|
|
SUPPORT ZPOST BY DOING YOUR TIRERACK SHOPPING FROM THIS BANNER, THANKS! |
Post Reply |
|
Thread Tools | Search this Thread |
11-25-2019, 02:50 PM | #1 |
Colonel
479
Rep 2,782
Posts
Drives: ESS/G-Power Z4M, VF Z4, 996tt
Join Date: Sep 2009
Location: Los Angeles
|
Want to tune your Z4 yourself? Check out Renovelo ByteTuner for MS45.0
Who?
2003-2005 Z4 owners with the Siemens MS45.0 ECU. ByteTuner for the Z4 3.0i has been released. Z4 2.5i software will be released shortly, pending beta testing. Contact Renovelo if you have tuning experience and want to beta test their 2.5i software. What? ByteTuner is an all-in-one software tuning suite. Using a $30 cable, a user can read and write to the ECU, tune the file (with thousands of parameters defined), and data log through OBD. When? Available now for $250. Black Friday and Cyber Monday discounts are in the works. Where? www.renovelo.com @renovelotuning on social media Why? Other options are available, both paid and free. None offer the complete package that ByteTuner offers, and no other tuning suite has every single map defined. Read/write: There are only a handful of options to flash the MS45 ECU: 1.) MS45 Flasher 2.) “Professional tuning tools” costing thousands of dollars (KTag, KessV2, CMD Flash, Dimsport Transdata and New Genius) 3.) ByteTuner MS45 Flasher offers the ability to read and write the ECU, but not edit. It has partial checksum corrections. MS45 Flasher successfully corrects the checksums that cover the area of the ECU where the basic maps are located, but it does not correct the torque tables, which must be tuned when adding forced induction or major engine modifications. MS45 Flasher setup is similar in difficulty to INPA, and without support since the software is freeware. As a paid program, ByteTuner’s instructions are thorough and explain the rationale to certain steps. ByteTuner setup was similar in difficulty to the setup of my professional tuning tools- not hard. Words can’t explain how much I appreciated the simple install. MS45 Flasher is freeware and comes with limited support via forums. My professional tuning tools cost $10k (plus $1800/yr in subscriptions) and allow unlimited cars to be written. ByteTuner is $250 and includes one vehicle license. Renovelo charges $200 to license additional vehicles. The cost of entry is significantly lower with ByteTuner. There are more than 20 software versions of MS45.0, even though the hardware may be the same. While the maps may be made up of identical values, they are located at different addresses in the ECU. Many professional tuning tools can only perform a “partial write” through OBD. A partial write is like it sounds- only part of the ECU is written, typically the calibration section where the ECU looks for values/maps (“parameters”). They cannot perform a “full write”, which alters the software version of the car, without physically cutting open the ECU and writing directly to the processor. If a tune is flashed onto an ECU from a different software version, the car won’t function, because the maps are not where the ECU expects them to be. Therefore, the tuner must create a separate tune for each software version of the ECU, and all parameters must be found individually when using other tools. ByteTuner overwrites the ECU’s software version upon its initial tune, so a tuner can make a single tune and copy it onto any M54B30 tuned with ByteTuner. This is a big advantage for ByteTuner, and it saves a lot of extraneous rework on the tuner’s end… not to mention that it eliminates the risk that a map could be misidentified when translating the tune among software versions. ByteTuner does not allow export of an unencrypted *.bin file (the standard ECU file format). It uses a proprietary *.dme2 format, which is encrypted and can only be read by ByteTuner. A tuner can’t pull a file from another source and write it to the ECU via ByteTuner. In order to remote tune a vehicle, both the tuner and customer need copies of ByteTuner. I don’t think I need to explain why giving a customer the ability to view or modify a tuned file isn’t the best idea. This is one of my two gripes, and fortunately Renovelo is already addressing it through the development of a limited, flash-only program to serve as an end-user tool. From what