RomRaider Logo

RomRaider

Open Source ECU Tools
 FAQ •  Register •  Login 

RomRaider

Documentation

Community

Developers

It is currently Tue Jun 28, 2022 7:42 am

All times are UTC - 5 hours [ DST ]





Post new topic Reply to topic  [ 520 posts ]  Go to page 1, 2, 3, 4, 5 ... 35  Next
Author Message
 Post subject: DS2 - datalogging MS41/43 by serial protocol
PostPosted: Fri Oct 10, 2014 9:56 am 
Offline
RomRaider Developer

Joined: Wed May 20, 2009 9:49 pm
Posts: 6991
Location: Canada eh!
RomRaider now includes DS2 logging

Once you start RR up make sure you setup the Editor def file in the Definition Manager. Launch the Logger and make sure to setup the Logger def file (minimum version required is v305) in the Settings menu. You will need to set your Log File Output directory to where you wish your data logs to be stored. Select DS2 k-line from the Settings -> Select Logging Protocol Options menu (alt-O).

Set your COM port (no need to do this if you are using an J2534 compatible cable) from the drop-down list and connect to the DME and the Parameter list should populate. Logger definitions define support for various MS41/42/43 ECU ident strings.

In the Logger Tools menu (or press F6) the Learning Table Values menu will read Adaptations if the ECU Definition file is set and contains the required details for your ECU.
Image

Use the ECU Reset feature in the Logger -> Tools menu to select and reset adaptations.
Attachment:
dme_reset.png


In the Editor there's a menu item Tools -> Test App. You can use it to Read any memory address range you indicate. Such as address:000000 Length:262144 to read the entire 256kB address range.
Also provided is some rudimentary write support.

Google Docs - DS2 Serial Commands - https://docs.google.com/spreadsheets/d/ ... sp=sharing

These parameters can be logged all together without incurring additional query\response delay:
Attachment:
ParameterGroup.png


Test App commands - http://www.romraider.com/forum/viewtopi ... 73#p107273


You do not have the required permissions to view the files attached to this post.


Last edited by dschultz on Mon Sep 02, 2019 9:23 am, edited 22 times in total.
RomRaider 0.5.9 RC2 now supports DS2


Top
 Profile  
 
 Post subject: Re: Testo - MS41 datalogger by pheno
PostPosted: Fri Oct 10, 2014 11:12 am 
Offline
Senior Member

Joined: Fri Feb 10, 2006 7:04 pm
Posts: 2613
Location: Pittsburgh, PA (English)
dschultz wrote:
If you can dig up the ECU comms protocol specs I can look at adding support for it to RR Logger.
RR Logger can already interface with any cable that presents a serial COM port, or with a J2534 cable that supports the electrical interface such as k-line if applicable.
It appears that Testo relies on some other software being installed first.

That would be awesome! I like RR's logger UI.

If you're having issues with Testo, you might try this:
pheno wrote:
Ah.. It's probably because I've linked my program to newer Ediabas API .lib that you have.

In the meantime you can download the .dll it's expecting from here http://phenoboy.kapsi.fi/testo/api32.dll and copy it into testo folder where the testo.exe is



The DS2 protocol interfaces with the ECU directly, as far as I know. Testo can send direct serial commands via the K-Line. I think it needs some *.dll files to work.
I'll try to find the exact commands but basically, the ECU replies back in chunks of data. So if you request data in 'group a', it may include things like RPM, load, TPS, etc. all in one reply which then has to be parsed and decoded.

Here's some info on the topic.
https://www.scantool.net/forum/index.php?topic=1607.0
http://markgardnergibson.com/BMW/protocol.html

Also see attached. There is a syntax description for the DS2 (K-Line) protocol.

Also, there are some BMW files that are used with their own diagnostics program, INPA, that have the detailed info necessary to parse and decode these replies. I believe there is another BMW program called Tool32 that helps out with this. All the necessary info is out there but it's very scattered. Maybe we should start a thread to compile it all in one place.

Also found this Android app that aims to do the same.
https://play.google.com/store/apps/deta ... mcom&hl=en


You do not have the required permissions to view the files attached to this post.

_________________
MS41 Project Leader & Co-Developer (2012 - present)
Custom Assembly Code - MS41.3
IDA/ECU/Engineering Analysis
Original MS41.2 ECU Editor Definitions
Technical Writing & Support

MS41 ECU Portal https://sites.google.com/site/openms41/tuning


Top
 Profile  
 
 Post subject: Re: Testo - MS41 datalogger by pheno
PostPosted: Fri Oct 10, 2014 1:39 pm 
Offline
Senior Member

Joined: Fri Feb 10, 2006 7:04 pm
Posts: 2613
Location: Pittsburgh, PA (English)
http://forums.bimmerforums.com/forum/sh ... st26074623
Here are some 'trace' files for MS41, MS42, and MS43. There are at least 4 variants of MS41 (DS0,DS1,DS2,DS3) and in the attached zip only the MS410DS1 variant is included. Unzip and open as a text file.

'Trace' files contain the commands sent and replies received from the ECU.

I still don't understand how to convert the replies into human readable format though apparently the info is right there in front of me. Maybe I just need to spend more time on it.

It looks like 'rf900rkw' was able to get some MS411DS1 trace files for his MS41.2. Can you attach them to this thread?


You do not have the required permissions to view the files attached to this post.

_________________
MS41 Project Leader & Co-Developer (2012 - present)
Custom Assembly Code - MS41.3
IDA/ECU/Engineering Analysis
Original MS41.2 ECU Editor Definitions
Technical Writing & Support

MS41 ECU Portal https://sites.google.com/site/openms41/tuning


Top
 Profile  
 
 Post subject: Re: Testo - MS41 datalogger by pheno
PostPosted: Fri Oct 10, 2014 2:11 pm 
Offline
Newbie

Joined: Wed Aug 06, 2014 3:44 am
Posts: 73
Location: Portland, Or.
Take a trace with the key on and modulate only the throttle position, that will gove you some info about the packets. There should be parts that repeat too.

_________________
96 328i

B-)


Top
 Profile  
 
 Post subject: Re: Testo - MS41 datalogger by pheno
PostPosted: Fri Oct 10, 2014 2:14 pm 
Offline
Senior Member

Joined: Fri Feb 10, 2006 7:04 pm
Posts: 2613
Location: Pittsburgh, PA (English)
Quote:
Can you help me understand the trace file? For example the job for 'engine speed' how do parse that into human readable format?
Code:
'12.01.2013 20:38:57 <jobstart>'STATUS_MOTORDREHZAHL','_STD     [      1437] SENDECUTEL
_STD     [      1437]  INPUT: 12 05 0B 03
_STD     [      1437]   I -> D: 14 06 00 FF FF 00
_STD     [      1437]   D -> I: 01 03 00
_STD     [      1437]   I -> D: 13 04 00 01
_STD     [      1437]   D -> I: 01 04 00 00
_STD     [      1437]   I -> D: 06 07 00 12 05 0B 03
_STD     [      1516]   D -> I: 01 20 00 12 1D A0 00 00 00 24 00 00 D3 E0 4F 00 00 24 5C 98
_STD                            7C 00 7E 80 00 80 00 06 06 00 00 15
_STD     [      1516]   I -> D: 13 04 00 01
_STD     [      1516]   D -> I: 01 04 00 00
_STD     [      1516]  ERROR: NO ERROR
_STD     [      1516]  OUTPUT: 12 1D A0 00 00 00 24 00 00 D3 E0 4F 00 00 24 5C 98 7C 00 7E
_STD                           80 00 80 00 06 06 00 00 15 '
12.01.2013 20:38:57 'JOB_STATUS','OKAY','text'
12.01.2013 20:38:57 'STAT_MOTORDREHZAHL_WERT','0.000000E+000','real'
12.01.2013 20:38:57 'STATUS_MOTORDREHZAHL_EINH','1/min','text'
12.01.2013 20:38:57 'STATUS_MOTORDREHZAHL_WERT','0.000000E+000','real'
12.01.2013 20:38:57 <jobend>

I understand that we send the ECU "12 05 0B 03" through our laptop's serial port but then how do we parse what we get back? What is "I -> D" and vice versa?

pheno wrote:
Look at the OUTPUT line: 12 means ecu index in the K-bus, 1D is message length, A0 means "OK". from byte 3 starts data.

