Announcement

**heinzboehmer** · 03-25-2020, 04:50 PM

Originally posted by Terra on M3Forum:

Here's how to convert the boot sector

Master:
Change the byte at 0x12AE from "E0" to "F0"
Change the bytes at 0x3FD7, 0x3FDF, and 0x3FE7 from "33" to "35"
Change the word at 0x3FFE from "E2C3" to "3C45" (this is the checksum)

Slave:
Change the byte at 0x12AE (0x812AE if the files aren't separated) from "E1" to "E0"
Change the word at 0x3FE2 from "EABA" to "6465" (this is the checksum)

General structure for each half:
0x0-0x3FFF = Bootsector
0x4800-0x4876 = flash counter; make sure you have at least one set of "00 00" otherwise the DME won't boot
0x8000-0xFFFF = Data
0x10000 - 0x4FFFF = Program

Convert 0PA and 0DAs to binaries to get the program and data sections.

You can clear all the ranges not mentioned. There's some manufacturing data stored, but it's not terribly important.

**heinzboehmer** · 03-25-2020, 04:53 PM

Originally posted by NickG on M3Forum, sadly I can't get any attachments back, but the instructions and provided files on MSSFlasher's page seem to achieve the same result:

For those of you that don't mind getting dirty and taking some risk, here's a way to get the CSL program without reflashing the boot sector (ie, no BDM required unless you f- this up). If you don't understand what I'm about to describe, then this mod isn't for you. Wait for somebody else to do it and wrap it into a pretty package for the masses.

This mod isn't perfect, but if you want the CSL DME functionality without using a BDM, there is no other choice at the moment. The side effect of this mod is that follows there is a chance that future flashes of the DME can cause the DME to lock-up due to a mismatch in program/calibration format

If you're fine with the above, then let's move on........

The whole premise of these changes is to (obviously) allow the non-CSL boot loader to accept the CSL program. This is done by changing the CSL program and calibration project string from 2500 to 2300 (from MSS54HP CSL to MSS54HP non-CSL). Since the locations that the non-CSL boot loader references do not match up with the CSL calibration, the CSL calibration is modified to make the non-CSL bootloader happy. THEN, the CSL program is modified to work with this newly modified CSL calibration. Clear as mud, right?

First, you'll have to prepare your CSL calibration file. Make the following changes:

0xBFBD = 0x33 (changes project to MSS54HP non-CSL)
0xBFCD = 0x33 (changes project to MSS54HP non-CSL)
0xBFDD = 0x33 (changes project to MSS54HP non-CSL)
0xE002 = 0x01 (makes master bootloader happy)
and then correct the checksum. Now your CSL calibration file is ready.

Next, get your new CSL program file ready. Attached is a modified CSL master program file. It is a .rar file. Download it and change the extension from .pdf to .rar. Uncompress it and you'll have the .bin file. Combine this modified master file along with a stock, unmodified CSL slave program file.

For those interested, the modified master program has the following changes:
- project changed from MSS54HP CSL to MSS54HP non-CSL
- reference to word at 0x8E002 changed to reference to byte at 0x8E003 (this frees up the byte at 0x8E002, which the bootloader looks at)
- checksum corrected

Now all you have to do is flash in the new, modified Program first, then follow it with the modified calibration.

Note: these steps essentially create a newly defined MSS54HP non-CSL program and calibration. Since the program number is a CSL number, but the project number is a non-CSL number, I don't know how factory diagnostic tools will handle the mismatch. Thus, if recovery via flashing is required, factory tools may not work. Brute force recovery methods may be required. You've been warned, so tread carefully.

Also of note, I have not tried this file. I have no need for this modification (as I don't really see any benefit). Thus, this is untested. Again, do this at your own risk.

Have fun!

**heinzboehmer** · 03-25-2020, 05:09 PM

Originally posted by NZ_M3 on M3Forum:

I just converted a MSS54 into a MSS54HP CSL DME and tested on my own CSL and it works perfectly.

You swap the AM29F200 chips for the AM29F400, solder on the H bridge and associated capacitors and change out two resistors on the back of the board (as they are different between HP and non HP DME - actually according to Terra who has done the trace he said there are 4 resistor differences, but you only need to do the two), turn off the injector driver error in the DTC (151 code - this according to Terra is a difference in injector drivers between the HP and non HP, but apparently they all function the same) and flash the CSL software on and it's all good to go - no errors.

If you don't do the resistor change you get error 233 which is map sensor related in CSL software guise. When I first did the conversion I left out the 2 resistors and this was the error it gave me ... the moment I changed them the error disappeared.

I haven't live streamed the data to make sure it is reporting correctly but according to Terra it is.

