit ICCID is still same and that is used to send data to car.

I tried swaping TCB SIM into 4G ATM both versions trunk and roof and always get SIM authentication error.

Now i am at a different point. SIMs in European BMWs are issued by T-Mobile Germany and Vodafone Netherlands. Dont know why and how BMW allocates this SIMs to cars.

As you may be aware 3G networks will be shutdown in Germany in 2022 so both my cars will loose Connected Drive and BMW does not have any solution for this at least for now.

So, i managed to order 2 x new 4G ATMs from a dealer that did not care what HW was in car factory fitted. I tried several dealers for about 3 months, all of them could not order ATMs on my VINs but finally i got one that delivered to me 2 brand new 4G ATMs trunk version.

Installed in my cars, flashed and coded, all Connected Drive services are working in car and connection is reported as LTE. Only Remote Services are not working because in CD Cockpit for my VINs old ICCID is still present, so basically BMW server is sending commands for remote to old SIM card not the new one.

Now i am trying all options to convince CD support to update ICCID to the new one. Tried local dealer who provided ATMs, few dealers in Germany, direct phone contact to CD support, even called from car using Customer Service option, sent several emails to CD support in Germany.

I am not succesfull to do this, all i get from CD support is "go back to dealer to update ICCID", dealer creates ticket for this and it gets closed in 1-2 days with message "HW not supported for VIN" and no further explanation.

I updated several times Online Services using dealer ISTA system with online connection as few years ago, when you did this ICCID is updated on Cockpit but now this dont work anymore.

So, now i am stuck at this point, i think need to find somebody actually working at BMW with access to update ICCID for my VINs, pay whatever it costs and have this done.

Open to any suggestions.

[TheShadow]

Originally Posted by Adrian_CRG

Contributing to this as i did few SIM swaps for both my cars and few customers.
ATM comes in few versions, there is 3G and 4G ATM as well as roof mounted and trunk mounted. As far as i saw trunk version can be 3G and 4G while roof version is 4G only.

I swaped my TCB SIM to a 3G ATM trunk version without any issue and did this for about 5 cars. All Connected Drive Services are working including Remote Service as in CD Cockpit ICCID is still same and that is used to send data to car.

I tried swaping TCB SIM into 4G ATM both versions trunk and roof and always get SIM authentication error.

Now i am at a different point. SIMs in European BMWs are issued by T-Mobile Germany and Vodafone Netherlands. Dont know why and how BMW allocates this SIMs to cars.

As you may be aware 3G networks will be shutdown in Germany in 2022 so both my cars will loose Connected Drive and BMW does not have any solution for this at least for now.

So, i managed to order 2 x new 4G ATMs from a dealer that did not care what HW was in car factory fitted. I tried several dealers for about 3 months, all of them could not order ATMs on my VINs but finally i got one that delivered to me 2 brand new 4G ATMs trunk version.

Installed in my cars, flashed and coded, all Connected Drive services are working in car and connection is reported as LTE. Only Remote Services are not working because in CD Cockpit for my VINs old ICCID is still present, so basically BMW server is sending commands for remote to old SIM card not the new one.

Now i am trying all options to convince CD support to update ICCID to the new one. Tried local dealer who provided ATMs, few dealers in Germany, direct phone contact to CD support, even called from car using Customer Service option, sent several emails to CD support in Germany.

I am not succesfull to do this, all i get from CD support is "go back to dealer to update ICCID", dealer creates ticket for this and it gets closed in 1-2 days with message "HW not supported for VIN" and no further explanation.

I updated several times Online Services using dealer ISTA system with online connection as few years ago, when you did this ICCID is updated on Cockpit but now this dont work anymore.

So, now i am stuck at this point, i think need to find somebody actually working at BMW with access to update ICCID for my VINs, pay whatever it costs and have this done.

Open to any suggestions.

You will not be successful. Even if you manage to somehow get the ICCID changed in the database, the offerings by Connected Drive/Online Services are tied to the VIN of the car AND THE SERVICES OFFERED AT THAT TIME.

There are multiple examples of this littered through the millions of posts on Bimmerpost and other Internet forums. And you will never get anyone in Connected Drive to change this.

You will not be able offered to renew Connected Drive/Online Services with your old VIN. No one can make that happen, correct ICCID or not.

That’s why there is only tried and true solution to making this work.

[Tuerkay]

Yeah TheShadow is right. You won´t be able to add/remove any CD Services.
If your car had the option to subscribe to Remote services, with ICCID change you would be able to use it. If it hadn´t remote services, you won´t be able to get them with your new ATM.

there are two BMW Dealers in my reagion and i know a few people working there. (sales, service, spareparts etc.)
All wanted to help me retrofitting an NBT Evo+ATM into my CIC+Combox F20 but after long discussions with the CD Department, they advised against buying an ATM with my VIN. Now i´m using an Donor ATM with more Subscription options than my original VIN.
Your CD Services are bound to your original VO. You can get retrofitted functions registered on the BMW servers but CD will only offer services that where available in factory state.

if even the BMW Dealer gets refused by the CD Department, your only option would be to find someone that works directly in the CD Department. Otherwise no one is able or willing to change anything.

There is only one guy i knew, which was able to do this retrofit. He was an Software engineer for BMW but got an new job, moved away and i lost any connection to him.