BMW Forums : BimmerForums banner
1 - 20 of 22 Posts

·
Registered
Joined
·
27 Posts
Discussion Starter · #1 · (Edited)
Hi,
this post is not "new", in fact it is 4 days old. I started it on an other board but nobody seem to be there : http://ecubb.bmwecu.org/board/viewtopic.php?t=2608

The DME is a Bosch 0 261 203 075
the car should be a euro spec E36 3.0L single vanos.

The file attached to the post should be renamed as a *.bin file to work fine

So in a first time, I'll put there all the informations I have at this moment, and I hope to going on with some of you for a common project.

Day 1
I had started to understand what's in the box and here so far what I've found in the DME chip (not the vanos box).

I think I've found some adresses but I'm not sure at this time :
7374 to 7380 : 12 steps
73A4 to 7463 : 192 steps (16*12 map ?)
761B to 76A5 : 96 steps (12*8 map ?)
7728 to 77E6 : 190 steps
7A7A to 7A7F : 6 steps
7B64 to 7B6B : 8 steps
7B7C to 7B80 : 4 steps
7DD4 to 7DDB : 8 steps
7E4D to 7E74 : 36 steps

So at this time I'm not very sure, I'll re check because I may have found new position and/or more steps in certain area.

On a side note when you put the file in ascii mode, you can see at this end of the file what it is but in reverse : 3.3 CINORTOM 03B05S
so does this mean that the whole file need to be 'reversed' to be more readable ?

Is this supposed to be a 8 or 16 bits file ?

DAY 2
I'm a bit lost in here.

I tried the demo of Winols, and the map finder report this :
6ECA : 8*7 (16 bit)
702C : 6*5 (8bit)
7096 : 8*6 (16 bit)
725F : 5*8 (8 bit)
73A4 : 12*16 (8bit)
749F : 7*6 (8 bit)
760E : 3*8 (8 bit)
764C : 6*16 (16 bit)
7728 : 12*16 (8 bit)
78DD : 7*12 (8 bit)
7956 : 4*6 (16 bit)
7A16 : 6*6 (8 bit)

Because all this is new to me, I needed some inspiration and found that the Porsche 944 and E30 scenes have lot of (lost ?) knowledge about Motronic DME.
http://www.motronic.ws/ have a lot of youseful hints.

If you go to the tab 'map table', you can see the author searching for map in between ff ff ff ff ff ff series.
So by simply applying this method, I found 20 to 25 areas (can't say if they are maps at this time). Some of them are huge (26.133 bytes) and other are very small (6 bytes).


DAY 3
Now here are those famous areas :
Code:
Adress (hex) / lenght (bytes)
0000 / 119
0084 / 276
01A4 / 429
035C / 68
03A8 / 26
03C7 / 26133
6ABD / 133
6B58 / 68
6BA4 / 122
6C28 / 22
6C60 / 80
6CBA / 22
6CF2 / 758
6FFA / 562
7232 / 885
75B2 / 888
792E / 75
7985 / 649
7C18 / 446
7E20 / 85
7FC9 / 31
7FFA / 6
I don't know if it is ok with the board, but I post the base bin file (found on internet) that is available on those ebay dvd's full of bin.

So now I guess I need to know if it's a 8 or 16 bits application.
If try to divide the whole lenght areas by 8, this is what we get :

Code:
Adress (hex) / lenght (bytes) / 8bits base
0000 / 119 / (14*8)+7
0084 / 276 / (34*8)+4
01A4 / 429 / (53*8)+5
035C / 68 / (8*8)+4
03A8 / 26 / (3*8)+2
03C7 / 26133 / too huge to be a table imo
6ABD / 133 / (16*8)+5
6B58 / 68 / (8*8)+4
6BA4 / 122 / (15*8)+2
6C28 / 22 / (2*8)+6
6C60 / 80 / (10*8)
6CBA / 22 / (2*8)+6
6CF2 / 758 / (94*8)+6
6FFA / 562 / (70*8)+2
7232 / 885 / (110*8)+5
75B2 / 888 / 111
792E / 75 / (9*8)+3
7985 / 649 / (81*8)+1
7C18 / 446 / (55*8)+6
7E20 / 85 / (10*8)+5
7FC9 / 31 / (3*8)+7
7FFA / 6 / too short
Assuming that maps from these times couldn't be widder/bigger than a 20*20 map, that give a length of 400 bytes.
So now, if I try to see what could be a map this is what we get (anything smaller than 400bytes):
Code:
Adress (hex) / lenght (bytes) / possible map size
0000 / 119 / 15*8 or 12*10
0084 / 276 / 17*16
01A4 / 429 / 27*16 or 2 maps of 13*16
035C / 68 / 8*8 or 9*8
03A8 / 26 / 3*8 or 13*2
6ABD / 133 / 16*8
6B58 / 68 / 8*8
6BA4 / 122 / 15*8 or 12*10
6C28 / 22 / 2*8 or 16*1
6C60 / 80 / 10*8
6CBA / 22 / 2*8 or 16*1
792E / 75 / 9*8
7985 / 649 / too big
7C18 / 446 / 27*16 something wrong there
7E20 / 85 / 10*8 or 11*8
7FC9 / 31 / 4*8 or 2*16
7FFA / 6 / too short (limiter ??? : speed or rpm)
So now I have something like 17 possible maps. The next step is to found what could be a label or a scale in each area.

