Member
Two things:
I found document with CAN -> Engineering value scaling for a bunch of stuff, but I have no idea how I created it. I know I got it from Tool32.
I have some data from the DSC module which may help decode 0x316 better, but I haven't analyzed it completely.
Also, make sure you know what you're doing in Tool32...It may say 'read only' but you can do stupid stuff. Like I put the DSC module in 'bet' mode - Belt End Test... Don't hit bet_aktiv!
-Matt
Member
BMW CCA Member
From what I can tell in the assembly:Originally Posted by Thaniel
There's a byte that will have a value anywhere from 0 to 7 (0 = 7.5k and up, 1 = 7k and up, etc until 7 which will be all lights from 4k and up), and then they're shifted left 4 bits before being pushed to the can byte.
So the lights should work like this:
LED Value (dec) Value (bin) Left shift 7500 0 000 #000#### 7000 1 001 #001#### 6500 2 010 #010#### 6000 3 011 #011#### 5500 4 100 #100#### 5000 5 101 #101#### 4500 6 110 #110#### 4000 7 111 #111####
See the attached excerpts from IDA
Screen Shot 2015-01-19 at 3.41.27 AM.png
Screen Shot 2015-01-19 at 3.43.30 AM.jpg
Edit: Actually I had the wrong subroutine for the CAN update. I think this is the right section. I corrected the above table. Not quite sure when FF8298 gets populated with the right data though
Screen Shot 2015-01-19 at 4.03.32 AM.png
Last edited by TerraPhantm; 01-20-2016 at 01:39 PM.
Tundra Mud
Cool stuff. Let us know what you find out or can share.
I have been probably overly cautious when using all these strange tools on my car. Having a bench test set up has been great. I can let my son click ALL the buttons on the tools and see what happens :-)Also, make sure you know what you're doing in Tool32...It may say 'read only' but you can do stupid stuff. Like I put the DSC module in 'bet' mode - Belt End Test... Don't hit bet_aktiv!
Hey that's some cool intense stuff. Digging into the assembly. Whoa.
Yah I tried that sequence first as it makes the most sense but when 2 bits were 1 at the same time it wouldn't light the lights. Only would work if one bit was 1 at a time. Maybe it's a different software version or something. I dunno. I have a video of the test somewhere. I have it go through all the values one at a time.
Thaniel
Member
BMW CCA Member
I have a real M3, I could try capturing some data as the engine warms up. Your 7k, 6.5k and 5.5k do match my table. And since the M3 does turn those lights off sequentially, the rest (except for 7.5, 8, and 8.5k) should be controllable
FWIW here's the complete subroutine. Everything else lines up with what you've already found for DME4.
Screen Shot 2015-01-19 at 4.19.03 PM.jpg
Last edited by TerraPhantm; 01-19-2015 at 04:35 PM.
Member
Here's some more data points on 0x316:
apiJob("DSC_MK60","status_can_dme_1_lesen","","sta t_motordrehzahl_wert;stat_motordrehzahl_einh;stat_ md_ind_ne_wert;stat_md_ind_ne_einh;stat_md_ind_wer t;stat_md_ind_einh;stat_md_reib_wert;stat_md_reib_ einh;job_status;_tel_auftrag;_tel_antwort")
Satz : 0
OBJECT = dsc_mk60
SAETZE = 1
JOBNAME = status_can_dme_1_lesen
VARIANTE = DSC_MK60
JOBSTATUS =
UBATTCURRENT = 1
UBATTHISTORY = 1
IGNITIONCURRENT = 1
IGNITIONHISTORY = 1
Satz : 1
STAT_MOTORDREHZAHL_WERT = 6.848438E+002
STAT_MOTORDREHZAHL_EINH = 1/min
STAT_MD_IND_NE_WERT = 1.132813E+001
STAT_MD_IND_NE_EINH = % von MD-Norm
STAT_MD_IND_WERT = 9.765625E+000
STAT_MD_IND_EINH = % von MD-Norm
STAT_MD_REIB_WERT = 1.250000E+001
STAT_MD_REIB_EINH = % von MD-Norm
JOB_STATUS = OKAY
_TEL_AUFTRAG = 7 Bytes
000 : B8 29 F1 03 22 03 16 ¸)ñ."..
_TEL_ANTWORT = 17 Bytes
000 : B8 F1 29 0C 62 03 16 01 05 1D 1F 11 19 20 00 1D ¸ñ).b... ..... ..
