BMW S1000RR Forum banner

1 - 20 of 39 Posts

·
Registered
Joined
·
6 Posts
Discussion Starter #1
So I got the Brentune stage 1 a few months ago
Then had to take the bike in for weeping calipers(replaced them with Brembo GP4 Rx’s because it was gonna take a month or more for replacement calipers from BMW). Anyway they did a software update that was supposed to fix the flat spot according to the bmw tech
It didn’t... so I had to repeat the Stage 1 flash... after reflashing it I lose all power if I ever pin the throttle open... have to turn the bike off and back on to return an throttle capability... weird
Anyone had this happen... emailed Chris this weekend... should hear back on Monday
 

·
Premium Member
Joined
·
265 Posts
Before you took it to the dealership did you flash back to stock? If not, there's your problem, he should be able to fix it for a $100 fee.
 

·
Vendor
Joined
·
2,077 Posts
So I got the Brentune stage 1 a few months ago
Then had to take the bike in for weeping calipers(replaced them with Brembo GP4 Rx’s because it was gonna take a month or more for replacement calipers from BMW). Anyway they did a software update that was supposed to fix the flat spot according to the bmw tech
It didn’t... so I had to repeat the Stage 1 flash... after reflashing it I lose all power if I ever pin the throttle open... have to turn the bike off and back on to return an throttle capability... weird
Anyone had this happen... emailed Chris this weekend... should hear back on Monday
There is no software update to the 2020 for the 2nd and 3rd gear flat spots. Its EPA mandated and it is not going to change for the 2020 S1000RR for sure from what I am told by BMW people.

You messed up the handheld process it sounds like. You can deal with BT on that.
 

·
Vendor
Joined
·
2,077 Posts
Not to high Jack the post, for my own knowledge, is this a "thing"? Should I now buy a GS911?
Last I checked there is no GS911 solution for the 2020 S1000RR still. The protocols are completely different from the K46. Even the 2017/18/19 K46 took them months get OBDII working via the 16 pin.
 

·
Registered
Joined
·
6 Posts
Discussion Starter #8
I reset it to stock prior to taking it in and resent to updates ECU file to Brentune
I’m hopeful I did something wrong on the handheld... but cannot figure out what that would be
 

·
Registered
Joined
·
261 Posts
Last I checked there is no GS911 solution for the 2020 S1000RR still. The protocols are completely different from the K46. Even the 2017/18/19 K46 took them months get OBDII working via the 16 pin.
Floyd, have you done any OBD2 programming - querying all of the relevant PIDs for performance logging? I was thinking about getting a OBD2-Bluetooth scanner to play with. Here are a bunch between $25-100. It would be nice to get a full list of BMW PIDs given that there is motorcycle data that isn't standard/relevant on cars (e.g., lean angle). Do you have any recommendations?

The new revision to the BMW Connectivity app gets a bunch of data including speed, revs, lean angle, acceleration/deceleration (I assume this comes from the EMU accelerometer and hot the phone's), location (might come from phone) over Bluetooth.

My guess is that the TFT console is more than a display - it has its own processor that is a client to the Can bus, maybe via a OBD2-type protocol, puts a bunch of data up on the screen, provides some ECU config functions, and serves the Bluetooth interface to the phone app. Is this your understanding?

I'm thinking about digging into the bowels of this thing. I might start by hacking into the mobile app Bluetooth stream to see if there is anything recognizable. It would be easiest if it's a JSON-type web service interface, but even a OBD2-protocol relay would not be too bad. I hope it isn't encrypted.
 

·
Vendor
Joined
·
2,077 Posts
Floyd, have you done any OBD2 programming - querying all of the relevant PIDs for performance logging? I was thinking about getting a OBD2-Bluetooth scanner to play with. Here are a bunch between $25-100. It would be nice to get a full list of BMW PIDs given that there is motorcycle data that isn't standard/relevant on cars (e.g., lean angle). Do you have any recommendations?

The new revision to the BMW Connectivity app gets a bunch of data including speed, revs, lean angle, acceleration/deceleration (I assume this comes from the EMU accelerometer and hot the phone's), location (might come from phone) over Bluetooth.

My guess is that the TFT console is more than a display - it has its own processor that is a client to the Can bus, maybe via a OBD2-type protocol, puts a bunch of data up on the screen, provides some ECU config functions, and serves the Bluetooth interface to the phone app. Is this your understanding?

I'm thinking about digging into the bowels of this thing. I might start by hacking into the mobile app Bluetooth stream to see if there is anything recognizable. It would be easiest if it's a JSON-type web service interface, but even a OBD2-protocol relay would not be too bad. I hope it isn't encrypted.
Not exactly the thread to chat about PID's.. and very few people even know what a PID even is. I use to help crack OBDII codes for General Motors ECU's and the hot thing back then of course was to build the bluetooth scantools we see today.

