Looking for REAL OBD2 / CAN Bus Experts

[Tenac]

As I said above. Clearing normal fault codes is possible, I've wrote a program so I can do it all the time by myself. I didn't faked anything, these were active DTCs and I was able to clear them!
But for write access to the ECU's and of course the DDE/DME as well, you'll need SecurityAccess - this is only possible via the Bosch Grade-X !!!

Yeah totally understand I'm about to look into buying the Bosch unit..... My thought was the level of fault was being cleared? Like maybe you can trip a Airbag fault and see if it can clear.

 

[Dieter]

Yeah totally understand I'm about to look into buying the Bosch unit..... My thought was the level of fault was being cleared? Like maybe you can trip a Airbag fault and see if it can clear.

I know there will be an Airbag error when you disconnect the starter battery while the ECU's are still active. This is a typical scenario when you put your car in a shipping container, the guys who are handling this just disconnect all the batteries. Then when unboxing the car at it's destination harbor, you'll have this annoying Airbag error showing up all the time - could only be cleared at an INEOS workshop.

I think I'll try to replicate this Airbag error - let's try if I can clear it by my own now! - that would be a great use case !

 

[Tenac]

I know there will be an Airbag error when you disconnect the starter battery while the ECU's are still active. This is a typical scenario when you put your car in a shipping container, the guys who are handling this just disconnect all the batteries. Then when unboxing the car at it's destination harbor, you'll have this annoying Airbag error showing up all the time - could only be cleared at an INEOS workshop.

I think I'll try to replicate this Airbag error - let's try if I can clear it by my own now! - that would be a great use case !

Exactly what my thought was as well

 

[joejet]

The globeguard can do the below, I have tested some of it and can read live data but as I’m in the Cayman Islands with no dealer here I don’t want to brick the car by mistake !

 

[Dieter]

The globeguard can do the below, I have tested some of it and can read live data but as I’m in the Cayman Islands with no dealer here I don’t want to brick the car by mistake !



View attachment 7924633

reading live data is easy, clearing fault codes works only if you know all the ECU's (generic OBD2 readers can't) - and both features are easy to implement (I've done it). Besides that, just look at this "feature list" and compare it to any other car maker they support - it's an exact 1:1 text copy, not a single Grenadier specific feature is mentioned, there is no detailed documentation available. And honestly, for this price tag it's an extremely overpriced OBD2 device for just "reading fault codes & clearing it", IMHO - but this device is currently the only on the market which is able to access all the Grenadier ECU's and read/clear fault codes! So, good for all you are living out of reach of an INEOS workshop.

 

[DenisM]

I was due to get the door locks changed under warranty. The dealership internet was down. The door lock job required the use of their special laptop. The dealership laptop needs to connect to a secure server at Ineos Australia HQ and then handshake with the "mothership" in Hambach.... the result was to come back in three months ..
There is no way they're going to make Ineos-specific codes available to owners. It's the BMW locked software forced subscription model we're being shackled with despite earlier promises....
25 years ago, BMW and Bosch pulled this stunt with the Bosch motronic engine management system in the 3 series BMW. (Same system in the JLR 1999 4.6l Rover V8 Bosch upgrade known as the Thor version..)
The 3 series BMW was competing in the British Touring Car competition. Engine tuners were stymied because they couldn't get access to the encrypted software system to properly remap the engines. This behaviour continues a quarter century later.
While I really enjoy my Grenadier , the about face by Ineos in this regard on their original marketing promises regarding DIY servicing capability as a "point of difference" is deeply disappointing.

 

[landmannnn]

. changing or modifying any settings in an ECU of the Grenadier IS NOT POSSIBLE AT ALL TODAY - only the Bosch Grade-X (original INEOS workshop diagnosis system) has SecurityAccess to the ECU's in the Grenadier

From my understanding the ETGW (entry and terminal gateway) allows reading of codes (omni-directional) by the obd port and is configured to allow just the generic "reset fault codes" to pass though the other direction.

This is an enhanced version of the Security Gateway methodology which is a module between the obd port and canbus. These can be bypassed, not possible with an ETGW. I doubt if this is BMW derived.

