CSL '0401' Program Binary Disassembly Notes

[R3VM3UP]

bmwfnatic and I have been making a lot of progress, and that's culminated this weekend in me having the time to map across characteristics (Parameters, Curves and Maps) as well as Global Variables from the 1801 master binary to the 0401 master (I'm still to do the slave binary).

We've managed to map 973 global variables which I've listed here: https://github.com/karter16/CSL_0401...#master-binary



As well as all the characteristics from 1801 (except for things which don't apply to the CSL like HFM). There were 5 characteristics in the 1801 master binary I wasn't able to identify, plus another 115 that are specific to the 0401 binary. These 120 characteristics which are still to be identified are listed here: https://github.com/karter16/CSL_0401...#master-binary



I should be able to work out what a bunch of these are, I'm just focused first on getting in all the characteristics, etc. to both the Master and Slave so we can update the archive to share with others.


Side note - I found it interesting as I was going through the master binary to see that the EGAS module has a separate EGAS_WDK table for when the CSL snorkel flap is open which has some subtle differences in both the interpolation point and the values around the 1200 RPM mark - others are probably already aware of this but I hadn't come across it before:

Sorry for the massive quote, and forgive my ignorance on some of this, but are you just doing this all manually or have you developed some sort of scripts to handle this? I get it that you've got a fairly complete XDF for the 1801 binary, are you just looking up how variables defined in the 1801 XDF are being used in the 1801 decompiled binary, and then checking to make sure that they are being used in the same way in the decompiled 0401 binary?

On a similar note, as you find stuff, are you just manually labeling variables you find in the decompiled binary?

[karter16]

Is the C decompiler part of the disassembly tool?

Yep - the screenshots I've shared of C code are generated by the decompiler. The variable names and stuff need to be done by hand, but not having to manually convert all the ASM to C equivalent saves a lot of time. The decompiler isn't perfect so you need validate its output sometimes, but overall an awesome tool.


Sent from my iPhone using Tapatalk

[ac427]

Absolutely - things like the C decompiler (although not infallible) are a game changer for quickly understanding what's going on, I can understand ASM but no where near as easily as C.


Sent from my iPhone using Tapatalk

Is the C decompiler part of the disassembly tool?

[karter16]

It is satisfyingly fun to dig into all this 15-20 years later with the benefits of modern technology, I must say.

Absolutely - things like the C decompiler (although not infallible) are a game changer for quickly understanding what's going on, I can understand ASM but no where near as easily as C.


Sent from my iPhone using Tapatalk

[Bry5on]

You're most welcome - ask as many questions as you like. It's for the community's shared knowledge and interest that I'm doing this work. I certainly don't know all the answer and am just figuring it out as I go (I also can't guarantee I won't end up having to correct my own answers in the future!!!) but the whole point is to help us understand more.

Same, and we’re of course always subject to being wrong! In which case the community learning applies even better. It is satisfyingly fun to dig into all this 15-20 years later with the benefits of modern technology, I must say.

[karter16]

Thank you both for you help. It's really good to gain an understanding of not only how it works but the thinking behind it.

You're most welcome - ask as many questions as you like. It's for the community's shared knowledge and interest that I'm doing this work. I certainly don't know all the answer and am just figuring it out as I go (I also can't guarantee I won't end up having to correct my own answers in the future!!!) but the whole point is to help us understand more.

[ac427]

My data logs show that if you actually duct the lower snorkel to the bumper, you will have low IATs above 40mph. My theory is that the open top half of the flap actually allows air exchange, functioning as an exhaust when the lower half is supply. Just a guess based on my data logs with flap open/closed.

Also, it’s not just the IAT that’s right behind the radiator, but also the thermally conductive airbox itself (carbon should be a lot more conductive than plastic). Hot airbox could mean hot air at low speeds and loads, so it’s my opinion that the IAT is conservatively placed to prevent damage to the engine. If you’re concerned about the IAT readings, you’re WAY better off just ducting from the bumper to the airbox and actually having low IATs vs trying to spoof lower temps. I’ll get off the soap box now.

All good mate and thank you for the explanation.

yeah echoing this. I've had a look through 0401 and 1801. TAN is calculated exactly the same in both (e.g. there's no adjustment to the calculation of TAN itself in 0401), the KLs and KFs that take TAN as an input are also the same between both. The only difference is 0401 has additional code to utilize TAN in the calculation of RF based on MAP sensor and TAN. However as MpowerE36 has shown, the code implementation of the maths doesn't include any sort of "adjustment factor". Which further supports Bry5on's comment above. I think we can conclude doing it the way BMW did is a conservative approach. I would think as soon as you get some reasonable airflow through the box the IAT will be fairly accurate, and when you are sitting still (which isn't really the point of a CSL in BMW's eyes remember) the heat soak resultas in a conservative reading.

Thank you both for you help. It's really good to gain an understanding of not only how it works but the thinking behind it.

