Hey,
you are right,map read/write of Conti/Siemens M3C is not possible at the moment.
Furthermore for complete service you need the "Seed-key", which is only available with a "Brute-Force-Attack" to the M3C at the moment.
This method can last up to 7 days,you need a garage with power for your Laptop and the battery of the bike.

You need two cables:
---ELM:

V1.5 ELM327 OBD2 OBD CAN-BUS Auto Car USB Diagnostic Interface Code Scanner R2 | eBay

and:

Ducati 4 Pin Multistrada CAN Diagnostic Connector Adaptor (DDA) [LEDUCC16ADAP] - £14.99 : Lonelec, Fault Code Readers & ECU Diagnostic Equipment

Cheers

No,i am not a geek....(and no hipster,too) >

 

I'm only partially a geek, so I'm just trying to understand this all.

Once the guessing game has completed and you know the seed-key combination it's a one-time thing right? It's just a matter of trying every combination until it's known, correct?

 

Yes,correct.M3C8 has a seed-scanner,after running,it writes the key to a ini file.
Its a one-time-thing.But every ecu has a unique key,the algorythm of the key is unknown at the moment.

 

Here are some photos. Hope it helps!

If you need it, I could also take a picture of the wiring chart (it's part of the manual)

 

If you need it, I could also take a picture of the wiring chart (it's part of the manual)

Yes, a high-res scan would help, at least until they upload the PDF manual.

When I was looking over the diagram in-person I noticed it mentioned a Bluetooth connection. Also the USB connector is for charging only.... no data lines. But it shares power with some sensors. (I think.) If that's true, I would be too scared to use it! I'd probably want to trace it again to be sure.

You need an adapter that goes from 16 pin OBDII to _____ which connects to the ducati via its OBD port (this part is a mystery to me at the moment, read below.)

That's a Delphi SICMA sealed 4-way connector... common to Multis, Pannis, Monster EVOs, etc. It accesses the 500kbps 11-bit CANbus on the bike. Sadly, the protocol is completely proprietary. Some very smart people are working on reverse engineering it right now. You can't hack it, you don't own it.

http://catalog.delphi.com/connectors/product/view/211PL042S0011

 

The wiring diagram won't help here, but please upload a photo or a scan of it. It will come in handy for other reasons. Thanks for the photos!

 

ECU Remapping

Has anyone had a look at the Rexxer module?
They claim to be able to access and remap the M3C ECU. If that is correct, I guess the issues with to lean fuel at constant speeds.
:: RexXer ECU-Tuning ::

Regards
Frank

 

Rexxer re-flash

I've already been in touch with Rexxer and they advised me they will have a map and we will be able to get our ECU reflashed in about 3 weeks.
My Monster 1100 suffered from lean running, popping out of the Termis on deceleration and some hard starting. The Rexxer cost me $400, removed the oxygen sensors, removed thee xhaust flapper valve and stopped the popping/backfiring. It ran as smooth as, no hunting/surging and started a lot easier. As soon as one is available I will have it done to my Scrambler which does have some surging/hunting especially when trying to stick to one of our F..... stupid 50 Klm/hr speed limits.
Let The Good Times Roll - Ray
p.s. - I'm in Adelaide, South Australia.

 

I've already started messing with flashing the ECU on these.

• resetting the service indicator
  • I decoded the CAN protocol a few hours ago.
  • Successfully read/cleared DTC errors on an Icon.
  • No service light (yet). Not because it isn't possible or I don't know how... but I'd be impressed if someone managed to put on 600 miles in 2 days.
• adjusting the fuel trim value
  • Scrambler uses closed loop with 2 lambas. "Fuel trim" is only for open loop. Not an option here.
• downloading and uploading ECU maps
  • "1CABBAG1" >

 

Do i understand your post correct-you are able to read/write the Scrambler ECU?
Which tool did you use?
THX!

 

Will there be a way for the rest of us to do this with software and connectors in the future? Are you designing software or did you write your own to perform the operations on the ECU?

 

No work on the ECU yet -- since that would be "evil".

I've made my own tools and cables. I made an Adruino microcontroller the size of a pack of cards that connects to the DDA port. It can read every bit of data available to the bike and logs it to a SD card. (Acceleration, speed, gear, temperature, manifold pressure, GPS, throttle position, blinkers... you name it.) I've also added the code to reset service/maintenance lights with the push of a button. Even hijacked some of the instruments: when I press the menu buttons in a certain sequence the logger turns on, and turn cancel button to turn it off. (I could make it do anything I want: flip a relay to turn on auxiliary lights, etc.)

It's still in development, lots of exposed wires and command line tools. But if you've ever heard of ScanM5X (free on Google play), I'm the person who worked with the developer to add digital AFR logging. Now I'm helping him add these new bikes. I've already reverse engineered most of the protocol but there's still some holes... particular with the ABS unit.