To be bi-directional the ETGW requires a token from Ineos which is vehicle and user specific. Presumably this is hosted by Bosch, this token is obtained via the cloud in real-time and currently only Grade X is configured to obtain this token. Welcome to the new world.

There is no technical reason that Bosch ADS X (a more basic device) couldn't be configured to give bi-directonal control, or indeed similar products from Delphi etc. This would require cooperation, fees, licencing and agreement across these brands/OEMs. Nevertheless these devices are at least £1,000 to purchase with annual subscriptions a similar amount. That prices it well above a consumer device, although Grade X will be about ten times that.

So fully in agreement that an obd device will not be sufficient for the bi-directional control that you have investigated.
I also doubt that the Globemaster device will be able to do this, including service reset, unless they can arrange logins and token provision with Ineos and Bosch.

 

[landmannnn]

I was due to get the door locks changed under warranty. The dealership internet was down. The door lock job required the use of their special laptop. The dealership laptop needs to connect to a secure server at Ineos Australia HQ and then handshake with the "mothership" in Hambach.... the result was to come back in three months ..
There is no way they're going to make Ineos-specific codes available to owners. It's the BMW locked software forced subscription model we're being shackled with despite earlier promises....
25 years ago, BMW and Bosch pulled this stunt with the Bosch motronic engine management system in the 3 series BMW. (Same system in the JLR 1999 4.6l Rover V8 Bosch upgrade known as the Thor version..)
The 3 series BMW was competing in the British Touring Car competition. Engine tuners were stymied because they couldn't get access to the encrypted software system to properly remap the engines. This behaviour continues a quarter century later.
While I really enjoy my Grenadier , the about face by Ineos in this regard on their original marketing promises regarding DIY servicing capability as a "point of difference" is deeply disappointing.

It's not the BMW software. It is the ETGW (entry and terminal gateway) which prevents access to read and write, developed by Bosch and sold to Ineos.

But your point still stands.

 

[Dieter]

In the meantime, I was able to reproduce the permanent Airbag fault. Just make sure all the ECU's are still alive and running, then disconnect the starter battery and reconnect it after an hour or so.
Then you'll get a lot of warnings/faults in the status display. Then the "Airbag Error" and "ABS and ESC off" messages in the HU. All faults are clearing, but the red "Airbag fault" stays permanently on, time to visit the INEOS workshop.

Then I tried my own developed OBD2 tool and reset the ECU's DTC/faults, had to ran a few cycles, had to drive the car a little distance, then another two clear cycles and the permanent Airbag fault was really cleared !!!
So, yes we can use an OBD2 reader to clear those faults like the Airbag fault. At least I could prove this right with my own developed OBD2 tool.

But, just to be honest - NO and absolutely NO write access to the ECU's in the Grenadier is possible w/o the Bosch Grade-X and an online connection to the INEOS service portal with a dealer/workshop login!

 

[derek_zoolander]

Understood about write access. Are you able to read any of the coding or customization? Would even be cool to see what's possible and what the options are.

There's a shop in aus I think that is able to write tunes to the motor ECU, wondering how they ended up doing it without grade-x maybe they cracked the encryption/keys

 

[b58]

Reprogramming the DDE/DME is a completely different topic from what Dieter is doing here.

This thread is about a slim diagnostic solution for the Grenadier: identifying ECUs, reading live data, reading DTCs across all relevant modules, and clearing faults that are actually clearable through the path exposed via OBD. That is already very useful in practice, especially for owners travelling far away from an INEOS workshop.

Flashing or recalibrating the engine ECU is a different league altogether. Yes, commercial tools like Autotuner already do support the Grenadier’s DDE/DME, and more like Alientech Kess V3 or Magic Motorsport Flex will probably follow. But that has little to do with building a lightweight read/clear tool for service purposes. One is diagnostics at service level, the other is calibration and reprogramming. Those should not be mixed up.

Also, people should not underestimate what ECU tuning actually involves. Reading a file is one thing. Modifying it properly is something else entirely. For that you need proper definition files, a solid understanding of the calibration structure, and a lot of experience. Otherwise the risk is not just “making more power badly”, but decalibrating the ECU in a way that causes unpleasant side effects or real damage. That is exactly why many flashy YouTube examples should be viewed with caution, the one posted in this thread before included.

