BMW M3 Forum
BMW M3 Forum BMW M3 Gallery BMW M3 Reviews BMW M3 Social Groups BMW M3 Chat M3Forum Sponsors >>
Loading


Mobile M3forum
Go Back   BMW M3 Forum.com (E30 M3 | E36 M3 | E46 M3 | E92 M3 | F80/X) > BMW M3 Discussions > E90 M3 (Sedan) | E92 M3 (Coupe) | E93 M3 (Convertible) (2008-2013)
Tire Rack Buy Winter Tires Now!
Not a member? Register Now!
Register Gallery All Albums Garage Search Today's Posts Mark Forums Read Calendar FAQ

E90 M3 (Sedan) | E92 M3 (Coupe) | E93 M3 (Convertible) (2008-2013) {Engine: S65 - Max Hp: 414 hp (420 hp Euro) at 8,300 rpm / 295 lb/ft at 3,900 rpm}


Reply
 
Thread Tools Display Modes
Old Tue, Jan-02-2018, 10:29:25 PM   #11
terraphantm
Moderator
 
Join Date: Dec 2010
Posts: 11,052
In the garage:
Reputation: 11 terraphantm is on a distinguished road
Location: Philadelphia

United States




Default Re: Comprehensive MSS60 DME Information

Quote:
Originally Posted by MartynT View Post
Full reads/writes work perfectly with my Kess V2.

I haven't tried a partial either though but the writing occurs much quicker than the read.

I just wish it was quicker!
Is this all done through the OBDII port? If so it's probably the CAN gateway slowing things down. Same issue on the MSx8x. It deliberately slows down read requests, but writes can work at full speed.

In the case of the MSx8x, connecting to the DME directly speeds up reads considerably, but it's fast enough that the DME's buffer fills up and communications subsequently crash.
__________________
Jump to top terraphantm is offline   Reply With Quote
Sponsored Links
Register now and remove these ads
Old Tue, Jan-02-2018, 10:55:05 PM   #12
dpaul
Registered User
 
Join Date: Jun 2017
Posts: 8
Reputation: 0 dpaul is on a distinguished road

United States




Default Re: Comprehensive MSS60 DME Information

Hi Terra

Yes, OBDII. Just to be clear, by connecting directly to the DME do you mean hooking an DCAN cable directly? I can't read via BDM because "left" processor is locked. Unless you have discovered some way of unlocking it?

Curious part is that my clone KessV2 corrects the checksum for "full" writes but does not do so for "partial" writes. Too bad because "partial" writes (256Kb) take not more than 2 minutes, plenty fast for any application.

David
Jump to top dpaul is offline   Reply With Quote
Old Wed, Jan-03-2018, 07:30:04 AM   #13
MartynT
Registered User
 
MartynT's Avatar
 
Join Date: Aug 2012
Posts: 574
In the garage:
Reputation: 0 MartynT is on a distinguished road

United Kingdom




Default Re: Comprehensive MSS60 DME Information

Quote:
Originally Posted by terraphantm View Post
Is this all done through the OBDII port? If so it's probably the CAN gateway slowing things down. Same issue on the MSx8x. It deliberately slows down read requests, but writes can work at full speed.

In the case of the MSx8x, connecting to the DME directly speeds up reads considerably, but it's fast enough that the DME's buffer fills up and communications subsequently crash.
I'm not sure the CAN gateway is slowing the transfer down, the iFlash cable / software that Evolve/etc use can do a full read/write in about 40 mins and still goes via OBD.
Jump to top MartynT is offline   Reply With Quote
Old Thu, Jan-04-2018, 12:20:19 AM   #14
dpaul
Registered User
 
Join Date: Jun 2017
Posts: 8
Reputation: 0 dpaul is on a distinguished road

United States




Default Re: Comprehensive MSS60 DME Information

I wanted to correct an error I made in a previous post:

My KessV2 DOES correct the checksums for both full and partial writes. As it turned out, my first attempt at a partial write failed for other reasons (a somewhat troubling overwriting of 64 bytes at offset 0x80 with FF - this has not repeated on subsequent writes).

