E46 Fanatics Forum banner
Status
Not open for further replies.

***BMW ECU programming solution*** OPEN DISCUSSION inside please

340K views 482 replies 110 participants last post by  briatore 
#1 ·
Hi all,

I'm an experienced tuner (Mitsubishi, GM cars) and I want to have a open discussion with anybody that has information on tuning BMW's. OR any kind of information you want to share, or spare ecu you can donate "temporary"..

I found the hardware that is needed for READ/WRITE
"KWP2000+ Plus ECU Flasher"

example: On my 2003 330i my ECU is a Siemens MS43.

Since the ones that hold ALL the knowledge dont want to share the info I'm taking it on myself with the help of others (I hope) to find the info and in the hopes to finally provide a solution to ALL to tune our own cars and be able to create our own custom F/I kits...
 
#273 ·
bmw-scanner 1.4 has already proven useful though, i've disabled the damn daytime running lights and removed door autolock above speed.
Nice, just for that its worth having it. Where did you buy it? is it genuine or ebay? I got galletto but it only does the same thing as KWP2000+. Please let me know if the bmw scanner dumps the whole eprom from ms43
 
#274 ·
let me upload the eprom i got this morning, it said it finished with errors, but i also had the trans controlled hooked up and wideband hooked up.the car was on a charger, but the charger was flashing error in the morning. i'm redumping it again.

i'll upload what i got, and upload more when i get home tonight.

the bmwscanner is from ebay, it came from asia somewhere. took about a month to get here.

searched for bmwscanner, went with the lowest buy it now auction, seems to work okay, but needs a 32 bit machine (windows 7 is fine, but not on my 64bit win7)

anything you can tell me about my dump via galletto that i posted ? any way you could modify your XDF so i can see the maps inside that ? i would love to be able to modify the vanos angle maps until support for vanos is added to the ms3 alpha. as well as a few other things.
 
#275 ·
okay, here's some more stuff to look at:

main directory:

http://gurov.us/bmw_scanner/


http://gurov.us/bmw_scanner/2-2-2011_7-21-59-PM/DME_00000-6883F-00.bin is the partial dump of the first part of the DME (0x00000 - 0x7FFFF) that i stopped almost when it was done. this completed without errors like the one i will post later.

http://gurov.us/bmw_scanner/2-2-2011_7-21-59-PM/2-2-2011_7-21-59-PM.log log with all the lovely errors

all the .ebp files are "coding data" saves.
all the .bin files are eprom saves from various modules

http://gurov.us/bmw_scanner/2-3-2011_03-39-10-AM/DME_00000-7FFFF-00.bin is the "full" dump i ran overnight that finished with errors.
 
#276 ·
Nice to hear it can dump the whole 512kb bin file. But I will need your one clean dump without errors so I can run it in my software and find out where to mod the XDF for your software version.
Errors are there because of the static noize, most battery chargers are AC current, they are ment to charge the battery once out of the car. This is why it is recommended to flash ECUs on a bench using small DC current 14v voltage adaptor.
Does the BMW scanner let you burn the full dump back or no?
 
#277 ·
it does have that option, yes.

it takes an hour or so to get the dump. if the thing errored tonight, i'll pull the ecu next time i park the car overnight somewhere i can pull the ecu and rig up a bench for this with a power supply, it's entirely possible that disconnecting all the load stuff would've fixed that. i'll see when i get home.
 
#279 ·
I'm glad that you guys are still following up on this issue with such vigor. After seeing an older thread die down (Shark Injector guy started running his mouth), I will surely follow this one and hope for some good progress. Best of luck to everyone working on ECU programming in this new year.
 
#280 ·
http://gurov.us/bmw_scanner/DME_00000-7FFFF-00-proper.bin

this is the proper file that was read without errors.

i've got the ecu out right now and i'm going to rig it up on a bench here. seems i can only read memory in the car. i'll see if the options change when the thing is out of the car and powered with higher voltage than what's in the car.
 