Between <jobstart> and <jobend> is issued one job from EDIABAS. The trace file generation is done by me. EDIABAS does not have this kind of trace file generation.

We will get one decoded value from EDIABAS (which means in EDIABAS terms 'job result', for example STATUS_MOTORDREHZAHL_WERT) at the end. And we also get the output that contains (somewhere) this value. As I said before value is decoded by taking a byte and multiplying it with value a then summed by value b. You just have to find out what are the values a and b. EDIABAS and .prg files do not tell you all of the details.


Pheno says you need to find the multiplier 'a' and offset 'b' but I wonder if that is what's in the "I->D" section?

_________________
MS41 Project Leader & Co-Developer (2012 - present)
Custom Assembly Code - MS41.3
IDA/ECU/Engineering Analysis
Original MS41.2 ECU Editor Definitions
Technical Writing & Support

MS41 ECU Portal https://sites.google.com/site/openms41/tuning


Top
 Profile  
 
 Post subject: Re: Testo - MS41 datalogger by pheno
PostPosted: Fri Oct 10, 2014 2:15 pm 
Offline
Senior Member

Joined: Fri Feb 10, 2006 7:04 pm
Posts: 2613
Location: Pittsburgh, PA (English)
tkelly278 wrote:
Take a trace with the key on and modulate only the throttle position, that will gove you some info about the packets. There should be parts that repeat too.

I don't have a working INPA installed yet. It would be nice for someone like rk900rfw to post the trace files since he's already taken them for his MS41.2 which are identical for an MS41.1 ECU since they both use the same 'job' in INPA.

_________________
MS41 Project Leader & Co-Developer (2012 - present)
Custom Assembly Code - MS41.3
IDA/ECU/Engineering Analysis
Original MS41.2 ECU Editor Definitions
Technical Writing & Support

MS41 ECU Portal https://sites.google.com/site/openms41/tuning


Top
 Profile  
 
 Post subject: Re: Testo - MS41 datalogger by pheno
PostPosted: Fri Oct 10, 2014 2:29 pm 
Offline
Senior Member

Joined: Fri Feb 10, 2006 7:04 pm
Posts: 2613
Location: Pittsburgh, PA (English)
Here's a post I made a while ago there.
Quote:
I've been going through the MS411DS1.BIV file trying to understand it in hopes of learning something that might help during disassembly. Got a couple of questions.


Can the two jobs listed below read any specific RAM and ROM addresses? How would one run this job with a specific address in mind? Is there a way to run this command repeatedly over a range of addresses?
Code:
JOBNAME:RAM_LESEN
JOBCOMMENT:Beliebige RAM - Zellen auslesen
ARG:RAM_LESEN_ADRESSE
ARGTYPE:long
ARGCOMMENT:Uebergabeparameter, Startadresse High-Middle-Low
ARG:RAM_LESEN_ANZAHL_BYTE
ARGTYPE:int
ARGCOMMENT:Uebergabeparameter, Anzahl der auszulesenden BYTES
RESULT:JOB_STATUS
RESULTTYPE:string
RESULTCOMMENT:"OKAY",  wenn fehlerfrei
RESULT:RAM_LESEN_WERT
RESULTTYPE:binary
RESULTCOMMENT:nichts
RESULT:RAM_LESEN_EINH
RESULTTYPE:string
RESULTCOMMENT:Einheit HEX


Code:
JOBNAME:ROM_LESEN
JOBCOMMENT:Beliebige EPROM - Zellen auslesen
ARG:ROM_LESEN_ADRESSE
ARGTYPE:long
ARGCOMMENT:Uebergabeparameter, Startadresse High-Middle-Low
ARG:ROM_LESEN_ANZAHL_BYTE
ARGTYPE:int
ARGCOMMENT:Uebergabeparameter, Anzahl der auszulesenden BYTES
RESULT:JOB_STATUS
RESULTTYPE:string
RESULTCOMMENT:"OKAY", wenn fehlerfrei
RESULT:ROM_LESEN_WERT
RESULTTYPE:binary
RESULTCOMMENT:nichts
RESULT:ROM_LESEN_EINH
RESULTTYPE:string
RESULTCOMMENT:Einheit HEX



Also, how have you gone about figuring out the 'serial' version of these commands? Trial and error? Or is there some documentation somewhere?

