TunerPro User Forum

olafu

0xDC73 (0xDC79-DC7C)overrun fuel cut rpm.
*Edit

thats for 413. I don't know for 402.

olafu

6x1 map in 0xE35C (0xE364-E369) is lambda control switch off load limits. It follows RPM and if actual load is higher than map value, closed loop will be switched off. If you have been adjust K-value, that is one of many maps what must be rescaled. 0xE36A, 0xE378 and 0xE382 are also called lambda sw...

olafu

Categories numbering rolls over: When trying to use category 256 it acts like "Any category" and 257 starts from category 1, and so on.
It's not problem, i think 255 different categories are enough, but that may confuse users.

olafu

Because adjusted K-value, it affects to load and maybe auto transmission gets engine load information from "load" or "injection time". I'm never check this, but maybe good thing to start... Did you rescale all tables what are load dependent or consists load values? But about that...

olafu

Read this tread,good info! Having a problem with my MAF,when tracing i MAF-table it stops around 2,4-2,5V and don´t want to go any higher. Did a testrun and measured voltage directly on MAF,it´s about 4,7-4,8V when boosting 0,7bar and 5000k rpm. Is there something in the binfile blocking MAF-signal...

olafu

D3 follows IAT sensor input, D4 not. So, i'm pretty sure D3 is air temperature.

0x3C25 is active only in stopped engine. (waiting for crank).

olafu

D5B2 is temp sensor normalizer table. Same table is used for IAT and CLT sensors. Looks like raw adc-value is stored in "27". I did some research: 0x3C25-3C47 is where IAT value goes to INTMEM_D3 and CLT goes to INTMEM_D7. Looks like the map reading happens, when it calls subroutine ROM_41...

olafu

If you are using 413 ecu, CEL should be on, when ecu is powered up and waits for crank signal. Ecu needs strong power supply, i'm using 15V / 6A from old laptop. 12V / 1A was too lame. Voltage should be something between 12...15V.

olafu

Did you use an isolation transformer? Any fault codes?

olafu

Ctrl + F8 , "Engine_sim crank and cam simulator". You can select square, triangle or sine wave.
but if it doesn't work, don't forget Audacity

olafu

And everything looked logical on tunerpro, when your friend edited it?

olafu

Car? ECU number? BIN number and XDF what was used to edit it.
As example 413 ecu with 623 bin only sets trouble code if checksum is wrong.
Most likely wrong XDF was used. ECU goes reset loop if map header data is broken. Wrong offset in XDF can cause this.

olafu

knock xdf in my dropbox is for -715 bin. You need -623 XDF, -715 bin has different offset. I will upload new one… M52B28 alu block has also different "running noise" and iron block's knock settings can cause problems. I don't know anyone who are re-tuned those knock threshold maps for alu ...

olafu

What bin you are actually using? Almost every bins has different offset. This knock-part is for silver label "1 267 358 715" bin. Red label has usually "1 267 357 623" or "1 267 357 609" bin. this is a link to hairyscreech's dropbox: https://www.dropbox.com/sh/9bhg4mjk7...

olafu

My tests with INPA was with -506 DME's -965 bin, because it's not working with 413 DME's -623 bin. I have no idea why, but if you have emulator, try to run your DME with -965 bin. Hardware is cross-compatible. If it works, the problem is propably in the INPA software. You can cheat it with using -96...

olafu

You can read ram with INPA, but i can't say where those knock adaptation values are stored. And i'm pretty sure they are in map form, no idea what kind. And own map for every cylinder.

olafu

https://www.dropbox.com/s/ljl0nz0325ix85y/silver_label_knock.xdf?dl=0 <- knock parts for silver label. Tools -> Custom tools -> New TunerPro Instance ... copy paste. This ecu has 8kB SRAM chip on underside of the board. It's used for storing self-learning adaptation values (including knock-correctio...

olafu

Correction data location wasn't found yet (it has individual load x rpm table in RAM for each cylinder), but i will send you XDF for silver label knock part.

olafu

Actually, real max_rpm is lower. Those tests was accidentally done with 6500rpm rev limit. :oops: max rpm with external rom: 7860rpm max rpm with internal rom: 8340rpm no cam signal. with maf fault mode (alpha n) max rpm with internal rom: 7980rpm. :roll: Motronic hardware with software shittened to...