If there's interest I may make more of these and make it available for sale, but it is definitely a "power user" tool. (Aside from the service light resets and diagnostic commands.)

 

I'm definitely interested, but to put it into perspective, I am only smart enough to make a Raspberry Pi play vintage Nintendo games. I know what you're talking about, I just don't know how to do any of this on my own without possibly blowing up the ECU. I'm also an Apple kool-aid drinker, so I haven't owned any Android devices. But what you're saying is that eventually with a bluetooth dongle, we can use an android device to reset the service light on our bikes and log DTC so we know what's broken?

That's mostly what I'm after.

I'd also be interested in whatever interface can download ECU maps to flash memory and conversely upload them from the same place. It's always highly dependent upon having someone smart like you to be associated with the specific bikes in order for the rest of us to ever be able to break free from the dealerships. ie: certain bikes have no DIY support and others have a lot of freeware and ECU maps floating around the internet.

So I'd be happy to support your endeavors in some way. If everyone that had a Scrambler could easily use the app to keep track of their bike's health I think it'd be a good thing.

 

Ultimately we want you to .... become a vendor here or .... sell your project to one of our Site Sponsors for resale.
Grass Roots / Garage Project Forum - Ducati.ms - The Ultimate Ducati Forum
Ducati.ms - Membership Fees

Read that and you'll understand why I have issues sharing my work outside a small circle I trust.

The mods on the sister forum wanted me to start paying them to share my open-source, open-spec dev. I don't like the idea of my work being touted as an "asset" for the forum owners to forcibly sell to Site Sponsors. And I sure as heck don't have $600 per year -- I don't even have a donate button! All the work I do on the internet is free as in speech, free as in beer. That one policy has been holding back Ducati development a lot I think. Six/seven years ago people used to make airbox plates, mill triples, fender eliminators, etc. out of their garage, and there were a lot more interesting projects. Not so much anymore.

But that is neither here nor there. So I'll just post pictures of my new toy.

• The phone is optional, I designed this to be a standalone tool. It logs to the SD card you see there or to the USB port if you plug it in. I control the service resets and datalogger functions through the joystick.
• The UI is was thrown out completely... I recently had to switch TFT shields because the old one wasn't playing nice with the I2C bus. And I'm waiting on a Mouser order to make a power regulator so I can use the bike's 12v directly rather than a Battery Tender USB plug.
• I'm still having some issues with the service login for these Siemens VDO ECUs.... if someone is knowledgeable about that, they're the person I need to talk to right now.

Canbus Hack - Security Access or 0x27 Ways to Have Fun

 

Thats awesome guys!

Please keep up the excellent work.

D

 

I'm very interested in this, especially if you can come up with something like ScanM5X.

 

I wouldn't "come up with something like ScanM5X", I'd help him code it to add these bikes! The whole point is making it available to end-riders.

It won't be shareable for a while. Could be next summer. I'm still playing with the hardware, lot of implementation-specific challenges. Like I said, if anyone is good with understanding the ECU security access handshake, send me a message or post!

 

The guy who developed the M3C8 software for this ECU has the function to brute force hack the seed/key combo but someone said it can take two weeks of constant attempts to break it. If you don't have that software, you might download it and see if it would help you at all. Presently the download is here:

http://jpdiag.akress.com/download.php?file=M3C8

The software works with VAG OBDII cords and the proper connector to the ECU on the Ducati (the four pin SICMA style on the bike.) You are probably hooked directly to pins on the ECU though, so I'm not sure if it'd be helpful to you or not.

 

Silverluxe... I'm one of the people who contributed to that program.
It's not a one-man show. A bunch of other dedicated hackers/coders/riders have helped!

JP's program currently does not work with the Scrambler ECU. They changed the protocol enough that the readings are gibberish.

I use my own standalone diagnostic tool to analyze the bus, the ELM327 is too restricting an interface. It seems Ducati changed the format. His software is unable clear the service warning. I just tried it on a buddy's ICON. (For the record, neither can the $10,000 generic service tool most repair shops use. Guess how I know! ) So it seems unless I can fuzz the new commands, the only way to reset the 600 mile service light is to go to a DEALER -- as of today, no independent shop can reset it. Ducati does not sell their Ducati Diagnostic Service tool to anyone outside official dealers, no matter the price.

So they sort of have your nuts in a vice. The dealers nearby quoted me "shop minimum labor" for just plugging in turning off the light since we did our own oil change. Totally a cash grab. Older Ducatis you could turn it off by holding down some combination of buttons and switches when keying on the bike.

Couple other points:

• VAG COM cables aren't for these bikes, they're for the older Marelli ECUs. If you buy one of those it will not work.
• I'm not plugging into bare wires. I'm one of the people who publicly identified the connector. (Not the first, but the first who did it openly.)
• I'm also working to find a better cord alternative than the ELM327. It overloads way too easily to ever be used for reflashing.
• That's one of the reasons I made my tool the way I did... it can be used for reflashing.

