I cloned my MSV70 DME

Bob@BPC · 01-05-2016, 05:44 PM

Quote:

Originally Posted by Nicholas Bentley

Thanks for the info Bob. Mine is a 10-28-2010 production date 2011 model.

Its going to have the MEVD17.x, If you want to tune your ride on your own, i'd contact Cobb. There isn't a good cheap clone tool for the MEVD DME's and the stuff we have at the shop costs $$$$$

Nicholas Bentley · 01-05-2016, 08:19 PM

10-4. Thanks again!

Terraphantm · 01-06-2016, 10:01 PM

Chris, did you ever figure out the checksum on the MSV70?

I've been playing around the MS45 and it seems to be similar -- MPC555 CPU, and the checksum appears to be a CRC32 at the beginning of the data section with the checked region spelled out cleanly. Standard polynomial and starting value don't work though. Using WinOLS to correct it for now, but would be nice if I could whip up a quick program to calculate it.

Also how has the disassembly been going for you? 68k code is so much easier to read.

hassmaschine · 01-07-2016, 08:04 AM

no I have not. BDM100 automatically corrects checksums anyway - it just would be nice to be able to do it if I want to share files with other people, so I can fix the checksum first.

I haven't worked on disassembly in a while. I was stuck on the memory layout, I think I figured that out but I haven't gone back yet. yeah, PPC instructions are tough to read for sure, and there's so much more code on these newer DMEs it makes MSS54 seem quaint.

Are you working on disassembling MS45? Does it use a PPC cpu as well?

Terraphantm · 01-08-2016, 11:35 PM

Quote:

Originally Posted by hassmaschine

Are you working on disassembling MS45? Does it use a PPC cpu as well?

"Working" is a strong word, but it is an interest. It's an MPC555 CPU. 448K internal flash, 1M external flash, and a 1K serial EEPROM. "Program" is split between the internal flash and external flash, "data" and some unidentified code is on the external flash, along with individual data like ISN and AIF. No idea what's on the serial EEPROM.

hassmaschine · 01-09-2016, 10:52 AM

Sounds like it is similar to MSV70. it has a similar memory arrangement, but it's an MPC563 CPU - the same one used on MSS70, MSS60 and MSS65. As I've said before, MSV70 and MSS70 are about 90% identical. I think there's somebody working on an MSS65 disassembly but they aren't very responsive (can't blame them really).

on MSS70 and MSV70, I believe the boot code is on the internal flash. the data and main program is on the external flash. The serial EEPROM is 4kb and I believe it houses the ISN, it also has some other data like the VIN and production date. It appears to store the data for error codes, adaptations, and other things that get written periodically (it definitely has the mileage counter). the AIF is stored on the external flash.

The difficulty with the MPC563 is the address registers for the different memory segments are programmable. For example, the data area starts at 0x40000 on the external flash and the program at approximately 0x80000. But the registers are programmed with a different address, so in code it's actually something like 0x840000 and 0x880000. I didn't figure that out until I had nearly given up, but I haven't tried it again either.. I don't know if MPC555 does the same thing but just as a point of reference. I clued in on it because WinOLS lists all the addresses starting at 0x8XXXXX (I had also read the tech doc, and knew it was programmable - but had no guess as to what it was programmed to).

You're a lot more experienced in IDA than I am (although I did find it a lot more intuitive the second time around than I did with MSS54), but maybe there are some things we could do to make it easier. there was that script somebody wrote that defined the major memory areas on MSS54, which made it easier - I have no such thing for MSV70. It would be great to write a script for an MPC CPU that could define which is data and which is program instead of having to go through line by line. the MSV70 program area is like 4x the size of MSS54.

The one thing that does make it easier are the fixed length instructions, it's usually pretty obvious just looking at it which is data and what is not. It's like The Matrix, lol. I don't see code anymore.. I see blonde, redhead, brunette..

And some point I had a list of different PPC instructions and what bytes they started with.. I even had some memorized. It's not impossible, it would just consume a lot of time, and I wasn't getting anywhere so I stopped.

rjahl · 01-10-2016, 10:43 AM

OK Hass I just changed the bytes in the calibration file that controls the torque reduction during a gearshift. Holy SH#t, what a difference. Car acts likes one of the toy cars from my teen age years. Acceleration during the up-shift, instead of the eternal wait.