I will let Terra explain what needs to be done as all credit to him for figuring this out.
All above thanks to Terra for his guidance.

Some photos:

Started with this:

Changed out the AM29F200 to AM29F400, added the H-Bridge (and tested on GT1 to make sure the flapper control works and it does)

Added the capacitors for the H Bridge and changed the Resistors as advised by Terra

Flashed CSL software over WINKFP after virginising the DME

Left, converted MSS54, right MSS54HP CSL conversion

Injector driver difference between the two boards

**heinzboehmer** · 03-25-2020, 05:10 PM

Originally posted by NZ_M3 on M3Forum:

The chipset I got were AM29F400BB-50SE

Those last set of numbers denotes the speed of the chip - the lower the number the faster the speed.

If you google you'll find spec sheets on 29F400 chipsets and what the numbers and letters mean.

The CSL DME chips are 55M6 - I've seen anything from a 55 to a 60 in a HP DME and in the non HP anything from a 60 to 90. So they are all a bit random to be honest.

Ironically I was warned not to buy the chipsets from ebay as they can be unreliable. I didn't listen and bought them from ebay (including the H bridge) from what I consider to be reputable sellers and I think I got lucky as both the memory chips and H bridge were genuine and worked the first time.

However, I would still strongly recommend buying from reputable resellers as you really never know with ebay. I was willing to sacrifice this non HP DME in case it didn't work out.

**heinzboehmer** · 03-25-2020, 05:11 PM

Originally posted by Terra on M3Forum:

Might as well post this

Red resistors are the ones you definitely have to change if you want to use the MAP sensor. 7.15 kΩ resistors seem to do the trick there. The yellow ones are also different (10 kΩ on the MSS54HP, 1 kΩ on the non-HP), but they don't appear to effect anything.

Also the onboard pressure sensor is different. You can either install one with the same specs as the MSS54HPs (MPXA6115A or MPXAZ6115A), or you can change the pressure scale (at 0xC476, change "D3 1C 12" to "C2 5F 03"). Sorry, forgot to mention that in the emails to you NZ

One thing I want to make clear is that this is still fairly experimental. You're modifying the DME in ways BMW never intended. While I've done a fair bit of testing, it's impossible for me to test all scenarios.

**heinzboehmer** · 03-25-2020, 05:23 PM

Originally posted by NZ_M3 on M3Forum:

Originally posted by NickG View Post

[B]For those of you that don't mind getting dirty and taking some risk, here's a way to get the CSL program without reflashing the boot sector (ie, no BDM required unless you f- this up). If you don't understand what I'm about to describe, then this mod isn't for you. Wait for somebody else to do it and wrap it into a pretty package for the masses.

This mod isn't perfect, but if you want the CSL DME functionality without using a BDM, there is no other choice at the moment. The side effect of this mod is that follows there is a chance that future flashes of the DME can cause the DME to lock-up due to a mismatch in program/calibration format

If you're fine with the above, then let's move on........

The whole premise of these changes is to (obviously) allow the non-CSL boot loader to accept the CSL program. This is done by changing the CSL program and calibration project string from 2500 to 2300 (from MSS54HP CSL to MSS54HP non-CSL). Since the locations that the non-CSL boot loader references do not match up with the CSL calibration, the CSL calibration is modified to make the non-CSL bootloader happy. THEN, the CSL program is modified to work with this newly modified CSL calibration. Clear as mud, right?

First, you'll have to prepare your CSL calibration file. Make the following changes:

0xBFBD = 0x33 (changes project to MSS54HP non-CSL)
0xBFCD = 0x33 (changes project to MSS54HP non-CSL)
0xBFDD = 0x33 (changes project to MSS54HP non-CSL)
0xE002 = 0x01 (makes master bootloader happy)
and then correct the checksum. Now your CSL calibration file is ready.

Next, get your new CSL program file ready. Attached is a modified CSL master program file. It is a .rar file. Download it and change the extension from .pdf to .rar. Uncompress it and you'll have the .bin file. Combine this modified master file along with a stock, unmodified CSL slave program file.

For those interested, the modified master program has the following changes:
- project changed from MSS54HP CSL to MSS54HP non-CSL
- reference to word at 0x8E002 changed to reference to byte at 0x8E003 (this frees up the byte at 0x8E002, which the bootloader looks at)
- checksum corrected

Now all you have to do is flash in the new, modified Program first, then follow it with the modified calibration.

Note: these steps essentially create a newly defined MSS54HP non-CSL program and calibration. Since the program number is a CSL number, but the project number is a non-CSL number, I don't know how factory diagnostic tools will handle the mismatch. Thus, if recovery via flashing is required, factory tools may not work. Brute force recovery methods may be required. You've been warned, so tread carefully.

