[hassmaschine]

Originally Posted by CobraMarty

Yep and yep. MSV80 and AA tune, E92, N52N, '07 328xi.

But as our engines are not a MAF. Yes there is a MAF sensor but is it really used? When is it really used? Only at idle? Maybe at idle the MAF is used but I suspect and hope that at higher rpm and load levels it does not use the MAF directly.

How are the SC and turbo guys, ESS and BPC, getting around this higher air flow? They do not flow higher air flow at idle or even low load. They flow more air at higher rpm and higher idle.

Yeah, IDK. But it does look like all the valvetronic engines use and share many of the pieces. This mechanical changes should work for all the valvetronic engines. I might not be able to tune for it with the MSV89, but you will be able to use the mechanical pieces and tune your MSV70 to use it.

They can run without a MAF - but by default, that is not how they are set up. It certainly is used for more than just idle.

Don't forget the N52 also has a MAP sensor. The DME already has a mechanism to correct for higher air density and pressure via the MAP & MAF sensors (remember, the N54 computer is just a derivative of the N52 computer - they share a lot of the same features). It's not really relevant to the discussion of changing something mechanical as air density is already part of the algorithm.

[hassmaschine]

Originally Posted by CobraMarty

The same intake cam is used on all these models-
http://www.realoem.com/bmw/enUS/part...&q=11317563663

The same eccentric cam is used on all these models-
http://www.realoem.com/bmw/enUS/part...&q=11377515868

They are all N52s - all of them used the same cam (I cross referenced the parts a while back hoping to find something OEM+). the N55 has a different eccentric shaft and intake cam. The cam would probably fit in the N52 head, but the lift/duration are likely less as it's optimized for boost.

[CobraMarty]

The modified ratio would work in all these models- Now will the DME play nice with these mods?

1' E81   (02/2006 — 12/2011)
1' E87   (03/2005 — 02/2007)
1' E87 LCI   (01/2006 — 06/2011)
1' E88   (11/2006 — 10/2013)
1' E82   (12/2006 — 10/2013)
1' F20   (07/2010 — 02/2015)
1' F20 LCI   (05/2014 — 05/2016)
1' F21   (07/2010 — 02/2015)
1' F21 LCI   (06/2014 — 05/2016)
2' F22   (10/2012 — 05/2016)
2' F87 M2   (11/2014 — 05/2016)
2' F23   (03/2014 — 05/2016)
3' E90   (02/2004 — 09/2008)
3' E90 LCI   (07/2007 — 02/2012)
3' E91   (02/2004 — 08/2008)
3' E91 LCI   (07/2007 — 05/2012)
3' E92   (05/2005 — 02/2010)
3' E92 LCI   (11/2008 — 06/2013)
3' E93   (09/2005 — 02/2010)
3' E93 LCI   (11/2008 — 10/2013)
3' F30   (02/2011 — 01/2016)
3' F30 LCI   (10/2014 — 06/2016)
3' F31   (07/2011 — 06/2015)
3' F31 LCI   (12/2014 — 05/2016)
3' F34 GT   (07/2012 — 05/2016)
3' F35   (06/2011 — 08/2015)
3' F35 LCI   (01/2015 — 05/2016)
4' F32   (11/2012 — 05/2016)
4' F33   (03/2013 — 05/2016)
4' F36   (07/2013 — 05/2016)
5' E60   (07/2004 — 06/2007)
5' E60 LCI   (11/2005 — 08/2010)
5' E61   (07/2004 — 02/2007)
5' E61 LCI   (11/2005 — 03/2010)
5' F07 GT   (09/2008 — 06/2013)
5' F07 GT LCI   (08/2012 — 05/2016)
5' F10   (01/2009 — 06/2013)
5' F10 LCI   (08/2012 — 06/2016)
5' F11   (02/2009 — 06/2013)
5' F11 LCI   (10/2012 — 05/2016)
5' F18   (08/2009 — 08/2013)
5' F18 LCI   (10/2012 — 05/2016)
6' E63   (02/2004 — 07/2007)
6' E63 LCI   (05/2006 — 07/2010)
6' E64   (03/2004 — 07/2007)
6' E64 LCI   (05/2006 — 07/2010)
6' F06 GC   (05/2011 — 02/2015)
6' F06 GC LCI   (06/2014 — 05/2016)
6' F12   (10/2009 — 02/2015)
6' F12 LCI   (07/2014 — 05/2016)
6' F13   (04/2010 — 02/2015)
6' F13 LCI   (05/2014 — 05/2016)
7' E65   (06/2004 — 07/2008)
7' E66   (07/2004 — 07/2008)
7' F01   (06/2008 — 06/2012)
7' F01 LCI   (05/2011 — 05/2015)
7' F02   (09/2007 — 06/2012)
7' F02 LCI   (05/2011 — 05/2015)
X1 E84   (09/2008 — 12/2015)
X3 E83 LCI   (02/2006 — 08/2010)
X3 F25   (07/2009 — 06/2016)
X4 F26   (05/2013 — 06/2016)
X5 E70   (02/2006 — 03/2010)
X5 E70 LCI   (04/2009 — 06/2013)
X5 F15   (08/2012 — 06/2016)
X6 E71   (07/2009 — 06/2014)
X6 F16   (09/2013 — 06/2016)
Z4 E85   (10/2004 — 08/2008)
Z4 E86   (10/2005 — 08/2008)
Z4 E89   (01/2008 — 05/2016)

[rjahl]

In other news,

I was able to flash custom tunes via winfkp using fast baud rate today. Takes about 40 seconds for a full ODA file.

I'm starting to look at the command line options available for winfkp. I'd like to call it directly from my script,that will make it a little quicker and less prone to user error.

I did about 6 flashes on the bench today. I need to check if the new setting allow these data transfer speeds in the car.

I've done a little more research to see if I can unlock the ECU using the same tools and I'm not too hopeful. It looks like a new program is flashed into a higher area of memory and checked by the original programming before allowing the new program to replace the original. Speculation on my part, does anyone know any different?

[hassmaschine]

I don't think it works like that. There's really no space to store a 2nd copy of flash.

What i know happens is if the RSA check fails during the write, there's a double word that it doesn't write near the program space which causes it to fail to boot. The reason we can ignore it with BDM is we always write that double word - and that is the only time the RSA key is checked.

Really good to hear winkfp flashed are working though! I still havent made mine work yet, lol.

[rjahl]

I think your are correct with the process for the calibration files, but the programs section seem to be written differently. I took a BDM of a failed program flash and found the new program hiding in 0x60000 while the original program could still still be found at 0x20000. Funny part about this is the actual Hex file location for this data is 0x60000.

I'll look at the size of this block, but I believe its the entire block/program between 0x20000 and the calibration segments at 0x40000.

I'll crash another one and see what it looks like.

[hassmaschine]

the main program is at 0x80000 (excluding what is stored on the MPC563). There is boot code at 0x20000, but generally that is not written to (unless you are using BDM). The program will definitely not fit in the space between the end of the parameter space and the beginning of the program space - it's about 4x longer than that.

[rjahl]

Originally Posted by hassmaschine

the main program is at 0x80000 (excluding what is stored on the MPC563). There is boot code at 0x20000, but generally that is not written to (unless you are using BDM). The program will definitely not fit in the space between the end of the parameter space and the beginning of the program space - it's about 4x longer than that.

I really don't know where the boot code ends or begins and I guess that causing some confusion.

I'll see if i can find a better way of illustrating when I get home this evening.

I'm pretty sure, when I reverse a BIN back into an 0PA file, the sector at 0x20000 is part of the 0PA. It's mapped at 0x60000 in the hex file but you find it at 0x20000 in a "good" bin. My Hex file tool subtracts 0x40000 from the following block addresses when it reads the data from the bin.

except from the Public Offsettable array in my tool. Left column is starting block address and the right if the offset between the hex file description and the actual bin location.

offsettable(1, 1) = "060000": offsettable(1, 2) = "40000"
offsettable(2, 1) = "060100": offsettable(2, 2) = "40000"
offsettable(3, 1) = "060200": offsettable(3, 2) = "40000"
offsettable(4, 1) = "060300": offsettable(4, 2) = "40000"
offsettable(5, 1) = "060600": offsettable(5, 2) = "40000"
offsettable(6, 1) = "070000": offsettable(6, 2) = "40000"
offsettable(7, 1) = "07FBC0": offsettable(7, 2) = "40000"
offsettable(8, 1) = "07FDC0": offsettable(8, 2) = "40000"


Unless I'm missing something and I often do. The space between 0x60000 and 0x80000 is empty. That would be large enough to temporarily store the data/program/bootsector? at 0x20000 - 0x40000.

What is the sector at 0x8000 - 0x14000 ? I was thinking that was the boot sector as that data as it can not be found in the 0PA or 0DA file.

So much to learn, so little time.

[hassmaschine]

that's the boot sector. I'm sure of it. It's not all of it, but it's a good chunk.

There is boot code at 0x0-0x1F00, the AIF region is 0x4000-0x4FFF, another region of boot code at 0x8000-0x14220, and the boot code you're talking about at 0x20000-0x3FFFF.

The main program code (not including MPC flash) is 2-3x longer than the 3 boot sectors, AIF and parameters combined. It's plausible that it copies the 3rd boot sector to the empty space between the parameters and program as a safety measure in case the write fails but there's definitely nowhere for it to store a second copy of the program anywhere.

I think the first and second boot sectors can only be written with an *.0ba file, which as far as I know nobody has access too.

[rjahl]

Originally Posted by hassmaschine

that's the boot sector. I'm sure of it. It's not all of it, but it's a good chunk.

Just to be clear, 0x8000 - 0x14000 is part of the boot sector?

[hassmaschine]

Yep!

[rjahl]

Hassmachine,

Have you ever reviewed the learned ignition adaption values on your tunes? If extracted do you think they could give a good indication how the DME is correcting for "noise" from the know sensors.

[hassmaschine]

no, I would love to pull RAM dumps from a running car - but on the E90 they didn't hook up the K-line and I don't have any software that will read RAM with the D-CAN cable.

I could wire it up but that seems like a lot of work, lol. About 4 feet of wire to snake through the dashboard.. ugh.

[rjahl]

Originally Posted by hassmaschine

no, I would love to pull RAM dumps from a running car - but on the E90 they didn't hook up the K-line and I don't have any software that will read RAM with the D-CAN cable.

I could wire it up but that seems like a lot of work, lol. About 4 feet of wire to snake through the dashboard.. ugh.

There is no way to extract and interpret the stored adaption values from the DME? That's a shame.

I'm starting to understand the ediabas functions a little better, maybe I can use one of those Excel files I sent last week to create an "environment" to read the DME over DCan. I'm a little worried about the data transfer speed with a running car. It's possible that the data taken during the beginning of the read may not match corresponding data at the end.

It will probably be best to limit each read operation to a small range of memory but not as small as the 254 byte limit in INPA.

[hassmaschine]

Not directly. You can log some of it, but it's so much better if you can access RAM directly.

Is the Z4 Can11h? If so, it should have K-line connected. You could use Pasoft 1.4 to do a full dump of it. It think testo or dr. gini could do it too via D-can, it's just a matter of figuring out the EDIABAS/KWP commands.

Don't the logs have a time stamp? It should be fine because all the data bits are from the same time frame, right? It's not like O2 data is on a different timeline from RPM.

I think I will eventually just hook up the K-line to my car. My swap project will have it of course but that's a ways off.

BTW, I just sent you something to test. Possibly a way to disable the RSA check via OBD.

[rjahl]

Originally Posted by hassmaschine

Not directly. You can log some of it, but it's so much better if you can access RAM directly.

Is the Z4 Can11h? If so, it should have K-line connected. You could use Pasoft 1.4 to do a full dump of it. It think testo or dr. gini could do it too via D-can, it's just a matter of figuring out the EDIABAS/KWP commands.

Don't the logs have a time stamp? It should be fine because all the data bits are from the same time frame, right? It's not like O2 data is on a different timeline from RPM.

I think I will eventually just hook up the K-line to my car. My swap project will have it of course but that's a ways off.

BTW, I just sent you something to test. Possibly a way to disable the RSA check via OBD.

I still owe you some answers on this but look at what Pheno is doing for the Diesel Guys. Swamped with work and other events in my life right now.

http://www.e90post.com/forums/showpo...postcount=1502

[hassmaschine]

hey cool. If he can directly log RAM locations, I can list or find any of the ones we might be interested in.

[Kgolf31]

Hass,

In earlier threads (forget if you were apart of them or not). There have been discussions about coolant temperature and how the car dynamically changes pump to control to certain temperatures for efficiency, and performance.

Anyway we can specifically tell the car to control to a 80C coolant temperature (aka the performance temperature) and not have it vary?

[hassmaschine]

yes, I could do that. but why? you won't gain more reliability or performance. you will only lose fuel economy. The only times it is supposed to run at the higher temp thresholds is when the engine is lightly loaded.

If you are seeing it run at hotter temps during track use, maybe there's a threshold for the 80c setting that could be lowered instead of compromising the rest of the driving states?

if you really want to force it to run at 80c all the time, there's a Mishimoto thermostat for the N52 that does just that. I just don't see the point.

[Kgolf31]

Originally Posted by hassmaschine

yes, I could do that. but why? you won't gain more reliability or performance. you will only lose fuel economy. The only times it is supposed to run at the higher temp thresholds is when the engine is lightly loaded.

If you are seeing it run at hotter temps during track use, maybe there's a threshold for the 80c setting that could be lowered instead of compromising the rest of the driving states?

if you really want to force it to run at 80c all the time, there's a Mishimoto thermostat for the N52 that does just that. I just don't see the point.

My car is trailered to/from events and doesn't see any DD time anymore.

Could be because I don't know exactly the quantifiable results of lowering coolant temp, but my car sits in a grid (autox) and in staging lanes for ProSolos which the car is idling, and thus generating tons of engine heat. I don't exactly track coolant temp at this time, because my tablet is being utilized for data logging runs, but I'm assuming the car will default back to "economy mode" when idling.

Going out for a run, it would make sense to drive to coolant temp low to being with so you don't have to play catch up.

Just shooting out an idea, don't the validity of it

[hassmaschine]

ok, that makes sense. In that case the simplest way is to just get the Mishimoto thermostat. I don't know if it's any good though, I don't know anyone who has used it, but it's advertised for the N52.

If you have the means to flash yourself (OFT is the only way to DIY flash over OBD currently), then it's a simple matter of changing the 4 temp thresholds for the thermostat to 80c.

this is your 128i or your Z4M?

FWIW, I can do the same stuff with the Z4M that I can do with MSV70. They share about 98% of their code. I don't know if the Z4M has the mapped thermostat though?

[justpete]

Originally Posted by hassmaschine

ok, that makes sense. In that case the simplest way is to just get the Mishimoto thermostat. I don't know if it's any good though, I don't know anyone who has used it, but it's advertised for the N52.

If you have the means to flash yourself (OFT is the only way to DIY flash over OBD currently), then it's a simple matter of changing the 4 temp thresholds for the thermostat to 80c.

this is your 128i or your Z4M?

FWIW, I can do the same stuff with the Z4M that I can do with MSV70. They share about 98% of their code. I don't know if the Z4M has the mapped thermostat though?

I have one of the Mishimoto thermostats and the directions say you have to pull the metal tip out so the DME can't control it. So the coolant system becomes fixed temp. Not sure how the DME responds to something like that or what you have to do for the pump operating speed.