I'm going to be easy with it for a while to see how or if the transmission adapts. I'm not all that confident that the ZF6HP19 can handle full torque during gearshifts. If the clutches take too long to engage I think the heat build up will kill them.

At least we know that the reduction can be turned off without throwing a fault.

Mike. · 01-10-2016, 10:55 AM

Quote:

Originally Posted by rjahl

OK Hass I just changed the bytes in the calibration file that controls the torque reduction during a gearshift. Holy SH#t, what a difference. Car acts likes one of the toy cars from my teen age years. Acceleration during the up-shift, instead of the eternal wait.

I'm going to be easy with it for a while to see how or if the transmission adapts. I'm not all that confident that the ZF6HP19 can handle full torque during gearshifts. If the clutches take too long to engage I think the heat build up will kill them.

At least we know that the reduction can be turned off without throwing a fault.

break through

hassmaschine · 01-10-2016, 12:59 PM

Quote:

Originally Posted by rjahl

OK Hass I just changed the bytes in the calibration file that controls the torque reduction during a gearshift. Holy SH#t, what a difference. Car acts likes one of the toy cars from my teen age years. Acceleration during the up-shift, instead of the eternal wait.

I'm going to be easy with it for a while to see how or if the transmission adapts. I'm not all that confident that the ZF6HP19 can handle full torque during gearshifts. If the clutches take too long to engage I think the heat build up will kill them.

At least we know that the reduction can be turned off without throwing a fault.

it's actually better if it shifts faster. it slips the clutches less. not sure if that parameter changes that or not. people just like slow, smooth shifts.

rjahl · 01-25-2016, 07:28 PM

Not sure that I did but I fried the EEPROM in my spare DME. I was goofing around running INPA on the bench and subsequently the unit would not work in the car.

Turned out to be an easy fix. Soldered in a new chip and a a quick re-flash and it was back to business.

The EEPROM is dirt cheap and is only a few pins to solder. Just wish I new what killed it.

hassmaschine · 01-25-2016, 09:41 PM

Which one? The 4kb chip?

That is odd. I didn't fry it, but my spare dme was freaking out. I swapped them and the spare is working fine on the bench. I'm thinking my bdm adapter was shorting out.

rjahl · 01-26-2016, 06:02 AM

Quote:

Originally Posted by hassmaschine

Which one? The 4kb chip?

That is odd. I didn't fry it, but my spare dme was freaking out. I swapped them and the spare is working fine on the bench. I'm thinking my bdm adapter was shorting out.

Yes, it was the 4kb chip.

the DME would run on the bench but their was one special error stored along with all of the other errors regarding the DME not being connected to the car. EEPROM checksum not correct!

The other clue was my BDM rig would not recognize the EEPROM. I normally have the option to read or write to any or all of the three memory chips External Flash, Micro and EEPROM. As I don't normally re flash the EEPROM it took me a while to realize the EEPROM options was grayed out.

Mike. · 01-26-2016, 06:49 AM

How is the new torque limiter reduction doing

rjahl · 01-26-2016, 09:07 AM

Quote:

Originally Posted by Mike.

How is the new torque limiter reduction doing

The blown EEPROM chip derailed me for a little while. I'm still running with the torque limit deactivated and it's pretty nice for about 80% of the shifts. There are times when the shift is just too hard, mostly loaded downshifts, needs rev matching.

I reset the adaptions on the transmission and it is better, probably just faster and harder everywhere. This was the first time that resetting the transmission adaptions actually made a noticeable difference. It's also the first time that I reset the adaptions on a hot transmission, like the ZF instructions.

My plan going forward is to test the other values for the DME torque reduction. Standard was 3, I'm running at 2 but I would like to know what happens with a value of 1 or 0.

Next, I'll try going back to the stock and messing with the time limit for the torque reduction. Stock is something like 998 seconds, I'd like to try something like 100-200 milliseconds. Just a short blip to help the transmission through the initial phase of the shift. Maybe I can find a good balance between the settings.

The best solution is a new transmission flash but no one knows how to do that, Yet.

332ijunkie · 01-26-2016, 09:29 AM

Great to hear

maf330xi · 02-03-2016, 11:04 AM

I honestly have no idea of all the work you've put into this but just wanted to say great job posting it here and helping the community. Subscribed; I'm curious as to what comes out of this as someone who just wants to improve the drivability of the N52.

rjahl · 02-10-2016, 06:05 AM

Hass,

I filled the eccentric map that I found with with 179s and the engine pulls full load all the way to the shift point. Recommend testing this one! You will see more improvement than me, Dammed Auto shifts just a little too early.

This was definitively a soft limiter in the Factory Tune.

I'll post a log later today or tonight if I get home at a reasonable hour.

I'm getting pretty happy with the transmission torque reduction. limiting the torque reduction to 125 milliseconds is about right. It's still a little rough at times but I think that in the tune itself and can be worked out. I'm being picky.

What as difference this all makes, No more long "pregnant" pause at the full load shifts.

hassmaschine · 02-10-2016, 07:52 AM

Awesome! I'll have to pull the dme to flash it, but thats not too hard. Can't wait to try it!

hassmaschine · 02-10-2016, 09:44 AM

yeah it looks like that 160 degree setting limits the lift to about 9mm. Here's the curve for lift vs the eccentric shaft angle:

This curve would also have to be tuned for an aftermarket cam with more lift. as you can see, it's not linear - I think you would have to measure actual lift at the valve, including any lifter/shim clearance, while rotating the eccentric shaft. Maybe not so easy to get that right..

hassmaschine · 02-10-2016, 09:47 AM

BTW, I should try logging that trans torque reduction and see if it does anything with an MT..

One of the other pieces of this puzzle I've been missing is the cat overheat protection maps. They dump fuel to protect the cats at high RPM - terrible for power. Of course there's a trade off (who knows if the cats would actually have a problem - I don't drive at WOT all that often) but it would be interesting to see what all of this adds up to.

hassmaschine · 02-10-2016, 11:45 AM

yeah I need to dig up that parameter. Haven't been working much on MSV70. Trying to clear my plate of "other people's projects" so I can focus on my N52, but I always seem to end up with more, lol.

rjahl · 02-10-2016, 11:46 AM

Quote:

Originally Posted by hassmaschine

BTW, I should try logging that trans torque reduction and see if it does anything with an MT..

One of the other pieces of this puzzle I've been missing is the cat overheat protection maps. They dump fuel to protect the cats at high RPM - terrible for power. Of course there's a trade off (who knows if the cats would actually have a problem - I don't drive at WOT all that often) but it would be interesting to see what all of this adds up to.

Great chart, should have known you would have something like this.

Here is a very quick graph of today's run. You can see the VVL stays unchanged all the way to 6,900 RPM. I've got data through two gears that show the the shift, but I need to sort out how I will show it.

Interesting, I've logged actual eccentric values maxing at 172 degrees with the reported set point being 175 degrees. I was thinking the difference was simply adaptation adjustments, know I rethinking that assumption. I wonder if we have missed something in the tune that is keeping us limited to the 9.7 MM lift.

01-05-2016, 08:19 PM	#508
Nicholas Bentley Private 22 Rep 67 Posts Drives: 2011 BMW 335i E90 LCI N55 Join Date: Jan 2016 Location: Atlanta, GA iTrader: (0)	10-4. Thanks again!
	Appreciate 0 Quote

01-06-2016, 10:01 PM	#509
Terraphantm Captain 253 Rep 775 Posts Drives: E46 M3 Coupe Join Date: Apr 2009 Location: N/A iTrader: (1)	Chris, did you ever figure out the checksum on the MSV70? I've been playing around the MS45 and it seems to be similar -- MPC555 CPU, and the checksum appears to be a CRC32 at the beginning of the data section with the checked region spelled out cleanly. Standard polynomial and starting value don't work though. Using WinOLS to correct it for now, but would be nice if I could whip up a quick program to calculate it. Also how has the disassembly been going for you? 68k code is so much easier to read.
	Appreciate 0 Quote

01-07-2016, 08:04 AM	#510
hassmaschine Major General 3975 Rep 7,215 Posts Drives: "NBO" 330i Join Date: Jun 2014 Location: earth iTrader: (0)	no I have not. BDM100 automatically corrects checksums anyway - it just would be nice to be able to do it if I want to share files with other people, so I can fix the checksum first. I haven't worked on disassembly in a while. I was stuck on the memory layout, I think I figured that out but I haven't gone back yet. yeah, PPC instructions are tough to read for sure, and there's so much more code on these newer DMEs it makes MSS54 seem quaint. Are you working on disassembling MS45? Does it use a PPC cpu as well?
	Appreciate 0 Quote

01-09-2016, 10:52 AM	#512
hassmaschine Major General 3975 Rep 7,215 Posts Drives: "NBO" 330i Join Date: Jun 2014 Location: earth iTrader: (0)	Sounds like it is similar to MSV70. it has a similar memory arrangement, but it's an MPC563 CPU - the same one used on MSS70, MSS60 and MSS65. As I've said before, MSV70 and MSS70 are about 90% identical. I think there's somebody working on an MSS65 disassembly but they aren't very responsive (can't blame them really). on MSS70 and MSV70, I believe the boot code is on the internal flash. the data and main program is on the external flash. The serial EEPROM is 4kb and I believe it houses the ISN, it also has some other data like the VIN and production date. It appears to store the data for error codes, adaptations, and other things that get written periodically (it definitely has the mileage counter). the AIF is stored on the external flash. The difficulty with the MPC563 is the address registers for the different memory segments are programmable. For example, the data area starts at 0x40000 on the external flash and the program at approximately 0x80000. But the registers are programmed with a different address, so in code it's actually something like 0x840000 and 0x880000. I didn't figure that out until I had nearly given up, but I haven't tried it again either.. I don't know if MPC555 does the same thing but just as a point of reference. I clued in on it because WinOLS lists all the addresses starting at 0x8XXXXX (I had also read the tech doc, and knew it was programmable - but had no guess as to what it was programmed to). You're a lot more experienced in IDA than I am (although I did find it a lot more intuitive the second time around than I did with MSS54), but maybe there are some things we could do to make it easier. there was that script somebody wrote that defined the major memory areas on MSS54, which made it easier - I have no such thing for MSV70. It would be great to write a script for an MPC CPU that could define which is data and which is program instead of having to go through line by line. the MSV70 program area is like 4x the size of MSS54. The one thing that does make it easier are the fixed length instructions, it's usually pretty obvious just looking at it which is data and what is not. It's like The Matrix, lol. I don't see code anymore.. I see blonde, redhead, brunette.. And some point I had a list of different PPC instructions and what bytes they started with.. I even had some memorized. It's not impossible, it would just consume a lot of time, and I wasn't getting anywhere so I stopped.
	Appreciate 0 Quote

01-10-2016, 10:43 AM	#513
rjahl Colonel 998 Rep 2,287 Posts Drives: Z4 35is Join Date: Jun 2011 Location: Tampa iTrader: (0) Garage List 2012 Z4 35is [0.00]	OK Hass I just changed the bytes in the calibration file that controls the torque reduction during a gearshift. Holy SH#t, what a difference. Car acts likes one of the toy cars from my teen age years. Acceleration during the up-shift, instead of the eternal wait. I'm going to be easy with it for a while to see how or if the transmission adapts. I'm not all that confident that the ZF6HP19 can handle full torque during gearshifts. If the clutches take too long to engage I think the heat build up will kill them. At least we know that the reduction can be turned off without throwing a fault.
	Appreciate 1 Pinscher113.50 Quote

01-25-2016, 07:28 PM	#516
rjahl Colonel 998 Rep 2,287 Posts Drives: Z4 35is Join Date: Jun 2011 Location: Tampa iTrader: (0) Garage List 2012 Z4 35is [0.00]	Not sure that I did but I fried the EEPROM in my spare DME. I was goofing around running INPA on the bench and subsequently the unit would not work in the car. Turned out to be an easy fix. Soldered in a new chip and a a quick re-flash and it was back to business. The EEPROM is dirt cheap and is only a few pins to solder. Just wish I new what killed it.
	Appreciate 0 Quote

01-25-2016, 09:41 PM	#517
hassmaschine Major General 3975 Rep 7,215 Posts Drives: "NBO" 330i Join Date: Jun 2014 Location: earth iTrader: (0)	Which one? The 4kb chip? That is odd. I didn't fry it, but my spare dme was freaking out. I swapped them and the spare is working fine on the bench. I'm thinking my bdm adapter was shorting out.
	Appreciate 0 Quote