Also of note, I have not tried this file. I have no need for this modification (as I don't really see any benefit). Thus, this is untested. Again, do this at your own risk.

Have fun!

As sort of a continuation of the above posts from NickG and Terra I thought I'd do a quick write up on how to flash the files Terra modified for this purpose using WINKFP Expert Mode:

This is assuming you have a correctly loaded WINKFP (i.e. working in comfort mode) and is reasonably proficient in what to do with loading files in WINKFP.

1. Go to Import, Data/Program/BSU NAAB files

2. Select the files Terra provided (or simply put them in the data/mss54 folder and import the lot)

3. Proof the DME I am using isn't a CSL one but a normal HP DME (or in this case a converted HP DME)

4. Go to Expert mode and load the correct files

5. You will get this error because the DME isn't a CSL one with CSL hardware number or boot sector offset. Just ignore it and click ok, as what you are doing next is flashing the program file provided by Terra with the modifications done to allow it to flash CSL program.

6. Click prog. Program once you have the correct files setup

7. Enter VIN number

8. It will tell you it can be programmed X number of times

9 Begin flashing the modified CSL program

10. Once done flash the modified CSL Data provided by Terra

11. If done correctly you will see the correct CSL software (7837331) number in INPA

12. Just to prove that it is the same DME but now thinks it is CSL Hardware (7837340)

13. And to show that it indeed boots up correctly, here's a screenshot of it running a data change via Comfort Mode (warning!! DO NOT carry this out, as Terra says, it will fail and might brick your DME under certain conditions).

Hope that was helpful.

p.s. I recommend using WINKFP 5.3.1 or above for the above operation.

**heinzboehmer** · 03-25-2020, 05:29 PM

Originally posted by NZ_M3 on M3Forum, upon discussion of trying to find an alternative for obsolete MC33186VW:

Tested the Bosch 30348 and it works perfectly without issues

**heinzboehmer** · 03-25-2020, 06:35 PM

Now onto some notes about converting an MSS54 to HP/CSL spec:

Here's what I did to convert my MSS54 to HP spec. I didn't add the H-Bridge for the flap because I'm not running a flap. I just wanted to be able to run CSL software and a MAP sensor.

Upon warnings of getting non-functional cloned EEPROMs, I decided to not order them from eBay. Instead, I got them from this site. They were much more expensive (ended up being around ~$45 with tax and shipping) than those advertised on eBay, but this company looked more legit and is based in Canada, so shipping estimates were much quicker than the estimates for the chips shipping from China on eBay. I had not heard of this company before, but the chips I got worked from them worked just fine.

I was initially planning on using a hot air station I have access to at work to remove the old chips and install the new ones, but I received the chips after access was restricted to the building due to the virus. So I just went at it with a soldering iron. I would definitely recommend doing this with a hot air station, but I can confirm that a fine tipped soldering iron does work. I worked leg by leg and used thin, long tweezers to put upward pressure on each leg while i heated up the solder with the soldering iron. The legs bent slightly once detached from the board, but I managed to not break any or lift any pads.

Installing the new chips was done in the following way: Clean up remaining old solder on pads, place new chips in position, hold them down with tweezers, anchor down a couple of corners with the iron, release pressure provided by tweezers, and carefully apply solder to each individual leg. Happy to report that result was pretty much the same as having used hot air.

Sidenote: The soldering iron technique will not work for either removing or installing the flap H-Bridge. The bottoms of those are soldered to the board for heat purposes. Those need a hot air station/reflow oven to be installed. You can tell I messed around with the temperatures necessary to melt the factory solder out of curiosity in the previous pic. I set my iron to ~500 °F and touched one side of the pad to see if I could get all the solder to melt and I barely got it to melt 1/3 of the way.

After the EEPROMs were done I moved on to the two resistors on the back. Having to do this with a soldering iron meant that these are not as pretty as they could have been, but the DME has performed without an issue, meaning that the issue is just cosmetic. Procedure for getting them off was gripping with tweezers and heating up each side intermittently until they pulled off. Be gentle if you are going to attempt this, you don't want to lift the pads they're attach to. Install consists of holding them down with tweezers and reflowing the solder on either end with the iron.

Software conversion steps follow:

1. Write EEPROMs

This can be done with a chip burner before installing the new EEPROMs or via a BDM programmer once the hardware conversion is done. Anders93 created a great write up for using an FGTech Galletto V54 to do this, linked here. Using this same method I flashed the full 7837329/PD11 CSL binary.

