Sunday, May 27, 2018

How to use KTM100 to read/write/tune/remap BMW M4

KTAG/KTM100 BMW M4 2016 Test: Success! 

Here is information provided is by su_root for educational purposes. Its sourced f80.bimmerpost.com

Disclaimer: su_root and obdexpress.co.uk will not be responsible for any direct or indirect damage that may occur to your property as a result of the information provided here.

KTAG/KTM100 with BDM frame and adapters is inbound. My intention is to document a regular guys attempt at homebrew DME/ECU tuning my 2016MY F82 M.

Attachments:
BMW-Bosch DME MEVD172G Wiring Guide:
 NT_BOSCH_MEVD172G_IROM_TC1797_BMW.pdf

Parts arrived this morning. Below are pictures of what was included in the box.
-KTAG/KTM100 Clone
-12v/1A AC Adapter
-USB2.0 A-to-B Cable
-Cables to wire up to the DME
How to use KTM100 to read/write/tune/remap BMW M4 1

How to use KTM100 to read/write/tune/remap BMW M4 2




Prepping Bench PC:
The instructions provided recommend the use of WinXP/7, disabling all network connections and malware detection programs. I was in a rush to stage the software and connect the flashing tool to ensure all was OK so I tested the following setup on a Win10Pro x64 machine. I also made the changes below before starting:
-Disable Driver Signature Enforcement - REQUIRED or Dimsport driver will not install and device will show as 'Unknown' under Device Manager
-Disable AV/Malware Software - I use Webroot/Defender and shut them off
-Disable LAN/WLAN adapters

After making the changes above to my PC I powered up the adapter and plugged in the USB cable. Windows warned me of the unsigned driver and continued the install.

Bringing up KTM100 I see all is recognized correctly. You can also see below that the DME is supported and a plugin is available to communicate with that DME and calculate the correct checksum. I think Im ready to start!
How to use KTM100 to read/write/tune/remap BMW M4 4

 How to use KTM100 to read/write/tune/remap BMW M4 3


Update: On Sunday I was able to get the car on the dyno and grab some factory numbers.

I want to thank the guys(one guy who runs the place) over at GarageYourself.com for providing some baseline Dyno runs on their DynoDynamics unit. For anyone in the SouthFlorida/Miami area that enjoys working on their own car but cant find the space or tools this place is quite unique. Drive in with your own car and they provide everything..car lifts, hand tools, air tools, tire changing machine, sand blaster and even a fabrication area with welding tools and an engine lathe. Very useful.
How to use KTM100 to read/write/tune/remap BMW M4 5

How to use KTM100 to read/write/tune/remap BMW M4 6




And now the results:
How to use KTM100 to read/write/tune/remap BMW M4 7



Phase 1 - Reading the DME:

Here she is. Bosch MEVD172G DME.

Below are a few pictures of the outside of the unit. I cleaned up a bit of sand around the unit to make sure nothing gets in while I attempt to open it up.
How to use KTM100 to read/write/tune/remap BMW M4 8

How to use KTM100 to read/write/tune/remap BMW M4 9

After about 30 minutes with a small blade going around the edges of the unit I was able to open the casing up. Luckily the components are not close to the edge of the case so as you're going around it with a blade you don't have to worry too much. But as always be careful not to jam the blade too deep; you may accidentally damage some of the surface mounted components.
How to use KTM100 to read/write/tune/remap BMW M4 10

How to use KTM100 to read/write/tune/remap BMW M4 12


Wired up the unit to the KTM100 clone using the PDF I posted earlier. Reading procedure is as follows:

1. Connect wires from the provided harnesses to the DME pins as shown in the Bosch PDF including BOOT pin.
2. Power ON KTM100 and connect to USB on PC
3. Launch KTM100 Application
4. Connect the harness side of the cables to the KTM100
5. Click 'ID' in KTM100 Application to verify DME communication.
6. Done. Now you can carry out the function you need (read/write/etc)
How to use KTM100 to read/write/tune/remap BMW M4 12

How to use KTM100 to read/write/tune/remap BMW M4 13

How to use KTM100 to read/write/tune/remap BMW M4 14

How to use KTM100 to read/write/tune/remap BMW M4 15




Phase 2 - Tuning:

You have two options:

1. Acquire and LEARN tuning software like WinOLS or similar, and spend time and resources on custom dyno tuning the car(which is quite honestly way above my level of expertise).

2. Take your dumped files and send them off to a tuner for tuning service. Most US tuners will flat out turn your business away. I wont call them out here but I would encourage you to contact them and listen to their response first hand. So USA is out. Sort of.

@protuningfreaks ProTuningFreaks (PTF) supports the DIY guys like myself and the Community. After sending my unencrypted DME files to them they validated all was green and offered to help. Kudos!


