[hassmaschine]

I would guess it looks up the value in the first table, multiplies that factor by the value in the second table, and then subtracts it from the nominal ignition target.

started a search with that E70 file - should be helpful, thanks. The 328i only matches about 32%, but I can also run that vs the 325i which should be similar.

[rjahl]

Originally Posted by hassmaschine

I would guess it looks up the value in the first table, multiplies that factor by the value in the second table, and then subtracts it from the nominal ignition target.

started a search with that E70 file - should be helpful, thanks. The 328i only matches about 25%, but I can also run that vs the 325i which should be similar.

It actually get more complicated, There is another similar correction factor for speed vs. gear.

I believe the Stored / learned offsets are also taken into account when determining the final ignition advance.

[bNks334]

Just wondering, what are you using to correct checksums and write to the ECU?

I cant seem to find any plugins for winols that support MSV80.1 and most generic software I am coming across don't explicitly state that they support anything higher than the MSV70 Generation DME. I found a few euro race teams that produced custom software to read/write and modify bin files for the newer ECU's, but they were in thousands of dollars to buy.

I'd like to get started messing with some of this myself!

[hassmaschine]

CMD Flash corrects the checksums automatically. However, I did finally figure out how to correct the MSV70 checksum manually. Don't know about MSV80 - it might be similar. There's a table in MSV70 that shows where the range is for the checksum calculation, and another table for the checksum itself. I haven't looked that closely yet in mSV80 but I haven't see anything obvious.

actually I think I do see it. 16 bit values in MSV80 are little endian - at 0x40120, if you flip the bytes around, there's a table that has the addresses 040300-04FFFF, 050000-06FFFF. There's actually a few "blocks" just like on MSV70.

If I were to guess, the checksum range is likely 040300-06FFFF. On MSV70 it's a CRC32, and you have to input the polynomial "04C11DB7" to calculate the correct checksum (this string can be found in the full binary of MSV70). I can't find that string in MSV80 but it's probably based on the CPU architecture so I don't know what it is. I also don't know where the actual checksum is located on MSV80.

MSV70 also has a switch to turn off the checksum, but it's not clear where the equivalent is on MSV80. If I were to guess, it would be between 040150-04015F. 040160 has an equivalent in MSV70 at 040100, and the checksum switch is just before that, and after the checksum block definition.

[rjahl]

Hass,

I'd guess that the check sum is here.

Many of the OPA files have the check sum spelled out at the CVN number at the end of the file. Just search the CNV number and you find the check sum.

[bNks334]

Originally Posted by hassmaschine

CMD Flash corrects the checksums automatically. However, I did finally figure out how to correct the MSV70 checksum manually. Don't know about MSV80 - it might be similar. There's a table in MSV70 that shows where the range is for the checksum calculation, and another table for the checksum itself. I haven't looked that closely yet in mSV80 but I haven't see anything obvious.

Is there any way you/rjahl can summarize your tuning techniques?

hassmaschine - If I am understanding this correctly, you're bench flashing a standalone DME "clone"? You are using an ~$8,000 CMD-Flash dongle and corresponding software to read/write BDM data from the DME? You are then creating your own .xdf to work with the "raw" hex BDM data in Tunerpro?

rjahl - You stated in the earlier posts that you were ordering a cable. Which cable did you end up buying? Are you also bench flashing a spare DME? Which software are you using?

From what I am understanding you guys are both manipulating things on a more raw level?

My initial goal was to buy a KWP 2000 plus dongle to simply read/write an OTS tune to my DME via OBD. It doesn't seem like any of these generic cables will actually be able to write? None of them seem to support higher than MSV70? Can the Galletto dongle pull BDM data from the cars OBD port? Does that require jumping pins too? Is OBD tuning even possible with the MSV80.1 yet? I just cant find any answers to these basic questions to get started!

I have more questions but maybe someone can lay out the legwork for me via pm or something...

[hassmaschine]

no, I don't have an $8000 piece of hardware.. I have a $40 BDM-100 clone that comes with a copy of CMD Flash (can't be updated as it's not official).

you can write to MSV80 over OBD, but you can't quite get the full dump you can on MSV70 - you can get everything except where the secret key is stored, which is why you cannot clone MSV80.

