Hi,
this post is not "new", in fact it is 4 days old. I started it on an other board but nobody seem to be there : http://ecubb.bmwecu.org/board/viewtopic.php?t=2608
The DME is a Bosch 0 261 203 075
the car should be a euro spec E36 3.0L single vanos.
The file attached to the post should be renamed as a *.bin file to work fine
So in a first time, I'll put there all the informations I have at this moment, and I hope to going on with some of you for a common project.
Day 1
I had started to understand what's in the box and here so far what I've found in the DME chip (not the vanos box).
I think I've found some adresses but I'm not sure at this time :
7374 to 7380 : 12 steps
73A4 to 7463 : 192 steps (16*12 map ?)
761B to 76A5 : 96 steps (12*8 map ?)
7728 to 77E6 : 190 steps
7A7A to 7A7F : 6 steps
7B64 to 7B6B : 8 steps
7B7C to 7B80 : 4 steps
7DD4 to 7DDB : 8 steps
7E4D to 7E74 : 36 steps
So at this time I'm not very sure, I'll re check because I may have found new position and/or more steps in certain area.
On a side note when you put the file in ascii mode, you can see at this end of the file what it is but in reverse : 3.3 CINORTOM 03B05S
so does this mean that the whole file need to be 'reversed' to be more readable ?
Is this supposed to be a 8 or 16 bits file ?
DAY 2
I'm a bit lost in here.
I tried the demo of Winols, and the map finder report this :
6ECA : 8*7 (16 bit)
702C : 6*5 (8bit)
7096 : 8*6 (16 bit)
725F : 5*8 (8 bit)
73A4 : 12*16 (8bit)
749F : 7*6 (8 bit)
760E : 3*8 (8 bit)
764C : 6*16 (16 bit)
7728 : 12*16 (8 bit)
78DD : 7*12 (8 bit)
7956 : 4*6 (16 bit)
7A16 : 6*6 (8 bit)
Because all this is new to me, I needed some inspiration and found that the Porsche 944 and E30 scenes have lot of (lost ?) knowledge about Motronic DME.
http://www.motronic.ws/ have a lot of youseful hints.
If you go to the tab 'map table', you can see the author searching for map in between ff ff ff ff ff ff series.
So by simply applying this method, I found 20 to 25 areas (can't say if they are maps at this time). Some of them are huge (26.133 bytes) and other are very small (6 bytes).
DAY 3
Now here are those famous areas :
I don't know if it is ok with the board, but I post the base bin file (found on internet) that is available on those ebay dvd's full of bin.
So now I guess I need to know if it's a 8 or 16 bits application.
If try to divide the whole lenght areas by 8, this is what we get :
Assuming that maps from these times couldn't be widder/bigger than a 20*20 map, that give a length of 400 bytes.
So now, if I try to see what could be a map this is what we get (anything smaller than 400bytes):
So now I have something like 17 possible maps. The next step is to found what could be a label or a scale in each area.
Reading the ascii code I can tell that 7E20 is not a map, it look like a definition header and this is why I think that the file must be read... backward.
- how to make sure a map is a map ?
- how to found the formula conversion ? is it known ?
- what are the typical maps in a motronic of this generation ?
DAY 4
Ok, for what I have understood thru the different link/reading, is that the mcu is using the inputs/outputs in the code with some 'pointers'.
They seem to be D#, and just after the hex value converted to decimal give you the number of value you'll have on the x axis, then an other D# with and other value give you the y axis.
And they also say in the 413 thread that the maps are hold after address 7000.
Can all this be applied to the M3.3 075 ecu ? Well I hope so, this could lead me to the next step.
I finally managed to found several map using the method of motronic.ws, most of them are 2D or 3D maps and most of them match !!!
So I look for any sequences that is starting with D0.
When in a 2D scheme, it just hold scales and values like this
D0 0A xx xx xx xx xx xx xx xx xx xx ** ** ** ** ** ** ** ** ** **
So that mean :
D0 is a pointer
0A is the length, which is 10 in decimal mode
xx are the 10 scales
** are the 10 values.
When in a 3D scheme, it work like that
D0 06 xx xx xx xx xx xx D5 0C yy yy yy yy yy yy yy yy yy yy yy yy
********************************************************...
D0 is a pointer
06 is the length, which is 6 here
xx are the scales for D0
D5 is a second reference (the other axis)
0C is the length of D5, 12 in decimal
yy are the scales for D5
********* : are the value of the map . Now you're supposed to have 72 of them because you just found a 6*12 map.
I'm still watching for possible map inside the bin but the pointers that come the more often are :
D0, D5, D6, D7, D8.