Do you know if there exists a job to change the communication speed?

It looks like there is a *.BIV file that I believe is the file you get once you run the appropriate *.PRG file through Tool32. And I believe the *.BIV file will tell you what the multipler and offsets are for the datastream while the 'trace' file tells you what serial commands are sent and received. So all of this needs to come together for a proper understanding.

I need to find these files on my home computer and attach them here. I'm sure I have them somewhere.

_________________
MS41 Project Leader & Co-Developer (2012 - present)
Custom Assembly Code - MS41.3
IDA/ECU/Engineering Analysis
Original MS41.2 ECU Editor Definitions
Technical Writing & Support

MS41 ECU Portal https://sites.google.com/site/openms41/tuning


Top
 Profile  
 
 Post subject: Re: Testo - MS41 datalogger by pheno
PostPosted: Fri Oct 10, 2014 2:56 pm 
Offline
Experienced

Joined: Thu Sep 25, 2014 12:53 pm
Posts: 627
Location: Houston, TX
mrf582 wrote:
tkelly278 wrote:
Take a trace with the key on and modulate only the throttle position, that will gove you some info about the packets. There should be parts that repeat too.

I don't have a working INPA installed yet. It would be nice for someone like rk900rfw to post the trace files since he's already taken them for his MS41.2 which are identical for an MS41.1 ECU since they both use the same 'job' in INPA.


Do you need me to do anything with INPA? On MS41.1 or MS41.2?


Top
 Profile  
 
 Post subject: Re: Testo - MS41 datalogger by pheno
PostPosted: Fri Oct 10, 2014 3:05 pm 
Offline
Senior Member

Joined: Fri Feb 10, 2006 7:04 pm
Posts: 2613
Location: Pittsburgh, PA (English)
Enabled wrote:
mrf582 wrote:
tkelly278 wrote:
Take a trace with the key on and modulate only the throttle position, that will gove you some info about the packets. There should be parts that repeat too.

I don't have a working INPA installed yet. It would be nice for someone like rk900rfw to post the trace files since he's already taken them for his MS41.2 which are identical for an MS41.1 ECU since they both use the same 'job' in INPA.


Do you need me to do anything with INPA? On MS41.1 or MS41.2?

Yes please!

Gather some trace files for an MS41.2 by following pheno's directions here - http://forums.bimmerforums.com/forum/sh ... st25495046
Select an ECU from the list that says something like 'M52 with OBDII' or "MS 41.1 fuer M52 OBD II" to be exact. That should run the MS411DS1.BIV file
Do this at ignition on/engine off, idle, and 2000RPM. Maybe run the traces twice for each scenario?

I'm attaching the corresponding MS411DS1.BIV in TXT format. We should be able to pair that up with some 'trace' files.


You do not have the required permissions to view the files attached to this post.

_________________
MS41 Project Leader & Co-Developer (2012 - present)
Custom Assembly Code - MS41.3
IDA/ECU/Engineering Analysis
Original MS41.2 ECU Editor Definitions
Technical Writing & Support

MS41 ECU Portal https://sites.google.com/site/openms41/tuning


Top
 Profile  
 
 Post subject: Re: Testo - MS41 datalogger by pheno
PostPosted: Fri Oct 10, 2014 3:25 pm 
Offline
Experienced

Joined: Thu Sep 25, 2014 12:53 pm
Posts: 627
Location: Houston, TX
mrf582 wrote:
Yes please!