olafu

Some tests with internal and external rom:

8960 rpm (no cam signal, no closed loop, internal rom)
8440 rpm (no cam signal, no closed loop, external rom)

maximum RPM:s. If exceeded, ECU goes reset. Significant penalty.

olafu

Knock control IC: https://www.dropbox.com/s/ted5caw5yrrd09g/PLCC28_30117_pinout_unfinished.png and how it seems to work: https://www.dropbox.com/s/wzz82fdpj8wkwg2/30117_how_it_works.png channel select signals seems to come from S920. :? So, after discovering all this information, i found pieces of B...

olafu

No, it is synced now with faked cam signal.
153624 -> 536241 it's same firing order, but it only starts from 5. I think this is something to do with 120 degrees different trigger wheel position. Maybe only BMW engeneers can say why this is changed.

olafu

Yes, with M60 bin, ignition firing sequence is going to 2-9 also with 413 board. And those pin 8 and 9 (T507 and T508) transistors are missing. But 7 and 8 cylinder's injection pulses are not seem to come out from anywhere. https://www.dropbox.com/s/e0o8zid3mf7sea9/M331_with_404_bin_.BMP In 413 ecu,...

olafu

I have to do some tests, need to clear out how this system treats that S750. It woud be useful information for disassembly work. With this fine laboratory :lol: https://www.dropbox.com/sh/l2subwkgoef2akm/AACToZd5w2dYe-btTgSj-L57a EDIT: https://www.dropbox.com/s/ivb6hpl33z9riss/Bosch_30131.jpg <- ign...

olafu

Seems like this B58039 PLCC44 chip, number "S750" has significant role in injection output stage (and maybe something else) controlling. Chip "S705" sends eight pieces of data packets in burst to that "S750" on every injection event, three times at one crankshaft rotati...

olafu

From 80196 user guide: "The execution times for the instruction set are given in Figure 3-3. These times are given for a 16-bit bus with no wait states. On-chip EPROM/ROM space is a 16- bit, zero wait state bus. When executing from an 8-bit external memory system or adding wait states, the CPU ...

olafu

Audio isolation transformer protects your sound card, but second sound card is anyway good choice... I bought my own transformer from local grocery store. I was thinking to drive positive feedback comparator and controlling switching transistor with it. On positive peak from daqarta (or something el...

olafu

Same system as last year, but now daqarta used as signal generator. Audio isolator in PC soundcard output and wired to crank sensor input. Few potentiometers and some load resistors. 1k resistors are enough for load. No cam signal, need to do some kind filtering circuit with latch and generate only ...

olafu

Hairyscreech wrote:How did you go about lifting that pin?
Iron onto the exposed trace part and then lifted/pulled out with some tweezers?

With crowbar

Tiny bent needle and some heat from soldering iron.

olafu

Yes, EA-pin is now lifted up and grounded. First ROM access is 0x2018 (chip configuration byte) and program starts from 0x2080. ECU boots up and seems to run normally...

olafu

Power on, no cranking: 0x4000 and 0x4001 are first readed bytes from external ROM, when power is switched on. Next comes 0x4120, 0x4121, 0x4122, 0x4123, 0x476B, 0x476C, 0x476D, 0x476E, 0x476F, 0x4770 and so on, sequentially up to 0x4816. Then comes 3.5ms perioid with no reading from external ROM. Re...

olafu

M42 coil pack is actually four "COP" coils in same package... :? So, i think 30106 is used, because it has many other useful features, but, as example, only four transistor driver channels... So M50 and M60 needs separate driver ic. EDIT: https://tinyurl.com/y7ctthob <- M43 coil workshop m...

olafu

The 30106 is I believe similar to this one 413 ecu has 30131 (at least 8ch, maybe 10ch?) chip for coil transistor buffering. I think 30106 has something other features instead of that buffer... Has also M3.3 ecu 30117 knock sensor chip? M60 has four knock sensors, so it would be nice to know how it...

olafu

Some CPU pin data from my notes: (413 ecu) CPU pins: 4 = P0.3 ACH3 = Battery voltage 5 = P0.1 ACH1 = Intake air temperature 6 = P0.0 ACH0 = Mass air flow 7 = P0.2 ACH2 = Throttle position sensor 8 = P0.6 ACH6 = Lambda voltage 9 = P0.7 AHC7 = Signal from knock sensor controller IC: knock signal level...

