Siemens MS45

From MS4X Wiki
Revision as of 22:44, 5 March 2020 by Ryanknee (talk | contribs) (Cat Delete)
Jump to: navigation, search

Getting Started

The MS45 and MS45.1 are a more advanced version of the MS43, and a precursor to the newer MSV70 DMEs found in newer BMWs such as the e90 platform cars.

The primary differences between MS45 and MS45.1 are that the MS45.1 adds wideband pre-cat O2 sensors and uses a MAF in the SAP. MS45.1 was primarily an emissions update and was only used in north american cars.

Software & Tools

The MS45 external flash is comprised of a large 1024kb block, which contains both the program space and the parameter space. If using PASoft to read from the DME, for example, a "full read" of the 1024kb block would be done from address 0x00000 to 0xFFF3F. The parameter space is a subsection located within that larger block and is approximately 128kb in size found from 0x40000 to 0x5CF7F. However some tools such as the Frieling Racing flash tool will write a full 128kb from 0x40000 to 0x5CFFF, which is fine, the extra bytes aren't used they are just filler basically.

At this time all your tuning changes will be in the 128kb parameter space.

Flashing software

These are the tools you would use to read or write a tune to your car. Their only job is to take a file, or tune, and get it onto the car, or read the current tune from the car so you can use a different piece of software to edit that tune.

Options have been very limited primarily due to the fact that the MS45 family DMEs employ 512bit RSA encryption in order to write a new tune over the OBDII port. Very few have cracked this so far, although with today's compute power it is totally possible using brute force tactics and only a couple days of time, and the know-how. So expect these options to grow over the next few years, but for now, it is what it is.

  1. BDM - Requires you to remove the DME from the car and have a bench setup with a laptop. The BDM100 uses a connector that is soldered to a BDM port on the back of the DME and will grant you full access to all of the onboard flash in the DME. Each time you flash a new tune to your car, you'll have to remove your DME, put it on the bench, flash it, and then reinstall in the car. Not very practical, and best used if you are going to begin deep disassembly of the DME, and at that point you dont need this wiki :)
  2. Frieling Racing - This is a tool that is licensed to tuners, not something a hobbyist would likely have or use. If you contact a tuner and they tell you they can tune your MS45/MS45.1 car remotely, this is the tool they are using. The tuner will send you a special OBDII-to-USB adapter and a small piece of software to load on a laptop so when they send you a ".mod" file you can simply load it on the car. Its fast and it works reliably, but again, typically only tuners use this software due to the licensing costs and its "encryption" of the tune files they send you to prevent sharing. It will correct the most basic checksum covering a majority of the parameter space, but does not automatically fix the checksum covering some torque monitoring parameters, you'll need to adjust those on your own.
  3. Bimmerlabs.com - Still in development, and partially available, bimmerlabs.com has the ability to take your tune in binary format (.bin) and convert it to a .0da file complete with fixed checksums (all of them). That is the exact file used by the BMW WinKFP tool to flash updated OEM BMW firmware to your DME. It does require you have a working installation of "BMW Tools" on your laptop (the suite of software from BMW that contains INPA, WinKPF, EDIBIAS, etc). It will provide you with a conveniently packaged batch file (.bat) that you can double click on that will automatically launch WinKFP and start the flash process without you needing to do anything else. It's very fast and uses a standard basic OBDII-to-USB cable that you can find on eBay, amazon, or bimmerlabs.com for about $30.
  4. MS45 Flasher by hassmaschine & TerraPhantm: see here for information: https://forum.e46fanatics.com/showthread.php?t=1248513
  5. Renovelo ByteTuner Will flash a tune and update the firmware to the latest version. But only flashes tunes created with ByteTuner, will not flash a .bin file.

Tuning software

The tuning software is not necessarily required, as you can technically make all the changes to the file with a HEX editor as well, but then you probably wouldn't need this wiki ;)

Many tuning packages rely on definition files, or maps. These are not publicly available, and many tuners only have access to a very limited or partial map pack. The MS45 DME has over 2500 parameters! That said, only a fraction of those typically are changed when tuning these cars.

Most of these tools expect that you already have a way to read and write to your DME using a flashing tool.

