[rjahl]

So, while reading about the Rev Matching features that are possible I figured I should look into how that might actually work on my car.

I have logged some interesting Torque management values under low and negative torque, ie gear shifts when the car is being pushed or slowing down.

This data log shows an interesting "blip" in the torque just before a downshift. Yellow line, circled in blue. Notice the torque raises but the pedal value remains the same. Then, once the Rate of RPM (White Line) increase drops the torque value drops again.

The red line is the normal CAN based instruction from the TCU to cut torque for the gear shift. In this case, It seems to come into play near the end of the gear shift.

Also The values from the Stat_drehmomentabfall Biem Gahgwechsel Wert are slightly higher than the reported engine torque this matches our theory that the TCU can issue a REV Match instruction based upon a torque table. The problem in this case, is it's very late.


Attached is also a torque limit map from the the TCU for a down shift. X axis is RPM while Y is Motor Torque

Could there be another CAN request from the TCU asking for a torque increase? or is the torque increase simply a function of the DME managing engine output with the increase in RPMs

[DWR]

Originally Posted by rjahl

If I have the 8x10 shift pressure maps correct there is an 8x8 map between each of them. The shift pressure maps Schaltdruck seem to follow the public Xhp 8x10 maps pretty well with Torque on one axes and RPMs on the other. Values and layouts look about right. But the 8x8 map between each one has me a little mystified. Anyone have any ideas? The values look like they should follow shift time in milliseconds.

Each upshift or downshift has 2 clutches involved. The public maps are for the oncoming clutch. The pressure profiles for the off going clutches look different.

[rjahl]

Update:

I have made more progress towards tightening the shifts. Over the week end I had some mid torque shifts in the 350-400 ms range while the full load shifts were much slower. The strange part of the slower full load shifts is all of the maps I've found are scaled for a FASTER shift at higher loads/rpms. This leads me to think that those "slow" shifts are simply a factor of clutch holding power rather than target shift times.

So digging around I found a map that controls the oncoming clutch pressure gradient. By modifying those values, I was able to get a little more out of the old gearbox.


I'm at the point that I don't want to force the clutches closed any faster, I need to go back and take a little from the torque intervention maps to reduce the power produced by the engine during the shift. By reducing the amount of energy the clutches are trying to absorb I think high load/rpm shift times will further improve.

At this point, I have modified the following:

First shift ramp time targets
Second shift ramp time target
Shift pressures (5-6 times)
Shift pressure ramps
Shift maps
RPM limiter
Removed manual mode kick down switch
Added gear display for D and S mode


Next, Round off the rough edges and work on the Dead time between the "tip" signal and the actual gear shift.


Getting very close to video time.

Yes, I've been building the maps for the 330I and 530I ZF versions. They are very similar.

[DWR]

Originally Posted by DWR

Each upshift or downshift has 2 clutches involved. The public maps are for the oncoming clutch. The pressure profiles for the off going clutches look different.

Hmm, I had thought that's what those 8X8s were. Now you have me thinking ... not sure anymore.

Really admire your tenacity and talent.

[rjahl]

Not sure if you noticed, this shift pressure map is an 8x10. I can't remember if that follows the Second generation layout or not. Some maps are different between the two TCUs.

Today's drive to work was fun. Car has some real bite on the shifts. As I mentioned earlier some shifts are a little harsh and I need to tone them down but I plan on driving it this way for a few days, take notes and then work towards rounding off the package. I'll probably start by using the torque management maps to pull a little more power during the shifts and see how that feels.

[CobraMarty]

Originally Posted by rjahl

Added gear display for D and S mode

I like that feature.
I would like that on my E90 auto.

[rjahl]

Originally Posted by CobraMarty

I like that feature.
I would like that on my E90 auto.

If you have a ZF tranny, We will get to that, don't worry.

Do you know the the ZB number for your TCU?

[CobraMarty]

I thought I have the GM auto trans.

Where is the TCU located? I can check the #.

[Terraphantm]

Originally Posted by CobraMarty

I thought I have the GM auto trans.

Where is the TCU located? I can check the #.

It's built into the transmission mechatronics.

[rjahl]

Another update:

I have managed to secure a map description file for the ZF6HP19 from a diesel E60. It's taken a crap load of work to convert the file into something I can use and it's going to take more to convert it into an E85,E90,E60 file but its a huge benefit to the project.

For instance, there are about 20 different shiftmaps/programs in this TCU. Without this description file, it would take trial and error to determine what each map did. Now I have them all identified. In all, I have over 2,000 maps identified.