I understand, Renovelo has a functioning prototype, so I’d expect this to be a non-issue in short order. Tuning: The greatest feature of ByteTuner is that it has all maps defined. I was able to install Porsche 997tt injectors with the capacity to run flex fuel, and the car behaves like stock because I have access to the injector data. FYI, many tuning companies don’t adjust the injector values. They get away with it by using the smallest injectors possible that still get the job done. As a consequence, the tiny injectors leave minimal headroom for further power-adders. I’ve been able to solve the hesitation issues inherent in high boost MS45 applications, raise idle rpm to compensate for my lightweight flywheel, and tune out the SAP and rear O2 sensors. It’s even possible to modify the number of oxygen sensors the ECU uses for fuel trims down to a single primary O2 sensor (such as for a turbo manifold… hmmm…). I’ve used BMW Editor / Bim-Tun, which has a great interface but a limited number of maps defined. ECM Titanium, another expensive professional tuning program, is meant for tuning a lot of cars a little bit (think “stage 1” with stock hardware). It only has about 20-30 maps defined. I haven’t used Dimsport Race Evo, but I understand it’s similar to ECM Titanium. There aren’t any WinOLS definitions (“Super Map Packs”) available through authorized resellers. I even purchased two files at $300+ each hoping that they would be similar enough to my Z4’s file that I could reverse engineer them, but there were too many differences. If you want to truly tune your ECU, there are certain maps that must be adjusted, and they aren’t defined with any other off-the-shelf software. There is one other way to define all of the maps in the ECU, and it takes proprietary files (which I have) and hundreds of hours of software engineering to build the definition file into an existing program like WinOLS. Or, you can spend $250 and buy a proven program that also flashes tunes, corrects checksums, data logs, and offers excellent support. The next biggest advantage of ByteTuner is that it solves a checksum issue that arises when torque tables are modified. These tables must be tuned to have the car perform optimally, and a checksum has to be corrected when the tables are adjusted. If it’s not corrected, the car won’t start. To my knowledge, no other tuning software or tool corrects this checksum automatically. If you don’t know what a checksum is, don’t worry, because you won’t need to deal with them if you use ByteTuner. ByteTuner is not a hex editor, meaning you can’t manipulate or search the raw data in your car’s file. Then again, there shouldn’t be a need to do so, since the maps are defined. ECM Titanium does have some features that ByteTuner does not. Most importantly, ECM Titanium allows the tuner to load two files simultaneously. A “compare” function can be utilized to immediately find differences. Maps change color as they are modified, so the tuner can easily see which maps have been changed. This is helpful to ensure nothing is missed when tuning the 50+ maps necessary to build a good forced induction file. ECM Titanium offers the ability to revert to the original values at any time, as well as save maps. However, ByteTuner interfaces with Excel tables, and I’ve grown to like this method more because I can save all the maps into a single Excel file. ByteTuner has no subscription costs; ECM Titanium subscription costs are about $600/year, but the software is stored on a USB stick that can run on any computer. ByteTuner must be licensed for each computer on which it’s installed. Data Logging: ByteTuner includes all of the features of ByteLogger, which is similar to BMWLogger. ByteTuner can log parameters that are essential to the tuning process, such as load (mg/stk), fuel pressure, and oil temperature. Load is an axis value on spark, Vanos, and injection maps; a tuner needs to know what cell the car is operating in to know which direction to modify the calibration. I monitored fuel pressure when I started running flex fuel, since ethanol requires up to 30% more fuel flow than straight gasoline, and I’m pushing 10 psi of boost on a stock fuel pump. I prefer ByteTuner’s data logging features over BMWLogger, with the exception of one thing – Innovate LC-2 wideband integration. ByteTuner interfaces with a DATAQ multi-channel signal acquisition device, which is great for incorporating external sensors like boost pressure or WMI flow into data logs. However, I haven’t had good luck accurately capturing the analog voltage signal from the wideband. There seems to be too much noise to get a reliable reading, and I’ve tried it on multiple vehicles. This issue isn’t limited to the Z4, DATAQ, ByteTuner, or even the LC-2… a USB input directly into the laptop is generally superior to recapturing the analog output of a wideband controller. FWIW, HP Tuners has the same issue, and it’s considered to the gold standard among reflash tuning suites. Otherwise the DATAQ is a great feature, and it offers the tuner the ability to log almost any external sensor. The wideband signal capture resolution is my only other big gripe with ByteTuner besides the lack of an end-user flash tool. If you’ve read any of my product reviews on the forums, you’ll know that I tend to be brutally honest; just two gripes with an all-encompassing tuning suite is pretty amazing. I’ve followed up with Renovelo, and they’re working to integrate LC-2 support once they finish their end-user flash tool. So, both gripes will soon be addressed. Other Thoughts: Reflashing places an ECU in a vulnerable state; the first step is to erase the data that’s there. Having worked with many different tuning programs, nothing makes me more nervous than a buggy program with a half-finished interface. ByteTuner’s software is stable and aesthetically pleasing. The layout has been thought through. It’s obvious that considerable time was expended by talented people to develop the final product. The “feel” of the software is the cleanest and most polished of any tuning program I’ve used. It gives the tuner confidence that the program will perform as it should, and there’s no fear of bricking an expensive ECU. Conclusion: It’s rare to come across software that is extremely powerful yet easy to use. ByteTuner is the ONLY program that has all maps defined, all checksums corrected, and data logs all critical parameters via OBD. Its features are beautifully integrated. Once the end user flash tool is released and LC-2 support is added, it will be the only program needed to tune a Z4. Even without these features, it’s the best tuning suite at any price point. I’ve worked symbiotically with Renovelo for the past year or so, and I’ve been beta testing ByteTuner with success. I paid full price for the software. I was offered a partial reimbursement for my honest feedback and work as a beta tester, but I passed the discount on to a friend instead so that the forums could be assured an unbiased review. Overall score – 9.8/10!
__________________
|
11-25-2019, 06:05 PM | #2 |
Colonel
2430
Rep 2,705
Posts
Drives: Built not Bought 04 Z4 VF
Join Date: Feb 2013
Location: Kitchener Ontario Canada
|
I can highly recommend the Renovelo software and whole heartedly recommend Josh at Severn Tuning for his abilities and systematic approach to tuning the MS45.0 ECU.
The owner of Renovelo during an exchange of emails regarding the tuning software said to me...” I am in good hands “Josh is sharp”
__________________
W2A Intercooled Vortech V3Si, custom ducting, Alpha N, 60# Bosch,2.62 pulley, multi port WMI, Severn Tuning(pokeybritches), Tial, magnaflow,SS race muffler, 42 design,3.91LSD, H&R, Hotchkis,ST coils,Konis, Megan camber arms, AKG SS, Nylon mounts, Poly bushings, Carbon interior, CF Aero.APEX
|
Appreciate
2
pokeybritches479.00 Vanne1623.50 |
12-09-2019, 11:19 AM | #3 |
Down Under!!
1624
Rep 4,295
Posts |
Awesome to read and hear. My new tune is already in Josh's hands once my car is back together.
__________________
2007 EuroSpec Z4///MC - Building/Developing Z4 GT3
Powered by |
Appreciate
1
pokeybritches479.00 |
12-10-2019, 10:13 AM | #4 |
Hug the road... Carpe Asphalt
105
Rep 722
Posts |
Am I correct that there isnt a tune (hardware + software) for the E85/86 Z4M?
According to RealOEM my car has the following DME: Z4 E86 Z4 M3.2 Programmed control unit DME / MSS70 There's no MSS70 in the ByteTuner Vehicle Compatibility List. A few E46M's as well as S54's are available but they require a MSS54-type DME. Any development timeline for the MSS70?