#281 · (Edited)
Great. I started doing the XDF for your software version. See if that software is giving you option to flash and if it has auto checksum correction. It should give an option to flash even if it is the car.
I am looking at P.A.Soft webpage and one of the screenshots shows options: "write read EEPROM" and "recalculade checksum", do you have those options for DME?
 
#282 ·
yes, but they are grayed out right now.

i just hooked the ms43 on the bench here, and i can get into it with only a few wires connected.

in the process, i learned a great deal about the labeling of WSD.

main unit has 5 connectors.

connector 1 - big thick wires, constant 12 v on 7 + 8
connector 2 - o2 sensors
connector 3 - engine stuff
connector 4 - interior and diagnostics
+12v on pin 26 and 4
ground on 12
k line on pin 32

that's all that's required to connect to this.

i'm going to scavenge my place for some power supplies. i'll combine some power supply together to get the needed voltage, my computer power supply reads 10.8 volts on voltmeter and realtime feedback.

perhaps that's the key to enabling flashing of this thing. if this does work, it could be done in the car, just bring the power supplies out with you and hook up to the correct pins.
 
#283 ·
doesn't appear i can write the full 512kb with this tool, the read/write eeprom are grayed out.

battery voltage reports a green and 14.5-14.7 volts on the bench here.

i'm going to grab the 2nd set from "DME read memory" the 2nd 512kb to see what's in there.
 
#286 ·
#287 ·
yes, but they are grayed out right now.
Bummer, looks like that version from china does not have it. They have the new software out v1.4.8, I don't know if that one does it.

ms43 doesn't appear in that list.
Thats because MS43 is not a BDM flashable ecu.

it's fine though... galletto can write 64k back into the ecu, and that is supposedly enough to modify the maps and such.
It sucks that galletto won't do auto checksum correction

2nd part of the read memory via bmw-scanner 1.4
That looks like second part of that EEprom, it is just raw code there are no maps in there but it is nice that you fully dumped your ecu's flash bin.
 
#288 ·
Bummer, looks like that version from china does not have it. They have the new software out v1.4.8, I don't know if that one does it.



Thats because MS43 is not a BDM flashable ecu.



It sucks that galletto won't do auto checksum correction



That looks like second part of that EEprom, it is just raw code there are no maps in there but it is nice that you fully dumped your ecu's flash bin.
using latest version. same deal.

aren't checksums in various places in the code ? so the flash tool would have to know all the offsets for the checksums ?
 
#289 ·
Good flashing tool for BMW should have checksum correction. Galletto only flashes what you want to flash, it is up to tuner to correct the checksum of the tuned file. What would be great if you could buy shark injector software, flash it then read the whole first part bin, then send it to me, they I would know what realy is going on. I might do that, but I am short on money now in this bad economy.
 
#293 ·
Do you mean buy the Shark injector device that basically does a reflash from the OBD II port? What software will allow you to connect to the Device then to your laptop to extract the file. I assumed the file was stored on the device in memory only and there was no interface to the file. Correct me if i'm wrong.
Thanks,
 
#290 ·
hmmm i have the bavauto power programmer... lemme go get it and see if i can get it working this time with a proper power supply. i've never been able to get it working, maybe it's the power supply that was needed.
 
#291 ·
nope, still doesn't work, what a waste of $300
 
#292 ·
oh, and just to put this stuff to rest, the power supply i used was two normal power bricks.

a 5 volt and 9 volt supplies, wired in series, to bring voltage up to 14 volts. no magic here. one supply from a cordless phone, another from a portable dvd player.
 
#302 ·
what's the hardware interface it uses ?
 
#303 ·
some pics from my bench:


14.7 volts from two power supplies:



bare ecu hooked up



4 wires there:



constant battery power that's supposed to be there



GM5l40E trans pinout, unrelated to this, but still ecu-related

 
#306 ·
some of the maps do not make sense, and the axis are somewhat off.

i'm mostly in this to take the stock maps out of the ecu (esp the vanos as there's going to be dual vanos support in ms3 soon)
 
#309 ·
ignition advance values are valued from 20 to 129, so there's some multiplier there applied to the timing advance angle.

the X axis in those tables is from (null) to 15, with Y axis being all nulls.

vanos maps look around the right shape, but also have some kind of a multiplier to them, 120 being max, and in the 60s being the lowest (intake)

the maps look a lot better in 4.4 tunerpro than whatever the latest version is.
 