The good thing about some PID's is there is SAE standards https://www.kvaser.com/about-can/can-standards/j1587/
you would have to assume it is following the J1979 byte structure
GM PIDs

I use to have software sniffing tools for the serial line because the GM TECH2 was on the serial port. Easy to pull the data into a program and decrypt the data flow. Now today you would have to have bluetooth sniffers and of course there are CAN BUS sniffers already https://www.tech-tools.com/logic-analyzer.htm?gclid=CjwKCAiA27LvBRB0EiwAPc8XWbZL0BNGcWwTqnbP_IeI4CNxYUrkCWVIZr1yBB3OefnPyVAEE6C1HxoCptoQAvD_BwE#CANBUS

The TFT is a scantool / display. It is low level priority. that is why you select the action at the left side multi switch and it slow to finally do the action. The General Module is the coordinator of the system. Request are sent to the GM and put out on the CAN BUS based on priority. The TFT display is the BlueTooth center of action.

Its actually called an IMU that has the 6 axis measurements. The GPS data would come from the phone since the TFT display does not have a GPS antenna in it. Had BMW spec'ed that in the design we would have laptimes in real time via the cluster. There is a connector in the back of the display I have tried to research but I have seen nothing to indicate it is a GPS input for the future of having a GPS laptimer device.
 

·
Registered
Joined
·
70 Posts
MEMS technology has been a game changer in the IMU world. The capability in 6 axis IMUs is amazing. Thank goodness for devoices like phones and Sony Wii for making it so affordable :)
 

·
Vendor
Joined
·
2,077 Posts
Floyd, have you done any OBD2 programming - querying all of the relevant PIDs for performance logging? I was thinking about getting a OBD2-Bluetooth scanner to play with. Here are a bunch between $25-100. It would be nice to get a full list of BMW PIDs given that there is motorcycle data that isn't standard/relevant on cars (e.g., lean angle). Do you have any recommendations?

The new revision to the BMW Connectivity app gets a bunch of data including speed, revs, lean angle, acceleration/deceleration (I assume this comes from the EMU accelerometer and hot the phone's), location (might come from phone) over Bluetooth.

My guess is that the TFT console is more than a display - it has its own processor that is a client to the Can bus, maybe via a OBD2-type protocol, puts a bunch of data up on the screen, provides some ECU config functions, and serves the Bluetooth interface to the phone app. Is this your understanding?

I'm thinking about digging into the bowels of this thing. I might start by hacking into the mobile app Bluetooth stream to see if there is anything recognizable. It would be easiest if it's a JSON-type web service interface, but even a OBD2-protocol relay would not be too bad. I hope it isn't encrypted.

Ok, i have read this webpage ... it reminds me of the old days when I hacked the LS1/6 PCM . I have the AVT716 device. Not just everyone could get a AVT device from that company so very few were sold to the public. http://christianmillard.com/Carprogrammer/Z28/PCM/disassembly/AVT_716_b2.pdf It is the serial RS232 data sniffer / J1976 scantool .. I used to capture a GM TECH2 load process to crack the seed and key algorithms needed for laptop to PCM via the OBDII port. Born was HPTuners.com and EFILive.com . I was part of HPTuners which back in the day was OBDHacking.com

I have opened several of these ADX files. Very nice work in these files https://pcmhacking.net/forums/viewtopic.php?f=42&t=6269&sid=a1a70c8a442fea24058c136df591a3f1&start=10

You can buy the PID list for Motorrad. I forgot the company name, but there is a keeper of the data and it is sold to companies like Snap On and Mac Tools to develop scantool devices. The problem is the data cost about $50,000 to keep your average joe from getting the data and just throwing it on the internet.

2020 K67 ///M Programmed XWORKS ECU by me
2018 K46 RCK3 / HP Power Kit'ed ECU by me
2017 K46 RCK3 / HP Power Kit'ed ECU by me
2015 K46 RCK3 / HP Power Kit'ed ECU by me
2014 K46 RCK2 / HP Power Kit'ed ECU by me
Thanks to MotoMillion.com for the support and selling my programming
PM me for any tech support and feature details on XWORKS ECU's

EXWERKS Flash Tuning Programming
BMSK BMSX BMSMP BMSO BMW S1000RR S1000R ECU Reprogramming
HandHeld Tune/Flash tool information:pM me for now-website coming 2020
Email:pM for now-website coming 2020
Phone:pM for mobile text or voice
Programming RCK2 RCK3 HP Power Kit 2010-2019 K46
Programming 2019/20 K67 EXWERKS BMWAG flash
Programming Marriage ECU Cluster EWS
Lost Keys Service 2005-2020 BMW Motorrad
Master ASE with L1
Certified Master GM Tech
 

·
Registered
Joined
·
17 Posts
$100 to fix after dealer updates to software. After paying $1000? LOL, what a rip off..no thank you.
from what i read on their site that's if you HAVEN'T gone back to stock and the dealer flashes the bike.

it seems like if the bike worked just fine before it went to the dealer and doesn't work right now, the variable is the dealer. looking forward to answers as i'm looking at both the xworks and brentuning flashes for my own bike.
 