01-26-2016, 06:49 AM	#519
Mike. Mike: Everyone's Pal 2046 Rep 2,972 Posts Drives: F80 M3 Join Date: May 2013 Location: Eastern Long Island iTrader: (5) Garage List 2013 BMW 335xi [10.00]	How is the new torque limiter reduction doing __________________ [CENTER] 2021 6.2L Trail Boss, 6" BDS lift, Chevy Performance intake, 35" Nitto Grapplers, 20" Fuel wheels
	Appreciate 0 Quote

01-26-2016, 09:29 AM	#521
332ijunkie 65 Rep 174 Posts Drives: 08 335i, 87 M52 E30, M52 E36 Join Date: Jul 2013 Location: Atlanta GA iTrader: (0)	Great to hear
	Appreciate 0 Quote

02-03-2016, 11:04 AM	#522
maf330xi First Lieutenant 41 Rep 385 Posts Drives: 06 BMW 330xi Join Date: Sep 2010 Location: Toronto iTrader: (2)	I honestly have no idea of all the work you've put into this but just wanted to say great job posting it here and helping the community. Subscribed; I'm curious as to what comes out of this as someone who just wants to improve the drivability of the N52. __________________ Blacklines \| 19" Morr VS8.2 \| Gloss Black Grilles \| PE \| M-Tech \| KW V1 \| Euro Spec Headlights
	Appreciate 0 Quote

02-10-2016, 06:05 AM	#523
rjahl Colonel 998 Rep 2,287 Posts Drives: Z4 35is Join Date: Jun 2011 Location: Tampa iTrader: (0) Garage List 2012 Z4 35is [0.00]	Soft Limiter Hass, I filled the eccentric map that I found with with 179s and the engine pulls full load all the way to the shift point. Recommend testing this one! You will see more improvement than me, Dammed Auto shifts just a little too early. This was definitively a soft limiter in the Factory Tune. I'll post a log later today or tonight if I get home at a reasonable hour. I'm getting pretty happy with the transmission torque reduction. limiting the torque reduction to 125 milliseconds is about right. It's still a little rough at times but I think that in the tune itself and can be worked out. I'm being picky. What as difference this all makes, No more long "pregnant" pause at the full load shifts.
	Appreciate 1 Quote

02-10-2016, 07:52 AM	#524
hassmaschine Major General 3975 Rep 7,215 Posts Drives: "NBO" 330i Join Date: Jun 2014 Location: earth iTrader: (0)	Awesome! I'll have to pull the dme to flash it, but thats not too hard. Can't wait to try it!
	Appreciate 0 Quote

02-10-2016, 09:44 AM	#525
hassmaschine Major General 3975 Rep 7,215 Posts Drives: "NBO" 330i Join Date: Jun 2014 Location: earth iTrader: (0)	yeah it looks like that 160 degree setting limits the lift to about 9mm. Here's the curve for lift vs the eccentric shaft angle: This curve would also have to be tuned for an aftermarket cam with more lift. as you can see, it's not linear - I think you would have to measure actual lift at the valve, including any lifter/shim clearance, while rotating the eccentric shaft. Maybe not so easy to get that right..
	Appreciate 0 Quote

02-10-2016, 09:47 AM	#526
hassmaschine Major General 3975 Rep 7,215 Posts Drives: "NBO" 330i Join Date: Jun 2014 Location: earth iTrader: (0)	BTW, I should try logging that trans torque reduction and see if it does anything with an MT.. One of the other pieces of this puzzle I've been missing is the cat overheat protection maps. They dump fuel to protect the cats at high RPM - terrible for power. Of course there's a trade off (who knows if the cats would actually have a problem - I don't drive at WOT all that often) but it would be interesting to see what all of this adds up to.
	Appreciate 0 Quote

02-10-2016, 11:45 AM	#527
hassmaschine Major General 3975 Rep 7,215 Posts Drives: "NBO" 330i Join Date: Jun 2014 Location: earth iTrader: (0)	yeah I need to dig up that parameter. Haven't been working much on MSV70. Trying to clear my plate of "other people's projects" so I can focus on my N52, but I always seem to end up with more, lol.
	Appreciate 0 Quote