#311 ·
All of the maps are in their original raw data state. I only atempted to "guess" the calculation for one timing map and it resulted in close but wrong BTDC, that I made just for example. Axis for the same map are simply not there, because I don't know what it is. But I could compare it to older motronic and I could make some axis there just so we know to go to right direction. If I had some tuned versions of your software I could make it more understandable, because it wouls give me a idea of how much the data is changed.
 
#315 ·
There are lots of bineries from MS43 ecu on the internet. I am not gaining anything by you sharing your dump file.
Megasquirt is writen in C code and Siemens is writen in HEX code, the calculations of megasquirt ecu is totaly different as to those of Siemens so maps won't look the same at all. Megasquirt wants you to know everything about their code so they even posted their C code secrets on their site so other developer can redesign the software. Siemens does not give out anything so any find is big gain.
If I can raise RPM level, eliminate speed limit, in my MS43, just that alone is big step for me.
 
#316 ·
that's a load of horseshit, my friend, and here's why:

megasquirt is written in C, then translated to motorolla assembler, that same HEX code you mention. >NOBODY< writes things in machine code anymore, they're all compiled from either C, C++, or in the case of Formula1 ecus, labview processes, where they stuff a very powerful processor into the box and waste cycles so they can easily model things.

storing data is storing data. it's bits, you're not going to escape an 8 bit byte, a signed/unsigned integer being X bytes long, and that value being translated into a meaningful value inside the source code.

since there's more than one person working on the siemens ecus and programming various aspects of them, it will be in a common language all the engineers can understand, so that's most likely written in C.

enter, the spec sheet for the MS3 main processor, this thing here:



sak-c167cs-lm is the name on it. put it into google, gets you the datasheet for the whole thing, explaining all the registers, all the pins, etc.

http://www.datasheetcatalog.org/datasheets/2300/274904_DS.pdf open it up for yourself and follow along.

looks pretty straight forward, 25/33mhz cpu, MS43 has an onboard crystal, so it's not using the internal clock. 16 megabyte addressable space - interesting, yes ? chip itself doesn't have the amount of space required, so they can offload this stuff into external chip, which is why this particular CPU was picked.

– 3 KBytes On-Chip Internal RAM (IRAM)
– 8 KBytes On-Chip Extension RAM (XRAM)
– 32 KBytes On-Chip Program Mask ROM
is the memory on the chip itself. most likely has the bootloader that fires it up and loads the memory off the remote chip, or many chips.

pdf said:
C167CS-4R, C167CS-L
• High Performance 16-bit CPU with 4-Stage Pipeline
– 80/60 ns Instruction Cycle Time at 25/33 MHz CPU Clock
– 400/303 ns Multiplication (16 × 16 bit), 800/606 ns Division (32/16 bit)
– Enhanced Boolean Bit Manipulation Facilities
– Additional Instructions to Support HLL and Operating Systems
– Register-Based Design with Multiple Variable Register Banks
– Single-Cycle Context Switching Support
– 16 MBytes Total Linear Address Space for Code and Data
– 1024 Bytes On-Chip Special Function Register Area
• 16-Priority-Level Interrupt System with 56 Sources, Sample-Rate down to 40/30 ns
• 8-Channel Interrupt-Driven Single-Cycle Data Transfer Facilities via
Peripheral Event Controller (PEC)
• Clock Generation via on-chip PLL (factors 1:1.5/2/2.5/3/4/5),
via prescaler or via direct clock input
• On-Chip Memory Modules
– 3 KBytes On-Chip Internal RAM (IRAM)
– 8 KBytes On-Chip Extension RAM (XRAM)
– 32 KBytes On-Chip Program Mask ROM
• On-Chip Peripheral Modules
– 24-Channel 10-bit A/D Converter with Programmable Conversion Time
down to 7.8 µs
– Two 16-Channel Capture/Compare Units
– 4-Channel PWM Unit
– Two Multi-Functional General Purpose Timer Units with 5 Timers
– Two Serial Channels (Synchronous/Asynchronous and High-Speed-Synchronous)
– Two On-Chip CAN Interfaces (Rev. 2.0B active) with 2 × 15 Message Objects
(Full CAN/Basic CAN), can work on one bus with 30 objects
– On-Chip Real Time Clock
• Up to 16 MBytes External Address Space for Code and Data
– Programmable External Bus Characteristics for Different Address Ranges
– Multiplexed or Demultiplexed External Address/Data Buses with 8-Bit or 16-Bit
Data Bus Width
– Five Programmable Chip-Select Signals
– Hold- and Hold-Acknowledge Bus Arbitration Support
• Idle, Sleep, and Power Down Modes with Flexible Power Management
• Programmable Watchdog Timer and Oscillator Watchdog
• Up to 111 General Purpose I/O Lines,
partly with Selectable Input Thresholds and Hysteresis
here is the pinout:



since there are only 24 ADC converters, those might be goign through an input multiplexer that the main cpu will talk to via an i2c or another interface to grab additional analog inputs, if there are not enough of on-cpu ADC converters.

REGARDLESS, if you look carefully, the pins with a line above the name are service pins, RSTOUT, RSTIN, CLK, etc, these are for an ICD , in-circuit-debugging to be able to read/write to the processor. there's also the RXD0 and TXD0, that's serial input/output, wonder what's on there and wonder where those go to.

the processor is a C166 family, if you google around, you should be able to find the assembler instructions, if you were so inclined you could decompile the large dumps, which hoppefully include the actual machine code, they'll have all the comparisons, and all the instructions. this is very tedious and i do not wish it upon anyone.

megasquirt 1 was written in motorolla assembly.

in conclusion, it doesn't matter what the hell the thing is written in, it will still store data in a certain format, which should be predictable, and most importantly be meaningful for the program that is using it.

if there's 120 in the cell, that's fine, that 120 may mean 120 half degrees, 120 1/3rd degrees.

there is >ZERO< magic with this, and if the cpu is not internally locked against flashing, one should be able to write a full replacement for whatever siemens put on there.
 
#317 ·
here's an IDE for these processors with ASM and C compilers: http://www.rigelcorp.com/reads166.htm
here are the assembler instructions and parameters they take for the c166 processor: http://www.keil.com/dd/docs/datashts/infineon/c166ism.pdf
look, google for c166 decompiler brings this up: http://andywhittaker.com/ECU/DisassemblingaBoschME755/tabid/96/Default.aspx

ecufix ? i'm guessing siemens has been using infineon processors for a while now, core development team remains, they change up the algorithms, basic stuff remains the same. perhaps he could even shed some light onto what the translations are and how the tables are organized. which they'll be organized in arrays of arrays. with another set of arrays for axis, once again no escaping that here, just how the CPU expects the data to be for fast access.
 
#318 ·
i would suggest you watch the videos from that site, and see if you can duplicate the same thing using the full dump using IDA PRO. it's the same family processor.
 
#319 ·
Gurov, point of the thread is programming bmw ecus. Bump up the values in the timing map just slightly. Then flash it into your MS43 without correcting the checksum. I am curious to see if the engine will start, if it starts if there will be check engine light or not.
 
#320 ·
i'm the worst possible test subject for this.

all control of injectors and ignition has been taken away from the ecu forcefully, there's no maf, there's no drive by wire throttle body, there's no electric gas pedal. all the oxygen sensors are gone, the control of the automatic transmission has been taken away from the GS20 as well, so that's going to feed back to the ecu via CAN bus saying things aren't working.

i thought this was somewhat obvious from my signature, saying it's on standalone already.

my engine WILL start, unless the bogus checksum will not unlock the starter, or engages some other electronic trickery preventing the fuel from flowing, or the starter from cranking (fuel pump relay and starter lock)
 
Status
Not open for further replies.
You have insufficient privileges to reply here.
Top