To bad, I only understand the functions of about 100 or so.

[rjahl]

Update number, I lost count

I managed to get into a group purchase for a map definition file, OLS for a similar gearbox from an E60. The maps were not 100% in align with the GKE211 from the E85 but similar enough to help me find more details.

For starters, it helped me define all of the shift maps. There are 19 of them and it would have taken a crap load of trial and logging to identify all of them. With the OLS file, I now have them all defined.

I had already located the Manual Tiptonic shift map through trial and error, knowing the others will help me build a tunes for others who want to change the standard Drive or "XE", "XS" shiftmaps.

The downside to having the OLS file, is the learning to deal with the information overload. 4,264 maps to study. We probably only need to look at a few hundred but the amount of information is a little overwhelming.

Another downside to this sort of piracy, is two of the key maps I have been researching are missing from the OLS file. Shift time #1 and torque reduction maps are missing. I have translated them from similar gearboxes but that requires more work to research and validate.

[rjahl]

Originally Posted by BimmerGeeks

How are you liking your current remap vs the 3.0si mapping so far?

I'm certainly liking most of the settings, I make a few steps forward and then one or two back. Just recently, I took a bit of a step back. Not going into too much detail but I don't yet have the high RPM shifts where I want them. I did have the transmission making really fast sharp shifts under medium loads.

Overall, they are much better than stock but I'm not happy with them yet.

I've lost a couple of weeks dealing with the recently available OLS files for the BMW 8HP, VAG 6HP and BMW E60 6HP. Took a bit of work to convert them from a CSV file into an OLS file that we can all use. We all learned a new trick with the WinOls import script feature.

Using the new information, I mapped over your E60 file this morning and took a look at your X and XE shift maps. Like my E85 files these two maps are the same?

Vertical axes is throttle, in percent. 110 percent is "Kick down".

The X axes is the shift points
1>2, 2<1 ,2>3 ,3<2,4>3, 4<3 etc.

Map values are Transmission output shaft speed, not engine speed. You can approximate your engine speed at those shift points by using the gearbox reduction factors per gear. You could also calculate the shift point / vehicle speed by factoring the final drive ratio and tire size. Vehicle speed will be more absolute. Engine RPM values are complicated by calculated RPM from shift delay and torque converter operations.

I'm try to send you a modified X and XE shift map latter today.

Attached reduction ratios are for the 6HP19 and final drive ratio is the 325, Z4(E85) only.

[rjahl]

Originally Posted by BimmerGeeks

Nice! Send it over and I'll flash it & get you some feedback.

Email Sent

[NiNeTyOne]

Originally Posted by Terraphantm

If you're just looking for a flash that will handle a little more power/torque than stock, the 330i euro software would probably be a decent upgrade. For truly custom stuff, that'll require more work.

And for people like Chris and me, it's hard to develop anything for the automatic transmissions. For one, we don't own cars with automatics. And since the computer is built into the mechatronics assembly, we can't just buy one cheap on eBay and mess with it on our desks like we can for DMEs

I'm just down the road a bit from Chris and I have a GM Auto, so I'm happy to work with you guys on this. I could easily set up a VM for flashing on my linux laptop and save all sorts of hassle for whomever is working on the tunes.

May be nice to have some parallel dev happening on the auto as we fine tune the N52 tunes!

[rjahl]

Originally Posted by NiNeTyOne

I'm just down the road a bit from Chris and I have a GM Auto, so I'm happy to work with you guys on this. I could easily set up a VM for flashing on my linux laptop and save all sorts of hassle for whomever is working on the tunes.

May be nice to have some parallel dev happening on the auto as we fine tune the N52 tunes!

I think the GM transmission tune will be a large project that will require a team effort to pull off. Just to give you an idea, The follow is a list of steps that I would take:

1. You need to find a way to download a full bin from a GM transmission to examine the structure and boot code

2. Start collecting all of information regarding this model transmission possible. Microprocessor type, amount of RAM, Reduction ratios, torque limits, Vehicle applications, what cars have used this gearbox etc.

3. Start searching the internet for a definition file for the calibration data. First choice would be a Damos A2l file but a WinOls file will work as well. Last resort, it might be available to purchase. A "group buy" makes this cost more palatable. I think these usually go for 200-400 Euro. Finding a Damos file that matches the current program will be nearly impossible, so expect getting some thing slightly different and spending a crap load of time transferring the maps to the current BMW program

4. Start looking for registered patents from GM, often the special programs and features of the gearbox are protected by patents that describe the functions. Big clues there

5. It's safer to find a used TCU for bench tesingt any flashing program that gets written. Someone with access to a scrap yard might be able to donate one or two.