2. Modify partial to work with your setup

VANOS offsets: at 0x1802 change "00 1E" to "FF EC", at 0x1BB6 change "FF EC" to "00 0A"
- This is applicable only if running stock cams. This is not required if running CSL cams and will be incorrect if running any other type of cams.
Pressure scaling: at 0xC476 change "D3 1C" to "C2 5F"
- MSS54s have a different barometric pressure sensor than HPs, this changes the sensor's scaling to have the CSL software work correctly with the non-HP sensor.
Suppress injector error 151
- There is a hardware injector driver difference between non-HP and HP DMEs, meaning that this conversion will result in an injector driver error. However, these drivers still work fine, so suppressing the error is necessary if you don't want to have it listed constantly.
- To suppress: search for 97282803020203000102032801 and zero out the full string.
Rest of desired changes
- Manual (if your car is a manual), enable cruise control, top speed limiter removal, sport mode memory, etc.
- All these changes can be achieved with a hex editor, but having a copy of ECUWorx's MSS5x Binary Modification & Remap Tool makes this much easier by providing a graphical interface. At only ~$25, I'd say this is a no brainer. This tool also lets you suppress the injector error.

3. Read partial and verify changes

This is completely unnecessary, as everything should have worked, but will save you a lot of headache in case something didn't.

**Anders93** · 03-26-2020, 08:54 AM

Originally posted by heinzboehmer View Post

I was initially planning on using a hot air station I have access to at work to remove the old chips and install the new ones, but I received the chips after access was restricted to the building due to the virus. So I just went at it with a soldering iron. I would definitely recommend doing this with a hot air station, but I can confirm that a fine tipped soldering iron does work. I worked leg by leg and used thin, long tweezers to put upward pressure on each leg while i heated up the solder with the soldering iron. The legs bent slightly once detached from the board, but I managed to not break any or lift any pads.

I used a similar technique. I found it helpful to use copper solder wick to remove as much solder from the pads before applying pressure to "lift" the legs. Then, as you did, use tweezers to apply gentle upward pressure while applying heat to the pad. After wicking, there is so little solder left over that some of the legs lifted even without heat (although I would not recommend doing this as you could easily rip out a pad).

Originally posted by heinzboehmer View Post

Installing the new chips was done in the following way: Clean up remaining old solder on pads, place new chips in position, hold them down with tweezers, anchor down a couple of corners with the iron, release pressure provided by tweezers, and carefully apply solder to each individual leg. Happy to report that result was pretty much the same as having used hot air.

If you have a bevel tip on your soldering iron, you can put some flux paste on the legs, melt a little solder on the tip, and without lifting the iron up, sweep down the row of legs in one motion. The flux paste helps prevent bridging the pins. This is, of course, after soldering the corners to hold the chip in place. This video shows the technique: https://youtu.be/5uiroWBkdFY?t=115

**terra** · 03-26-2020, 12:32 PM

Originally posted by Anders93 View Post

If you have a bevel tip on your soldering iron, you can put some flux paste on the legs, melt a little solder on the tip, and without lifting the iron up, sweep down the row of legs in one motion. The flux paste helps prevent bridging the pins. This is, of course, after soldering the corners to hold the chip in place. This video shows the technique: https://youtu.be/5uiroWBkdFY?t=115

I usually do the same thing even with a chisel tip. Works great to the point where I don't even bother with the hot air except for removing stuff.

Finer pins can be tougher, but I did manage to replace one of the main CPUs using basically the same technique.

**rbg** · 04-05-2020, 12:27 PM

Thank you so much for such a detailed writeup! Some photos in post 4 are missing, or it is my browser?

**rbg** · 04-05-2020, 12:30 PM

Originally posted by terra View Post

I usually do the same thing even with a chisel tip. Works great to the point where I don't even bother with the hot air except for removing stuff.

Finer pins can be tougher, but I did manage to replace one of the main CPUs using basically the same technique.

Do you guys use water soluble flux paste for easy clean up?

**terra** · 04-05-2020, 03:20 PM

Originally posted by rbg View Post

Do you guys use water soluble flux paste for easy clean up?

I don’t now what its solubility is, but I like ChipQuick’s gel flux. Cleans up okay with alcohol.

**heinzboehmer** · 04-05-2020, 05:20 PM

Originally posted by rbg View Post

Thank you so much for such a detailed writeup! Some photos in post 4 are missing, or it is my browser?

Looks like it's not just you. Thanks for letting me know! Fixed.

Announcement

Converting an MSS54/HP into an MSS54HP CSL (H-bridge)

Converting an MSS54/HP into an MSS54HP CSL (H-bridge)

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment