Berry tuning tool

[Tazzi]

Like all black boxes the more you spend the better they work. It's amazing what your mind can do. Think I am skeptical. I am waiting to see the proof in the pudding.

Yeah, I can't help thinking the same. Like magnets on your fuel line, only high-tech.

Joe.

I remember that one!

I guess it could do something like ALDL mode 4, which can override most of the PCMs main parameters (eg spark advance, target afr) as well as the sensor values.

Yeah spot on. Expect on the mordern CAN Bus, they are called AE commands.. eg.. 7E0 03 AE 40 80.

Id be very interested to monitor the bus and see whats actually going on.

[antus]

There is no guarantee a kickstarter will successfully turn in to a product. Wait for that first.

[beyerch]

I guess it could do something like ALDL mode 4, which can override most of the PCMs main parameters (eg spark advance, target afr) as well as the sensor values.

For "thousands" of cars by different manufacturers? This is just a bullshit product.

[vlad01]

Looked at the link in the OP, I don't know, seems like a lot of pie charts and graphs with fancy logos and what not.

I call BS.

[vn5000]

I reckon b/s to , another business seems to be selling something similar

http://www.ebay.com.au/itm/CRS-TUNING-P ... 1755930442

[Tazzi]

This is one of the replies I received when asking "Does it suit the two major Aussie vehicles, Holden commodores and Ford falcons? Does it falsify live data to make the changes? And what happens if there is an engine fault/problem, does the unit recognize this and stop what its doing?"

It was initially thought of though we targeted the system on more of a world wide compatibility basis, explaning the VW's and Renaults etc. More funding will see us perform further tests on different vehicles over the coming months.
That is correct, it is essentially intercepting the data 'on-the-fly' and adjusting to what the device has learned of your driving habits, fuel type etc. It will not prevent the car going into limp mode, infact the unit will disable until the issue is resolved.
The unit is designed to program in the safest possible way, sometimes this does mean that your vehicle wont 'over-tune' and pre/post detonate combustion. The beauty of the intercept is that it know how you car is operating and even takes constant readings from your knock sensor and cam position sensors to adjust to faults or existing engine wear

hmmm.....

[Tazzi]

Right.. I saw an interesting comment in there with a reponse..

Question:

Hi @Creator - just made a small 'placeholder' pledge to get more info re compatibility with VW Golf models before committing to a unit.
Some questions please:
1. The unit provides a Bluetooth OBD2 interface compatible with existing apps, so I assume that side of things is exposing an emulated ELM327 command set? What's the PID refresh rate when querying a set of say 10 PIDs?
2. With tuning of a petrol Mk6 2.0L turbo VW Golf I assume you're adjusting boost levels as part of the tune? Does Berry provide a boost reading so that adjusted boost can be monitored via OBD2, given the VW CANGateway doesn't provide MAF or MAP boost on any standard PID? Is this something your hardware provides on the client side interface?
3. You mention that you're not writing to the ECU directly (which would throw TD1 flags and void engine warranty) so are you writing values to the power train CANBus through the Gateway for the ECU to interpret and adapt to? If so is there any issue with data overlap or do you also filter out the original data values from the bus so the ECU doesn't get confused?
This sounds like a great idea - I've just read bad reviews about plug in tuning devices before and want to make sure your unit works fully with my VW before buying. Thanks!

Answer:

@James, all your questions and feedback are appreciated.
1. Correct, we are using a ELM327 emulation. Due to connection established with the ECU from the tune side, the most we usually see is around 50PID's/Second. It simply wasn't possible to achieve anything higher than this.
2. In the exact circumstance of manifold pressure, the readout will not show the modified boost (either max pressure, or rising - Berry may not necessarily modify the max boost pressure). You would need a secondary boost gauge, weather it be analog, or a tee'd digital readout directly off your factory MAP sensor (yes this will work).
3. I understand that having a project through Kickstarter allows consumers to have an in depth, manufacturing story of the product with a great perspective on design, which we believe we have covered pretty well. Unfortunately due to the nature of the product, there is only so much information we can release without compromising the architecture of the circuit and software which remains patented intellectual property.
There is a few 'plug-in' tuners availible, and quite a few bad reviews - with good reason. I think 'Placebo' would be a suitable word. After all, we have set out to revolutionize the market, not put it in reverse.

My response to the above...
1) 50PID's/Second... so.. is that all vehicles? one particular vehicle? Just the one he owns and has tested on?
I know from my own research.. not all ECU's can request live data at the same rate. Although.. an E38 will happily go over 150+PID/s.
Due to connection established with the ECU from the tune side ..... um... what? wtf is the tune side? Does he mean the communication bus or some secret tuning gateway that Iv obviously missed for the past 4years...