[karter16]

My data logs show that if you actually duct the lower snorkel to the bumper, you will have low IATs above 40mph. My theory is that the open top half of the flap actually allows air exchange, functioning as an exhaust when the lower half is supply. Just a guess based on my data logs with flap open/closed.

Also, it’s not just the IAT that’s right behind the radiator, but also the thermally conductive airbox itself (carbon should be a lot more conductive than plastic). Hot airbox could mean hot air at low speeds and loads, so it’s my opinion that the IAT is conservatively placed to prevent damage to the engine. If you’re concerned about the IAT readings, you’re WAY better off just ducting from the bumper to the airbox and actually having low IATs vs trying to spoof lower temps. I’ll get off the soap box now.

yeah echoing this. I've had a look through 0401 and 1801. TAN is calculated exactly the same in both (e.g. there's no adjustment to the calculation of TAN itself in 0401), the KLs and KFs that take TAN as an input are also the same between both. The only difference is 0401 has additional code to utilize TAN in the calculation of RF based on MAP sensor and TAN. However as MpowerE36 has shown, the code implementation of the maths doesn't include any sort of "adjustment factor". Which further supports Bry5on's comment above. I think we can conclude doing it the way BMW did is a conservative approach. I would think (edit: actually as Bryson has proven) as soon as you get some reasonable airflow through the box the IAT will be fairly accurate, and when you are sitting still (which isn't really the point of a CSL in BMW's eyes remember) the heat soak resultas in a conservative reading.

[Bry5on]

No worries. It would certainly be an interesting experiment.

Speaking of calibration, it would be interesting to know how the CSL IAT is coded for the heat soak issue. I mean, BMW could have placed it anywhere but they put it in a place where its output is bound to be skewed by the heat from the engine. Obviously they accounted for this in coding but i wonder if there is a point the output from the IAT just becomes useless?

My data logs show that if you actually duct the lower snorkel to the bumper, you will have low IATs above 40mph. My theory is that the open top half of the flap actually allows air exchange, functioning as an exhaust when the lower half is supply. Just a guess based on my data logs with flap open/closed.

Also, it’s not just the IAT that’s right behind the radiator, but also the thermally conductive airbox itself (carbon should be a lot more conductive than plastic). Hot airbox could mean hot air at low speeds and loads, so it’s my opinion that the IAT is conservatively placed to prevent damage to the engine. If you’re concerned about the IAT readings, you’re WAY better off just ducting from the bumper to the airbox and actually having low IATs vs trying to spoof lower temps. I’ll get off the soap box now.

[Slideways]

No worries. It would certainly be an interesting experiment.

Speaking of calibration, it would be interesting to know how the CSL IAT is coded for the heat soak issue. I mean, BMW could have placed it anywhere but they put it in a place where its output is bound to be skewed by the heat from the engine. Obviously they accounted for this in coding but i wonder if there is a point the output from the IAT just becomes useless?

Both the MAF and the CSL IAT need to be behind the filter to prevent damage to the sensor. The MAF even needs a mesh screen in front of it, my guess is to improve airflow over the sensor.

BMW used that IAT for a reason; otherwise, they could have used the other style sensor from their older models.

[ac427]

Not a lot of losses at part throttle, which is where this would be most useful I think. Then tune WOT without the HFM by AFR and open the flap, redo AFR for the flap open case. All the acronyms, sorry!

No worries. It would certainly be an interesting experiment.

Speaking of calibration, it would be interesting to know how the CSL IAT is coded for the heat soak issue. I mean, BMW could have placed it anywhere but they put it in a place where its output is bound to be skewed by the heat from the engine. Obviously they accounted for this in coding but i wonder if there is a point the output from the IAT just becomes useless?

[karter16]

What year did the E46 M3 GTR come out?

It was a V8. I'm not sure which ECU it used though.

Also, which DME did the E39 M5 have, probably a previous generation MSS5x ECU.

GTR was 2001 I think, so before the CSL. The DME in the race version was entirely separate, not sure what they did in the strassenversion but suspect it would have been a derivative of that.

The E39 M5 was the MSS52.


Sent from my iPhone using Tapatalk

[Bry5on]

True, I guess you could mount a MAF anywhere near the actual air intake path and then calibrate for loses?

Not a lot of losses at part throttle, which is where this would be most useful I think. Then tune WOT without the HFM by AFR and open the flap, redo AFR for the flap open case. All the acronyms, sorry!

[ac427]

Easy enough to make an adapter for the non-CSL MAF to the lower snorkel, then just leave the flap closed.

True, I guess you could mount a MAF anywhere near the actual air intake path and then calibrate for loses?

[Bry5on]

Are MAF's available in the CSL snorkel diameter?

It would interesting to implement an MAF for part throttle quality research.

Apologies, i could have put these these as one post but i was using the phone on the train home.

Easy enough to make an adapter for the non-CSL MAF to the lower snorkel, then just leave the flap closed.