I did finally find some examples of MSV80 being read directly but it required specific hardware and soldering a bunch of temporary jumpers. I still don't think it's possible for you and me unless you have $10k to blow on the hardware/software. otherwise, you're stuck with OBD.

I don't know if you can use KWP 2000 on MSV80 but I don't see why not.

Search engine: at 90% accuracy on MSV70 to MSV70, and increasing the accuracy actually made it faster too. MSV80 is considerably harder since there are so many false positives, but I think I can weed most of them out. realistically, about 75% of the definitions are constants, and 99% of those, nobody really cares about, so I think it will still be useful.

[rjahl]

Originally Posted by hassmaschine

no, I don't have an $8000 piece of hardware.. I have a $40 BDM-100 clone that comes with a copy of CMD Flash (can't be updated as it's not official).

you can write to MSV80 over OBD, but you can't quite get the full dump you can on MSV70 - you can get everything except where the secret key is stored, which is why you cannot clone MSV80.

I did finally find some examples of MSV80 being read directly but it required specific hardware and soldering a bunch of temporary jumpers. I still don't think it's possible for you and me unless you have $10k to blow on the hardware/software. otherwise, you're stuck with OBD.

I don't know if you can use KWP 2000 on MSV80 but I don't see why not.

Search engine: at 90% accuracy on MSV70 to MSV70, and increasing the accuracy actually made it faster too. MSV80 is considerably harder since there are so many false positives, but I think I can weed most of them out. realistically, about 75% of the definitions are constants, and 99% of those, nobody really cares about, so I think it will still be useful.

Sounds really good. Did the E70 file help with the accuracy at all?

[hassmaschine]

I think so. I switched algorithms when i started with that file to a much improved version, but there are maps on the 328i that are important which it simply isn't going to find since they are so different (disa, valvetronic).

I left it running at work - it was at 95% for MSV70 921s about halfway through so i think we will soon have at least a complete xdf for our cars.

[rjahl]

Originally Posted by hassmaschine

I think so. I switched algorithms when i started with that file to a much improved version, but there are maps on the 328i that are important which it simply isn't going to find since they are so different (disa, valvetronic).

I left it running at work - it was at 95% for MSV70 921s about halfway through so i think we will soon have at least a complete xdf for our cars.

That's really cool, can't wait to see it.

I tried a new tune in Sunday and so for it's been great. I've been holding back on the results until I put a few more miles on it. I don't want a repeat of the changes to the torque maps that felt ok but logged out to nothing.

Essentially it's just the same file with stock reference maps but I added 10% to the cylinder based knock factor tables. Feels like the hole bottom end just opened up. Revs very freely and no additional knocking in the logs. Top end feels like the timing values from your file but much smoother getting to full load.

The whole temperature sensitive timing thing has thrown me back little. If it's not bad enough trying to log this thing, now I need consistent weather.

[hassmaschine]

Sounds promising. I think the tune is coming together - i can't imagine getting a lot more improvement with an all stock engine.

It might be fun to go back to stock for a while and see if i can tell a difference. :-P

[antiprofi]

So, I was succesful in cloning my DME. Just wondering what these three files are containing:
- 29BL (OS?)
- MPC5xx Flash (engine map?)
- Serial E2 (Imobilizer Code?)

Any hints ?

Thanks

[hassmaschine]

the 29BLXXX is the parameter space (0x40000) & program (0x80000). MPC5XX (it's an MPC563 CPU) is the boot sector & more program code (ignition mostly). The Serial E2PROM contains the rolling codes for EWS and adaptation data (mileage, battery history, error codes, etc).

[antiprofi]

Originally Posted by hassmaschine

the 29BLXXX is the parameter space (0x40000) & program (0x80000). MPC5XX (it's an MPC563 CPU) is the boot sector & more program code (ignition mostly). The Serial E2PROM contains the rolling codes for EWS and adaptation data (mileage, battery history, error codes, etc).

Very impressive, thanks

[antiprofi]

Do you need more files? I have:

- E87 130i ECE (265HP)
- E60 525i US
- Z4 E86, 3.0si, tuned: stroker kit (3,2l), 100 cell kats

Do you think it's possible to copy the E86 map and use it in my e90 DME? I bought the modified engine and DME of a crashed E86. Unfurtunately the e86 is based on the E46, so there are different bus systems and it's not possible to copy the rolling codes to the E86 DME and use it in my e90.

