My newest project: PST2 aka Porsche System Tester
 

Here is a first shot of my newest project: Getting me a Porsche System Tester, aka PST2. The PST2 was the successor to the Bosch "Hammer" (KTS301). It can deal with a lot of the newer cars.

http://forums.pelicanparts.com/uploa...1213080490.jpg

It really is a 80486-based handheld computer with a B/W LCD display with 640x480 pixels. In this particular configuration it runs a crippled version of Windows 3.1 and Porsche's software. It also has an integrated URI module that can measure voltages, currents, and resistances. The URI module runs on a 68HC11 mircocontroler and communicates via a serial port to the main computer.

Bosch made a generic version called KTS 500 for all vehicles running OBD-II and a special Porsche-only version called PST2. And like everything else the Porsche version commands a rather hefty Porsche tax when trying to find used ones. So I set out to "convert" a generic Bosch KTS 500 into a PST2. After running into some hurdles I finally figured out how to "trick" the software to ignore the green outside and play with the Bosch hardware. :D Next, I have to convert the OBD-II cable into the Porsche version and see if I can do some scanning. Stay tuned.

You are a far braver soul than I! When You get it to work are you going to market it as a converted unit or will you do the conversion for others? ??

village idiot,

I haven't even thought that far. At this point my main goal is to get it to run properly and learn things in the process. I like tinkering with that sort of stuff. But if someone is interested we can certainly talk.

A couple of years ago I did a similar project converting an ordinary KTS300 into a Hammer. I had to fabricate a PCB from scratch, a first for me.

http://members.cox.net/3.6/images/928module.jpg

And have I sold any? Nope, and it wasn't the point either - there are others that do. See here for the hammer in action on my 3.6 conversion: http://forums.pelicanparts.com/showthread.php?t=282401&highlight=hammer+bosch+kts 300

That's awesome! electrical/electronics is the one thing I don't enjoy messing with. Eventually, I'll have to buckle down and start studying because I do plan to have a 3.6 in mine as well.
Keep us posted on the results.

Update:

The bad news first: I was trying to read the DME on the 964 3.6 in my Targa. This should have been a pretty straight forward task. Plug the 8-pin AMP connector that goes into the Hamer into the short Bosch adapter and that goes into the PST2. However, despite numerous tries the PST2 did not find the DME. What a bummer. I think I have to chase the signals and check if something is mis-wired. Wired, the Hammer still finds the DME just fine. Maybe it is not as demanding and does not need the L-line. We will see.

The good news: Out of sheer frustration I went ahead and hooked the KTS 500 cable up to the 996. And surprise surprise the PST2 found the DME. I knew at the time that the standard Bosch-OBD2 cable is different from the Porsche version. So with new-found inspiration I went ahead and converted the cable to Porsche specificatons. And that lead to full success. See for yourself.

First, the PST scans the vehicle and highlights all control units found in the car. For the C4 coupe it found the PSM and all other moduls expected. The "#" in front of a unit means there are stored fault codes:

http://forums.pelicanparts.com/uploa...1213167593.jpg

Well, the faults are because the battery died on me. So the POSIP complained and so did the alarm unit if it can't lock/unlock the doors or move the windows. So I went ahead and erased the faults:

http://forums.pelicanparts.com/uploa...1213167745.jpg

And voila, the next scan comes up clean. No more fault codes. So my first little job has been completed successfully:

http://forums.pelicanparts.com/uploa...1213167826.jpg

Ingo

Ingo,

That is EXTREMELY cool, ALMOST makes me want to buy a watercooled car just to hack it! Well, that and the better engine. . . suspension. . .aerodynamics. . . HVAC. . . etc. . . :)

I want one !

Ingo, That is very cool. Can you reflash the 996 ECU? Would it work for a 986 as well? Might be a market for those 996-Boxster installs where the 996 maps are installed in a 986 ECU.

If it works to find the 996 I bet there is a connection issue with the 3.6. I suspect it is hardware related (cable).

Jamie,

To answer your first question: Yes you can write to any ECU in the car and Porsche makes extensive use of that. Starting with the 996/986 everything is stored in EEPROM memory. ISP (In System Programming) is much easier than having to open the box and replace a memory chip.

However, first of all the PST2 is far away from an open book. It has structured menu items to change settings in the ECU. Things like settings for the POSIP, engine #, etc. You can also re-flash parts of the ECU or the instrument cluster to a new box in case it needs replacement.

Some writeable areas are protected by binary security pass phrases. Each car is identified by its VIN number. Porsche maintains a data base with these keys for each car. There are several areas that are protected. Things like the instrument cluster, the immobilizer, remote entry, alarm, vehicle history just to name a few. If you want to write to those areas you need the specific key for your car from Porsche. I have seen a printout at the dealership for a 997 with all its keys. There were at least 10 if not more. If a service technician needs to perform a certain operation he needs to talk to his supervisor to get the key. Only the supervisors have access to these keys. My guess is that Porsche use some sort of AES or DES encryption. That’s what the pass phrases look like.