So while tuning is definitely an interesting subject in its own right, I would keep this thread focused on the diagnostic side: ECU access, fault-code handling, service-relevant functions, and the limits imposed by ETGW / SecurityAccess. That is already a valuable enough topic by itself.

 

[landmannnn]

Understood about write access. Are you able to read any of the coding or customization? Would even be cool to see what's possible and what the options are.

There's a shop in aus I think that is able to write tunes to the motor ECU, wondering how they ended up doing it without grade-x maybe they cracked the encryption/keys

They just remove and write directly to the ECU.

 

[Tazzieman]

Most of us just want the airbag error to be home fixeable. And the service reset thingy ( which I presume once done is a one off glitch).
Neither is causing failure to proceed.
What else do we need to e.g. get out of a fake limp mode when we're in the back of beyond on a dark and stormy night?

 

[Dieter]

Here an example on clearing the fault codes of all the 17 ECU's which are present in my Grenadier MY23 Diesel.

Step 1: reading and displaying all the ECU's fault codes

Step 2: verifying that all the 17 ECU's having now 0 active faults

I know, in the Petrol version is the DME and from MY24 on a few more ECU's. These will be added to my tool as soon as I have access to those vehicles.
But for now, I'm happy with the progress...

 

[Dieter]

Most of us just want the airbag error to be home fixeable. And the service reset thingy ( which I presume once done is a one off glitch).
Neither is causing failure to proceed.
What else do we need to e.g. get out of a fake limp mode when we're in the back of beyond on a dark and stormy night?

The Airbag Error can be cleared, this is a standard OBD2 procedure to clear DTCs, I've successfully tested it today!
But a Service Reset is a write access which requires SecurityAccess to the ECU's - currently, no chance w/o the Bosch Grade-X !!!

 

[joejet]

Crazy the service reset is locked away, but someone e in another thread did say a dealer reset the service just with a handheld tool. I did reply saying we need to know what that took was. But I still don't see a reply, there are 2 passwords via the screen and as far as I know only the 1st one is out there. Maybe ....

Anyway congrats on all the work so far, when can we buy your tool

 

[Dieter]

Crazy the service reset is locked away, but someone e in another thread did say a dealer reset the service just with a handheld tool. I did reply saying we need to know what that took was. But I still don't see a reply, there are 2 passwords via the screen and as far as I know only the 1st one is out there. Maybe ....

according to the Service Reset:
I'd like to analyze first how the Grade-X is changing the settings within the ECU's, then I can tell if it requires SecurityAccees or not - but so far I just believe 99% it's using SecurityAccees, this has to be verified!

I'm also considering building an iPhone app which works with an bluetooth dongle , would be way easier to use in the car.
I already have an OBDLink MX+ here - but developing an iPhone app requires a lot of work/time... let's see

 

[bakepl]

according to the Service Reset:
I'd like to analyze first how the Grade-X is changing the settings within the ECU's, then I can tell if it requires SecurityAccees or not - but so far I just believe 99% it's using SecurityAccees, this has to be verified!

I'm also considering building an iPhone app which works with an bluetooth dongle , would be way easier to use in the car.
I already have an OBDLink MX+ here - but developing an iPhone app requires a lot of work/time... let's see

Out of interest Dieter..... do you know how aftermarket tools like Launch or Autel gain near if not manufacturer level access to other bmw or other late model vehicles? Have they bypassed security access?

 

[joejet]

I was wondering about this before

I found they have some API info

https://bmw-cardata.bmwgroup.com/th...ata/technical-configuration/api-specification

The other thing is the cars computer systems providers must issue an API in the first place for BMW to test and integrate. Could be any manufacturer unless it's all in-house (Tesla maybe, but probably not)

 

[landmannnn]

Out of interest Dieter..... do you know how aftermarket tools like Launch or Autel gain near if not manufacturer level access to other bmw or other late model vehicles? Have they bypassed security access?

Typically something like Delphi or SnapOni for example will log into the manufacturer's systems in the background via a central server.
That allows the garage to log onto their local device without needing the manufacturer logins and tokens. It comes at a price which is a subscription per manufacturer.