Reading the ascii code I can tell that 7E20 is not a map, it look like a definition header and this is why I think that the file must be read... backward.
00007e20h: EA C0 EB CC ED 50 FC D6 FD D8 00 02 61 01 00 00 ; Í¿ÎÃÌP¸÷˝ÿ..a...
00007e30h: 82 C4 1A 1C 1A 1C 1E 1C EA C0 00 00 00 00 00 00 ; ǃ......Ϳ......
00007e40h: 11 D8 FF 14 0C 31 31 34 2F 36 30 36 20 30 38 30 ; .ÿˇ..114/606 080
00007e50h: 30 35 37 30 33 30 32 31 36 32 30 31 38 30 37 35 ; 0570302162018075 (the dme code in reverse !!!)
00007e60h: 33 37 36 32 31 39 30 39 37 31 33 31 31 30 30 32 ; 3762190971311002
00007e70h: 37 31 2E 32 36 ; 71.26
I'm slowly approaching my limits (if not almost reached or overruled), so if anyone have some hints or inputs on all this, please let me know.

- how to make sure a map is a map ?
- how to found the formula conversion ? is it known ?
- what are the typical maps in a motronic of this generation ?

DAY 4
Ok, for what I have understood thru the different link/reading, is that the mcu is using the inputs/outputs in the code with some 'pointers'.

They seem to be D#, and just after the hex value converted to decimal give you the number of value you'll have on the x axis, then an other D# with and other value give you the y axis.

And they also say in the 413 thread that the maps are hold after address 7000.

Can all this be applied to the M3.3 075 ecu ? Well I hope so, this could lead me to the next step.

I finally managed to found several map using the method of motronic.ws, most of them are 2D or 3D maps and most of them match !!!

So I look for any sequences that is starting with D0.

When in a 2D scheme, it just hold scales and values like this
D0 0A xx xx xx xx xx xx xx xx xx xx ** ** ** ** ** ** ** ** ** **

So that mean :
D0 is a pointer
0A is the length, which is 10 in decimal mode
xx are the 10 scales
** are the 10 values.

When in a 3D scheme, it work like that
D0 06 xx xx xx xx xx xx D5 0C yy yy yy yy yy yy yy yy yy yy yy yy
********************************************************...
D0 is a pointer
06 is the length, which is 6 here
xx are the scales for D0
D5 is a second reference (the other axis)
0C is the length of D5, 12 in decimal
yy are the scales for D5
********* : are the value of the map . Now you're supposed to have 72 of them because you just found a 6*12 map.

I'm still watching for possible map inside the bin but the pointers that come the more often are :
D0, D5, D6, D7, D8.
Assuming D0 is rpm (because it is the most used but it could be map too !), what are the other pointers ?

Maps goes from 3*1 to 16*12 (got 3 of them actually) so what do you think ?

DAY 5 : today !
Starting @7000h, i have found something like 20 to 30 maps of each (2D & 3D) for a total of 50.

There must be some more, but I hope in all that i would have the minimum :
- idle fuel
- part throttle fuel
- part throttle ignition
- full throttle fuel
- full throttle ignition

If I understand the 'motronic way', idle and wot are often 2D maps and partial 3D.
What I'll need now is found speed & rpm limiters. It's very hard because it's just a value (for each) lost somewhere in the code, with a formula.

I'm actually trying to understand how to XDF in Tunerpro to show you some maps.

Any advice or help is welcome, as you can see I'm starting from scratch and don't have a clue about disassembling or hex editing... but I try ! :D
 

·
Registered
Joined
·
27 Posts
Discussion Starter · #3 · (Edited)
I'm glad you put an eye on this, and hope to found many people to work on this as it happened for the 413.

Facts :
Ok now I have nearly 100maps starting at 7000h, some are maps, other aren't but at this time I can't tell. The only thing I can tell is that I'm able to "see" a sequence in the code (see above on day 4).

What do we need as inputs ?
Load, rpm, ECT (water T°) : what else ?

The most seeing pointers in the bin file is : D0
Maps that have D0 goes from 3*1 to 16*12. I think D0 is the load parameters : MAF

D0 often come with D5 in many 3D maps, but D5 never come without D0. So you can have D0 with Dx, but you won't found D5 with Dx.
That lead me to say that D5 is surely RPM...

I understand that all this may be confusing to you but remember English is not my native tong. I'll put some data in a more mathematical way to be sure you understand me :

Single pointers are 2D maps, and double pointers are 3D maps :
Code:
D0 : 28 maps
D0/D6 : 3 maps
D0/D5 : 19 maps
D0/D7 : 3 maps
D0/D8 : 1 map
D2 : 1 map
D3 : 6 maps
D3/D7 : 1 map
D7 : 30 maps
D7/D4 : 1 map
D7/D3 : 1 map
D8 : 2 maps
D9 : 1 map
D0 is load
D5 is rpm


Keep in mind that at this stage, there must be thing that I believe to be maps but aren't.

So I (we ?) need to understand exactly what is each pointer and after this (and only after this) should try some formulas to convert these into readable/writable values/units.

EDIT : may be something visual will talk better for me...
 

·
Registered
Joined
·
27 Posts
Discussion Starter · #6 ·
Yes from euro S50B30

Alright, this is not a [How to] but this is how I had worked on this.

You need a few tools :
- hexeditor : freeware everywhere
- map tool : tunerpro and win ols demo are free
- hex/dec calculator : there is also one in windows
- pencil and paper : I prefer computer, but it was quickier some times to do it with paper, trust me !

In this post, I will assuming a lot of thing that I didn't/couldn't verify by myself but trust to be a good starting point.

Open the hex editor and search for 'D0' after the adress 7000h. You'll find a lot of them, in fact nearly 100 !!! Take them one by one with patience, some are good and other aren't.

How do you know if it is a good or a bad one ?
There is usually 2 good cases for this, the other aren't.


Case 1 : a 2D map (x*1)
If you look at the picture, you can a yellow border. This is a 2D map.
D0 is what we're looking for
The next number 10 give the lenght of the map
Use your calculator and put 10 in hex mode, it give you 16 in decimal.
So just count 16 steps after 10.
Starting at 05 it will end at 4C and this is the scalar values for the x axis :
05 06 07 0C 0D 0C 0D 0C 0D 0C 0D 0C 0D 0C 05 4C
Right after 4C, you have 8E.
So again 16 steps after 4C, including 8E
8E 89 8C 8B 88 92 91 8C 89 88 8B 87 89 89 89

And here is a beautiful 16*1 map


Case 2 : a 3D map (x*y)
If you look again at the first picture, you'll see an orange area.
D0 is still what we're looking for
The next number 10 give the lenght of the map
Use your calculator and put 10 in hex mode, it give you 16 in decimal.
So just count 16 steps after 10.
Starting at 05 it will end at 4C and this is the scalar values for the x axis :
05 06 07 0C 0D 0C 0D 0C 0D 0C 0D 0C 0D 0C 05 4C
Right after 4C, this time you have an other D 'something'.
This time it's a D5 associated with a 0C and converted to decimal give a 12.
So for this second axis (D5 based) will have and other scalar (starting right after 4C) :
0F 0F 0A 0A 0A 0A 0A 0A 0A 0A 14 74
and like in the 2D form, followed by the values from 76 to 86.
with a 16*12 map this give you 192 values !!!



You should proceed like this in a the whole file with D0, then D1, D2 and so on to D9. If a Dx is almost used by an other map/table you can't use it a second time.

NOTE : let's say you're looking for D5, you couldn't use the last one in my example because it's part of a 16*12 (DO/D5) map.
 

·
Registered
Joined
·
27 Posts
Discussion Starter · #7 ·
I have read amount of threads over the net that talk of Motronic, would it be 403, 413 BMW's dme, or VW G40, G60 ecu's, even some Porsches.

There are common things and I took the liberty to mix them as it helped me understand a few things :
- 3 sort of maps : closed throttle, part throttle and wot.
- when in wot mode, the only variable is the engine rpm, there is no maf reading.
- wot maps are 2D style in a 16*1 form
- part throttle are 16*12 form


So with these facts, now it's become crystal clear that D0/D5 is rpm vs. load.
Why ?
Simply because I didn't found ANY D5 maps. All D5 was related to a D0 BUT, there was severals D0 only. You get it ?