  1. WinOLS - This package is fairly expensive to license, although there is a freeware demo version that has some limitations. Its a general tuning package not specific to BMW or any particular DME. Requires a map pack, which is not provided by WinOLS. You have to either find your own maps or try to buy a map pack from someone. Really great tool for a professional tuner, but not ideal for the hobbyist due to cost and lack of map pack availability.
  2. TunerPro - TunerPro is freeware and there are a lot of community provided definitions (XDF files). For MS45.1 take a look over in our Definition Files.
  3. BimTun - Somewhat affordable and does not require a map pack, the maps are built-in, but the number of maps available are limited. Offers support for changing some of the more popular settings such as fueling, timing, etc. Does not have access to all parameters in the MS45, but does have a hex editor if you know what bytes you want to change.
  4. Renovelo ByteTuner - This tool has full MS45.0 and MS45.1 support giving you access to all 2500+ parameters. It is different than the other tuning packages listed here because it can both edit tuning parameters AND flash to the car in one software package. It also corrects all the checksums for you and will update your DME to the latest firmware version during the flash process.

Checksums and Signatures

There are at least two checksums in the MS45, and one of them is not very straightforward. You will either need to correct these checksums by hand, or you'll need your flashing tool to correct them for you on the fly during the flash process.

The primary checksum you'll deal with when editing values in the parameter space is found at 0x40100. The default checked region is 0x40200-0x5CFFF. It is a 32-bit CRC, using polynomial 04C11DB7, default initial value is 0xFFFFFFFF, no reflection, XOR out 00000000.

A second checksum, primarily for logical switches, is stored in the middle of the tune. This is equivalent to the "additional checksum" on the MS43. Like the MS43, this checksum can be disabled (change val_mo3_swi_cal_cks -> 0xA5 to disable).

The MS45 uses an RSA signature to validate flashed data. The parameter RSA signature is stored at 0x40170. The default signed regions are 0x40000 - 0x4016F and 0x40200 - 0x5CFFF. To flash over OBDII, a valid RSA signature is required.

Terminology

The acronyms are Siemens mapnames from the Funktionsbeschreibung.

The following list contains a selection of the most used terms. It's crucial to understand at least the major engine states like _is_, _pl_ and _fl_ to make sense out of the cryptical naming of the maps.

File:Abbreviations.pdf

Enginestate Description
as after start
cs cold start
es engine stopped
fl full load
is idle speed
pl part load
pu trailing throttle
puc trailing throttle fuel cut-off
r restart
st start

Fueling

Fuel Injection Maps

The lambda sensors for closed loop operation are narrowband for the MS45 and wideband for the MS45.1. Fuel trim learning for the MS45.0 only happens during closed loop operation, but the learned fuel trims do affect full throttle fueling as well. MS45.1 has a set of learned fuel trims for normal driving and a separate set for full load conditions.

There are several parameters that control when "full load" is determined, such as a minimum RPM, minimum operating temp, etc.

During full load the following table is used to define a lambda set-point:

  • ip_lamb_fl__n (Lambda full load enrichment)

MS45.1 will eventually assign long term fuel trims during full load operation to try to hit the lambda targets in ip_lamb_fl__n.

Additional fueling tweaks can be performed on the mass fuel flow correction tables directly (ip_mff_cor_1 and ip_mff_cor_2), but this shouldn't normally be necessary.

Non Stock Injector Maps

If you will be changing the size of your fuel injectors, such as when charging your engine, some parameters will need to be adjusted accordingly.

You will need to adjust the global injection time correction as well as the dead time correction for your new injectors.

Calculate the difference in percentage of volume flow between stock and your new injectors and adjust the following parameter accordingly. Stock value is 1.0, so if your new injectors flow twice as much fuel, try setting this value to 0.5. I've found .508 to be a pretty good value for the Bosch 42lb green giants.

  • c_ti_as (Global injection time correction)

The injector latency compensation (injector dead times) should be set based on your injector's specifications from their manufacturer so you have good on/off throttle drivability:

  • ip_ti_add_dly (Injector dead time correction)

If the first 30 seconds of your cold starts are rough, you can try increasing these values to add more cold startup fuel before the wideband O2 sensors kick in for lambda control:

  • ip_fac_ti_tco_wup (Warm up basic factor)

Timing

Basic Timing Maps

"Basic ignition angle for RON 98" is the main table used with a healthy engine (so no VANOS fault codes, normal warmed up operating temperature) running RON98/PON93 gasoline.

There is a knock based interpolation between the RON91 and RON98 RON tables. The other tables should be kept safe.

  • ip_iga_bas_ron_98__n__maf (Basic ignition angle for RON 98)
  • ip_iga_bas_ron_91__n__maf (Basic ignition angle for RON 91)

Boosted Applications

When running boost the amount of air flowing through the engine is greatly increased. In order for throttle control to work properly the Intake Manifold Model has to be adjusted to compensate, as well as a couple torque maps. These two go hand-in-hand. If you increase the Intake Manifold Model alone, the car will never go into full throttle. If you do not increase the Intake Manifold Model the car will go to full throttle way too soon.