If you want to change the mapping for an engine you would have to reverse-engineer the binary image of the ECU, get the checksums right and inject it back into the PST2 software to get it to write the modded image to the ECU. But I don’t want to kill my C4 just yet. So I don’t think I am going to do much in that line. There are other aftermarket solutions out there that can do this.

For your second comment I don’t know why it is not working on the 964. Everything works fine with my Hammer. It finds the DME. My custom cable that goes between my custom diagnostic port in the car and the Hammer is the same cable that I used with the PST2. Since it works with the Hammer I assumed that there is no issue with the cable and/or port.

However, I am still not quite clear why about the differences between the K-line and the L-line. Some control units do not even use the L-line. It must be some sort of hand-shake and it is unidirectional. The K-line is a bi-directional port. So as I said maybe my L-line on my custom implementation in the early car is not working properly and the Hammer doesn’t care while the PST2 does. I need to do some signal-chasing I guess.

Ingo

Ingo:
Good work!
Subscribed

Hello there,

ok man, you 're exactly doing what i'm planning to do:

converting a generic KTS 300 to KTS 301
or
converting a generic KTS 500 to PST2

i would maybe prefere to convert a KTS 500 as it's more sophisticated.
so, as far as i understand,

for a KTS 500 conversion to PST2 you need:

- a KTS 500
- a specific PCMCIA card? does the serial regular PCMCIA card offer all the same functionnalities than a PST2?
- the PST2 software
- porsche adaptable plugs for obd2 and 19 round pins

am i correct?
is there something else to modify?
could you help me in that process?
where could i find the software and the Modified PCMCIA card(if necessary)

Please let me know

cheers

cedric

Delivered to 30075, how much? ;)

You get all of the hardware on Ebay Germany. I am not sure about the differences between the generic PCMCIA cards (2 versions) and the Porsche card other than the dealer information stored in the Porsche cards. However, that is not even an issue anymore.

For the KTS300 -> KTS301 it is pretty much done and confirmed working. I can produce the ROM module. And yes, you need the cables to interface to the car. JDS in England makes a reproduction 19-pin cable for the 964. The OBD2 style connector can be bought at Digikey and you can make your own cable.

For the KTS500 -> PST2 transition it is a little bit more involved. I haven't sorted it all out yet. Read here for the latest. http://forums.pelicanparts.com/showthread.php?t=415530 and help if you can.

Cheers,
Ingo

FWIW, the KTS PCMCIA card also contains a 68HC11. It runs OS9. The code running on it comes from the SDM\DL directory in various .DL files.

Bill

Interesting. So the 68HC11 gets its executable code downloaded for each communication job then? I wonder why Bosch used another RTOS layer rather than using the PC itself. Do you think timing wasn't cutting it with Windows3.11/DOS?

Ingo

Update: After some more work and fixing some hardware issues I finally got the tester to work properly on the 964. First it scans the car and finds the DME as the only control unit. This is the only system on my conversion. No ABD or airbag ECU here...

http://forums.pelicanparts.com/uploa...1216274975.jpg

Next, here is the main menu where you can check and errase the fault memory (no faults stored in this case), monitor actual values, actuate drive links (injectors, resonance flap, tank venting, etc.) perform the system adaptation, check the coding of the DME, do knock registration, and check the general part number

http://forums.pelicanparts.com/uploa...1216275008.jpg


And this is the list of parameters that can be monitored when the engine is running. Up to 8 items can be displayed simultaniously and one can record a log for later investigation. Helpful when dealing with intermittent failures that occur during driving (under load)

http://forums.pelicanparts.com/uploa...1216275049.jpg



We'll see what's next - maybe it time to move on to the PIWIS :D

Hello Ischmitz

i have a problem with my pst notebook..
the notebook was ghostet from an prosche pst, and im use a bosch kts 405 PCMCIA card.

i can only see the DME and one of the other module .. but i have abs alarm and airbag.

do you know this problem?

thank you for help ^^

greez

pstnoob

What model car are you trying to scan?
BTW, there is no KTS405. There is a KTS400, KTS401, and KTS402 as far as I know.

Cheers,
Ingo

you are a traitor to the air cooled traditions Cramer! :rolleyes:

Ingo,

VERY COOL! Does this mean the hammer can live in Indiana now? ;-)

I like the interface, a lot easier to work with than the Hammer to say nothing of being easier to see.

Thanks for your post. Nice work.

It is so much easier to make a PST2 from an IBM 600E. I have done it dozens of times. The 600E runs about 6 times faster, displays in color, has readily available parts for replacment and is smaller and easier to carry. The only downside to the IBM is that it will not run off the power from the car as the PST2 will. However replacement batteries are only about $35.00 on Ebay.

And BTW your unit is using an old verion of the PST2 software. The last software was update 24

If you need the update or other information on getting a PST2 PM me.

Richard, I understand and have successfully "made" PST2's from various different laptops. It doesn't have to be an IBM. Some prefer Toshiba, and Dells works fine as well and can be had dirt-cheap on eBay.

However, as you said the downside of a laptop is that you either need a cigarette lighter powered adapter or good batteries. On top of that the rugged design of the KTS 500/ original PS2 stands up a lot better to the rough workshop environment.

PS: I meanwhile run V24

I do have one question though if you are a specialist: Is the later version of the URI module compatible with any of the Porsche SW. I have tried to later boards and can not use the Ohm setting. The software throws up an "unidentified label" error and gets unhappy. This seems to be a bug as far as I am concerned. The original PST2 hardware only had the earlier URI board from what I understand. Any thoughts?

Cheers,
Ingo

Ingo - Can you make this work on a KTS 650?

Why would you want it to run on a KTS650 To make or get a PST2 is about $3,000 complete and the KTS 650 alone costs about $5000 ( if you can find a used one) or more before you get the Porsche special cables, and additional labor and software costs to make it run the PST2 software.

And as to durability of the KTS500 ( or PST2) compared to the IBM 600E, try to get repair parts for the Bosch unit. If you drop the IBM just buy another on Ebay for about $100, swap the HD and your good to go. Service, parts, repairs for the Bosch are impossible. Porsche and Bosch do not support it anymore.

It is so much easier to make a PST2 from the IBM 600E. The IBM is cheaper, faster, COLOR, reparable, and mine is running V24

After much hacking, I have V24 running under Windows 98 on
other types of laptops with other PCMCIA chipsets. Not something that's
ready for others to use yet, though.

Bill

Why bother with hacking. Leave the hard part to finding and reprograming the KTS cards and getting the pigtail and Porsche cables.

And I have seen the other 4 year and older laptops. They feel like they are about to fall apart. The IBM was made for commercial use and stands up well to time and use.

Cause it's fun.

Hey Bill, how are things? Long time no talk. I hope all is well at your end. Cheers Ingo

Yup, all is well. Just busy at work trying to not get fired. ;-)

I have some new PST2 stuff working I want to show you sometime
when I get a breather.

Bill

Dear All,
Getting in late in the game, what exactly does a system adaptation do, reset all the values to their default or something more sophisticated?
Thanks
Tim

Surely with the correct Porsche lead from the OBD11 socket, a PC can be used with "cloned" Porsche system tester software???

Sorry-came to this late in the day: need to "recalibrate" my 996 cab soft top/lid...!!!
Keep up the good piracy!!!

Sorry-came to this very late in the day!!!

Trying to avoid Porshe Main Dealer, but need to "recalibrate" my cab roof!

Unfortunately the PST-2 uses a custom PCMCIA card that handles all the protocol communication with the control units. So a simple PC won't do unless you are willing to re-write the complete software from scratch.

There are aftermarket solutions out there (Durametric) that have done that. But it is a PROJECT. You need to fully emulate the protocol stuff and the have knowledge about the address locations and protocol details of each control unit. Lot's of reverse engineering and time.....

This is why using the Borsch hardware is some much more efficient.

Ingo

Hi, Ingo!

And don't forget, hack/crack various encryption and locking schemes to get the ECUs into special modes. Which can only be done by intimate knowledge and hands-on with the PST2.

Bill

I've been working on and off on a thunking shim layer that sits between the Bosch PCMCIA Win16 DLLs and Win32 USB drivers so the KTS Karte isn't required. With it the PST2 pgm runs on Windows XP. It works, but far from finished. Haven't looked it at for a year now.

But it's just never going to be generally useful. Because the user would still need a copy of the PST2 software, which isn't public domain.

I made this board to replace the Bosch PCMCIA:

http://www.wrljet.com/rennpics/drbmini.jpg

PST2/ Thinkpad 600E
 

I have a Toshiba Satellite Pro 480 CDT with PST 2 on it. It has died and Toshiba won't service it.
We have found that the hard drive is OK and I have a ghost copy as well as a download onto a thumb drive. Ghost copy has error messages and wants more input.
It was suggested that I get a 600E and swap the hard drive. I did, but it seems to want a floppy disc.
Re installed the 600E hard drive and tried the thumb drive. Better, I get files, etc. and can open some, but it still wants some other input.

Can anyone help? I'm not a computer techie.

Ed B :confused:

1) The easiest thing to do is buy another Toshiba 480 CDT. You should start a search on Ebay and save the or 2) You need the IBM 600E drivers for windows 3.11 on a floppy so the IBM knows how to run the HD and program.

Most of the downloads avail are VMWare and will be too slow on a 600E

Yeah but can you get a temp on the dogs butt?
iPad version?
Will this work on a '72?

I've been unable to find another Toshiba 480 CDT. Any Ebay listing says out of stock. Found a source, but no response for several months.
I have found a driver for a PCMCIA for Windows NT on the Lenovo site for the 600E. My 600E has Windows 2000. Should be OK?

Ed B