NefMoto

Hi!

Dont know if this has been discussed before, but cannot find much information.

I see that the Bosch MotorSport MS4 is a ME7.5, with the same hardware.

Has any of you looked into if this could be copied/used?

Software Download:

http://www.bosch-motorsport.com/en/de/downloads/software/software_1.html

It would be nice but IIRC the motorsport ecus are significantly different from the stock ecus.

Also, expensive.

Yes, I found out it was wery expensive :-(

But I have compared the 40CSTX36_ccp_en.a2l with another ME7.5 .A2l of same version, and it mostly looks the same. Same CPU, memory mapping etc.

Would be great if someone with the right skills had a look at this :-)

If you look at the A2l file, there are some very interesting things that other A2l files doesnt have.
Just look at the checksum and communication stuff:

/begin IF_DATA ASAP1B_CCP
 
  /begin SOURCE
    "10 ms - time synchronous event channel"
    4
    1
    /begin QP_BLOB
      0
      LENGTH 12
      CAN_ID_FIXED 0x720
      RASTER 0
    /end QP_BLOB
  /end SOURCE
 
  /begin RASTER
    "10 ms - time synchronous event channel"
    "10_ms"
    0
    4
    1
  /end RASTER
 
  /begin SEED_KEY
    /* seed&key dll for CAL privilege */ ""
    /* seed&key dll for DAQ privilege */ ""
    /* seed&key dll for PGM privilege */ ""
  /end SEED_KEY
 
  /begin TP_BLOB
    /* CCP version       */ 0x201
    /* Blob version      */ 0x202
    /* CAN msg ID - send */ 0x7EF
    /* CAN msg ID - recv */ 0x7EE
    /* station address   */ 0x1234
    /* byte order (2=MSB LAST) */ 2
   
    BAUDRATE 1000000
   
    SAMPLE_POINT       60 /* in % */
    SAMPLE_RATE        1 /* 1 or 3 */
    BTL_CYCLES         19
    SJW                3
    SYNC_EDGE          SINGLE /* SINGLE or DUAL */
   
    DAQ_MODE    BURST
    CONSISTENCY DAQ
   
    /begin CHECKSUM_PARAM
      /* algorithm */ 0x8001    /* M_16_BIT_BY_ADD8 */
      /* limit     */ 0xFFFFFFFF
      CHECKSUM_CALCULATION ACTIVE_PAGE
    /end CHECKSUM_PARAM
   
    /begin DEFINED_PAGES
      1
      "reference page"
      /* address ext. */ 0x00
      /* base address */ 0x00010000
      /* page length  */ 0x00008000
      FLASH
    /end DEFINED_PAGES
   
    /begin DEFINED_PAGES
      2
      "working page"
      /* address ext. */ 0x00
      /* base address */ 0x00384000
      /* page length  */ 0x00008000
      RAM
      FLASH_BACK
      RAM_INIT_BY_ECU
    /end DEFINED_PAGES
   
    OPTIONAL_CMD 0x05 /* TEST */
    OPTIONAL_CMD 0x08 /* START_STOP_ALL */
    OPTIONAL_CMD 0x09 /* GET_ACTIVE_CAL_PAGE */
    OPTIONAL_CMD 0x0C /* SET_S_STATUS */
    OPTIONAL_CMD 0x0D /* GET_S_STATUS */
    OPTIONAL_CMD 0x0E /* BUILD_CHKSUM */
    OPTIONAL_CMD 0x0F /* SHORT_UP */
    OPTIONAL_CMD 0x10 /* CLEAR_MEMORY */
    OPTIONAL_CMD 0x11 /* SELECT_CAL_PAGE */
    OPTIONAL_CMD 0x12 /* GET_SEED */
    OPTIONAL_CMD 0x13 /* UNLOCK */
    OPTIONAL_CMD 0x18 /* PROGRAM */
    OPTIONAL_CMD 0x19 /* MOVE */
    OPTIONAL_CMD 0x1B /* GET_CCP_VERSION */
    OPTIONAL_CMD 0x20 /* DIAG_SERVICE */
    OPTIONAL_CMD 0x21 /* ACTION_SERVICE */
    OPTIONAL_CMD 0x22 /* PROGRAM_6 */
    OPTIONAL_CMD 0x23 /* DNLOAD_6 */
  /end TP_BLOB
/end IF_DATA


/begin CHARACTERISTIC
    EPK
   "Eeprom-Kennung"
   ASCII
   0x10000
    KwbUb
   50
    KennText
    0
    255
    FORMAT "%5.1"
   READ_ONLY
   
    NUMBER 50
    /begin IF_DATA ASAP1B_KWP2000 DP_BLOB 0x10000 0x32 /end IF_DATA
    /begin IF_DATA ASAP1B_CCP DP_BLOB 0x00 0x10000 0x32 /end IF_DATA
/end CHARACTERISTIC

  /begin IF_DATA ASAP1B_KWP2000
      /begin SOURCE
         "timeslot"
        0
        0
        QP_BLOB
            0
           BLOCKMODE
           0xF0
           0
              40
     /end SOURCE
 