Partial writes are quite fast, around 2 minutes. So it is indeed a useful tool for tuning, if only one had an A2L or XDF to make sense of the map data or the patience and skills to make their own definition files.
Jump to top dpaul is offline   Reply With Quote
Old Tue, Jan-09-2018, 03:24:44 AM   #15
jcolley
Registered User
 
Join Date: Nov 2017
Posts: 3
Reputation: 0 jcolley is on a distinguished road

United States




Default Re: Comprehensive MSS60 DME Information

I'll tag along here and provide some input. Sorry I haven't gotten back to your email @dpaul, I will, just buried in too many things right now.

To clarify, when you BDM read the mss60, the port is *not* blocked. Most tools will read it out properly, just the internal flash portion of the one processor will be empty. I have spent a month or so starting at disassembly on both mss60 and mss65 and this is one area I've focused on. I will say I'm 99% certain how the data is filtered out, but haven't decided yet if I intend to make any commercial use of it.

Yes, I am on the commercial end of this, but got started on mss65 in the m5board effort that never went much of anywhere. At the time I was still active duty, but now find myself eking out a living playing with these cars and I haven't made up my mind yet how much I want to give away. I read every post about mss6x on pretty much every forum there is and it's only a matter of time, it will all be public. I just can't financially throw it all out there right now.

Most of my work at the moment is dedicated to R/E the mss6x for the purposes of reconstructing portions of the code in MoTeC's M1 Build to run and S65 and S85 on a MoTeC M1 series ECU. The torque manager, idle actuator CAN, throttle actuator CAN, IBS, SMG/DCT structures...these are all of the things I have in focus as my primary goal is to bring a standalone ECU option to the E6x Ms and E9x Ms that provides full functionality of all systems.

I have been staring at mss65 almost daily for about 4 years now and tuning the S85 for about 2 years now.

My interest in the BDM lock is not to remove it, but actually implement it on both processors for both mss60 and mss65. I'm probably 50% of the way there on that, just trying to get comfortable with the idea of altering assembly to insert code in the program area.

For reading and writing, I will say, for 99% of what you guys want to achieve, unless you plan on leading a project into IDA and going at some PPC disassembly, a full read is pretty much useless.

mss65 has had very minimal changes to the program and calibration structure over any iteration with exception of 520E which was never for use in the US. I've not had time to get into what the nuts and bolts differences are, but have full reads of every mss65 version from 60E up to 520E.

mss60 had some pretty significant reconstruction at some point, to include incorporating the BDM internal flash masking. I initially thought that these changes were in the boot area and would require access to some file not publicly available in ISTA/PROGMAN/etc, but that is not the case.

It stands to reason that if the lock was incorporated at some point down the line with an iLevel upgrade, it would be in a program version change for mss60. I mistakenly believed that this would be in the boot area and would require an elusive/rumored .0ba file and not in the .0pa or .0da files. I will save you all the time. The lock is not in the boot area.

As I said, I'm still undecided how much I am willing to give away, not that I know what I *want* to give away. I just need to get my revenue stream shifted away from reflash tuning and get a few motec projects running.
Jump to top jcolley is offline   Reply With Quote
Old Tue, Jan-09-2018, 04:42:55 AM   #16
dpaul
Registered User
 
Join Date: Jun 2017
Posts: 8
Reputation: 0 dpaul is on a distinguished road

United States




Default Re: Comprehensive MSS60 DME Information

Thanks jcolley for the info - yes, "locked" for me is shorthand for can't read the processor internal 512K. I was guessing the "lock" invokes hardware censorship described in the Fresscale MPC563 data sheet. The only documented method of clearing the censor bits also erases the flash module. But maybe I'm completely wrong - I'm neither a hardware nor software engineer. In the end, it doesn't really matter for most kinds of tuning

In any case, you are entitled to be compensated for the work you do and it appears that you've done plenty to further the efforts of others without compensation. I would not ask you to give more.