All right so we have :
D0 : load
D5 : rpm
I also found claims that
D7 was ECT related and I guess it is because of the look of the map and that
D8 is battery related, may be some kind of Electrical Load Detector to compensate injector opening vs. electrical power available.

An other VERY interesting thing I found was the formula to calculate the D0/rpm/X axis.
Here how it work...

If we take my previous examples nor the 16*1 or the 16*12 ones, we have the scalar
05 06 07 0C 0D 0C 0D 0C 0D 0C 0D 0C 0D 0C 05 4C
in order to found real world value, you need to calculate from... right to left !

Let's start with 4C :
first convert 4C hex = 76 dec
then the formula (76*40) -[(2^8)*40]
and that give 7200.

so now we have 05 06 07 0C 0D 0C 0D 0C 0D 0C 0D 0C 0D 0C 05 7200
the next value is on the left !
But from there we will only substract from the right :
05 hex = 5 dec (that was easy ! lol)
and we do 7200-(5*40)=7000

so now we have 05 06 07 0C 0D 0C 0D 0C 0D 0C 0D 0C 0D 0C 7000 7200
C is 12; D is 13 : each values is multiplied by 40 and substract from the previous result
at the end you'll end up with this
800 | 1000 | 1240 | 1520 | 2000 | 2520 | 3000 | 3520 | 4000 | 4520 | 5000 | 5520 | 6000 | 6520 | 7000 | 7200

Each time you've got a map that start with D0 you can apply this formula to found the real world value for the rpm.

Now for D5 (load) I don't know what is the unit. On Nissan Bikirom, I have seen MAF value (load) in percent so you know how much headroom you have on your AFM.

But here we are on a naturally aspired setup, so my guess is that everything is tight on calculation, and this why on wot you only need rpm to know air mass.

On the next episode I'll try to find load, fuel and ignition formulas. Wish me luck !
 

·
Registered
Joined
·
43 Posts
0 261 203 075 is the bin file that I am looking at and it is 64kb long

hex location
CA96 MAF map 16bit 16x16

CD20 TPS map 1x31

CDDF engine temp sensor map 1x15

CF94 Idle map 6x4

CFEE pt fuel map 16x12

CFBE WOT fuel map 16x1

C809 rev limit? (this is the area of constants) there are 128dec values, one of them could be target lambda

Thats enough for start,
 

·
Registered
Joined
·
27 Posts
Discussion Starter · #13 · (Edited)
I'll check on my laptop and I'll told you later, thank anyway !

EDIT :
so I have checked and my file is a 32kb size. I know that the vanos module also have a 32kb chip.
Did you stack both of them ?
Which one did you put first (dme or vanos) ?

I also tried to offset your addresses by -8000h and couldn't find anything that match my file which is also a 261 203 075.

So far here what I have :
D0 = rpm
D3=IAT
D7=ECT
D8=Voltage
still don't know for D2 and D9

7250 [email protected] throttle 6*4
727A [email protected] 16*1
72AA [email protected] throttle 16*12
74DC [email protected] throttle 8*3
751A [email protected] 16*6
75F6 [email protected] throttle 16*12

I also have a mysterious 7C7C (10*1) and
an other 6AE1 (4*1) rpm or speed limiter ?

I had actually 102 maps in this file but can't name a lot of them and if my pointers Dx is false then the maps name is false too.
 

·
Registered
Joined
·
8 Posts
Your fuel table target lambda conversion should be as follows:

128 == Lambda 1 (14.7:1 ratio)

If you are using TunerPro, use the following conversion displayed as a floating point number: 1/(x/128)*14.7

Hope this helps!

PS I can confirm that indeed D0=LOAD, D5=RPM, D7=Temperature & D8=Battery Voltage
I dont have a clue what the others are for either!

May I recommend you download the TunerPro XDF for the American 413 ECU. It will give you a rough idea what to look for in your own map as I believe Bosch Motronic ECUs use similar map structures (including their order of appearance in memory).

Hope this helps
 

·
Registered
Joined
·
27 Posts
Discussion Starter · #19 ·
I had to try a few bin, but this work flawlessly with a dump from a german ecu. I'll try to mod the xdf to fit my bin (some offsets I guess).

Thank a million times !!!
 
1 - 20 of 22 Posts
This is an older thread, you may not receive a response, and could be reviving an old thread. Please consider creating a new thread.
Top