CSL '0401' Program Binary Disassembly Notes

[karter16]

Have finished the CSL specific section of the Load Detection (Lasterfassung) module in the XDF. All parameters are named, with descriptions and correct conversion factors and units of measure.

Pretty much the only way this section will get more accurate now is if someone who has them shares the actual BMW names for these parameters, but that's really just a nice to have, it wouldn't change the understanding of what these parameters are and do.

[karter16]

Couple of updates:

I've confirmed that the 0x4000 - 0x7FFF memory space is non-volatile memory used for storing things like the AIF Counter, Stored DTCs, trims, etc. that persist between drives.



Also this is the latest memory map - it's still incomplete in that I know I need to add the 2x CANbus frame buffers at 0x00ff0000 and 0x00ff1000) among a range of other things, but I want to do some more confirmation around those before I add them to the table.

[ac427]

Yeah, my bad for jumping OT! Agreed 👍🏽


Sent from my iPhone using Tapatalk

No worries Brian. It's a really interesting topic in its own right.

All the best
Ac427👍🏽

[SliM3]

Perhaps we can move this to a dedicated SMS/DSG thread?

Yeah, my bad for jumping OT! Agreed 👍🏽


Sent from my iPhone using Tapatalk

[ac427]

You can use the MS43 plug-n-play harness adapter, which is what I'm doing - although you might need to move a few things around. I'm also using a MaxxECU, with an e92m3 DCT, but a turbo Honda k24 in an e46. I'm using the MS43 play-n-play harness, but I made a custom Honda k24 engine harness to BMW DME style x60003/x60005 plugs so everything is very factory.

Here is the wiring documentation: https://www.maxxecu.com/webhelp/wiri...u-bmw_m54.html

Perhaps we can move this to a dedicated SMG/DSG thread?

[liam821]

How do you hook up the Maxecu? splice it into the existing DME wiring, or is it capable of reading the values from can? How is throttle blip and ignition retard working?

You can use the MS43 plug-n-play harness adapter, which is what I'm doing - although you might need to move a few things around. I'm also using a MaxxECU, with an e92m3 DCT, but a turbo Honda k24 in an e46. I'm using the MS43 play-n-play harness, but I made a custom Honda k24 engine harness to BMW DME style x60003/x60005 plugs so everything is very factory.

Here is the wiring documentation: https://www.maxxecu.com/webhelp/wiri...u-bmw_m54.html

[sda2]

Yes, anything 0x7** is development stuff, yes. I was unaware of the 0x310-515. I only know 316,329,338 and 545. So MSS54 is indeed very special.

SliM3 I know the Maxx and Dodge firmware, but after driving a Dodge one, I have to say that BMW is way better for daily use, than Dodge.

How do you hook up the Maxecu? splice it into the existing DME wiring, or is it capable of reading the values from can? How is throttle blip and ignition retard working?

[karter16]

As I said earlier, awesome work! Did you go through the SMG CAN implementation by any chance? It would be awesome to ditch the SMG and install DCT or 8HP with a CanTCU, but for that the secondary CAN bus needs to be deciphered.

Afaik the MSS54 acts as a gateway between the gearbox and the chassis, so the can11h message "EGS1" on 0x43F is actually sent out by the DME, not the SMG control unit.

SMG CAN starts at something like 0x410 up to 0x412. I think olza also posted about this.

I haven't had a chance to get into the secondary CAN yet. But having a very quick look now.

There are 11 outbound messages from the DME.

0x310
0x311
0x312
0x313
0x314
0x515
0x710
0x711
0x712
0x720
0x701

The 0x7xx messages I'm pretty certain will mirror the convention on the primary CAN and will be diagnostic messages from when BMW were developing and tuning. They seem to contain unrelated parameters that would be useful for tuning. Their sending is controlled via parameters in the partial ROM.

There are 3 inbound messages that are read as you've previously identified.

0x410
0x411
0x412

I'll get into this more when I get the chance , but that seems to be the high level.

Edit: Also yes - 0x43F is sent from the DME on the primary CAN.

[karter16]

You'll be better off running a MaxxEcu for 8HP control. Copy the optimal torque map from whatever OEM SW you want (I use CSL) and overwrite the MaxxEcu base tq map + increase values by 28-30%. Plus you can program CAN outputs for a “stock-like” gear position indicator to replace the SMG display that's currently in our clusters.
Sent from my iPhone using Tapatalk

Very cool - is this an in-flight project you're working on?

[0-60motorsports]

You'll be better off running a MaxxEcu for 8HP control. Copy the optimal torque map from whatever OEM SW you want (I use CSL) and overwrite the MaxxEcu base tq map + increase values by 28-30%. Plus you can program CAN outputs for a “stock-like” gear position indicator to replace the SMG display that's currently in our clusters.





Sent from my iPhone using Tapatalk

Ma man! Can't wait to see it!

[SliM3]

As I said earlier, awesome work! Did you go through the SMG CAN implementation by any chance? It would be awesome to ditch the SMG and install DCT or 8HP with a CanTCU, but for that the secondary CAN bus needs to be deciphered.

Afaik the MSS54 acts as a gateway between the gearbox and the chassis, so the can11h message "EGS1" on 0x43F is actually sent out by the DME, not the SMG control unit.

SMG CAN starts at something like 0x410 up to 0x412. I think olza also posted about this.

You'll be better off running a MaxxEcu for 8HP control. Copy the optimal torque map from whatever OEM SW you want (I use CSL) and overwrite the MaxxEcu base tq map + increase values by 28-30%. Plus you can program CAN outputs for a “stock-like” gear position indicator to replace the SMG display that's currently in our clusters.





Sent from my iPhone using Tapatalk

[sda2]

As I said earlier, awesome work! Did you go through the SMG CAN implementation by any chance? It would be awesome to ditch the SMG and install DCT or 8HP with a CanTCU, but for that the secondary CAN bus needs to be deciphered.

Afaik the MSS54 acts as a gateway between the gearbox and the chassis, so the can11h message "EGS1" on 0x43F is actually sent out by the DME, not the SMG control unit.

SMG CAN starts at something like 0x410 up to 0x412. I think olza also posted about this.

[0-60motorsports]

Karter. Amazing work. Thanks for doing this. Hopefully now we can have an OE+ kind of tune for the community to use with our different OG mods like CSL intakes and SS exhaust systems.

[karter16]

Depended if you reach the engine speed limiter at the end of the test track or other conditions is in which gear you need to start.

That would quite possible explain then why the "NOISE_GANG" for the CSL is 4th gear, but for the Euro M3 it's 3rd. Maybe the extra power + reduced weight of the CSL was enough to cause the starting gear to be different.

Thanks for this - very interesting!!

[Tomba]

Great work Karter, I have been reading this for a while and would like to have the skills to do this as well. Thanks for sharing all this.

Okay so this is very limited.

Essentially what it does is monitor for the condition where the car is in 4th gear and has been cruising between 44 and 54 km/h for more than 3 seconds. At that point it enters "noise" mode where the max requestable torque is limited. As soon a different gear is selected or the car drops below 44 km/h or goes about 70 km/h noise mode ends....

For European markets there is a noise measurement around 50km/h and then full load. Similar function is in my 2010 S1000RR which closes the exhaust valve to reduce noise during this event.
Depended if you reach the engine speed limiter at the end of the test track or other conditions is in which gear you need to start. I believe the Ferrari 360 Modena would reach the limiter in 2nd gear and therefore the test conditions were adjusted.