I have much less experience than most of the contributors here but I am enjoying the process of learning about the MSS60. I can make the following very simple contributions, which likely are already well known to many:

1) The latest available clone KessV2 v 5.017 is a perfectly fine tool for tuning. However, it is necessary to make a "full" read then a "full" write one time before partial writes are successful. After that, changes made to parameter area values are written quickly (~2 minutes) by "partial" writes without checksum errors or other issues. Precisely what is changed by the full read/write is not yet clear to me but there are only a few changes in the (readable) program code.

Offsets in the Kess full read are quite different than those reported by others using BDM or unspecified ODB tools. However, by comparison with 0da/0pa files converted to bin format, it looks to me that all the code/data is there. I believe Kess can read but not write to boot sector/AIF and possibly other areas.

2) There are a slew of 13 x 1 word diagnostic trouble code tables starting at 0xAC2 in the Kess partial read, and another set 64k later on (presumably referencing the other processor). Of particular interest to me are the tables headed by 2789 and 278A, codes for catalytic converter conversion banks 1 and 2. Zeroing out those tables eliminates the CEL if cats are absent and the ODBII readiness flag for that function is never set.

I will spend the remainder of the winter making guesses about ignition, vanos and fueling tables. For obvious reasons, this was all way easier in my E90 335.

Last edited by dpaul; Tue, Jan-09-2018 at 04:57:03 AM.
Jump to top dpaul is offline   Reply With Quote
Old Sat, Jan-27-2018, 12:50:47 AM   #17
jcolley
Registered User
 
Join Date: Nov 2017
Posts: 3
Reputation: 0 jcolley is on a distinguished road

United States




Default Re: Comprehensive MSS60 DME Information

After a week of flashing every possible daten version all the way back to v32 then v28, I can confirm that the BDM "lock" is not removed by flashing back.
Jump to top jcolley is offline   Reply With Quote
Old Mon, Jan-29-2018, 02:54:04 PM   #18
dpaul
Registered User
 
Join Date: Jun 2017
Posts: 8
Reputation: 0 dpaul is on a distinguished road

United States




Default Re: Comprehensive MSS60 DME Information

I tried the same experiment with the same result (although the earliest daten I could find was associated with ProgmanV32 - 110E).
Jump to top dpaul is offline   Reply With Quote
Old Mon, May-28-2018, 10:19:08 PM   #19
amuse
Registered User
 
Join Date: Sep 2010
Posts: 3
Reputation: 0 amuse is on a distinguished road
Location: LAX

United States




Default Re: Comprehensive MSS60 DME Information

With the KESS/KTAG clones its best you rework your current PCB to make it more stable.
Apparently, in China the best KTAG PCB is the green one at the moment with Murata filters.
It still needs a PCB rework by replacing transistors from DigiKey.
Jump to top amuse is offline   Reply With Quote
Old Mon, May-28-2018, 10:28:41 PM   #20
cossie1
Registered User
 
Join Date: Dec 2013
Posts: 449
Reputation: 0 cossie1 is on a distinguished road

United Kingdom




Default Re: Comprehensive MSS60 DME Information

Just wondering, if an FGTech V54 any good for reading / writing MSS60 ?
Jump to top cossie1 is offline   Reply With Quote
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump



All times are GMT. The time now is 11:16:10 AM.


Powered by vBulletin® Version 3.8.6
Copyright ©2000 - 2018, Jelsoft Enterprises Ltd.
M3Forum.com and M3forum.net is in no way sponsored, endorsed or affiliated by or with BMW NA / BMW AG or any of it's subsidiaries or vendors.
BMW and M3 (E90 M3 | E92 M3 | E93 M3 | E46 M3 | E36 M3 | E30 M3) are registered trademarks of BMW AG.
M3Forum Terms of Service
Copyright 1999-2017 M3Forum.com
Discussing Comprehensive MSS60 DME Information in the E90 M3 (Sedan) | E92 M3 (Coupe) | E93 M3 (Convertible) (2008-2013) Forum - {Engine: S65 - Max Hp: 414 hp (420 hp Euro) at 8,300 rpm / 295 lb/ft at 3,900 rpm} at BMW M3 Forum.com (E30 M3 | E36 M3 | E46 M3 | E92 M3 | F80/X)