Update: I installed the DME back into the car yesterday afternoon. It was pretty nerve wrecking to sit in the car and push the 'Start' button. I was very confident I followed all the right steps but theres always that sense of uncertainty in the back of your mind. What if i damaged something? At that moment I didnt care if the remaps actually yielded any results; I was just hoping the car would crank back up. I held my breath, pushed 'Start' and the car sprung back to life. It was such a sense of accomplishment.

Thoughts..throttle response in noticeably sharper and the car definitely pulls harder. Unfortunately its been raining all day here in SFlorida and all the roads are wet so I havent attempted WOT.


IMPORTANT NOTES OF Phase 1 & 2:

What needs to be understood is that there are two phases to the process of tuning or remapping your DME.

Phase 1- gaining read/write access to the DME. Fxx DMEs are password protected(TPROT) and bootmode tools for Infinity Tricore DMEs have been available for some time from makers like EVC and CMD Flashtec to name a few. However, as you pointed out, these tools are prohibitively expensive for the DIY'er to attempt this on his/her own. The well established shops invest in these tools and eventually come to market with their software. Some see this as the easy phase since it's simply wiring up a few pins and clicking a button. Recently, clones of these tools have made their way to market. This brings the price to play way down and is what prompted this writeup.

Phase2- Tuning. Once you have your original DME file you have to edit it, aka remap it. Editing seems to work around the concept of maps. Maps are areas of the file that correspond to values like ignition timing or air fuel, etc. This isn't an exact science. More of an art some would say and takes time, resources and experience. I believe this is why we are just now seeing the tunes come to market. The mad scientists at respected shops have been hard at work on the dyno editing the different maps and are now ready to come to market with not only the performance remaps(HP/Torque), but also bonus remaps like 'ZCP burble' and GTS roar, etc.

Here is where I see the most value in my write up to the community. Once you dump your own DME you have a choice. 1)Do you learn to tune your own car or 2)you simply send your file to a European tuner like Heinz OLS(www.heinz-ols.be), Sedox Performance(sedox-performance.com), B&C Consulting(www.bcconsulting.be) or any of the US based tuners like ACM(www.autocouturemotoring.com) or VF(www.vfengineering.com). Point is having your own DME file opens up a world of options for tuning.

I'm still learning each day as I go through this process and some of my content may change as I learn and correct previous statements. Do not take my findings as law.


Update:

Update! After a quick checksum correction the new remapped MPC file has been successfully written to DME.
How to use KTM100 to read/write/tune/remap BMW M4 16

How to use KTM100 to read/write/tune/remap BMW M4 17

How to use KTM100 to read/write/tune/remap BMW M4 18


Remap is expected to deliver +70hp +130nm(95lb/ft tq). Also, top speed limiter has been increased to 300km/h (186mph)

It's not much to see but below is a Hexedit compare between my original file and the remapped file
How to use KTM100 to read/write/tune/remap BMW M4 19】


About my tuning on M4:

I am doing this as a DIY and I have zero intention to profit from this. The only benefit here is to my own M4.

Tuning in itself is a business. Tuners are very smart and knowledgeable educated men/women who understand how engines work and fuel and timing boost and etc etc. Things I know nothing about. They spend hours on a dyno changing things here and there and developing better performance on a specific car. That knowledge they learn about a particular engine/car is the real asset, thats the actual product.

But if a master tuner(lets say Hoffman Tuning) is located in Florida, like I am - How could I tune cars all over the USA for all the M4 owners our there, without asking them to drive down here or pull&ship their DME's to me while at the same time protecting all the work I put into remapping this car.

Well, DME tuning in a business scenario for firms such as VF,ESS or ACM, Ive learned, is built on a master/slave system.

For example today...Hoffman-Tuning(H-T for short) can simply ask their customers to pull and ship their DME to them. In this scenario, H-T is the only person who ever opens/reads/writes the DME. There is no risk that someone see's what they change in the file to achieve their performance gains. Shy of their own employees stealing their work.

But this scenario comes with a catch; how many of us actually can/want to take a wrench to your shiny new M4, risking damage, and then ship it off for 2-3 days while the car sits in a garage. All the while it can get lost in the mail, or stolen by UPS, or who knows what else could happen? Very few people actually can/want to do that. Which means their customer base is a very small percentage of M owners. Hence, very small earning potential considering the high cost to develop a tune from scratch.

But what M4 owners do want, is to drop off our M3/M4's early in the morning at an 'authorized H-T dealer' and let them take care of everything. We then pickup our car at night, pay the invoice, drive off and all is good in the world.

Except now theres a middle man, how can H-T protect their intellectual property from the peeping eyes of a dishonest mechanic who will copy the file for himself?