__________________
2007 BMW ///M Coupe
|
Appreciate
0
|
12-13-2019, 01:05 PM | #5 | |
Colonel
479
Rep 2,782
Posts
Drives: ESS/G-Power Z4M, VF Z4, 996tt
Join Date: Sep 2009
Location: Los Angeles
|
Quote:
__________________
|
|
Appreciate
1
Residentj3553121.50 |
12-16-2019, 01:49 PM | #6 | |
Captain
253
Rep 775
Posts |
Quote:
Trick is the software. KessV2 is what most people use today I think. I've been toying with the idea of releasing MSS70 flashing software (I'm the author of the MS45 flasher, it wouldn't be a whole lot of work for me to make an MSS70 version). I'm not sure I want to release the RSA bypass method just yet, though it's not hard to figure out if you study what the paid tools do, or even freeware tools for other DMEs. Also regarding MS45 flasher, you can disable that secondary checksum by setting val_mo3_swi_cal_cks to 0xA5. I'd be happy to look up the exact address for the newest revisions MS45 if people really want (no point in looking it up for all 20 something versions when anyone can update via WinKFP. Or I guess I could just patch it in, it's not that hard. Last edited by Terraphantm; 12-16-2019 at 01:55 PM.. |
|
Appreciate
1
pokeybritches479.00 |
12-20-2019, 12:32 PM | #7 | |
Colonel
479
Rep 2,782
Posts
Drives: ESS/G-Power Z4M, VF Z4, 996tt
Join Date: Sep 2009
Location: Los Angeles
|
Quote:
WinOLS doesn't provide map explanations beyond the A2L either, so I guess WinOLS just offers an improved UI and tuning functions to do the same thing you could do with ASAP2 (or import the A2L into WinOLS if you have the paid add-on). One of the things I like about ByteTuner for MS45 is that there's no need to dig around the internet to find an A2L and *.bin for MS45. The maps are organized and laid out as soon as the software starts up. Like with MS43, at one point I experimented with setting val_mo3_swi_cal_cks to 0xA5 in MS45. I couldn't find val_mo3_swi_cal_cks with the first software version I tried, because there weren't any identifying patterns I could use to determine the offset of that specific parameter. Its address did not seem to be relative to other maps' addresses; rather it was "buried" somewhere in the file. I found it in the second version I tried, but disabling it didn't completely solve the checksum issue. Disabling val_mo3_swi_cal_cks did offer a roundabout solution though, which I was making due with until ByteTuner solved the checksum. Disabling val_mo3_swi_cal_cks allows the tuner to modify the load axis (mg/stk) in ip_tqi_ref__n__maf and ip_tqi_ref_mon, but not the actual values in the tables (newton-meters), so I was able to trick the ECU into calculating that it was making less torque. I'm not sure if the tables couldn't be modified because there's an additional checksum; or if one checksum's solution is included in the area monitored by another checksum (and so the order the solutions are determined makes a difference)... or something else. I was digging for a means to solve it myself when ByteTuner solved it. I assume it's a 32-bit CRC. Knowing how to do it would be useful, because MSS70 has similar tables and the same checksum issue. This is likely part of the reason why all aftermarket FI companies use alpha-n when they tune the Z4M: they can't modify the torque tables without figuring out the checksum, and alpha-n eliminates a lot of the background compensations. Only G-Power has figured it out in MSS70 AFAIK. MS45 Flasher is a great tool, and it's hard to complain about a product that a subject matter expert has developed on their own and offered for free. ByteTuner has a few advantages IMHO in terms of ease of use and knowledge / time required to go from “stock to tuned”.
__________________
|
|
Appreciate
0
|
12-20-2019, 10:45 PM | #8 |
Captain
253
Rep 775
Posts |
It's not a CRC. It's a little bit hard to explain, but essentially the DME starts with an initial value of 0x123456789ABCDEF, and in the checked range 4 byte are added at a time as a 32-bit number. The final sum is what the stored checksum should be.