6. Someone needs to find a way to beat the RSA protection. I suspect some Terraphantms methods will work but here again it's likely that the Bin is compressed and we need to find a tool that will decompress the BIN so someone with Terrphatms skills can beat the boot loader

7. You need one or more tuners to develop the tunes and a one or more people will to use there cars as test subjects.


Perhaps this will give you an idea why professional tuners who do their own development work charge so much money for their tunes.

Just a note: I am not a professional tuner. This is a hobby for me and I was lucky enough to procure knowledge from the Diesel ZF tuning project plus Terraphantm was kind enough to crack the 512 bit RSA protection. There were 3-5 other people in the back ground that helped me get this far.

[hassmaschine]

The biggest hurdle is probably #6. We were just discussing it the other day.

the RSA signature is 1024 bit, so brute force cracking it isn't an option. Beside that, the TCU uses code compression, and without knowing exactly how it was compressed, there's no way to decompress it, thus no way to disassemble it and figure out another way to delete the RSA signature check.

Another possible way to flash would be BDM, as I believe it still uses an MPC5xx CPU - however, since the TCU is inside the transmission, that would be rather difficult to do, and you wouldn't want to be pulling the transmission apart to flash multiple tunes for testing. Possibly, the public keys could be replaced with our own, and we could generate a valid signature that would flash, but you'd still have to pull everything apart for a "maybe" (or supply a TCU from a parts car with the GM trans).

[NiNeTyOne]

Daunting indeed!

So can we effectively raise the rev limit on the GM in manual/sport without having access to the tune on the transmission?

It would seem the code for 'auto shift up' at the limiter is buried in the transmission tune right?

Your making me want to do a manual swap C.

[Terraphantm]

So according to this image it's likely an MPC562, and I do tend to agree. Looking at the 0PAs and 0DAs, it's structured fairly similarly to the ZF software (down to still using a CRC16 for the checksums), it's definitely big endian, and it appears to use code compression. Likely BMW asked both companies to structure the software similarly




As far as possible attacks go, it might be worth investigating if the level 4 and level 5 security access keys give any more useful access than the level 3 keys used by WinKFP. It seems like it'd be a major security flaw to allow a 512-bit key to override security, but hey, the stuff we've figured out are also major security flaws. Compressed code makes it difficult to study, but maybe we can study what the different keys are used for in the DME.

Originally Posted by NiNeTyOne

Daunting indeed!

So can we effectively raise the rev limit on the GM in manual/sport without having access to the tune on the transmission?

It would seem the code for 'auto shift up' at the limiter is buried in the transmission tune right?

Your making me want to do a manual swap C.

No, without a tranny tune, you won't be able to raise the rev limiter.

Manuals don't have any software to deal with, so that's always nice

[NiNeTyOne]

Originally Posted by Terraphantm

Manuals don't have any software to deal with, so that's always nice

Yeah, I think C would approve of that too. I get the feeling he doesn't like Autos :P

[hassmaschine]

well, if you want to try it, find me a GM TCU from a junkyard that I can bench test. No promises though.

[rjahl]

Originally Posted by Terraphantm

So according to this image it's likely an MPC562, and I do tend to agree. Looking at the 0PAs and 0DAs, it's structured fairly similarly to the ZF software (down to still using a CRC16 for the checksums), it's definitely big endian, and it appears to use code compression. Likely BMW asked both companies to structure the software similarly




As far as possible attacks go, it might be worth investigating if the level 4 and level 5 security access keys give any more useful access than the level 3 keys used by WinKFP. It seems like it'd be a major security flaw to allow a 512-bit key to override security, but hey, the stuff we've figured out are also major security flaws. Compressed code makes it difficult to study, but maybe we can study what the different keys are used for in the DME.



No, without a tranny tune, you won't be able to raise the rev limiter.

Manuals don't have any software to deal with, so that's always nice

In the ZF OLS file there is one parameter value that is "0" for ZF and 1 for GM. Makes me wonder how similar the programs might be. Could just be something lost in translation and there are functions that are simply not used.

[NiNeTyOne]

Originally Posted by hassmaschine

well, if you want to try it, find me a GM TCU from a junkyard that I can bench test. No promises though.

I can start working on this...