·
Vendor
Joined
·
1,052 Posts
So I got the Brentune stage 1 a few months ago
Then had to take the bike in for weeping calipers(replaced them with Brembo GP4 Rx’s because it was gonna take a month or more for replacement calipers from BMW). Anyway they did a software update that was supposed to fix the flat spot according to the bmw tech
It didn’t... so I had to repeat the Stage 1 flash... after reflashing it I lose all power if I ever pin the throttle open... have to turn the bike off and back on to return an throttle capability... weird
Anyone had this happen... emailed Chris this weekend... should hear back on Monday
We have discovered a new strategy today built into the newest software update and are currently working on it. In the meantime we recommend people do not update to this software or instruct dealer against updating during any services.
 

·
Registered
Joined
·
690 Posts
My tuner and I confirmed that when BMW updates the ECU the data is not always in the same order. (The literal lines of code move around. We checked this by looking directly at the hex-code; probably to stop people trying to flash their bike. They do the same thing with their cars). Your flash is probably trying to alter incorrect sections of the code. This is why a tuner will ask you what version of the software your bike has before they send you a flash. I did the exact same thing. I got a dealer update and it broke my flash when we tried to put it back on a few days. Luckily we saved the entire ECU codebase before I took it to the dealer. So we put it back.

In other news.
@BMW_388 Do you happen to know why the odometer would turn red after shortly after startup? The mileage is correct but I always remembered the text being white. I'd guess that it's because my ECU and dash aren't paired or something.
 

·
Premium Member
Joined
·
265 Posts
So I got the Brentune stage 1 a few months ago
Then had to take the bike in for weeping calipers(replaced them with Brembo GP4 Rx’s because it was gonna take a month or more for replacement calipers from BMW). Anyway they did a software update that was supposed to fix the flat spot according to the bmw tech
It didn’t... so I had to repeat the Stage 1 flash... after reflashing it I lose all power if I ever pin the throttle open... have to turn the bike off and back on to return an throttle capability... weird
Anyone had this happen... emailed Chris this weekend... should hear back on Monday
We have discovered an "anti-tune" strategy today built into the newest software update and are currently working on it. In the meantime we recommend people do not update to this software or instruct dealer against updating during any services.
Wow, this sure sucks! So it seems BMW is not wanting owners to get the full potential of their bikes 🤔.
 

·
Vendor
Joined
·
1,052 Posts
Wow, this sure sucks! So it seems BMW is not wanting owners to get the full potential of their bikes 🤔.
It's only a small setback. This is typical for companies like Apple, for example. They see someone exploiting a vulnerability in their software (ie "unlocking" an iPhone) and they patch it so no one can "unlock" it anymore. Then a few days later a patch comes out from the company that does the unlocking and they get back into the phone again. No different here. We are working on this update now.

Since the stop sale is still in effect for the S1000RR, the only time this will be an issue is if you go to the dealer to perform a service and they update it. Ask them not to update for now until we can verify this issue is resolved.
 

·
Vendor
Joined
·
2,077 Posts
My tuner and I confirmed that when BMW updates the ECU the data is not always in the same order. (The literal lines of code move around. We checked this by looking directly at the hex-code; probably to stop people trying to flash their bike. They do the same thing with their cars). Your flash is probably trying to alter incorrect sections of the code. This is why a tuner will ask you what version of the software your bike has before they send you a flash. I did the exact same thing. I got a dealer update and it broke my flash when we tried to put it back on a few days. Luckily we saved the entire ECU codebase before I took it to the dealer. So we put it back.

In other news.
@BMW_388 Do you happen to know why the odometer would turn red after shortly after startup? The mileage is correct but I always remembered the text being white. I'd guess that it's because my ECU and dash aren't paired or something.
Yes, the BMWAG has implemented some Evil code. I had found this while trying to figure out how to deliver XWORKS to any ECU regardless of the code version, and I did in fact crack that code. That is what took me so long in August and September to fight with this code issue. There are OSID's and there are the CheckSums associated need some work.

@simes007us the miles are in the cluster, in the GM, in the RDC, in the ABS, in the key and EWS ( ignition switch ) , in the ECU, ... So, inside the ECU is 15 mileage counters. They are out of sync on purpose so that people cannot find the locations of them to reset. I have found them all. However, if you are out of sync with the other modules that are on the CAN BUS now, you will get RED miles. ISTA can sync this back up. Requires the whole bike now at the dealer, or you would have to send me all the listed modules above and I can bench sync them. It is supposed to WHITE. Red is BMW tamper indicator.
 

·
Premium Member
Joined
·
77 Posts
Can confirm Bren is working on it and has solid progress. Also, thank goodness for Texas weather and 130 tollway for some demo room.
 
1 - 20 of 39 Posts
Top