Back to what I said earlier, the official/legitimate tools used to read/write the DME are built on a master/slave system. H-T can hand the 'authorized dealer' a slave tool which is married to their master tool. The authorized shop then pulls the DME, opens it, connects the slave tool to the DME and reads it. Except what they read is an encrypted version of the DME files I mentioned earlier (mpc, eeprom, etc). The shop sends the encrypted file to H-T, who decrypts/unpacks the file with their master tool. Edits the file. Re-encrypts/packages the file. Then sends it back to the 'authorized dealer'. Who then writes the changes to the DME using their slave tool. Puts the car back together, and off you go.

In practice its a good system and it works, sortof. Genuine Master tools are expensive. Slave tools are even more expensive- so for VF/ESS/ACM to invest in a network of authorized dealers is a costly endeavor. And they need/should protect their property. They also need to make sure that the authorized shop has mechanics with the skillset not to damage the car.

Which brings up the issue with finger pointing. Take a look at the guy going through the horror story in the other thread. VF says its the shops fault, the shop says its VFs fault. In the end everyone blames someone else and it will cost the owner time and money.
 

In any case, this has been a really interesting learning experience for me-especially on the tech side. Ive never worked on a car to the degree this has taken me. I've learned so much. Would I do it for someone else? Hell no. I dont need that kind of liability. Will I lend my master tool for anyone else willing to follow in my steps?...Sure, Ill teach you everything I know-knock yourself out.

As far as costs. BOM to date:
1. KTM100 Master Clone tool - $379 (OBDExpress.co.uk)
2. Craftsman 7-Piece External Torx Set - $38 (Sears.com)
3. BMW Coolant - $24 (BMW of Pembroke Pines)
4. F82 Remap - $0 (thanks Mike at Heinz-Performance.com)

Learning Experience...Priceless




BIG THANKS to su_root

Src:
http://www.obdexpress.co.uk/service/bmw-m4-f82-dme-ecu-read-write-tuning-guide-29714.html

Saturday, May 26, 2018

(Solved) Kess V2 5.017 Error UM 00:0000

In both Clone Red KESS V2 Ver.2.25 & Ver.2.23 it is impossible to write with "UM 00: 0000" error.
kess-v2-5.017-error-UM-00-0000
Customer solution 1:
I have same problem when writing file to L33 Phoenix as 00:UMM:000 comes up.
ID and reading goes fine, it's just when using writing mode error comes up.
Have used recovery ever since I found out that recovery writes the mod file with no problem on L33.
Just use recovery and it will write with no problem.
At least it works for me

It is possible and KTAG. The question is that the flooding of the drain is not a fact that will solve the problem, there the reason is quite amusing

Customer solution 2:
Cec recalculates controls...Yes, let at least 10 times to recalculate, if the curve breaks wine spoils.
There is no difference whatsoever to sew this block is not - starting from SDD ending with the cass, ktagom and others. But in crooked hands and the calculator hangs.
By the way, until I forgot) In Piasynew and Helpdesk helps, the connection points are shown somewhat incorrectly (in the case of this particular block), putting the block on the table will have to trace the board

Tech support from obdexpress.co.uk:
You should use Ksuite 2.23 with Kess V2 5.017. Real pros tested it for hundreds of times and you’ll have no issues of it.
Free: download Ksuite 2.23 and Winols 2.24- full ksuite, with helps and internet https://mega.nz/#!PoIm1DJL!G7m_TsNs8dMIiI1EmVc46uqHyFu7yFFcMKen37666qA
Protected

Tested 100%: download Ksuite 2.23 for Kess 5.017
http://www.obdexpress.co.uk/wholesale/kess-v5.017-ecu-online-version.html


Src:http://blog.obdexpress.co.uk/2018/05/26/kess-v2-5-017-ksuite-2-23-error-um-000000/

Sunday, May 20, 2018

KTAG Reads Bosch ME 9.7 from Mercedes S350 (W221) 2006

Can use ktag ecu programmer to work on ME 9.7 Mercedes S350 2006? How to do ?

Here we go:
Test: Ktag on ME 9.7 Mercedes S350 2006
Tool: Ktag programming tool China clone
Car: Mercedes S350 (W211) 2006
ECU: Bosch ME 9.7

Procedure:
Select a model in KTag software

KTAG Reads Bosch ME 9.7 from Mercedes S350 (W221) 2006 1

IMPORTANT: make a backup copy of the ECU
Connect the ECU to the Ktag programmer
Pin 2 = GND
Pin 15, 16 = +12V
KTAG Reads Bosch ME 9.7 from Mercedes S350 (W221) 2006 2

