E46 Fanatics Forum banner

Tuning for BMS46

3 reading
230K views 337 replies 68 participants last post by  veggeto2021  
#1 · (Edited)
Hi Guys!
I have bmw z3 1.9 restyling, with 194E1 engine (86Kw for 1500kg of car).
One day, i was driving on highway, and a dude in a smart brabus, raced with me. i lose.
Next day, i put a kompressor of clk 220 under my hood :excited:
seriously, i can't stand that a beautiful car like z3, has only poor Horse.
Under advice of daniel_f , i post this thread. he tell me that a lot of guys are still because bms is an hard battle. SO, i know a bit of ecu tuning and know some address tested on my car. if you want we can begin this adventure on study this ecu.
In this ecu there is a 29F200BB. i have 2 file, one is whole eprom,(it isn't from my car but from the same ecu) and one is 32kb(read with galletto or mpps). we need to study on this short file because it is the simplest method for tune this ecu.
sorry for my bad english
 
#4 ·
Well, without a proper damos file, it´ll be some hard work but as long as a you´re willing we may find the neccessary maps.
I´ll show you how to work around.

Bosch ecus are much easier in identifying maps compared to Siemens, so i´ll give you a short introduction:

By having a quick look at the 32kb file, we can pretty easily identify a map between 0x1AE0 and 0x1B50. Even if we don´t know what that map is used for, we can find the exact size of the map and the axis values directly in front of the map. The bigger the map, the easier to identify.

Lets have a look at that map...

Image


We know the exact size in x and y values is somewhere in front of the map and even the axis values. By looking at the decimal values in front of the map, we can find a "11" and a "10",

Image


followed by some constantly raising values.


The "11" tells us the size of the map in y-direction and the "10" is the size in x-direction. The values between the map and the size-descriptors are then the entries at the individual axis. The y-axis is getting these entries:

Image


and the x-axis is getting the following entries:

Image


So the final map will look something like this:

Image


Note: I already multiplied the common factor for rpm (32) to the y-axis. By having a look at the values, i tend to think it is something which works with partial load.

This way one needs to work through the file to get some decent looking maps which can later be checked for usability :eeps:

It will take you some time to mess through the file ;)
 
#6 · (Edited)
NOW, i write all map that i try and i know
spark timing 25BA/2844 (firts at normal condition, the second is at max load)
Injection 106E
lambda 146E (if play in winols proprietes, i know a way to see the lamda multiplier)
1E2A and other 4... Injection??? i can't try well...
flowmeter/load 1AF3
22A8 idk but it is secure a map of injiection sistem.
2533 possible knock sensor?
RPM limit: impossible to find!
 
#10 · (Edited)
Daniel how we can find factors and multipliers??? If you want , i Can write alla sensor that the car has.
In. the proprietes of 0146e map, Please Wright in factor 128, precision 2 and click on reciprocal. You Can see lambda multiplier! On This map, i use the method of ms41.1 that is similar ECU. So go on x axis of lambda map(load) set in data source 1,2,3 in factor write 8,4 in offset 8, the dame in y axis(rpm) But factor 400 and offset 500
 
#14 ·
i don't think, that exist a "full load lamda map" because in certain cases, the lambda go in open loop, and this map go right only, when you drive slowly or comfortably. listen my "brain way" : SECURE map, is only this: 25ba\2844. because i test it on my car step by step. if we look at axis( this map use rpm\load), we make a series of valor,013--->150 and 025--->208. in other maps, we get same valor, like 013--->150 ( i think these are the steps of rpm) and 025--->~180 (i think this is load) what do you think?
 
#15 ·
I think without a Damos its all mess ;)

The problem is, we need to find referencies for load and rpm points. I know BMW uses 32 as factor for rpm at the Siemens ecu. I don´t know if that exact same factor is used at Bosch ecus, too.

MS41 seems to be from Siemens, too?! So that would be no real help.

You may need to find out which processor the ecu is using and start disassembling with IDA Pro. As i´m definately not an expert at IDA, the work is pretty much all up to you. :eeps:

As alternative, you could try to purchase a Damos from Olsx.be, just tell them you don´t use WinOLS, rather then ASAP2Demo. Full damos file is 300€
 
#16 ·
OK daniel... Please don't give up This project!
The processor is ZC439505MFT20 Motorola, what is ida? lol
Ms41 got same thinghs and it Can be read with same protocol on eobd. This bms, if i remember right, on the box is write "BOSCH" But on internal board i read "siemens". How it possible?
 
#24 ·
No reply from olsx :(
I'm searching rev limit. It is 6375, if we use the "Bosch" usually calculation, we have to do: 6375x6/0,75. We got 51000, and i have to find This value in 16 bit lo/hi.
A part This, do you have other tips? I know that bms is a m5.2 similar to 740i. And i got a file and a damos for This ECU. If i look on This, i Can see a lot of similar things. I'm disperate, no one Here in Italy can REALLY help me.