010 : 28 (
So, 0x316 definitely has some torque values in there, but I'm not certain about any more then that at this moment.
Here's what I've come up with from some patent searching:
No idea what Ind_NE is.
MD_Ind -> aktuelles Drehmoment des Antriebsaggregats -> current torque of the drive unit (ie engine?)
MD_Reib -> Verlustmomente -> torque losses [ in percent of maximum value ] (ie driveline loss)
MD_Norm -> maximum Drehmoment jeweiligen Aggregattyps -> maximum torque of each type of aggregate (all the forces on the vehicle)
-Matt
Member
BMW CCA Member
Found the definitions in the MSS54 Funktionsrahmen - here's the google translate version:
md_norm_can: reference torque moment for all details
md_reib_can: loss torque of the engine including all consumers (alternator, oil pump, air compressor, ...).
md_ind_ist: produced indexed actual torque of the engine without taking into account the DSC intervention
md_ind_ne_ist: produced indexed actual torque of the engine under consideration of all interventions
md_ind_lm_ist: theoretical engine torque calculated from the measured air mass excluding external ignition angle
Last edited by TerraPhantm; 01-20-2015 at 07:58 AM.
Member
TerraPhantm - awesome info. It looks like Thaniel was correct that there is torque info being broadcast by the DME. At least some of that should be able to be calculated in real-time, some of it I'm not so sure. Might need to combine datastream items from the DME and a 3rd party ECU to get the information correct to have DSC still operate with full intervention capabilities. Time will tell.
-Matt
Member
BMW CCA Member
Just combing through the disassembly a bit more, I've found this:
ARBID: 0x329 (DME2)
-B0
-B1 is Temp [Temp in C = .75 * hex2dec(byte01) - 48.373]
-B2 is atmospheric pressure -- not sure of conversion yet
-B3 Clutch switch bit 0 (0 = engaged, 1 = disengage/neutral); Possibly Motor Status bit 4 (0 = on, 1 = off), Tank Evap duty cycle (possibly mislabeled, looks more like some sort of status byte) bits 5, 6, 7
-B4 Driver desired torque, relative (00 - FE)
-B5 Throttle position (00-FE).
-B6 kickdown switch depressed is 4 (bit 2 = 1), Brake light switch error is 2 (bit 1 = 1), Brake pedal depressed is value 1 (bit 0 = 1)
-B7
On the MSS54 there is a table defining how much torque is produced under optimal conditions for a given RPM and cylinder filling, and then there are a crap load of factors applied to determine the actual torque. If DSC requests torque to be reduced, the DME determines what to do to reach the desired intervention.TerraPhantm - awesome info. It looks like Thaniel was correct that there is torque info being broadcast by the DME. At least some of that should be able to be calculated in real-time, some of it I'm not so sure. Might need to combine datastream items from the DME and a 3rd party ECU to get the information correct to have DSC still operate with full intervention capabilities. Time will tell.
-Matt
If the ECU you're trying to use does traction control in a similar way, it shouldn't be too difficult to have a "translator" sitting between the ECU and can-bus to convert to and from the BMW format. If there is no torque management, it'll probably be tough to write all new routines to handle those functions (but not impossible)
Last edited by TerraPhantm; 03-23-2015 at 11:25 PM.
Member
In INPA, Ambient Pressure is in hPa.
For B1 - It's just -48, not -48.373. Verified in INPA.
For B3 - Nothing in bits 1 or 2?
For B4 - Is this simply a percentage (based on driver wish) of maximum torque possible without regard to ignition timing (like in the DSC equations)?
For B5 - This is either Pedal position or cruise pedal position.
For B6 - Brake light switch error is interesting.
B0 was some weird rolling code thing.
Is B7 just a static value?
At least with the MoteC M1, I can write whatever I need.So, slightly painful, but doable.
-Matt
Member
BMW CCA Member
This DME also deals with pressure in HPa/mbar, but 1 byte isn't enough to store the value in mbar without some sort of conversion. I see that the DME does some math before pushing the value to the can message, I'll need to take a closer look at it when I get the chanceIn INPA, Ambient Pressure is in hPa.
For B1 - It's just -48, not -48.373. Verified in INPA.
For B3 - Nothing in bits 1 or 2?
For B4 - Is this simply a percentage (based on driver wish) of maximum torque possible without regard to ignition timing (like in the DSC equations)?
For B5 - This is either Pedal position or cruise pedal position.
For B6 - Brake light switch error is interesting.
