[rjahl]

Originally Posted by hassmaschine

the maps are 3D. but the part load fuel is all lambda 1.0. There's no reason at all to mess with this map.

I'm sure I posted the ignition maps and full load fuel before in this thread. But it's going to look different depending on what tune you have - 325 vs 328 vs 330i.

You posted the lambda maps on page 5.

[roflmao]

Good day guys. I know, that it is e90 forum, but i have a problem with e60 and i believe i can find a solution here. The problem is with msv70, can anybody help me to change oulcoding to wert 2? I have dimps from my DME. I know, that i need to reset "operating time" or change one byte in bin file, but i can't find it. Can anybody help me?

[hassmaschine]

It's not really possible, and it isn't necessary anyway. the powerclass isn't stored on the DME, and I don't know how you change it or which module it gets it from.

The DME reads the vehicle powerclass value over CAN, which is sent by another module; there's no setting inside the DME you can change. It compares the vehicle power class with the power class byte stored in the DME, and if they don't match it runs in limp mode. Fortunately the work around is easy.

The simplest way is to take the tune for the 330i that you want to flash, Change the power class byte from 02 to 00 (which matches your car), and change the software number to match the one on your original tune (the program number must match, should be 049PP921S, the software number is after that). The easiest way to do this is with BDM at the moment.

[Terraphantm]

Originally Posted by hassmaschine

It's not really possible, and it isn't necessary anyway. the powerclass isn't stored on the DME, and I don't know how you change it or which module it gets it from.

The DME reads the vehicle powerclass value over CAN, which is sent by another module; there's no setting inside the DME you can change. It compares the vehicle power class with the power class byte stored in the DME, and if they don't match it runs in limp mode. Fortunately the work around is easy.

The simplest way is to take the tune for the 330i that you want to flash, Change the power class byte from 02 to 00 (which matches your car), and change the software number to match the one on your original tune (the program number must match, should be 049PP921S, the software number is after that). The easiest way to do this is with BDM at the moment.

Chris, I'm still not convinced about the power class being obtained over CAN. The non-BN2000 cars (namely the E85) don't have any modules that would store that information, and they still verify the power class. I think serial EEPROM is the most likely candidate. NCS Expert seems to have the capability to write the power-class *IF* the DME is virginal (stat_bz_wert or whatever it's called = 0)

Have you ever written a full dump from a 325i DME to a 330 DME or vice versa (or 525/530, etc)? What does the DME report as the power class?

[roflmao]

Thank for you reply! The car is already flashed and as you say it runs in limp mode. If i look in dme coding via NCSEXPERT (msv70) i can see, that oulcoding is wert 0 (low power class) and i need wert 2 ( high power class). So, now i have an error in ISTA P (wrong coding).Can you tell me, where is the power class byte, that i should change? Thanks in advance!

[hassmaschine]

Originally Posted by Terraphantm

Chris, I'm still not convinced about the power class being obtained over CAN. The non-BN2000 cars (namely the E85) don't have any modules that would store that information, and they still verify the power class. I think serial EEPROM is the most likely candidate. NCS Expert seems to have the capability to write the power-class *IF* the DME is virginal (stat_bz_wert or whatever it's called = 0)

Have you ever written a full dump from a 325i DME to a 330 DME or vice versa (or 525/530, etc)? What does the DME report as the power class?

Maybe on the non-BN2000 cars it works differently, but it definitely references "power class received via CAN" in the assembly.

I would have to pull a RAM dump after cloning a DME, because the power class byte is tested against a value stored in RAM (which, as far as I can tell, is determined via CAN on the BN2000 cars). I don't think it will change until it connects to the car.

it is possible of course to write software that will reset the "stat_bz_wert" (I think that's close), but there's literally no point when you can just change the byte in the tune file to match what the DME is expecting.

The serial EEPROM is still problematic. But I'm not convinced any adaptations are stored there. I have actually tested it by zeroing out the entire thing, and none of the learned variants were affected.

[hassmaschine]

Originally Posted by roflmao

Thank for you reply! The car is already flashed and as you say it runs in limp mode. If i look in dme coding via NCSEXPERT (msv70) i can see, that oulcoding is wert 0 (low power class) and i need wert 2 ( high power class). So, now i have an error in ISTA P (wrong coding).Can you tell me, where is the power class byte, that i should change? Thanks in advance!

if your software number is current (049PP921S), then the power class byte is 0x44D50. Change it from 02 to 00 and it will work perfectly.

[Terraphantm]

Originally Posted by hassmaschine

Maybe on the non-BN2000 cars it works differently, but it definitely references "power class received via CAN" in the assembly.

I would have to pull a RAM dump after cloning a DME, because the power class byte is tested against a value stored in RAM (which, as far as I can tell, is determined via CAN on the BN2000 cars). I don't think it will change until it connects to the car.

it is possible of course to write software that will reset the "stat_bz_wert" (I think that's close), but there's literally no point when you can just change the byte in the tune file to match what the DME is expecting.

The serial EEPROM is still problematic. But I'm not convinced any adaptations are stored there. I have actually tested it by zeroing out the entire thing, and none of the learned variants were affected.

Just took a look at the code. Looks like BN2000 cars have an extra step of verification.

Non-BN2000 cars compare the value in the parameter space with a value in RAM (pow_conf_idx_ext_req), which is "power class via tester". I suspect "tester" in this case refers to what NCS can set. Where that value is retrieved from and loaded into RAM, I'm not sure. I'd investigate further, but I really should be studying for my anatomy final

BN2000 cars do the above comparison *and* a comparison that's received over CAN (CAN comparison is actually done first, but same difference)

[roflmao]

Originally Posted by hassmaschine

if your software number is current (049PP921S), then the power class byte is 0x44D50. Change it from 02 to 00 and it will work perfectly.

Now i have a dump from EEPROM (95320). As i know power klass byte is there. Or i need a full dump? Can kess v2 make this dump? The software number is 049PP0L921S.

[Terraphantm]

Originally Posted by roflmao

Now i have a dump from EEPROM (95320). As i know power klass byte is there. Or i need a full dump? Can kess v2 make this dump? The software number is 049PP0L921S.

Forget the 95320. Dump the parameter space ("tune") and change the byte hass mentioned. Correct checksums and flash back

[roflmao]

Thank you! Sorry for my stupid questions. Can kess read and write parameter space? (if you know of course). And sorry please, but 0x44D50 is the string in hex redactor? Sorry for my stupid question again

[dstrickland]

Originally Posted by roflmao

Now i have a dump from EEPROM (95320). As i know power klass byte is there. Or i need a full dump? Can kess v2 make this dump? The software number is 049PP0L921S.

We used a Kess v2 to do my 325/330 conversion. As Hassmachine said, flash the 330/530 software with winkfp, use kess v2 to read the entire file, open the bin & change the powerclass from 02 to 00. Then upload the new modified file.

[hassmaschine]

Originally Posted by roflmao

Thank you! Sorry for my stupid questions. Can kess read and write parameter space? (if you know of course). And sorry please, but 0x44D50 is the string in hex redactor? Sorry for my stupid question again

0x44D50 is the offset (or address). Yes, Kess can write to the parameter space. You can use a hex editor to find the address and change the byte (the value will be 02, change it to 00).

[roflmao]

Thank you very much! God bless you, guys

[rjahl]

Originally Posted by hassmaschine

Maybe on the non-BN2000 cars it works differently, but it definitely references "power class received via CAN" in the assembly.

I would have to pull a RAM dump after cloning a DME, because the power class byte is tested against a value stored in RAM (which, as far as I can tell, is determined via CAN on the BN2000 cars). I don't think it will change until it connects to the car.

it is possible of course to write software that will reset the "stat_bz_wert" (I think that's close), but there's literally no point when you can just change the byte in the tune file to match what the DME is expecting.

The serial EEPROM is still problematic. But I'm not convinced any adaptations are stored there. I have actually tested it by zeroing out the entire thing, and none of the learned variants were affected.

I can confirm this. I took a full read of all three chips, ECU, flash and EEPROM then reset adaptions took another full read and compared the three files again and nothing changed. Adaptions must be stored some where else.

[hassmaschine]

They are save in ram. A portion of it is non volatile and doesn't get erased if you remove power.

[Terraphantm]

Originally Posted by hassmaschine

They are save in ram. A portion of it is non volatile and doesn't get erased if you remove power.

Must be an external chip that the BDM doesn't dump then; MPC5xx datasheets don't mention anything about non-volatile memory.

[hassmaschine]

Are you sure? I specifically remember reading that a portion of it was. Anyway, I'm not neccesarily convinced the EEPROM doesn't play a role. We just don't know where it really fits, or how the cpu reads and writes to it.

On MSV70, there's a bunch of references to data at 0x180000 (all of them are mapped in MSS70 disassembly, many in MSV70). Unfortunately it doesn't seem to line up at all with the data in the EEPROM (some of which i have mapped out seperately - IBS data is stored there for sure).

Also, there are no references to a data section like that in MS45, which has the same EEPROM...

[roflmao]

Hello guys! Today i tried to change the byte in "tune" section of my dme. There was 02, changet to 00, but no effect at all. Is there any way to reset "run time" (operating minutes) in my dme (to get stat_bsz_wert 0)?

[hassmaschine]

Did you change the correct byte? It will work. You don't need to reset the runtime. I've done this several times on different cars.

if you have your binary, PM me your email and I can look at it.

[roflmao]

I will send it to you tomorrow, thank you! The entire string was like on dstrickland's picture. I changed 02 to 00. I already changed the model number from ne53 to ne73 and coded the entire car via ista P. But nothing worked.

[hassmaschine]

Is the model number NE53 the 525i, and NE73 the 530i?

that could be your problem. It's not necessary to change anything on the car. The DME has no idea that the tune is from a 530i - that's why we change the power class byte to match the car, instead of the other way around.

That byte is the only thing the DME is looking at, so it's possible changing the model number is now making it fault because now the car doesn't match the DME.

again, the only necessary change for using a 530i/330i file (higher power class) on 525/325i car is the power class byte. Nothing else needs to be changed.