On the MS45, the pointers to the start of the range is stored at 0x60620, and the end pointer is at 0x60624. Trouble is the location of the checksum itself does not have a hardcoded pointer location within the binary. So to correct it, I would either need to manually go through every MS45 variant and just hardcode the correct location, or I would need to limit support to the latest version. I could do a pattern search too (IIRC the speedometer factor is near there), but if those values are changed, I’d lose the pattern. I didn't like any of the solutions. On the MSS70 (and for that matter, the MSV70/80 and MSD80/81), BMW broke the 0xA5 bypass. So on those you either have to patch out the checksum routine in the program or calculate the checksum properly. The other way to cheat is to lookup what the DME *wants* to see by reading the correct ram addresses, and then writing that to the tune on a reflash. I used to do that until I figured out how to calculate the checksum. I have been tempted to convert my E46 M3 to run off an MSS70 (and modify the software to run a MAP sensor -- the code is actually all buried in there), but ultimately I'm not sure how much I would gain from that over the MSS54 with CSL software (and I'd lose some fun stuff like shift lights). Last edited by Terraphantm; 12-21-2019 at 09:19 AM.. |
Appreciate
0
|
12-22-2019, 11:20 AM | #9 |
Second Lieutenant
94
Rep 294
Posts |
Holy giant wall of text!
Quick question, does it come with an "off the shelf" tune or is this JUST the ability to go in and do a tune yourself? |
Appreciate
0
|
12-23-2019, 04:54 PM | #10 | ||||
Colonel
479
Rep 2,782
Posts
Drives: ESS/G-Power Z4M, VF Z4, 996tt
Join Date: Sep 2009
Location: Los Angeles
|
Great info! You’ve probably saved me a lot of headaches.
Quote:
Quote:
Quote:
Quote:
IMHO, the big advantage of MSS70 is the wideband O2 sensors. It comes with a base file, which is the same as a stock file. It doesn't come with a "performance tune" unless someone decides to create one and make it freeware.
__________________
|
||||
Appreciate
0
|
12-23-2019, 08:40 PM | #11 | |||
Captain
253
Rep 775
Posts |
Quote:
Subtract the FFE (and sometimes it'll be FFF). With the MS45, the FFE and FFF prefixes are for the external flash while the internal flash is mapped directly. Of course when disassembling most addresses are derived by adding/subtracting from a table of contents, but that's a bit outside of the scope here. FFE47340 (made up address) would map to 0x47340 in the external flash, or 0x7340 if you extracted the tune alone. Generally speaking I've found that the FFE prefixes are used to reference data within the parameter section and FFF for everything else on the external flash, but that's not a hard and fast rule. Quote:
Quote:
And yes I agree the main advantage is wideband O2s, which I would like to run. |
|||
Appreciate
0
|
12-24-2019, 12:40 AM | #12 | |
Colonel
479
Rep 2,782
Posts
Drives: ESS/G-Power Z4M, VF Z4, 996tt
Join Date: Sep 2009
Location: Los Angeles
|
Quote:
__________________
|
|
Appreciate
0
|
12-24-2019, 11:29 AM | #13 | |
Captain
253
Rep 775
Posts |
Quote:
Calculation is done the same way (start with 0x0123456789abcdef and add the values), but the high/low are flipped compared to the MS45. Using the example of adding 0xFFFFFFFF to the initial value, the checksum would be stored as 89ABCDEE 01234568 On the MSS70 820S/840S software, the checksum location appears to be 0x48ea8 / 0x8ea8 |
|
Appreciate
0
|
12-24-2019, 06:24 PM | #14 | |
Colonel
479
Rep 2,782
Posts
Drives: ESS/G-Power Z4M, VF Z4, 996tt
Join Date: Sep 2009
Location: Los Angeles
|
Quote:
For some reason I can't get the checksum calculator to work with the MSS70 *.bin files I have. The pointers make sense, and the data section they reference makes sense (which includes the torque-related tables, and a nice 00 start/end byte). c_rom_cks_cal_l is obviously a mess, but c_rom_cks_cal_h is only off by one increment: I'm calculating 012345FC when it should be 012345FD. It's the other way around in another MSS70 *.bin file I have, where my calculation is slightly higher than what the ECU wants to see. I've tried increasing/reducing the data area, reversing the start/end of the calculation, and reversing the byte pattern (so instead of adding ABCD1234, I tried reversing it to 4321DCBA)... pretty much any combination I could think of within that data section. Do you know if there's a 4-byte section of data that regularly changes in the section?
