Siemens MS45

From MS4X Wiki
Jump to: navigation, search

Getting Started

At this time there is not a great deal of publicly available support for the MS45 or MS45.1 DMEs. They are a more advanced version of the MS43, and a precursor to the newer MSV70 DMEs found in newer BMWs such as the e90 platform cars.

The primary differences between MS45 and MS45.1 are that the MS45.1 adds wideband pre-cat O2 sensors and uses a MAF in the SAP. MS45.1 was primarily an emissions update and was only used in north american cars.

Software & Tools

The MS45 external flash is comprised of a large 1024kb block, which contains both the program space and the parameter space. If using PASoft to read from the DME, for example, a "full read" of the 1024kb block would be done from address 0x00000 to 0xFFF3F. The parameter space is a subsection located within that larger block and is approximately 128kb in size found from 0x40000 to 0x5CF7F. However some tools such as the Frieling Racing flash tool will write a full 128kb from 0x40000 to 0x5CFFF, which is fine, the extra bytes aren't used they are just filler basically.

At this time all your tuning changes will be in the 128kb parameter space.

Flashing software

These are the tools you would use to read or write a tune to your car. Their only job is to take a file, or tune, and get it onto the car, or read the current tune from the car so you can use a different piece of software to edit that tune.

Options have been very limited primarily due to the fact that the MS45 family DMEs employ 512bit RSA encryption in order to write a new tune over the OBDII port. Very few have cracked this so far, although with today's compute power it is totally possible using brute force tactics and only a couple days of time, and the know-how. So expect these options to grow over the next few years, but for now, it is what it is.

  1. BDM - Requires you to remove the DME from the car and have a bench setup with a laptop. The BDM100 uses a connector that is soldered to a BDM port on the back of the DME and will grant you full access to all of the onboard flash in the DME. Each time you flash a new tune to your car, you'll have to remove your DME, put it on the bench, flash it, and then reinstall in the car. Not very practical, and best used if you are going to begin deep disassembly of the DME, and at that point you dont need this wiki :)
  2. Frieling Racing - This is a tool that is licensed to tuners, not something a hobbyist would likely have or use. If you contact a tuner and they tell you they can tune your MS45/MS45.1 car remotely, this is the tool they are using. The tuner will send you a special OBDII-to-USB adapter and a small piece of software to load on a laptop so when they send you a ".mod" file you can simply load it on the car. Its fast and it works reliably, but again, typically only tuners use this software due to the licensing costs and its "encryption" of the tune files they send you to prevent sharing. It will correct the most basic checksum covering a majority of the parameter space, but does not automatically fix the checksum covering some torque monitoring parameters, you'll need to adjust those on your own.
  3. Bimmerlabs.com - Still in development, and partially available, bimmerlabs.com has the ability to take your tune in binary format (.bin) and convert it to a .0da file complete with fixed checksums (all of them). That is the exact file used by the BMW WinKFP tool to flash updated OEM BMW firmware to your DME. It does require you have a working installation of "BMW Tools" on your laptop (the suite of software from BMW that contains INPA, WinKPF, EDIBIAS, etc). It will provide you with a conveniently packaged batch file (.bat) that you can double click on that will automatically launch WinKFP and start the flash process without you needing to do anything else. It's very fast and uses a standard basic OBDII-to-USB cable that you can find on eBay, amazon, or bimmerlabs.com for about $30.
  4. MS45 Flasher by hassmaschine & TerraPhantm: see here for information: https://forum.e46fanatics.com/showthread.php?t=1248513

Tuning software

The tuning software is not required, as you can make all the changes to the file with a HEX editor as well, but then you propably wouldn't need this wiki ;)

Many tuning packages rely on definition files, or maps. These are not publicly available, and many tuners only have access to a very limited or partial map pack. The MS45 DME has over 2500 parameters! That said, only a fraction of those typically are changed when tuning these cars.

These tools expect that you already have a way to read and write to your DME using a flashing tool.

  1. WinOLS - This package is fairly expensive to license, although there is a freeware demo version that has some limitations. Its a general tuning package not specific to BMW or any particular DME. Requires a map pack, which is not provided by WinOLS. You have to either find your own maps or try to buy a map pack from someone. Really great tool for a professional tuner, but not ideal for the hobbyist.
  2. TunerPro - TunerPro is freeware and there are a lot of community provided map packs (.XDF files) but none publicly available for the MS45 DMEs.
  3. BimTun - Somewhat affordable and does not require a map pack, the maps are built-in, but the number of maps available are limited. Offers support for changing some of the more popular settings such as fueling, timing, etc. Does not have access to all parameters in the MS45, but does have a hex editor if you know what bytes you want to change.

Checksums and Signatures

There are at least two checksums in the MS45, and one of them is not very straightforward. You will either need to correct these checksums by hand, or you'll need your flashing tool to correct them for you on the fly during the flash process.

The primary checksum you'll deal with when editing values in the parameter space is found at 0x40100. The default checked region is 0x40200-0x5CFFF. It is a 32-bit CRC, using polynomial 04C11DB7, default initial value is 0xFFFFFFFF, no reflection, XOR out 00000000.

A second checksum, primarily for logical switches, is stored in the middle of the tune. This is equivalent to the "additional checksum" on the MS43. Like the MS43, this checksum can be disabled (val_mo3_swi_cal_cks -> 0xA5 -- address will vary based on program version).