     /begin TP_BLOB
        /* Blob version          */ 0x100
        /* ECU address on k line */ 0x11
        /* requ. tester address  */ 0xF1
        /* ECU stimulation mode  */ WuP
        /* byte order            */ MSB_LAST
          /* ...                   */ 1
          /* project base address  */ 0x00000
         
        SERAM
            /* SERAM_A */ 0x10000
            /* SERAM_O */ 0x10000
            /* SERAM_U */ 0x17FFF
            /* SERAM_E */ 0x17FFF
           /* Flash address */ 0x000000
           /* RAM address   */ 0x000000
              /* Data Read   */ 1
              /* Code Verify */ 0
              /* Code Read   */ 0
              /* Load mode   */ 1
         
        /begin CHECKSUM
              0x010201
              1
              1
              RequestRoutineResults
              RNC_RESULT 0x23
          /end CHECKSUM
         
          /begin FLASH_COPY
              TOOLFLASHBACK
              3
              RequestRoutineResults
              RAM_InitByECU
              0x86
              COPY_FRAME 1
              RNC_RESULT 0x23 0xFB 0xFC
          /end FLASH_COPY
         
          BAUD_DEF
              /* BaudRate */ 105600
              /* DiagMode */ 0x86
              /* i, k     */ 0x81
          BAUD_DEF
              /* BaudRate */ 83200
              /* DiagMode */ 0x86
              /* i, k     */ 0x74
          BAUD_DEF
              /* BaudRate */ 41600
              /* DiagMode */ 0x86
              /* i, k     */ 0x54
          BAUD_DEF
              /* BaudRate */ 10400
              /* DiagMode */ 0x86
              /* i, k     */ 0x14
         
          TIME_DEF
              /* p1Max */ 0x0001
              /* p2Min */ 0x0000
              /* p2Max */ 0x0032
              /* p3Min */ 0x0003
              /* p3Max */ 0x0200
              /* p4Min */ 0x0000
          TIME_DEF
              /* p1Max */ 0x0001
              /* p2Min */ 0x0000
              /* p2Max */ 0x0032
              /* p3Min */ 0x0003
              /* p3Max */ 0x0200
              /* p4Min */ 0x0001
         
          SECURITY_ACCESS
              /* access mode  */ 1
              /* calc. method */ 1
              /* delaytime    */ 0
         
     /end TP_BLOB
  /end IF_DATA

I think this might be possible now.

I have successfully flashed both cpu, eprom and flash.

I have still just done some bench testing of some in and outputs, and all looks good so far.

Since I dont have the Msa-box, I havent got it communicating with the software yet.

I have the driver firmware-files, and it seems to be based on a SAM C21 microcontroller.

Could you remember, or find out what the ecu-difference was?

Update on this :-)

The MS4 ECU is a ME7.1.

With the firmware from Bosch MotorSport it has a little different pinout than Vag.

I have also managed to get a actia xs interface working with software.

Also the file must be modified before flashing to get the right adresses.

Still struggeling with the software, it requires license and pin code.

The software decompiles fine with IDA, but I dont have any assembly experience.

What did you do to get it working?
Modas expects a MSA-Box and I was not able to find any option to configure a different interface.

This is cool stuff! I wonder if you can do some similar things to the ABS-unit?

I never expact anything else. It will be too expensiv to build an individual hardware with all nessessary savety requirements only for a few motorsports tasks..

So they may chance application interface and seed-and-key to differ from stock OEM-ECUs, limit the chanceable maps by A2L and done..

Do you have a A2L for your MS4 ?

If Bosch SW is blocked by licens or PIN, just try to load A2L in INCA or CANape or other and connect via CAN interface to MS4. (CCP-protocol)

Me too, Continetal ABS unit is a OEM derivat, Bosch IMO will do the same

Some flags are directly derived from the installed licenses. But it should be possible to solve it with IDA.

Bringing this up, do you have any news?

I found out that the MS 3 Sport is a ME7.3.1 like used in my 156 GTA, i downloaded the installation cd from the .jp Bosch Motorsport page,
it includes ModasSport, a workspace and a2l and hex file of the ECU.
Managed to flash the hex file after converting it to bin, and ecu boots up with it, also does a kwp2000 handshake with a diag tool but does not support any diagnostic function over KWP2000.
The A2L file also has the CCP definitions ;-)
Vehicle side connector is pinned out different, Cruise control button is Box speed limiter and stuff, but the electrical levels seem to match (drivers, amperage etc).
Engine side connector is pinned out almost the same.

Regarding the MSA-BOX 2, the Bosch driver is almost the same as the Actia Lite-XS driver, the Actia Basic+ XS is more different.
Lite XS has the same bootloader bin files included.
Modas Sport might even work with the default Actia drivers, i have not tested. Or you could modify the Bosch driver to accept the Actia USB Ids.

Which Actia interface did you use ? A cheap chinese clone ?

Would be cool to get this running or maybe even copy the CCP code to other ME7 ecus, or activate it if its still left in there,
because then you would have a live tuneable ME with a cool gui which parses the a2l files nicely.

Seed DLL is also included for the MS3 firmware.

I sent you guys a PM but I figured I'd ask here to revive interest in this and for future referencing.

Is there an updates link where the firmware and software could be downloaded?

I'd like to experiment with this on the bench with an me7.2