Dealer system destroying remapped ECU's

[400ixl]

I don't. I expect them to void the warranty but the silicon is mine and what I choose to store on it is mine as well. I am not using their software and the ecu is not licensed to me. I own it.

Unless you have written your own mapping software from the ground up, you are modifying the Mercedes IP which is their property. remappers do not typically write their own management systems and maps from scratch, they modify the OEM's to change parameters they want to.

 

[markjay]

Unless you have written your own mapping software from the ground up, you are modifying the Mercedes IP which is their property. remappers do not typically write their own management systems and maps from scratch, they modify the OEM's to change parameters they want to.

You are correct sir.

This was a well publicised case at the time:

The Teens Who Hacked Microsoft's Videogame Empire—And Went Too Far

(The article is a bit long and detailed but makes for some interesting reading)

 

[tron]

Is it stated in the vehicle's documentation that this is so?

 

[400ixl]

Doesn't need to be in the vehicle's documentation, there are a whole bunch of legislation around IP which is universal.

Very little software you use do you actually own. The Operating system of the device you are viewing this site on is not owned by you, even if you paid for it. You have paid for the right to use it. You do not own the code (even open source you don't own the code, you just have the right to use it and in those cases fork it and modify it for your own purposes).

OEM ECU systems are not open source, they are proprietary.

The laws change slightly in 2016, driven by the DMCA in the US. You can modifiy parameters within the OEM's ECU mappings, by directly altering them. You are not allowed to change the code itself. So changing the fuelling table is perfectly legal, removing the code for say the DPF or EGR not so much. So there is limitation in what you can do to the software you have the right to use.

So, stay within the parameter changes only and you can legally modify the ECU, change the code and you are tampering with their IP and there are lots of regulations around that. Are they likely to take you to court, no, but they could.

If you subsequently take the car into the dealership and to fix a known fault, they have every right to overwrite any changes you have made as you do not own the software in the ECU, they do, you only have a right to use whatever they put on it. They also have the right to refuse to update it as it is no longer under warranty and insist you replace it with a new unit to take a new update.

Once you change the parameters it is no longer as the manufacturer intended and any warranty claims to do with the ECU are out of the window, likewise are any components that can be attributed to change. For example if you modify the parameter for the boost cut off, then basically any warranty on the turbo is void. If you increase the injector cycles, the warranty for the injectors, pistons, crank etc are all gone. However, if a window stops working, having modified the ECU has no bearing and they have to honour that warranty claim.

I used to write ECU modifications years ago for a different manufacturer and really its all about balance. As long as you know, understand and accept you are invalidating parts of the warranty, need to be careful if it goes into the dealers that they don't overwrite those changes, or if they do that you can re-apply changes.

One of the issues I used to see a lot was that a tuner would extract the map, make some changes and write it back and save that copy. The car would then go in and get an OEM update to fix a particular issue, the remapper would then not extract the new map, re apply the parameter changes to that, they would just blast back their backup map and the ECU was back to the old state again, negating the changes made by the dealer. The parameters should always be re-applied to a newly extracted map if it has changed since the last mapping.

Short story is, you do not own the ECU software, you can legally make some changes, some are illegal, but unlikely you will get prosecuted. Any changes will invalidate parts of the warranty and you need to be very careful if they update the ECU and you want to restore the map changes.

 

[markjay]

EULA

 

[Lee44]

Simple answer is then.. If you want a powerful Merc, buy a 63

 

[markjay]

Diesel engines are often remapped for better mpg.....

 

[Gazwould]

In my experience they don't gain mpg , had a economy map on a 1.5 dCi and nothing was gained so wished went full beans Stage 1 .

Most of the time Stage 1 is exactly the same mpg .

Diesels are mostly remapped for their ease of good gains .

 

[400ixl]

A decent mapper will get good gains in mpg when the car is being driven in the right way. By moving the torque lower down the range and increasing it, the car can be brought to speed and maintained at that speed more economically. This is often done through the ability to improve the burn cycle of the fuel being smoother and more complete without needing to increase the injector duty cycle.

Its really when you are driving it enthusiastically that no (or negative) economy is seen. There you are increasing the injector duty cycle and hence will burn more fuel in the process.

 

[400ixl]

Simple answer is then.. If you want a powerful Merc, buy a 63

If you want all out power then yes. Remapping a 2 or 3 litre diesel is not going to make it go and sound like a sports tourer.

 

[Yugguy]

No but diesel remaps do yield a useful increase in both torque and power. I remapped a Focus Mk1.5 1.8 from 115bhp to 140bhp and a 1.9 Bora from 130 to 170bhp, but what was best on both was the increase in torque which meant 3rd gear acceleration was vastly improved.

 

[Yex]

A decent mapper will get good gains in mpg when the car is being driven in the right way. By moving the torque lower down the range and increasing it, the car can be brought to speed and maintained at that speed more economically. This is often done through the ability to improve the burn cycle of the fuel being smoother and more complete without needing to increase the injector duty cycle.

This is exactly how I had my Chimaera 450 remapped. I had a known specialist map the car on his rolling road from the base map that was on the car to a bespoke one done by him on the day after fitting new injectors and a new stepper motor. The BHP only went up by 15 or so to 265 but the torque map was between 310-320lbs across almost all the Rev range. The car did not have any significant improvements in horse power but certainly pulled like a train, and very smoothly, through 2nd, 3rd and 4th which was about when my internal danger meter went off

Horse power wins pub chats, torque wins races.

 

[Lee44]

I had the E350d as a courtesy car. As far as diesel engines go that is a sweet one. Plenty of torque, really pulled mid range.
I wasn't aware until late that they do that engine in the GLC. I bet it's not far behind GLC 43 territory, pulling wise?

I know some folk don't like SUV's but I have a back injury so it's perfect for me height wise, really helps.

 

[PobodY]

Diesel engines are often remapped for better mpg.....

And blocked DPFs?

 

[markjay]

I had the E350d as a courtesy car. As far as diesel engines go that is a sweet one. Plenty of torque, really pulled mid range.
I wasn't aware until late that they do that engine in the GLC. I bet it's not far behind GLC 43 territory, pulling wise?

I know some folk don't like SUV's but I have a back injury so it's perfect for me height wise, really helps.

Just had a Renault Koleos (Nissan X-Trail) 2.0L Diesel for 3 weeks as a courtesy car - it's going back tomorrow.

Setting aside the quirky Renualt dash (which is very much an acquired taste...), I really liked the car, both in city driving an on Motoways. If I were in the market for an SUV, I would definitely consider it, though I'd go for the Nissan-branded variant with the more conventional interior.

 

[TheEnd]

Tuning is something I do, although more for BMWs, and I don't often get involved with Merc stuff.

On the majority of current ECUs, there has been tuning protection, this type of protection tended to allow reading of the ECU, but you couldn't write to it without the correct passwords (or rather you could write to it, but the ECU wouldn't run the engine)
To get around this, you had the "bench" tuning, the ECU would be removed from the car, opened up, connected through the usual CAN bus pins it talks to with the usual power and grounds, but you'd often have to ground a boot pin inside the ECU.

This boot pin is a bit like firing up a PC into the BIOS screen, the processor is held back from reading the program code, and do all its checks on how is loading a file onto it, and you could write something into it, put it back into the car, and it wouldn't know that anything has been changed.

Shortly after, these boot modes became password protected too, but for a brief window, since you could read the ECU fine, you could read out the boot password whilst it was in the car, and then remove it, open it up and put it into the boot mode.
They got trickier still with more security on the passwords, but still ways were found to read them.

Almost all of these ECUs also had one time programmable areas inside them too, which made cloning an ecu tricky in some cases, and it's possible more security was in this section so you couldn't bypass it.

The new and current era of tuning has two major steps past this, the main one is virtual reads.
For a virtual read, the tuning gadget would read the basic software numbers from the ECU, and download an untouched copy of it from the gadget's makers.
You could then program this into the ECU, with a bit of secret sauce added in, and do all of this through the diagnostic port.
The tool makers don;t say what they are doing, but the programming tends to have two or three short steps of writing something, the longer section which is the main file, and often another short section afterwards.