 

@Impulsive_Duc do you think that Dynojet is going to be able to release a Power Commander that works for the Scrambler so we can at least pay for dyno time locally and get the bike to fuel as best as it can with the power commander box piggy packed onto the ECU?

Or does the seed/key stuff get in the way of that as well?

 

PC's cannot do Ignition on Ducatis. Nor can they fix the closed-loop area on these models (i.e. the low-mid end, where you spend 90% of your time riding -- see the picture) because the ECU uses closed-loop regulation. It needs to be fixed INSIDE the ECU firmware.

In fact, if using the PC autotune system, you have to drill and weld two additional holes into your exhaust. Unless you have some rather specialized adapters like I do, you cannot properly AFR datalog these bikes (aka "Dyno them"). Anyone who dynos bikes by sticking a long rod up the exhaust is doing it poorly. It is possible to do it semi-blindly (without AFRs) if you are very, very, VERY experienced -- but few people are. I'm talking decades, the sort of guys who tune ignition manually by FEELING for knocking.

To put it simply: you could probably install a PC, but ignition and 90% of everyday fueling would be unfixable. PC is a "hack" that involves cutting into the stock harness and introduces multiple points of failure so I strongly don't recommend it.

 

So much value in this information, cheers... novice at this mapping chatter

 

That's good to know. We have a Honda dealer in town with a dyno and this is the only way they know how to 'tune' bikes. I'll be holding off on the power commander route. I never liked the thought of it anyway. Kinda like using a game genie on a Nintendo the way it has to be spliced into the system.

 

I for 1 would be happy to pay for a helpful tool. My dealer here in Mexico is 350 km away. I certainly appreciate you guys who are doing the heavy lifting on this diagnosis, and I am a little disappointed in Ducati for playing hide the bacon.


I am a buyer when the tool is ready.

 

Yeah... problem is R&D costs money. And I don't get anything for doing this, nor have a button for public donations. I've only gotten this far thanks to the goodwill of a few people sending me bits and pieces of hardware, contributing stuff to the wiki, or sharing datasheets (thanks, silverluxe ).

I don't even own a Scrambler! :crying: Makes testing my code rather difficult. If I do make a tool, it will be a while. Maybe next summer, who knows.

​

But for now, I can definitely read the technical info and give honest answers about the hardware itself, tuning options, etc. I am very close to having a solution for the service resets at least, however.

 

.... contributing stuff to the wiki

Is there a link to the wiki? Maybe,more people would support your work,if the address is known.
Best Regards

 

I just got the Techno-research Pro-Europe. I got it from a buddy who upgraded. It has the cables for the Marelli and the Siemens. I just finished confirming communication with my 2004 Multi and 2006 SC. I reset the service indicator on the Multi and reset the TPS on the SC. This (along with a stepper motor cleanup) cured my long standing hot idle problem on the SC.

It will not talk to the Scrambler YET!

I called them yesterday and they will have the upgrade to the latest in a couple of weeks. The tough part is it will cost me $199 for the box upgrade. I will spend the money as I am in the mountains of Western North Carolina and am at least 2+ hours away from a dealer. I figure the $199 will be made back very quickly in travel and service costs saved.

The tool is really pretty cool but I am still learning what it's capabilities are and how to really be productive with it. The stuff I did was pretty self-explanatory and I didn't **** anything up. In fact, I really surprised myself with the results I got right out of the box.

 

I'm fairly computer retarded, so I'll never tinker with the bike's electronics, but since I live nowhere near a Ducati dealer, and I was told that other than the 1st service, work can be done anywhere as long as proper part are used won't affect the warranty. My question is, can the dealer disable the service interval warning, and if it's possible would they do this, knowing that I cannot possibly use them for service due to geographic limitations?

 

You could always buy a Rexxer EVO and clear any service indicator when it appears. Not cheap but you will get a custom map or 2 in the price which benefits the scrambler in regards to fueling

 

1) One compatible software application is offered by JP and is called MC38.

Doe's anyone know if this has progressed at all for use with the MC3 ecu??

 

Had to bring this thread back from the dead. So.. the Jpdiag download site is no longer there. Is development still going on for the MC38? Did it ever get the ability to upload/download ecu maps, turn off o2, turn off service light?


Does anyone have the software and could upload it along with some basic instructions? (What type of cable connector to use with it?)

Is there another inexpensive way to disable the service light? I don't really feel like paying $300 to get 600 mi service at the dealer.

Is the Rexxer unit the best option at this point?

 

The JPDiag site is still active. The Siemens software has now reached MC39 and communicates with the Scrambler ECU - download link