__________________
|
|
Appreciate
0
|
12-24-2019, 07:10 PM | #15 |
Captain
253
Rep 775
Posts |
I'm not sure, I haven't looked that closely. This script has consistently generated valid data for me:
Code:
import struct import sys def CalcMO3CS(binary): CSLocation = 0x48EA8 #Location of checksum cs = '' for i in range (0, 2): binary.seek(CSLocation + 4*i) cs += format(struct.unpack('>L',binary.read(4))[0],'02x').rjust(8,'0') #Reads high/low checksums, returns MSB first print ('Stored CS: ' + cs) binary.seek(0x803B4) #Location of MO3 start pointer start = struct.unpack('>L',binary.read(4))[0] # '>L' = Read as Big Endian Long Unsigned binary.seek(0x803B8) #Location of M03 end pointer end = struct.unpack('>L',binary.read(4))[0] index = start csCalc = 0x123456789ABCDEF while index < end : binary.seek(index - 0x800000) csCalc += struct.unpack('>L',binary.read(4))[0] index += 4 print ('Calculated CS: ' + format(csCalc,'02x').rjust(16,'0')[8:16] + format(csCalc,'02x').rjust(16,'0')[0:8]) if len(sys.argv) == 1: if sys.version_info[0] < 3: filename = raw_input("Enter path/filename: ") else: filename = input("Enter path/filename: ") print ("Note: You can also give filename as a command line argument\n") else: filename = sys.argv[1] data = open(filename,"rb") CalcMO3CS(data) |
Appreciate
0
|
12-27-2019, 01:21 PM | #16 | |
Colonel
479
Rep 2,782
Posts
Drives: ESS/G-Power Z4M, VF Z4, 996tt
Join Date: Sep 2009
Location: Los Angeles
|
Quote:
__________________
|
|
Appreciate
0
|
12-27-2019, 08:20 PM | #17 |
Captain
253
Rep 775
Posts |
I’m not sure how your tool would organize it, but the script is operating under the assumption that the file loaded is a dump of the external flash.
Last edited by Terraphantm; 12-28-2019 at 07:35 AM.. |
Appreciate
0
|
12-28-2019, 12:47 PM | #18 |
Colonel
479
Rep 2,782
Posts
Drives: ESS/G-Power Z4M, VF Z4, 996tt
Join Date: Sep 2009
Location: Los Angeles
|
I'll keep working with it. Thanks for your time!! I greatly appreciate the help!
__________________
|
Appreciate
0
|
04-06-2021, 06:53 AM | #19 |
Registered
0
Rep 1
Posts |
Hi folks, sorry for resurrecting an old post, but.
I have a Z4 E85 2.5i 192hp M54B25. I would like to DIY flash it if at all possible. I used to have a Saab 93 turbo, I took the ECU out, downloaded a hex file and flashing tool from the forum, wired up the recommended £30 CAN cable, and presto I had a great new map. Can the same be done here? Are there known good compiled/hex files and free or cheap software tools with recommended hardware and instructions to do this? I'm familiar with this type of work being an electronics and computer engineer all my life, but due to time limitations I basically need a file, a flasher and a cable I can join up and press flash. Thanks! |
Appreciate
0
|
Post Reply |
Bookmarks |
|
|