On the BMWs, once you have wrote a file like this, you can then read out the immobiliser code.
This isn't so much a theft issue, but it's handy for replacing an ECU with a used one if they get damaged. Previously, this was impossible, so that hints that some of the fundamental code of the ECU is re-written, quite possibly the secure protected area is grafted to a different part of the ECU, and the main program is told to look for it a little bit further down the page so to speak.

Another type of tuning which has appeared very recently is full boot mode style reading and writing, but without having to open the ECU at all. This means you can read the current contents of the ECU, and any memory inside it, and make changes as you like (apart from the one-time-programmable areas mentioned before)


Anyway, back to the changes made.
Each one of these files (on newer ECUs) has a CVN, "Calibration validation number" which is like a checksum or fingerprint of the software, this ends up being changed by the modifications, and this often gets silently pinging back to HQ, and a mark is made saying "warranty void" is made.

Often the diagnostic stuff won't even alert the technicians working on it.
Audi had a "TP1" marker, BMW used to give a "Vehicle is or was not equal to series" message, and I'd imagine MB would do the same.

BMWs at least don't show this message anymore, even though you can spot the same clues it is looking for, so it suggests they stick that ace up their sleeve, and let the customer carry on bringing their car in and out for the usual servicing, unaware that there's not going to be any camaraderie in the event you want to make a claim on something drivetrain related.


These CVNs can be disguised though, but it's a lot of work, you essentially have to fudge a lot of the data so a new CVN matches the same as the old expected one.



It's also likely that some of the virtual read/OBD writing bypassing protection screws with the ECU so that an official file won't work with it, hence an ECU getting "bricked"


So there you have it, "bench" stuff can often be avoided these days, tuning can often be detected with CVNs, although they can be also corrected and hidden if needed, Main dealers can often detect tuning but they often will keep it to themselves, and it is possible that if parts of the ECU code have been re-written to accept other files, they might not act as expected with main dealer stuff.


As a sidenote, on some of the 2.0 BMW diesels from 10years ago, tuners would often run into "torque monitoring" issues. Thes was from missing out some of the torque tables, and the ECU would figure out one table says go high, another one doesn't, and that conflict would mean there's something going on. They'd know they are making more torque than they should.

On older diagnostics, the codes would come up with names like "L1/L2 torque comparison", "torque limitation due to fuel quantity", "torque limitation due to fuel pressure" etc.
These would have been old engineering codes from one it was being developed, eg - "I know you asked for 500Nm, and we could do that, but we are running out of fuel pressure"

They'd be set up for the engineers so the ECU would tell them why it didn't do what they asked.
In later versions of the diagnostics, all of these code explanations were changed to "ECU Internal fault" and the diagnostic tool would just say the ECU has gone mad, it must be replaced with a brand new one.
In these cases, (if the tuner didn't sort it out like they should) it would be possible to just reprogram it to original and everything would be fine again, but it seems it would be more fun to throw the customer (and by association, the tuner) under the bus and teach them a £1500 lesson.

 

[markjay]

Wow...

As for IPR... if this is not hacking, then I don't know what is

 

[Lee44]

Crikey....
TheEnd thank you so much for that comprehensive lesson, much appreciated. You know your stuff, that's mind blowing

 

[Gazwould]

Audi ODIS remap marker is TD1 .

Absolutely agree the info goes to the motherland and technician isn't informed .

Too many - had a service on my Stage 1 or removed tuning box and they didn't detect it ! Incorrectly thinking it's undetectable and certain tuning companies are still using that .

 

[Lee44]

So.. Let's "say" that a brand new car is remapped. You take it on the chin that it could "possibly" void the warranty for certain parts.

It goes to main dealer for service.
Unbeknown to us and the technicians their systems are sending a signal back to HQ relating to the ECU being "tamppered" with like TD1 code.

The car then suffers let's say some sort of engine blip before it's 3 year warranty is up, so you take it main dealer for them to sort. They do their digging and source the issue, however HQ already has stored on their system that this car has had a TD1 or some relating marker sent from it's ECU to them when it was last there.

That's their get out clause to say.. Sorry the warranty is void due to the info we received from your tampered ECU. (Assuming the engine blip relates to associated parts re ECU / engine).

Then it's £1500 please Mr Customer.

Also.. Yes there are companies out there still stating their latest remaps are undetactable