Assuming D0 is rpm (because it is the most used but it could be map too !), what are the other pointers ?
Maps goes from 3*1 to 16*12 (got 3 of them actually) so what do you think ?
DAY 5 : today !
Starting @7000h, i have found something like 20 to 30 maps of each (2D & 3D) for a total of 50.
There must be some more, but I hope in all that i would have the minimum :
- idle fuel
- part throttle fuel
- part throttle ignition
- full throttle fuel
- full throttle ignition
If I understand the 'motronic way', idle and wot are often 2D maps and partial 3D.
What I'll need now is found speed & rpm limiters. It's very hard because it's just a value (for each) lost somewhere in the code, with a formula.
I'm actually trying to understand how to XDF in Tunerpro to show you some maps.
Any advice or help is welcome, as you can see I'm starting from scratch and don't have a clue about disassembling or hex editing... but I try !
this post is not "new", in fact it is 4 days old. I started it on an other board but nobody seem to be there : http://ecubb.bmwecu.org/board/viewtopic.php?t=2608
The DME is a Bosch 0 261 203 075
the car should be a euro spec E36 3.0L single vanos.
The file attached to the post should be renamed as a *.bin file to work fine
So in a first time, I'll put there all the informations I have at this moment, and I hope to going on with some of you for a common project.
Day 1
I had started to understand what's in the box and here so far what I've found in the DME chip (not the vanos box).
I think I've found some adresses but I'm not sure at this time :
7374 to 7380 : 12 steps
73A4 to 7463 : 192 steps (16*12 map ?)
761B to 76A5 : 96 steps (12*8 map ?)
7728 to 77E6 : 190 steps
7A7A to 7A7F : 6 steps
7B64 to 7B6B : 8 steps
7B7C to 7B80 : 4 steps
7DD4 to 7DDB : 8 steps
7E4D to 7E74 : 36 steps
So at this time I'm not very sure, I'll re check because I may have found new position and/or more steps in certain area.
On a side note when you put the file in ascii mode, you can see at this end of the file what it is but in reverse : 3.3 CINORTOM 03B05S
so does this mean that the whole file need to be 'reversed' to be more readable ?
Is this supposed to be a 8 or 16 bits file ?
DAY 2
I'm a bit lost in here.
I tried the demo of Winols, and the map finder report this :
6ECA : 8*7 (16 bit)
702C : 6*5 (8bit)
7096 : 8*6 (16 bit)
725F : 5*8 (8 bit)
73A4 : 12*16 (8bit)
749F : 7*6 (8 bit)
760E : 3*8 (8 bit)
764C : 6*16 (16 bit)
7728 : 12*16 (8 bit)
78DD : 7*12 (8 bit)
7956 : 4*6 (16 bit)
7A16 : 6*6 (8 bit)
Because all this is new to me, I needed some inspiration and found that the Porsche 944 and E30 scenes have lot of (lost ?) knowledge about Motronic DME.
http://www.motronic.ws/ have a lot of youseful hints.
If you go to the tab 'map table', you can see the author searching for map in between ff ff ff ff ff ff series.
So by simply applying this method, I found 20 to 25 areas (can't say if they are maps at this time). Some of them are huge (26.133 bytes) and other are very small (6 bytes).
DAY 3
Now here are those famous areas :
Code:
Adress (hex) / lenght (bytes)
0000 / 119
0084 / 276
01A4 / 429
035C / 68
03A8 / 26
03C7 / 26133
6ABD / 133
6B58 / 68
6BA4 / 122
6C28 / 22
6C60 / 80
6CBA / 22
6CF2 / 758
6FFA / 562
7232 / 885
75B2 / 888
792E / 75
7985 / 649
7C18 / 446
7E20 / 85
7FC9 / 31
7FFA / 6So now I guess I need to know if it's a 8 or 16 bits application.
