My newest project: PST2 aka Porsche System Tester

[ischmitz]

Here is a first shot of my newest project: Getting me a Porsche System Tester, aka PST2. The PST2 was the successor to the Bosch "Hammer" (KTS301). It can deal with a lot of the newer cars.



It really is a 80486-based handheld computer with a B/W LCD display with 640x480 pixels. In this particular configuration it runs a crippled version of Windows 3.1 and Porsche's software. It also has an integrated URI module that can measure voltages, currents, and resistances. The URI module runs on a 68HC11 mircocontroler and communicates via a serial port to the main computer.

Bosch made a generic version called KTS 500 for all vehicles running OBD-II and a special Porsche-only version called PST2. And like everything else the Porsche version commands a rather hefty Porsche tax when trying to find used ones. So I set out to "convert" a generic Bosch KTS 500 into a PST2. After running into some hurdles I finally figured out how to "trick" the software to ignore the green outside and play with the Bosch hardware. Next, I have to convert the OBD-II cable into the Porsche version and see if I can do some scanning. Stay tuned.

[village idiot]

You are a far braver soul than I! When You get it to work are you going to market it as a converted unit or will you do the conversion for others? ??

[ischmitz]

village idiot,

I haven't even thought that far. At this point my main goal is to get it to run properly and learn things in the process. I like tinkering with that sort of stuff. But if someone is interested we can certainly talk.

A couple of years ago I did a similar project converting an ordinary KTS300 into a Hammer. I had to fabricate a PCB from scratch, a first for me.



And have I sold any? Nope, and it wasn't the point either - there are others that do. See here for the hammer in action on my 3.6 conversion: The infamous Bosch Hammer (aka KTS301) at work (long with pics)

[village idiot]

That's awesome! electrical/electronics is the one thing I don't enjoy messing with. Eventually, I'll have to buckle down and start studying because I do plan to have a 3.6 in mine as well.
Keep us posted on the results.

[ischmitz]

Update:

The bad news first: I was trying to read the DME on the 964 3.6 in my Targa. This should have been a pretty straight forward task. Plug the 8-pin AMP connector that goes into the Hamer into the short Bosch adapter and that goes into the PST2. However, despite numerous tries the PST2 did not find the DME. What a bummer. I think I have to chase the signals and check if something is mis-wired. Wired, the Hammer still finds the DME just fine. Maybe it is not as demanding and does not need the L-line. We will see.

The good news: Out of sheer frustration I went ahead and hooked the KTS 500 cable up to the 996. And surprise surprise the PST2 found the DME. I knew at the time that the standard Bosch-OBD2 cable is different from the Porsche version. So with new-found inspiration I went ahead and converted the cable to Porsche specificatons. And that lead to full success. See for yourself.

First, the PST scans the vehicle and highlights all control units found in the car. For the C4 coupe it found the PSM and all other moduls expected. The "#" in front of a unit means there are stored fault codes:



Well, the faults are because the battery died on me. So the POSIP complained and so did the alarm unit if it can't lock/unlock the doors or move the windows. So I went ahead and erased the faults:



And voila, the next scan comes up clean. No more fault codes. So my first little job has been completed successfully:



Ingo

[304065]

Ingo,

That is EXTREMELY cool, ALMOST makes me want to buy a watercooled car just to hack it! Well, that and the better engine. . . suspension. . .aerodynamics. . . HVAC. . . etc. . .

[Pete000]

I want one !

[jpnovak]

Ingo, That is very cool. Can you reflash the 996 ECU? Would it work for a 986 as well? Might be a market for those 996-Boxster installs where the 996 maps are installed in a 986 ECU.

If it works to find the 996 I bet there is a connection issue with the 3.6. I suspect it is hardware related (cable).

[ischmitz]

Jamie,

To answer your first question: Yes you can write to any ECU in the car and Porsche makes extensive use of that. Starting with the 996/986 everything is stored in EEPROM memory. ISP (In System Programming) is much easier than having to open the box and replace a memory chip.

However, first of all the PST2 is far away from an open book. It has structured menu items to change settings in the ECU. Things like settings for the POSIP, engine #, etc. You can also re-flash parts of the ECU or the instrument cluster to a new box in case it needs replacement.

Some writeable areas are protected by binary security pass phrases. Each car is identified by its VIN number. Porsche maintains a data base with these keys for each car. There are several areas that are protected. Things like the instrument cluster, the immobilizer, remote entry, alarm, vehicle history just to name a few. If you want to write to those areas you need the specific key for your car from Porsche. I have seen a printout at the dealership for a 997 with all its keys. There were at least 10 if not more. If a service technician needs to perform a certain operation he needs to talk to his supervisor to get the key. Only the supervisors have access to these keys. My guess is that Porsche use some sort of AES or DES encryption. That’s what the pass phrases look like.

If you want to change the mapping for an engine you would have to reverse-engineer the binary image of the ECU, get the checksums right and inject it back into the PST2 software to get it to write the modded image to the ECU. But I don’t want to kill my C4 just yet. So I don’t think I am going to do much in that line. There are other aftermarket solutions out there that can do this.

For your second comment I don’t know why it is not working on the 964. Everything works fine with my Hammer. It finds the DME. My custom cable that goes between my custom diagnostic port in the car and the Hammer is the same cable that I used with the PST2. Since it works with the Hammer I assumed that there is no issue with the cable and/or port.

However, I am still not quite clear why about the differences between the K-line and the L-line. Some control units do not even use the L-line. It must be some sort of hand-shake and it is unidirectional. The K-line is a bi-directional port. So as I said maybe my L-line on my custom implementation in the early car is not working properly and the Hammer doesn’t care while the PST2 does. I need to do some signal-chasing I guess.

Ingo

[patkeefe]

Ingo:
Good work!
Subscribed

[911cedric]

Hello there,

ok man, you 're exactly doing what i'm planning to do:

converting a generic KTS 300 to KTS 301
or
converting a generic KTS 500 to PST2

i would maybe prefere to convert a KTS 500 as it's more sophisticated.
so, as far as i understand,

for a KTS 500 conversion to PST2 you need:

- a KTS 500
- a specific PCMCIA card? does the serial regular PCMCIA card offer all the same functionnalities than a PST2?
- the PST2 software
- porsche adaptable plugs for obd2 and 19 round pins

am i correct?
is there something else to modify?
could you help me in that process?
where could i find the software and the Modified PCMCIA card(if necessary)

Please let me know

cheers

cedric

[rattlsnak]

Delivered to 30075, how much?

[ischmitz]

Originally Posted by 911cedric

Hello there,

ok man, you 're exactly doing what i'm planning to do:

converting a generic KTS 300 to KTS 301
or
converting a generic KTS 500 to PST2

i would maybe prefere to convert a KTS 500 as it's more sophisticated.
so, as far as i understand,

for a KTS 500 conversion to PST2 you need:

- a KTS 500
- a specific PCMCIA card? does the serial regular PCMCIA card offer all the same functionnalities than a PST2?
- the PST2 software
- porsche adaptable plugs for obd2 and 19 round pins

am i correct?
is there something else to modify?
could you help me in that process?
where could i find the software and the Modified PCMCIA card(if necessary)

Please let me know

cheers

cedric

You get all of the hardware on Ebay Germany. I am not sure about the differences between the generic PCMCIA cards (2 versions) and the Porsche card other than the dealer information stored in the Porsche cards. However, that is not even an issue anymore.

For the KTS300 -> KTS301 it is pretty much done and confirmed working. I can produce the ROM module. And yes, you need the cables to interface to the car. JDS in England makes a reproduction 19-pin cable for the 964. The OBD2 style connector can be bought at Digikey and you can make your own cable.

For the KTS500 -> PST2 transition it is a little bit more involved. I haven't sorted it all out yet. Read here for the latest. Are there any DOS 6.22 gurus out here - PST2 Tester and help if you can.

Cheers,
Ingo

[wrljet]

Originally Posted by ischmitz

It also has an integrated URI module that can measure voltages, currents, and resistances. The URI module runs on a 68HC11 mircocontroler and communicates via a serial port to the main computer.

FWIW, the KTS PCMCIA card also contains a 68HC11. It runs OS9. The code running on it comes from the SDM\DL directory in various .DL files.

Bill

[ischmitz]

Originally Posted by wrljet

FWIW, the KTS PCMCIA card also contains a 68HC11. It runs OS9. The code running on it comes from the SDM\DL directory in various .DL files.

Bill

Interesting. So the 68HC11 gets its executable code downloaded for each communication job then? I wonder why Bosch used another RTOS layer rather than using the PC itself. Do you think timing wasn't cutting it with Windows3.11/DOS?

Ingo

[ischmitz]

Update: After some more work and fixing some hardware issues I finally got the tester to work properly on the 964. First it scans the car and finds the DME as the only control unit. This is the only system on my conversion. No ABD or airbag ECU here...



Next, here is the main menu where you can check and errase the fault memory (no faults stored in this case), monitor actual values, actuate drive links (injectors, resonance flap, tank venting, etc.) perform the system adaptation, check the coding of the DME, do knock registration, and check the general part number




And this is the list of parameters that can be monitored when the engine is running. Up to 8 items can be displayed simultaniously and one can record a log for later investigation. Helpful when dealing with intermittent failures that occur during driving (under load)





We'll see what's next - maybe it time to move on to the PIWIS

[PSTnoob]

Hello Ischmitz

i have a problem with my pst notebook..
the notebook was ghostet from an prosche pst, and im use a bosch kts 405 PCMCIA card.

i can only see the DME and one of the other module .. but i have abs alarm and airbag.

do you know this problem?

thank you for help ^^

greez

pstnoob

[ischmitz]

What model car are you trying to scan?
BTW, there is no KTS405. There is a KTS400, KTS401, and KTS402 as far as I know.

Cheers,
Ingo

[mjshira]

Originally Posted by john_cramer

Ingo,

That is EXTREMELY cool, ALMOST makes me want to buy a watercooled car just to hack it! Well, that and the better engine. . . suspension. . .aerodynamics. . . HVAC. . . etc. . .

you are a traitor to the air cooled traditions Cramer!

[mjshira]

Originally Posted by ischmitz

Update: After some more work and fixing some hardware issues I finally got the tester to work properly on the 964. First it scans the car and finds the DME as the only control unit. This is the only system on my conversion. No ABD or airbag ECU here...



Next, here is the main menu where you can check and errase the fault memory (no faults stored in this case), monitor actual values, actuate drive links (injectors, resonance flap, tank venting, etc.) perform the system adaptation, check the coding of the DME, do knock registration, and check the general part number




And this is the list of parameters that can be monitored when the engine is running. Up to 8 items can be displayed simultaniously and one can record a log for later investigation. Helpful when dealing with intermittent failures that occur during driving (under load)





We'll see what's next - maybe it time to move on to the PIWIS

Ingo,

VERY COOL! Does this mean the hammer can live in Indiana now? ;-)

I like the interface, a lot easier to work with than the Hammer to say nothing of being easier to see.

Thanks for your post. Nice work.