Gather some trace files for an MS41.2 by following pheno's directions here - http://forums.bimmerforums.com/forum/sh ... st25495046
Select an ECU from the list that says something like 'M52 with OBDII' or "MS 41.1 fuer M52 OBD II" to be exact. That should run the MS411DS1.BIV file
Do this at ignition on/engine off, idle, and 2000RPM. Maybe run the traces twice for each scenario?

I'm attaching the corresponding MS411DS1.BIV in TXT format. We should be able to pair that up with some 'trace' files.



Ok, I will make some time for it this weekend. I'll try all those scenarios with both an S52 and an M52b28


Top
 Profile  
 
 Post subject: Re: MS41 - datalogging by DS2 (serial) protocol
PostPosted: Fri Oct 10, 2014 5:29 pm 
Offline
Senior Member

Joined: Fri Feb 10, 2006 7:04 pm
Posts: 2613
Location: Pittsburgh, PA (English)
Thanks.

OK here is an example of some data for us to start thinking about.

MS410DS1.BIV
Code:
JOBNAME:STATUS_LS_VKAT_SIGNAL_1
JOBCOMMENT:Spannug Lambdasonde vor KAT auslesen
RESULT:JOB_STATUS
RESULTTYPE:string
RESULTCOMMENT:
RESULT:STAT_LS_VKAT_SIGNAL_1_WERT
RESULTTYPE:real
RESULTCOMMENT:Spannungswert L-Sonde vor KAT
RESULT:STAT_LS_VKAT_SIGNAL_1_EINH
RESULTTYPE:string
RESULTCOMMENT:Einheit Volt


and its corresponding MS410DS1 trace file output by Testo. Testo uses the BMW EDIABAS protocol to call this job by its name then sniffs the serial port to generate the following output. It then knows what was sent and what was received.
Code:
12.01.2013 20:39:12 <jobstart>'STATUS_LS_VKAT_SIGNAL_1','_STD     [     15859] SENDECUTEL
_STD     [     15859]  INPUT: 12 09 0B 02 0E 00 00 01
_STD     [     15859]   I -> D: 14 06 00 FF FF 00
_STD     [     15859]   D -> I: 01 03 00
_STD     [     15859]   I -> D: 13 04 00 01
_STD     [     15859]   D -> I: 01 04 00 00
_STD     [     15859]   I -> D: 06 0B 00 12 09 0B 02 0E 00 00 01
_STD     [     15937]   D -> I: 01 09 00 12 06 A0 00 FA 4E
_STD     [     15937]   I -> D: 13 04 00 01
_STD     [     15937]   D -> I: 01 04 00 00
_STD     [     15937]  ERROR: NO ERROR
_STD     [     15937]  OUTPUT: 12 06 A0 00 FA 4E'
12.01.2013 20:39:12 'JOB_STATUS','OKAY','text'
12.01.2013 20:39:12 'STAT_LS_VKAT_SIGNAL_1_EINH','V','text'
12.01.2013 20:39:12 'STAT_LS_VKAT_SIGNAL_1_WERT','4.825000E+000','real'
12.01.2013 20:39:12 <jobend>


so we SEND "12 09 0B 02 0E 00 00 01"
get REPLY "12 06 A0 00 FA 4E"

How does Testo know the output in human readable format is 4.825volts? It some somehow able to convert the reply into 4.825volts. In the reply we know "12" is the ECU address. "06" is the number of bytes in this reply. "A0" means 'acknowledged'. We know the reply is in 'real' which means 2 bytes, right? So is it converting "00 FA" into "4.825volts"? Is the last byte "4E" a checksum like it is for the INPUT?

_________________
MS41 Project Leader & Co-Developer (2012 - present)
Custom Assembly Code - MS41.3
IDA/ECU/Engineering Analysis
Original MS41.2 ECU Editor Definitions
Technical Writing & Support

MS41 ECU Portal https://sites.google.com/site/openms41/tuning


Top
 Profile  
 
 Post subject: Re: MS41 - datalogging by DS2 (serial) protocol
PostPosted: Sat Oct 11, 2014 3:01 pm 
Offline
Experienced

Joined: Thu Sep 25, 2014 12:53 pm
Posts: 627
Location: Houston, TX
Attached are my trace files for MS41.2 (1999 Z3 M Coupe, S52) and MS41.1 (1996 328is, M52B28).