If try to divide the whole lenght areas by 8, this is what we get :
Code:
Adress (hex) / lenght (bytes) / 8bits base
0000 / 119 / (14*8)+7
0084 / 276 / (34*8)+4
01A4 / 429 / (53*8)+5
035C / 68 / (8*8)+4
03A8 / 26 / (3*8)+2
03C7 / 26133 / too huge to be a table imo
6ABD / 133 / (16*8)+5
6B58 / 68 / (8*8)+4
6BA4 / 122 / (15*8)+2
6C28 / 22 / (2*8)+6
6C60 / 80 / (10*8)
6CBA / 22 / (2*8)+6
6CF2 / 758 / (94*8)+6
6FFA / 562 / (70*8)+2
7232 / 885 / (110*8)+5
75B2 / 888 / 111
792E / 75 / (9*8)+3
7985 / 649 / (81*8)+1
7C18 / 446 / (55*8)+6
7E20 / 85 / (10*8)+5
7FC9 / 31 / (3*8)+7
7FFA / 6 / too shortSo now, if I try to see what could be a map this is what we get (anything smaller than 400bytes):
Code:
Adress (hex) / lenght (bytes) / possible map size
0000 / 119 / 15*8 or 12*10
0084 / 276 / 17*16
01A4 / 429 / 27*16 or 2 maps of 13*16
035C / 68 / 8*8 or 9*8
03A8 / 26 / 3*8 or 13*2
6ABD / 133 / 16*8
6B58 / 68 / 8*8
6BA4 / 122 / 15*8 or 12*10
6C28 / 22 / 2*8 or 16*1
6C60 / 80 / 10*8
6CBA / 22 / 2*8 or 16*1
792E / 75 / 9*8
7985 / 649 / too big
7C18 / 446 / 27*16 something wrong there
7E20 / 85 / 10*8 or 11*8
7FC9 / 31 / 4*8 or 2*16
7FFA / 6 / too short (limiter ??? : speed or rpm)Reading the ascii code I can tell that 7E20 is not a map, it look like a definition header and this is why I think that the file must be read... backward.
I'm slowly approaching my limits (if not almost reached or overruled), so if anyone have some hints or inputs on all this, please let me know.
- how to make sure a map is a map ?
- how to found the formula conversion ? is it known ?
- what are the typical maps in a motronic of this generation ?
DAY 4
Ok, for what I have understood thru the different link/reading, is that the mcu is using the inputs/outputs in the code with some 'pointers'.
They seem to be D#, and just after the hex value converted to decimal give you the number of value you'll have on the x axis, then an other D# with and other value give you the y axis.
And they also say in the 413 thread that the maps are hold after address 7000.
Can all this be applied to the M3.3 075 ecu ? Well I hope so, this could lead me to the next step.
I finally managed to found several map using the method of motronic.ws, most of them are 2D or 3D maps and most of them match !!!
So I look for any sequences that is starting with D0.
When in a 2D scheme, it just hold scales and values like this
D0 0A xx xx xx xx xx xx xx xx xx xx ** ** ** ** ** ** ** ** ** **
So that mean :
D0 is a pointer
0A is the length, which is 10 in decimal mode
xx are the 10 scales
** are the 10 values.
When in a 3D scheme, it work like that
D0 06 xx xx xx xx xx xx D5 0C yy yy yy yy yy yy yy yy yy yy yy yy
********************************************************...
D0 is a pointer
06 is the length, which is 6 here
xx are the scales for D0
D5 is a second reference (the other axis)
0C is the length of D5, 12 in decimal
yy are the scales for D5
********* : are the value of the map . Now you're supposed to have 72 of them because you just found a 6*12 map.
I'm still watching for possible map inside the bin but the pointers that come the more often are :
D0, D5, D6, D7, D8.
Assuming D0 is rpm (because it is the most used but it could be map too !), what are the other pointers ?
Maps goes from 3*1 to 16*12 (got 3 of them actually) so what do you think ?
DAY 5 : today !
Starting @7000h, i have found something like 20 to 30 maps of each (2D & 3D) for a total of 50.
There must be some more, but I hope in all that i would have the minimum :
- idle fuel
- part throttle fuel
- part throttle ignition
- full throttle fuel
- full throttle ignition
If I understand the 'motronic way', idle and wot are often 2D maps and partial 3D.
What I'll need now is found speed & rpm limiters. It's very hard because it's just a value (for each) lost somewhere in the code, with a formula.
I'm actually trying to understand how to XDF in Tunerpro to show you some maps.
Any advice or help is welcome, as you can see I'm starting from scratch and don't have a clue about disassembling or hex editing... but I try !