2) This response completely neglected the question. He wanted to know about reading boost from the ecu... not hooking up a physical gauge to the MAP sensor. This response indicates no manufacturer specific PIDs are stored in the device or requested.

3) Well, this is the only plausible method of doing this live tuning by faking sensors *assuming* it is separate modules sending live sensor data and not hardwired to the ECU.
But.. giving the benefit of the doubt.. whats the patent?

Please.. someone ask about the patent.. please oh please...

[antus]

Tazzie, I did ask about the patent. I didn't get a reply. Someone else should ask too.

Anyway this PDF would be a good read for anyone trying to understand how this could work. In my mind changing engine runtime data live via obd2 does resemble the hostile device on the can bus which the paper discusses and should not be possible in a generic way, if at all. The paper also shows how engine sensors are typically wired directly to the pcm to prevent them being tampered with via the obd bus. It notes that tampering is possible, but it is limited by the security design of the cars. It also covers the differences and process for 'security access' for 2 different manufacturers. Even just a skim should impart some knowledge of the differences, complexity and security in place by design of the systems.

http://www.ioactive.com/pdfs/IOActive_A ... _Units.pdf

Some food for thought:

Page 12 (worth noting that the cryptography mentioned is different between different manufacturers and models):

SecurityAccess
In order to perform many of the sensitive diagnostic actions, it is necessary to
authenticate to the ECU. This is done with the SecurityAccess service. There are
multiple levels of access possible. The first request asks the ECU for a cryptographic
seed. The ECU and the sender have a shared cryptographic function and key that when
given a seed will spit out a response. The sender then sends the computed result back to
prove it has the key. In this way the actual key is never sent across the CAN network, but
instead the non-repeatable challenge response is negotiated.

Pages 27-29:

Problems and Pitfalls
First, it should be seen that not everything can be controlled via the CAN bus. For
example, consider the Ford Escape and acceleration. The only time acceleration is
controlled “automatically”, i.e. without the driver physically pressing on the accelerator, is
with cruise control. But if you look at the wiring diagrams for the vehicle you will see that
all of the controls are wired directly into the PCM (see Figures 13,14,15)

Figure 13: The controls for adjusting the cruise control are wired directly into the PCM

Figure 14: The brake pedal switch and electronic engine controls are wired into the PCM

Figure 15: The electronic throttle control and accelerator pedal position sensor are wired into the PCM.

So the entire cruise control system is wired directly into the Powertrain Control Module
that also controls, among other things, the engine. This means, it is reasonable to
assume that the cruise control is not affected by CAN traffic directly. It is still theoretically
possible that the acceleration could be controlled via the CAN bus (perhaps via some
diagnostic sessions) but on the surface it is unlikely that this feature uses data from the
CAN bus.

Later on page 29:

There are other complications. Once you’ve figured out what a packet does, it doesn’t
mean that if you spoof it, any action will occur.

For example, in the Ford Escape, a CAN packet with ID 0200 can be observed that has a
byte indicating how much the accelerator is depressed. One might naively think that
replaying this packet with different values might make the engine go as if the accelerator
were pressed at the spoofed level. This is not the case. This packet is sent from the
PCM (which reads the accelerator sensor) to the ABS, presumably to help it figure out if
there is a traction control event in progress. It doesn’t have anything to do with whether
the car should speed up or not. There are countless examples like this including, for
example, packets that indicate how much the brake is depressed but when replayed don’t
engage the brake.

<snip>

Another problem is that the receiving ECU may have safety features built into it that
makes it ignore the packets you are sending. For example, on the Toyota Prius, the
packets that are used for turning the wheel in Intelligent Park Assist only work if the car is
in reverse. Likewise, packets for the Lane Keep Assist feature are ignored if they tell the
steering wheel to turn more than 5%. It may be possible to circumvent these restrictions
by tricking the ECU, but some extra work would be required.

[Jayme]

the funny thing is.... as tricky as his method possibly is and as secret as hed like to keep it for now, he has to know that the second the first batch get sent out, they will be reverse engineered! this may seem a bit pessimistic, but I guess his product is either genuine and is hoping to get enough profit before the clones drive him out of business, or hes genuine and is confident whatever he is doing cannot be reverse engineered, or he is a faker and is hoping to make a fortune before anybody debunks it as a fake.

[delcowizzid]

Gotta be an all out scam the software links just goto dash command on playstore just an elm cable that lets you see data is about all it is in my eyes over 40000 bucks earned so far buy some $5 elms to send out and be rolling in cash lol