olafu

Anyone hear about Daqarta..? Interesting software. It spits crank and cam sensor signals out from PC sound card. http://www.daqarta.com/dw_0okk.htm I didn't run any tests yet with this software, but if you want to run your ecu on the table, without engine, this will help you. I'm very curious to see...

olafu

Lookup table seems to be found at 0x6400, no offset, MSB first, so first table founds at 0x673E, next 0x6744 and so on... Biggest tables are: (Header start address, descriptors, axis size and table data start address) 687C 3A x 42 16x4 6894 68D4 3A x 42 12x12 68F0 6A92 3A x 42 12x12 6AAE 6D2E 3A x 4...

olafu

Knock control is not active, if load is not higher than specified threshold. Can you check that with other scanner? Bad support for old ECU's are very common problem in today's scan tools. It's not impossible for the scanner to read data from wrong address... Example: Some scanners will read MAF val...

olafu

hi guys, After our second track day session we are facing few small problems. _ idle come now too high (1200 rpm) and engine is slow to drop revs. _ engine is not runing good anymore around 4000 rpm. Idle is 1000 when cold and 1200 when hot. but very stable. I have tested the TPS sensor and ECT sen...

olafu

Use some offset. I think 715 has same maps but different place/offset. When you found one, you found other ones.

olafu

https://www.dropbox.com/sh/1qhnxk084dr4 ... U7y3a?dl=0 <- dtc triggering and knock part. And some other information.

More information is in that other, big m3.3.1 topic.

olafu

If you can use both knock sensors for external knock detector, it can work well. But ECU needs signal from knock sensors, if it is missing, ecu goes limp mode and reduces timing. 0xD288 affects DTC:s 69 and 70. By overwriting it with "FF" ecu doesn't notice missing signal from knock sensor...

olafu

thanks guys for your real reverse engineering work. It so impressive, that you spent so much time to go deep in the (necessary) details. A lot of XDF available only have the basic and easy findable maps , what is a little bit limited to tune advanced engines. The M.3.3.1 is more than 25 years old, ...

olafu

Where all theses adresses are coming from guys ? Did you bought a Damos file or did you disamembly the microprocessor code software ? I can recognize big maps on the hex, but small one like this ?? OxDC63 is also an acceleration map ? By testing with scopemeter and engine signal generator. Almost a...

olafu

0xD776 is actually a load filter table. "Acceleration enrichment: Triggered from rapid or less rapid LOAD increase... 0xDC15 D0xD5 4x4: Acceleration enrichment quantity by RPM and LOAD 0xDC31 D7 4x1: Coolant temperature correction for quantity These are multiplied by each other and determines h...

olafu

Where goes "tracing plot" when problem starts? Is the "load" value always same, or will it jump to somewhere?

olafu

New max load would be good to oversize. I can't say by sure, but i think so. You must compress original data to left side of table, and then you get right side of table "empty" for boost tunes. You lose some resolution. If you want to change gap between columns, you must modify table heade...

olafu

Good! We struggled with that v-signal problem in my frend's rally car about 2 years ago. Our solution was cut v-signal wire, and it was temporary stuffed in to cam signal pin chamber with screwdriver. This temporary solution is still in use :lol::lol: Need more specs of your build: What is your inje...

olafu

I wil try those, when we have our dyno in working order again. Thanks!

olafu

I was never changed injectors. But i can try to explain: By changing injector scaling/constant, you are actually changing a load calculation factor. Raw max. load is 255 in decimal, and it's 12.75ms in "load" value, if we use x/20 conversion. Now, if you change your injectors, say, for exa...

olafu

But how did you rescale the injector flow in ROM?

TunerPro User Forum

Search found 186 matches

Re: E36 402

Re: M3.3.1 413

Categories 256-300

Re: M3.3.1 413

Re: M3.3.1 413

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: incorrect checksum symptoms??

Re: incorrect checksum symptoms??

Re: DME 413 (silver) knock correction

Re: DME 413 (silver) knock correction

Re: DME 413 (silver) knock correction

Re: DME 413 (silver) knock correction

Re: DME 413 (silver) knock correction

Re: DME 413 (silver) knock correction

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?