Intake Manifold Model

The DME will compare incoming air from the MAF to the Intake Manifold Model in order to determine when full load, or Wide Open Throttle (WOT) needs to happen. If the model is too low, then the car will go into full throttle too soon during the throttle pedal travel. You ideally want to increase these tables based on the percent increase in air you are seeing at the MAF at various stages through the RPM band compared to stock or NA form:

  • ip_eff_vol_slop_max (Slope of gasflow into cylinder at WOT and standard conditions)
  • ip_eff_vol_slop_cam_vo (Slope of the cylinder air-mass flow dependant on valve overlap, VIM_AV = 0%)
  • ip_eff_vol_slop_cam_vo_vim (Slope of the cylinder air-mass flow dependant on valve overlap, VIM_AV = 100%)

Torque Maps

These maps control how far open the throttle plate moves in relation to the pedal travel. This is because the MS45 DME uses torque demand to control throttle. The strategy here is to leave the torque values themselves the same as stock, but adjust the engine load values to match the higher airflow we are moving with our charger.

First adjust the mg/stk values here:

  • ip_maf_sp (Setpoint mass air flow depending on slow torque setpoint)

Then adjust the mg/stk axis values here to match the changes to ip_maf_sp:

  • ip_tqi_ref__n__maf (Indicated engine torque at reference conditions)

And finally align the mg/stk axis values in the following monitoring table to match the changes to ip_tqi_ref__n__maf:

  • ip_tqi_ref_mon (Indicated engine torque at reference conditions (process monitoring))

Extra Features

Cat Delete

You can turn off the cat diagnostics by changing "Manual deactivation of cat diagnosis inhibition condition" to 1

  • lc_inh_cat_diag_man_deac (Manual deactivation of cat diagnosis inhibition condition)

If you want to quiet down the cold startup cycle you can disable the cat heating function by zero'ing out the values in:

  • ip_t_ch_tq_add (Activation time for CAT heating function 'IGA')
  • ip_t_ch_tq_add_is (Activation time for CAT heating function 'IGA at first idle phases')

If you completely remove your lower O2 sensors from the car you can turn off the diagnostics and heating functions:

  • lc_lsh_down_1 (Boolean variable to enable oxygen sensor heating)
  • lc_lsh_down_2 (Boolean variable to enable oxygen sensor heating)
  • lc_inh_ls_down_man_deac (Manual deactivation of downstream oxygen sensor diagnosis)

These will prevent the car from triggering an SES light and as far as the car is concerned it will be happy, but may or may not allow you to pass emissions testing in your state. Each state has different requirements.

You can force catalyst readiness by changing "switch to set the fault of the CAL data ROM test inactive" to 1. At the next engine start, the catalyst monitor should show readiness

  • lc_ls_cat_diag_cdn_man_act (switch to set the fault of the CAL data ROM test inactive)

Secondary Air Pump

The SAP can be prevented from ever turning on by zero'ing out the "Time delay to terminate SA function" table:

  • ip_t_sa_off_0 (Time delay to terminate SA function)

There is also a ip_t_sa_off_1 table, but it does not appear to be used by the DME.

These parameters may also be of interest:

  • lc_inh_sa_man_deac (Manual deactivation of SA diagnosis inhibition conditions)
  • lc_inh_safm_man_deac (Constant to switch of the inhibition (=1))

Speed Limiter

Speed limiter is controlled by "Vehicle speed limitation threshold":

  • c_vs_max (Vehicle speed limitation threshold)

Set this to 255 to have unrestricted vehicle speed

Idle Speed

A handful of maps need to be edited if you want to change your idle speed.

Increase the lowest values in these tables up to your desired idle speed:

  • ip_n_sp_is (Nominal idle speed without additional load on the engine)
  • ip_acin_n_sp_is (Nominal idle speed with air conditioner switched on)
  • ip_dri_acin_n_sp_is (Nominal idle speed with DRIVE (A/T) engaged and air conditioner switched on)
  • ip_dri_n_sp_is (Nominal idle speed with DRIVE (A/T) engaged)

Increase all of these values equally (e.g. if you want to raise your idle by 100RPM, then increase all values in these tables by 100)

  • ip_n_sp_is_pl (Nominal idle speed at PL on the engine)
  • ip_n_sp_is_cs (Idle speed setpoint for drive-off-support - manual transmission)
  • ip_dri_n_sp_ch (Max. idle speed during CAT heating with drive engaged)
  • ip_n_sp_ch (Max. idle speed during CAT heating with no drive engaged)