CSL '0401' Program Binary Disassembly Notes

[karter16]

As I said earlier, awesome work! Did you go through the SMG CAN implementation by any chance? It would be awesome to ditch the SMG and install DCT or 8HP with a CanTCU, but for that the secondary CAN bus needs to be deciphered.

Afaik the MSS54 acts as a gateway between the gearbox and the chassis, so the can11h message "EGS1" on 0x43F is actually sent out by the DME, not the SMG control unit.

SMG CAN starts at something like 0x410 up to 0x412. I think olza also posted about this.

I haven't had a chance to get into the secondary CAN yet. But having a very quick look now.

There are 11 outbound messages from the DME.

0x310
0x311
0x312
0x313
0x314
0x515
0x710
0x711
0x712
0x720
0x701

The 0x7xx messages I'm pretty certain will mirror the convention on the primary CAN and will be diagnostic messages from when BMW were developing and tuning. They seem to contain unrelated parameters that would be useful for tuning. Their sending is controlled via parameters in the partial ROM.

There are 3 inbound messages that are read as you've previously identified.

0x410
0x411
0x412

I'll get into this more when I get the chance , but that seems to be the high level.

Edit: Also yes - 0x43F is sent from the DME on the primary CAN.

[sda2]

Yes, anything 0x7** is development stuff, yes. I was unaware of the 0x310-515. I only know 316,329,338 and 545. So MSS54 is indeed very special.

SliM3 I know the Maxx and Dodge firmware, but after driving a Dodge one, I have to say that BMW is way better for daily use, than Dodge.

How do you hook up the Maxecu? splice it into the existing DME wiring, or is it capable of reading the values from can? How is throttle blip and ignition retard working?

[liam821]

How do you hook up the Maxecu? splice it into the existing DME wiring, or is it capable of reading the values from can? How is throttle blip and ignition retard working?

You can use the MS43 plug-n-play harness adapter, which is what I'm doing - although you might need to move a few things around. I'm also using a MaxxECU, with an e92m3 DCT, but a turbo Honda k24 in an e46. I'm using the MS43 play-n-play harness, but I made a custom Honda k24 engine harness to BMW DME style x60003/x60005 plugs so everything is very factory.

Here is the wiring documentation: https://www.maxxecu.com/webhelp/wiri...u-bmw_m54.html

[ac427]

You can use the MS43 plug-n-play harness adapter, which is what I'm doing - although you might need to move a few things around. I'm also using a MaxxECU, with an e92m3 DCT, but a turbo Honda k24 in an e46. I'm using the MS43 play-n-play harness, but I made a custom Honda k24 engine harness to BMW DME style x60003/x60005 plugs so everything is very factory.

Here is the wiring documentation: https://www.maxxecu.com/webhelp/wiri...u-bmw_m54.html

Perhaps we can move this to a dedicated SMG/DSG thread?

[SliM3]

Perhaps we can move this to a dedicated SMS/DSG thread?

Yeah, my bad for jumping OT! Agreed 👍🏽


Sent from my iPhone using Tapatalk

[ac427]

Yeah, my bad for jumping OT! Agreed 👍🏽


Sent from my iPhone using Tapatalk

No worries Brian. It's a really interesting topic in its own right.

All the best
Ac427👍🏽

[karter16]

Couple of updates:

I've confirmed that the 0x4000 - 0x7FFF memory space is non-volatile memory used for storing things like the AIF Counter, Stored DTCs, trims, etc. that persist between drives.



Also this is the latest memory map - it's still incomplete in that I know I need to add the 2x CANbus frame buffers at 0x00ff0000 and 0x00ff1000) among a range of other things, but I want to do some more confirmation around those before I add them to the table.

[karter16]

Have finished the CSL specific section of the Load Detection (Lasterfassung) module in the XDF. All parameters are named, with descriptions and correct conversion factors and units of measure.

Pretty much the only way this section will get more accurate now is if someone who has them shares the actual BMW names for these parameters, but that's really just a nice to have, it wouldn't change the understanding of what these parameters are and do.

[karter16]

Posted this in my build thread but thought it was worth putting here too:

Now that I'm setup for CAN logging I finally got a chance to try out my custom program and tune ROMs that allow for configuration of the additional CAN messages (7D0 and 7D1) in the partial binary (see here for the background: https://nam3forum.com/forums/forum/s...454#post310454).

The good news is that it all worked first time! (to be fair I put a lot of effort into checking and rechecking the code to make sure it was right)

First up I flashed the custom program to the DME and ran it with the standard tune. I've designed this such that if someone uses the custom program with a tune file not designed for it the additional functionality is simply disabled. Likewise if someone uses the custom tune with the standard program it is also gracefully handled.

I then verified that DME functionality was as expected. E.g. normal function and no additional CAN message activity. All was well.

I then added the new parameters to my tune file:



and flashed the tune. Sure enough everything still worked, and the 7D0 CAN message was present on the CANbus.

Here are the values being logged.



I've got some more scenario testing to do. e.g. test the 7D1 message as well, intentionally put bad data into the config parameters and make sure it's handled gracefully etc. but super stoked all is working so far as this is the most complex change I've made to the program so far!

Onwards and upwards - this functionality will be very useful to me as I dive into more refinement of my tune now I have high-frequency CAN logging available!

[heinzboehmer]

Man, that's super cool. Good stuff!