Copying the MPC5xx file only works, but not the 29BLXXX file (the DME isn't reachable via A-CAN anymore).

[hassmaschine]

Is your Z4 an M54 or an N52? If it's an N52 it uses the same DME - the tune can be copied, also you can make it work in your E90 too. If it's an M54 it's completely different anyway.

but yeah, I could definitely use some more files. what might really help are more Serial E2PROM files. I've mapped out part of them and I know some of the VO data is stored there - I zeroed mine out to see what would happen and all the options turned off. Trying to figure out how I can enable the sport switch (even if it's pointless, I would like to try).

[rjahl]

Originally Posted by hassmaschine

Is your Z4 an M54 or an N52? If it's an N52 it uses the same DME - the tune can be copied, also you can make it work in your E90 too. If it's an M54 it's completely different anyway.

but yeah, I could definitely use some more files. what might really help are more Serial E2PROM files. I've mapped out part of them and I know some of the VO data is stored there - I zeroed mine out to see what would happen and all the options turned off. Trying to figure out how I can enable the sport switch (even if it's pointless, I would like to try).

I would love to look at these files

Thanks.

[antiprofi]

Originally Posted by hassmaschine

Is your Z4 an M54 or an N52? If it's an N52 it uses the same DME - the tune can be copied, also you can make it work in your E90 too. If it's an M54 it's completely different anyway.

but yeah, I could definitely use some more files. what might really help are more Serial E2PROM files. I've mapped out part of them and I know some of the VO data is stored there - I zeroed mine out to see what would happen and all the options turned off. Trying to figure out how I can enable the sport switch (even if it's pointless, I would like to try).

The Z4 3.0si has N52 with MSV70. I use the engine of the crashed Z4 in my e90. Works fine without any modifications on the DME.

I tried to copy MPC5xx and 29BLXXX but the DME doesn't run. As a said: Z4 and e90 have different CANs because the E85 is an e46 derivat! It's also not possible to reach the DME using INPA etc..

When i copy the MPC5xx part only the DME is reachable und the car starts. So how can I copy the tune?!

[hassmaschine]

It's the same hardware actually.. it probably didn't work because your ISN didn't match (it's in the 29BLXXX file). You would have to copy the ISN from your original DME to the new one, and then it should work. But it would probably be better to just copy the tune over and leave the rest alone..

The CAN communication goes through a CAN gateway so it doesn't actually matter that it's "newer" - the CAN gateway dumbs it down for the earlier electronics (I use an E60 gateway for my bench setup).

[antiprofi]

Originally Posted by hassmaschine

It's the same hardware actually.. it probably didn't work because your ISN didn't match (it's in the 29BLXXX file). You would have to copy the ISN from your original DME to the new one, and then it should work. But it would probably be better to just copy the tune over and leave the rest alone..

OK, but I don't know how to copy the tune nor the ISN

The CAN communication goes through a CAN gateway so it doesn't actually matter that it's "newer" - the CAN gateway dumbs it down for the earlier electronics (I use an E60 gateway for my bench setup).

E60 = E82 = E90 = E65 ... ( -> BN2000)

E46 = E39 = E38 = E85 ...( -> BNE38high)

F10 = F30 = F20 = F01... ( -> BN2010)

These generations aren't 100% compatible. But to be honest, I'm more familar with the K-CAN

[hassmaschine]

yeah what happens is it sends out the messages on D-CAN and the KGM changes it for the other busses - so even with an MSV70, if you have the right KGM it will talk to the E46 bus. There's not a special version of MSV70 that I know of - they are all basically the same. At the very least it's just a config byte or two that sets it up for the different bus type.

[antiprofi]

Originally Posted by hassmaschine

yeah what happens is it sends out the messages on D-CAN and the KGM changes it for the other busses - so even with an MSV70, if you have the right KGM it will talk to the E46 bus. There's not a special version of MSV70 that I know of - they are all basically the same. At the very least it's just a config byte or two that sets it up for the different bus type.

I tried three different MSV70 in my e90 (original, E60, E85). Reading error codes was possible with the DME from E60 and E90 but not with the dme with e85 software on it. I can check on monday if there is a different OS for the E85/E86 but I'm pretty sure about that.

At this point I see two options:
- giving up and search someone who can tune this special engine (that's really hard because of the stroker kit)
- find a solution to copy the tune.I would be glad if you have some tipps