KTAG Reads Bosch ME 9.7 from Mercedes S350 (W221) 2006 3

KTAG Reads Bosch ME 9.7 from Mercedes S350 (W221) 2006 4

KTAG Reads Bosch ME 9.7 from Mercedes S350 (W221) 2006 5

 KTAG Reads Bosch ME 9.7 from Mercedes S350 (W221) 2006 6

KTAG Reads Bosch ME 9.7 from Mercedes S350 (W221) 2006 7

KTAG Reads Bosch ME 9.7 from Mercedes S350 (W221) 2006 8

KTAG Reads Bosch ME 9.7 from Mercedes S350 (W221) 2006 9

KTAG Reads Bosch ME 9.7 from Mercedes S350 (W221) 2006 10

Ktag is gonna to read Bosch Me 9.7 Mercedes (P102)
KTAG Reads Bosch ME 9.7 from Mercedes S350 (W221) 2006 11

KTAG Reads Bosch ME 9.7 from Mercedes S350 (W221) 2006 12

KTAG Reads Bosch ME 9.7 from Mercedes S350 (W221) 2006 13

KTAG Reads Bosch ME 9.7 from Mercedes S350 (W221) 2006 14

KTAG Reads Bosch ME 9.7 from Mercedes S350 (W221) 2006 16

KTAG Reads Bosch ME 9.7 from Mercedes S350 (W221) 2006 17


Success! Then save data.

Result: Ktag can read Me 9.7 Mercedes without any issue!


Src:
http://www.obdexpress.co.uk/service/how-ktag-reads-me-97-mercedes-s350-w221-2006-29709.html

Friday, May 18, 2018

Ktag 6.070 Ksuite 2.08 reads Ford Transit 2.2 SID 208

Firmware: Ktag 6.070
Software: Ksuite 2.08
Car: Ford Transit 2.2 cdi 2012g, block SID 208

Tips:
Ford Transit 2.2 cdi 2012g. block SID 208. It is necessary to remove the soot. The manual says that first you need to connect the K-Tag to the OBD connector with a cable 144300T108. Click on the ID and follow the instructions for unlocking, and then on the table you can merge and fill the firmware.

Cable 144300T108 pinout: 
KTAG_DB15 —> OBDII
11 ————> 04; 05 (Ground)
07 ————> 06 (CAN_H)
14 ————> 07 (K-Line)
15 ——- —–> 14 (CAN_L)
05 ————> 16 (Battery Power)
Note that It is unlocked on the table, if you do not plan to write in the outlet in the future, you can not unblock it.
ktag-cable-144300T108

Procedure: Ktag firmware 6.070 reading 2008 Ford Transit 2.2 SID 208
ktag-7.020-ford-transit-sid-208-1

ktag-7.020-ford-transit-sid-208-2

ktag-7.020-ford-transit-sid-208-3

ktag-7.020-ford-transit-sid-208-4

ktag-7.020-ford-transit-sid-208-5

ktag-7.020-ford-transit-sid-208-6

ktag-7.020-ford-transit-sid-208-7

ktag-7.020-ford-transit-sid-208-8

ktag-7.020-ford-transit-sid-208-10

ktag-7.020-ford-transit-sid-208-11

ktag-7.020-ford-transit-sid-208-12

Done!
Src:

Monday, May 7, 2018

Kess V2 Ksuite 2.47 vs Ksuite 2.23

This just some pictures talking about whats new in Ksuite 2.47 for Kess V2 5.017

7400 new vehicles!!!

THE MOST IMPORTANT NOTE:
Ksuite 2.47 is being tested for more ECUs. - Unknown workability on new engines
Ksuite 2.23 should be your best option so far (07-05-2018)

NEW KSUITE 2.47 Released Notes:

ADDED AND WORKINGS PROTOCOLS

CATERPILLAR A5E2 P 549
VOLVO 1.6 /2.0 CONTINENTAL SID807 P 489
FORD TRUCK FPT ENGINE BOSCH EDC7UC31 KLINE P 548
HUSQVARNA KEIHIN CAN P 554
ALL SIMOS 18 18.1 18.2 NEW GENERATION 4.5MB

AND MANY NEW VERSIONS 2017 ON SAME PROTOCOLS

MUCH CHECKSUMS BUG FIXED
 


Kess V2 Ksuite 2.47 (1

Kess V2 Ksuite 2.47 (2

Kess V2 Ksuite 2.47 (3

Kess V2 Ksuite 2.47 (4

Kess V2 Ksuite 2.47 (5

Kess V2 Ksuite 2.47 (6

Kess V2 Ksuite 2.47 (7

Kess V2 Ksuite 2.47 (9

Kess V2 Ksuite 2.47 (11

Kess V2 Ksuite 2.47 (12

Kess V2 Ksuite 2.47 (14

Kess V2 Ksuite 2.47 (15

Kess V2 Ksuite 2.47 (16

Kess V2 Ksuite 2.47 (17

Kess V2 Ksuite 2.47 (18

Kess V2 Ksuite 2.47 (19

Kess V2 Ksuite 2.47 (20

Kess V2 Ksuite 2.47 (21



Src: