[DWR]

ZF6HP19, ZF6HP26 and ZF6HP32 are first generation transmissions. ZF6HP21, ZF6HP28 and ZF6HP34 are second generation that have more clutch plates, revised valve body and faster shifting. The ZF6HP19TU is a technical upgrade that became the ZF6HP21.

[_TB_]

Originally Posted by DWR

ZF6HP19, ZF6HP26 and ZF6HP32 are first generation transmissions. ZF6HP21, ZF6HP28 and ZF6HP34 are second generation that have more clutch plates, revised valve body and faster shifting. The ZF6HP19TU is a technical upgrade that became the ZF6HP21.

Does that mean that the 6HP19TÜ is faster shifting and has more clutch plates than the 6HP19 ?

If so, that would explain why the 335d is shifting so sluggish compared with mine (325d)

[rjahl]

Check out the latest post in the N52 section

http://www.e90post.com/forums/showth...=957850&page=2


More information;

Will the alpina flash work on 328's with there version of the zf?

You cannot flash the ZF trans in a US spec 330 model or 325 model due to the mechatronics unit. All US spec 325/330 models were manufactured before 2007. Most 328s after 2007 came with a ZF trans.

Even though the trans is mechanically the same, the mechatronics unit is different for pre/post March 07 builds. Post March 07 builds had double the flash memory....which is required for the Alpina flash. The Alpina flash is just physically not small enough in file size to be flashed on to a pre-March 07 mechatronics.

Technically, you should be able to swap a post March 07 mechatronics unit into a pre-March 07 build, then flash it. However, I do not know the effects of this on a non-turbo model.

I actually have a euro sport trans flash on my 330xi and it increased throttle response and removed some of the dead spot in the pedal.

I have done a mech unit swap for a 335, then flashed it with Alpina but obviously, it was intended for that motor.

[Mik325tds]

I downloaded the P.A soft BMW scanner demo version (1.4.0), but it doesn't work with the E90. I guess we need the version 2.1.0 to read the 335d EGS.

Also, it seems like it can read only, so we'll still need some other tool to write back to the EGS.

On another note, I just found out that WinKFP does crash in Win7 when it tries to write the UI - field. It's best to deactivate this feature:

[DWR]

Originally Posted by _TB_

Does that mean that the 6HP19TÜ is faster shifting and has more clutch plates than the 6HP19 ?

If so, that would explain why the 335d is shifting so sluggish compared with mine (325d)

Earlier build 335d's (until 2009/08/28) had the ZF 6HP26Z or TU (technical upgrade) which thereafter was re-designated the 6HP28.

Let's not forget the calibration of the TCU has a big effect. After all, isn't that the subject of this thread?

[Mik325tds]

Yes, sir!

[_TB_]

Does anybody know the processor type in the TCU?

We have a full dump now - if someone knows the processor type we can disassemble it with IDA. Motorola? Freescale?

[Mik325tds]

Should be a Motorola MPC562.

[RBT-Tuning]

Originally Posted by Mik325tds

I downloaded the P.A soft BMW scanner demo version (1.4.0), but it doesn't work with the E90. I guess we need the version 2.1.0 to read the 335d EGS.

Also, it seems like it can read only, so we'll still need some other tool to write back to the EGS.

On another note, I just found out that WinKFP does crash in Win7 when it tries to write the UI - field. It's best to deactivate this feature:

On my Win7 Laptop it only crashes in expert mode. UIF write works fine in comfort.

[Mik325tds]

Originally Posted by RayBan81

On my Win7 Laptop it only crashes in expert mode. UIF write works fine in comfort.

Correct. Same with mine. But I deactivated writing UIF in comfort mode also in order not to run out of reprogramming attempts. I think I have only 53 left or so.

[Mik325tds]

Originally Posted by rjahl

OK attached is what I think is a full memory dump from a 6HP19 using BMW scanner, demo. I've used this software in the past and the files matched the actual ECU contents. It's only going to provide data in the flash and I have no idea what else in on the TCU board.

ZB#7571102
HN#7574645
DF#7571103

I have also attached the matching ODA and OPA file for the BIN. Sorry I had to break the dump into two parts, exceeded the 419KB limit for the forum. I then had to rename the files so the forum would allow the split files.

To use these, You need to rename the EGS_00000-FFFFF-00 first(001).zip to
EGS_00000-FFFF-00 first.zip.001. Same for the second file. This is required for Winzip to recognize the split archive and unpack them as a single file.

I took a quick look at the ODA files and I'm not seeing anything that looks like an RSA signature. I'm looking for a large block about 100 bytes of data that is not a map an is completely different between ODA files. It's just not jumping out at me.

I guess the next step would be to build a BIN from the ODA and OPA file and compare them against the actual TCU BIN.

That's all the time I have to today.


Edit: I just realized that the OPA Was too large as well. It's 7564645A.OPa. I think you can find that in your Data files.

In order to join the fun and learn something new, I now red the EGS of my E53 X5 with BMW scanner. The E53 utilizes the K-Line for diagnostics, so I think if we find the connector pin of the EGS that has the K-Line on it we could attempt reading the 335d EGS through K-Line. Does anyone have the pinout of that connector?

Anyway, the memory read took about 45-50 minutes and it came back with "reading finished with errors". Do you know what the difference between these different read modes are?

[rjahl]

Originally Posted by Mik325tds

In order to join the fun and learn something myself, I now red the EGS of my E53 X5 with BMW scanner. The E53 utilizes the K-Line for diagnostics, so I think if we find the connector pin of the EGS that has the K-Line on it we could attempt reading the 335d EGS through K-Line. Does anyone have the pinout of that connector?

Anyway, the memory read took about 45-50 minutes and it came back with "reading finished with errors". Do you know what the difference between these different read modes are?

No, I don't know the difference between the modes. I samples a few and the patial results were the same.

Glad you managed to pull a flash, now we have another bin too look at.

I was digging for information and found a ZF document that I have not seen before. Interesting section that outlines resetting adaptations on the transmission. I never followed those procedures before, I wonder how important this procedure really i.

http://www.natef.org/NATEF/media/NAT...sion-6-8HP.pdf

[rjahl]

Originally Posted by Mik325tds

In order to join the fun and learn something new, I now red the EGS of my E53 X5 with BMW scanner. The E53 utilizes the K-Line for diagnostics, so I think if we find the connector pin of the EGS that has the K-Line on it we could attempt reading the 335d EGS through K-Line. Does anyone have the pinout of that connector?

Anyway, the memory read took about 45-50 minutes and it came back with "reading finished with errors". Do you know what the difference between these different read modes are?

Can you post the bin along with your hardware and software numbers?

[Mik325tds]

Originally Posted by rjahl

No, I don't know the difference between the modes. I samples a few and the patial results were the same.

Glad you managed to pull a flash, now we have another bin too look at.

I was digging for information and found a ZF document that I have not seen before. Interesting section that outlines resetting adaptations on the transmission. I never followed those procedures before, I wonder how important this procedure really i.

http://www.natef.org/NATEF/media/NAT...sion-6-8HP.pdf

Looks like an interesting document. Thanks! That will be a nice read for my flight tomorrow.
Yes, you should reset the adaptions after an update of the calibrations. It could lead to some weird shift behavior if you don't.
Some in this forum do this on a regular basis since it seems the shifts are much smoother after a reset of the adaptions.

[Mik325tds]

Originally Posted by rjahl

Can you post the bin along with your hardware and software numbers?

Sure. See attached .zip files. I used the same method that you did, so rename
EGS_00000-FFFFF-00witherrrors(001).zip to EGS_00000-FFFFF-00witherrrors.zip.001 and so on.

The transmission is a 6HP26Z, so basically the same as the 335d except with an additional drive output for the X drive.

The numbers are:
Cal: A7564918.0DA
SW: 7557063A.0PA

Let me know if you need those as well.
I yet have to learn how to compare these files to the binary. A simple file compare doesn't do it. Seems like I need to install WinOLS again.

[_TB_]

Originally Posted by Mik325tds

Seems like I need to install WinOLS again.

WInOLS Demo will do the import from Intel Hex to binary. Problem is getting the binary exported from the Demo. You can extract it from the *.ols project file though..

[332ijunkie]

Originally Posted by _TB_

WInOLS Demo will do the import from Intel Hex to binary. Problem is getting the binary exported from the Demo. You can extract it from the *.ols project file though..

Ive found it doesnt always do this properly. MS45 for instance it converts incorrectly.

[Mik325tds]

Originally Posted by _TB_

WInOLS Demo will do the import from Intel Hex to binary. Problem is getting the binary exported from the Demo. You can extract it from the *.ols project file though..

Thanks. I'll try that. At work we use Hexview to do conversions between the different formats. Maybe that'll work better.

[DWR]

Originally Posted by Mik325tds

In order to join the fun and learn something new, I now red the EGS of my E53 X5 with BMW scanner. The E53 utilizes the K-Line for diagnostics, so I think if we find the connector pin of the EGS that has the K-Line on it we could attempt reading the 335d EGS through K-Line. Does anyone have the pinout of that connector?

Ask and you shall receive. EGS pinout below.
Have also included a document that gives some hints about WinKFP configuration for EGS flashing, including details for the UIF fields.

Have a safe trip and pleasant trip.

[DWR]

A while back I got on the HPTuners forum site and contacted Eric Brooks. Eric does applications development for HP Tuners and worked to get programming for the ZF6HP26 in Fords. So, this a little embarrassing, I hadn't visited the site in over 5 months and missed Eric's response to a PM I sent him. Here it is:

You are correct, there is an operating system and calibration area in the binary. If you change one, you have to change the other. Since the offsets change between operating systems, if you plugged in a different calibration, all the values would likely be at the wrong locations.

On this particular TCM, it is made by Bosch, and each table has its own X and Y axis defined. None of them are shared like the typical Ford engine calibration. So if you can find a table, the X and Y will be right there with it.

Have you tried to read the TCM from the BMW? It is possible the controller is the same. If that is the case, I might be able to disassemble it and add support for it.

Fortunately for me, I don't have to totally reverse most things, as I get leaked documents almost constantly. So I generally have an idea where the tables are at, what they do, etc.

Eric Brooks
HP Tuners, LLC

If we can confirm that our TCM/TCU is the same controller used in Fords, we maybe able to get HP Tuners to support our BMWs. It does not appear BMW calibrations are going to get us the flexibility many of us want. Now, how do we find the TCU info?

[Mik325tds]

Originally Posted by DWR

Ask and you shall receive. EGS pinout below.
Have also included a document that gives some hints about WinKFP configuration for EGS flashing, including details for the UIF fields.

Have a safe trip and pleasant trip.

Thanks, DWR!
If anyone has the lower panel off, would you mind taking a quick look at this connector and see if pin 3 is populated, meaning: does it have a wire attached going into the harness?
If so, we probably can pick up the K-Line somewhere in the vehicle and access the TCU with that. If not, we'll need to make a connector ourselves.

[Mik325tds]

Originally Posted by DWR

A while back I got on the HPTuners forum site and contacted Eric Brooks. Eric does applications development for HP Tuners and worked to get programming for the ZF6HP26 in Fords. So, this a little embarrassing, I hadn't visited the site in over 5 months and missed Eric's response to a PM I sent him. Here it is:

You are correct, there is an operating system and calibration area in the binary. If you change one, you have to change the other. Since the offsets change between operating systems, if you plugged in a different calibration, all the values would likely be at the wrong locations.

On this particular TCM, it is made by Bosch, and each table has its own X and Y axis defined. None of them are shared like the typical Ford engine calibration. So if you can find a table, the X and Y will be right there with it.

Have you tried to read the TCM from the BMW? It is possible the controller is the same. If that is the case, I might be able to disassemble it and add support for it.

Fortunately for me, I don't have to totally reverse most things, as I get leaked documents almost constantly. So I generally have an idea where the tables are at, what they do, etc.

Eric Brooks
HP Tuners, LLC

If we can confirm that our TCM/TCU is the same controller used in Fords, we maybe able to get HP Tuners to support our BMWs. It does not appear BMW calibrations are going to get us the flexibility many of us want. Now, how do we find the TCU info?

Well, we know it's made by Bosch and has likely a Motorola MPC562 in it. What else does he need?
It would be awesome if HP tuners could just extend their tool for the 335d!