The MS45 uses an RSA signature to validate flashed data. The parameter RSA signature is stored at 0x40170. The default signed regions are 0x40000 - 0x4016F and 0x40200 - 0x5CFFF. To flash over OBDII, a valid RSA signature is required.

Terminology

The acronyms are Siemens mapnames from the Funktionsbeschreibung.

The following list contains a selection of the most used terms. It's crucial to understand at least the major engine states like _is_, _pl_ and _fl_ to make sense out of the cryptical naming of the maps.

File:Abbreviations.pdf

Enginestate Description
as after start
cs cold start
es engine stopped
fl full load
is idle speed
pl part load
pu trailing throttle
puc trailing throttle fuel cut-off
r restart
st start

Fueling

Fuel Injection Maps

The lambda sensors for closed loop operation are narrowband for the MS45 and wideband for the MS45.1. Fuel trim learning for the MS45.0 only happens during closed loop operation, but the learned fuel trims do affect full throttle fueling as well. MS45.1 has a set of learned fuel trims for normal driving and a separate set for full load conditions.

There are several parameters that control when "full load" is determined, such as a minimum RPM, minimum operating temp, etc.

During full load the following table is used to define a lambda set-point:

  • ip_lamb_fl__n (Lambda full load enrichment)

MS45.1 will use short term trims during full load to try to maintain the lambda setpoints in ip_lamb_fl__n.

Additional fueling tweaks can be performed on the mass fuel flow correction tables directly (ip_mff_cor_1 and ip_mff_cor_2), but this shouldn't normally be necessary.

Non Stock Injector Maps

Changing the fuel injectors may be needed when charging your engine and therefore some constants and maps need to be tweaked.

You will have to calculate the difference in percentage of volume flow between stock and your new injectors.

The following scalars need to be adjusted accordingly:

  • c_ti_as (Global injection time correction)
  • c_ti_min (Minimum injection time)

Depending on the injectors you will have to finetune the injector latency compensation (injector dead times) as well:

  • ip_ti_add_dly (Injector dead time correction)

If the first 30 seconds of your cold starts are rough, you can try increasing these values to add more cold startup fuel before the wideband O2 sensors kick in for lambda control:

  • ip_fac_ti_tco_wup (Warm up basic factor)

Timing

Basic Timing Maps

"Basic ignition angle for RON 98" is the main table used with a healthy engine (so no VANOS fault codes, normal warmed up operating temperature) running RON98/PON93 gasoline.

There is a knock based interpolation between the RON91 and RON98 RON tables. The other tables should be kept safe.

  • ip_iga_bas_ron_98__n__maf (Basic ignition angle for RON 98)
  • ip_iga_bas_ron_91__n__maf (Basic ignition angle for RON 91)

Extra Features

Cat Delete

You can turn off the cat diagnostics by changing "Manual deactivation of cat diagnosis inhibition condition" to 1

  • lc_inh_cat_diag_man_deac (Manual deactivation of cat diagnosis inhibition condition)

If you want to quiet down the cold startup cycle you can disable the cat heating function by zero'ing out the values in:

  • ip_t_ch_tq_add (Activation time for CAT heating function 'IGA')
  • ip_t_ch_tq_add_is (Activation time for CAT heating function 'IGA at first idle phases')

If you completely remove your lower O2 sensors from the car you can turn off the diagnostics and heating functions:

  • lc_lsh_down_1 (Boolean variable to enable oxygen sensor heating)
  • lc_lsh_down_2 (Boolean variable to enable oxygen sensor heating)
  • lc_inh_ls_down_man_deac (Manual deactivation of downstream oxygen sensor diagnosis)

These will prevent the car from triggering an SES light and as far as the car is concerned it will be happy, but may or may not allow you to pass emissions testing in your state.

Secondary Air Pump

The SAP can be prevented from ever turning on by zero'ing out the "Time delay to terminate SA function" table:

  • ip_t_sa_off_0 (Time delay to terminate SA function)

There is also a ip_t_sa_off_1 table, but it does not appear to be used by the DME.

These parameters may also be of interest:

  • lc_inh_sa_man_deac (Manual deactivation of SA diagnosis inhibition conditions)
  • lc_inh_safm_man_deac (Constant to switch of the inhibition (=1))

Speed Limiter

Speed limiter is controlled by "Vehicle speed limitation threshold":

  • c_vs_max (Vehicle speed limitation threshold)

Set this to 255 to have unrestricted vehicle speed

Idle Speed

A handful of maps need to be edited if you want to change your idle speed.

Increase the lowest values in these tables up to your desired idle speed:

  • ip_n_sp_is (Nominal idle speed without additional load on the engine)
  • ip_acin_n_sp_is (Nominal idle speed with air conditioner switched on)
  • ip_dri_acin_n_sp_is (Nominal idle speed with DRIVE (A/T) engaged and air conditioner switched on)
  • ip_dri_n_sp_is (Nominal idle speed with DRIVE (A/T) engaged)

Increase all of these values equally (e.g. if you want to raise your idle by 100RPM, then increase all values in these tables by 100)

  • ip_n_sp_is_pl (Nominal idle speed at PL on the engine)
  • ip_n_sp_is_cs (Idle speed setpoint for drive-off-support - manual transmission)
  • ip_dri_n_sp_ch (Max. idle speed during CAT heating with drive engaged)
  • ip_n_sp_ch (Max. idle speed during CAT heating with no drive engaged)