I ran "MS 41.1 fuer M52 OBD II" on both cars. I even tried the one choice for MS41.2 (Serial) and it didn't connect to anything.

I did it at least twice each: Ignition on/Engine off, Warm Idle, and 2000RPM.


Just a side-note, on the 2000RPM log on the MS41.1, I had errors in the first 5 jobs, so I repeated them until I got good connection. I included them anyways.

Attachment:
testo Debug Logs.zip


You do not have the required permissions to view the files attached to this post.


Top
 Profile  
 
 Post subject: Re: MS41 - datalogging by DS2 (serial) protocol
PostPosted: Sat Oct 11, 2014 3:27 pm 
Offline
Newbie

Joined: Tue Aug 26, 2014 2:47 am
Posts: 70
Location: denmark (grenaa)
hey i use testo on my ms41,0ds3 and i can use ms41,1 and seriel on both of then and it works fine with my inpa dcan cabel..
i dont no if this is to enny help but this is the last contection files from ´my ebiabas trace folder api and apiold.

mads


You do not have the required permissions to view the files attached to this post.


Last edited by bmw_mads_e39 on Sun Nov 02, 2014 11:45 pm, edited 1 time in total.

Top
 Profile  
 
 Post subject: Re: MS41 - datalogging by DS2 (serial) protocol
PostPosted: Sat Oct 11, 2014 3:29 pm 
Offline
Senior Member

Joined: Fri Feb 10, 2006 7:04 pm
Posts: 2613
Location: Pittsburgh, PA (English)
Enabled wrote:
Attached are my trace files for MS41.2 (1999 Z3 M Coupe, S52) and MS41.1 (1996 328is, M52B28).


I ran "MS 41.1 fuer M52 OBD II" on both cars. I even tried the one choice for MS41.2 (Serial) and it didn't connect to anything.

I did it at least twice each: Ignition on/Engine off, Warm Idle, and 2000RPM.


Just a side-note, on the 2000RPM log on the MS41.1, I had errors in the first 5 jobs, so I repeated them until I got good connection. I included them anyways.

Attachment:
testo Debug Logs.zip

Fantastic! I'm working on it as we speak. I might need more trace files to capture certain data items. Already have RPM deciphered from the serial reply.

Time to drink some beers and nerd out!

_________________
MS41 Project Leader & Co-Developer (2012 - present)
Custom Assembly Code - MS41.3
IDA/ECU/Engineering Analysis
Original MS41.2 ECU Editor Definitions
Technical Writing & Support

MS41 ECU Portal https://sites.google.com/site/openms41/tuning


Top
 Profile  
 
 Post subject: Re: MS41 - datalogging by DS2 (serial) protocol
PostPosted: Sat Oct 11, 2014 3:32 pm 
Offline
Experienced

Joined: Thu Sep 25, 2014 12:53 pm
Posts: 627
Location: Houston, TX
mrf582 wrote:
Enabled wrote:
Attached are my trace files for MS41.2 (1999 Z3 M Coupe, S52) and MS41.1 (1996 328is, M52B28).


I ran "MS 41.1 fuer M52 OBD II" on both cars. I even tried the one choice for MS41.2 (Serial) and it didn't connect to anything.

I did it at least twice each: Ignition on/Engine off, Warm Idle, and 2000RPM.


Just a side-note, on the 2000RPM log on the MS41.1, I had errors in the first 5 jobs, so I repeated them until I got good connection. I included them anyways.

Attachment:
testo Debug Logs.zip

Fantastic! I'm working on it as we speak. I might need more trace files to capture certain data items. Already have RPM deciphered from the serial reply.

Time to drink some beers and nerd out!


Ok, let me know, and I'll see what I can do.

Also, both cars had AC off while doing this. I know that the ECU controls AC function, so I suppose something might change in the tracings with it on.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 520 posts ]  Go to page 1, 2, 3, 4, 5 ... 35  Next

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot] and 0 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
Style based on FI Subsilver by phpBBservice.nl