MSS60 Research

[pyth0n]

So there is no way to unbrick MSS60 in BDM with Ktag after Flashing RSA Bypass with cheap cable?

[Tomba]

i read this Thread in the end i find lot infos but nothing what Helps me i search Backup BDM (KTAG) for MSS60 most interessed on MPC maybe anone can help me here ??ß

You will need tool created by Vincent to unlock the processor. Contact MpowerE36 .

[obdshop]

i read this Thread in the end i find lot infos but nothing what Helps me i search Backup BDM (KTAG) for MSS60 most interessed on MPC maybe anone can help me here ??ß

[ppm008]

pshoey Do you know what version of SP-DATEN had the 080E? I have a half BDM read of one, but no full OBD read. Want to flash an mss60 with it from WinKFP and do some testing on it.

Z08E is an update released in Jul2008
Hardware 7841981 and soft EU 7841976 (ZB 7841975) US 7841978 (ZB 7841977)
If you need I could send

[adrianj73]

terra do you remember what OCD Speed setting you used with your Wiggler?

Also, seems my 5KW9586 ECU is BDM locked. I borrowed a Yanhua ACDP adapter that can read out either side - worked perfectly on my MSS65 but on the MSS60s I have, works on right side (obviously) but not on left side.

Interestingly, on 2 of the later ECU units, the error on the left side was CPU Encrypted but on the 9586 the error was "wrong model" (related to cpu identity).

I have one unit left to try, a 5KW9588 with 080E version of software. I'll open it up tomorrow if I get time.

It would seem to me that the "BDM lock" was introduced by a software update, given that the lock is software activated - I know you (@terra) disagree with that general opinion.

pshoey Do you know what version of SP-DATEN had the 080E? I have a half BDM read of one, but no full OBD read. Want to flash an mss60 with it from WinKFP and do some testing on it.

[Tomba]

That resistor to boot from external SRAM could be useful for recovering complete bricks.

This similar to SBOOT on newer ECUs?

https://github.com/bri3d/Simos18_SBOOT

[adrianj73]

Yeah I've written modified programs with no issue. RSA bypass needs to be done first

Nice. Are you open to doing similar RSA bypass for other BMW ECUs as paid work? Tried to PM you, won’t let me.

[terra]

Yeah I've written modified programs with no issue. RSA bypass needs to be done first

[adrianj73]

That's quite the resource there, much appreciated. That resistor to boot from external SRAM could be useful for recovering complete bricks.

A2Ls are hard to find for this DME. Only public one I'm aware of is from a prototype (which appears to be an old enough prototype to still be EWS3). Not sure how close the maps / config are to final.

I believe that if you take a known good A2L and use it as a template, you can delete all the unnecessary declarations for measurements, characteristics, functions, etc that aren’t pertinent to you tuning goal. Then with some R/E you can identify hex locations for the ones you want to keep in whatever version you’re creating the A2L for, correct the map addresses, sizes, etc. and it should work. One of my goals this year getting back into it. Realistically, live tuning you probably need access to less than 20-30 calibration curves. Everything else would be primarily configuration changes that can be done by standard reflash.

have you verified your flasher can write a modified program? I want to move a few functions and customize them to test and relocate and enlarge a few KLs and KFs.

[terra]

Not sure if this is posted already, but may be of use. mss65, but very little difference to mss60. Ionic measurement moved onboard for mss60 with no external modules, EWS4, that's about it.

Note that non-populated CAN transceiver spot on the board (sheet 3, grid E4) for the "messcan" that uses TouCAN C. There's a "messcan" flag in the calibration area that switches the directionality of TouCAN C IIRC. This is used for high speed data logging in the engine test cell and in development cars as well as the real-time tuning via Can Calibration Protocol (CCP) using the INCA tools. There's a good program called ASAP2Demo that can connect to the mss6x if you have a well defined A2L for it. The CCP code in the DME copies the calibration table contents to RAM and CCP connects the external messCAN connected device/software to make real-time changes. I was never clear of the external tool then saved a file to be flashed back in after or if the CCP subroutine then copies the modified tables in RAM back to the flash area.

That's quite the resource there, much appreciated. That resistor to boot from external SRAM could be useful for recovering complete bricks.

A2Ls are hard to find for this DME. Only public one I'm aware of is from a prototype (which appears to be an old enough prototype to still be EWS3). Not sure how close the maps / config are to final.

[Tomba]

Not sure if this is posted already, but may be of use. mss65, but very little difference to mss60. Ionic measurement moved onboard for mss60 with no external modules, EWS4, that's about it.

Note that non-populated CAN transceiver spot on the board (sheet 3, grid E4) for the "messcan" that uses TouCAN C. There's a "messcan" flag in the calibration area that switches the directionality of TouCAN C IIRC. This is used for high speed data logging in the engine test cell and in development cars as well as the real-time tuning via Can Calibration Protocol (CCP) using the INCA tools. There's a good program called ASAP2Demo that can connect to the mss6x if you have a well defined A2L for it. The CCP code in the DME copies the calibration table contents to RAM and CCP connects the external messCAN connected device/software to make real-time changes. I was never clear of the external tool then saved a file to be flashed back in after or if the CCP subroutine then copies the modified tables in RAM back to the flash area.

Main issue is getting a latest (241E) A2L for the ECU. Of course available but not public. All available I know off are likely pre-development which won't suit latest map layout, not to mention ram addresses for variables.
If available it would help a lot to map higher duration camshaft on that engine.

Very generous sharing such circuit diagram! Love it.

[adrianj73]

Not sure if this is posted already, but may be of use. mss65, but very little difference to mss60. Ionic measurement moved onboard for mss60 with no external modules, EWS4, that's about it.

Note that non-populated CAN transceiver spot on the board (sheet 3, grid E4) for the "messcan" that uses TouCAN C. There's a "messcan" flag in the calibration area that switches the directionality of TouCAN C IIRC. This is used for high speed data logging in the engine test cell and in development cars as well as the real-time tuning via Can Calibration Protocol (CCP) using the INCA tools. There's a good program called ASAP2Demo that can connect to the mss6x if you have a well defined A2L for it. The CCP code in the DME copies the calibration table contents to RAM and CCP connects the external messCAN connected device/software to make real-time changes. I was never clear of the external tool then saved a file to be flashed back in after or if the CCP subroutine then copies the modified tables in RAM back to the flash area.

[MpowerE36]

If you buy a new DME which is bdm locked (injection processor), you will not be able to make a clone of your bricked DME with your backup. Indeed, you will not be able to read and write in the flash memory of the injection processor (where are the VIN and the SK).

If you buy a new DME which is not bdm locked, you will be able to make a clone of your bricked DME with your backup. You can use a KTAG or FGTech for that.

Why don't you try to flash your backup in your bricked DME via bdm before buying a new DME ? Maybe the bdm access is not locked.

If it is locked, I can recover it for you but you will have to send me your DME.

[binary420]

If I Bricked my e92 m3 mss60 engine ecu with a incomplete update, and i want to buy a replacement ecu,
how important is the part number when searching for a replacement MSS60 ECU module?

If I want to flash my original backup from my original ECU, will any MSS60 work or am I limited to a narrower selection, or does it for some reason need to match exactly?

Real oem says they are retrospectively interchangeable so I assume any MSS60 will work to replace and flash with my 2008 MSS60 backup flash / tune files

And is just flashing my full backup to the new device all that is needed to re-populate my original VIN / SK or are there any other steps I'm missing to get that accomplished?

[boise567]

Do anyone knows what chips is for the oxygen sensor of DME mss65? I would like to replace that chip. Thanks