B0 was some weird rolling code thing.
Is B7 just a static value?
At least with the MoteC M1, I can write whatever I need.
-Matt
For B3, bit 2 seems to be set permanently. Bit 1 doesn't appear to be used. Maybe they're used on other DMEs
B4 is the proportion of max torque. If you want to deal with it in percent, divide by 256
B5 - Took a closer look - it's "corrected" pedal position (adaptions + sport/non-sport mode factored in)
There was some code that pushed something to B0, but I could tell what it was. Looks like it's a value that changes based on how long the DME was running, but I don't know where the values are pulled from.
Nothing is pushed to B7, at least in this DME. Other DMEs may use the byte.
Edit: Formula for pressure is mbar = (x + 298.5) * 2
Last edited by TerraPhantm; 01-20-2015 at 08:51 PM.
Member
Wow, you got that formula fast. For y = mx+b format, it's 2x + 597.
As for B0, yep, some sort of rolling counter. It cycles between 4 or 5 values I think, I'd have to look in logs.
B7 for me is always 255, according to my description.
B3 - that's where all the steering control bits are. I couldn't remember this earlier today, but looking at my data, that's what I have. That and other status bits, as you say. For my car, the 'idle' value is 19 Hex/25 decimal. 25 = 16+8+1. So for SSG, clutch is always set to 'engaged.'
Plugging your pressure formula in gets me 1005-1009 mbar, so that seems correct for Yonkers, NY.
I am confused on B4 - I've only seen this value be non-zero when cruise control is engaged, and at that point, B4=B5 unless you override via the pedal.
-Matt
Member
BMW CCA Member
Hmm. When my can-bus stuff arrives, I'll try logging my own car (unless you know how to do so with the D-CAN interface? I've already wired the CAN-bus to my OBDII port). But from the disassembly and the funktionsrahmen, it looks like it's both driver or cruise requested torque (whichever is higher essentially). MSS54 does more with the torque management than just DSC interventions though, so maybe that's why it's differentWow, you got that formula fast. For y = mx+b format, it's 2x + 597.
As for B0, yep, some sort of rolling counter. It cycles between 4 or 5 values I think, I'd have to look in logs.
B7 for me is always 255, according to my description.
B3 - that's where all the steering control bits are. I couldn't remember this earlier today, but looking at my data, that's what I have. That and other status bits, as you say. For my car, the 'idle' value is 19 Hex/25 decimal. 25 = 16+8+1. So for SSG, clutch is always set to 'engaged.'
Plugging your pressure formula in gets me 1005-1009 mbar, so that seems correct for Yonkers, NY.
I am confused on B4 - I've only seen this value be non-zero when cruise control is engaged, and at that point, B4=B5 unless you override via the pedal.
-Matt
Member
I'm tapping into the CAN Bus at the DME, not using the D-CAN interface.
Well, I know that Byte _5_ is known as 'Virtual CAN Accelerator' to the GS30 module, which is what leads me to believe Byte 4 is the same but for cruise. If nothing else, maybe this discussion will prove itself out in other pieces of code, giving you a better understanding of the M3, and the rest of us a better understanding of the CAN stuff.
-Matt
Member
BMW CCA Member
I intend to use an arduino like mentioned in the first post.
I guess another thing I could try is just push that value to something like the coolant temp byte and see if the gauge lines up with where I expect torque to be.
Member
For 0x316 Byte 0:
0x10 = Brake Light On
0x40 = AC Clutch Engaged
0x05 = Normal Operation
OR all the bits together..
For 0x329 Byte 0:
The values change depending on the rest of the message - I have a theory to try out. But when byte 3 is not 25, the values are:
17, 64, 128, 217
When byte 3 is 25:
17,64,132, 217
I think when the check engine light is on, the third byte in the sequence becomes 140.
That's all I can give for now.
-Matt
Member
BMW CCA Member
For 0x316 byte 0
Bit 0 - Something is pushed here, but I'm having a hard time tracing what it is. Appears it would always be set to 1 if everything is running normally
Bit 1 - Unused (in this DME)
Bit 2 - Set to 0 if ASC/DSC error, 1 otherwise
Bit 3 - Set to 0 if manual, Set to 1 if SMG (on this DME, I guess MS45 is different)
Bit 4 - Set to bit 0 of md_st_eingriff (torque intervention status)
Bit 5 - Set to bit 1 of md_st_eingriff
Bit 6 - Set to 1 AC engaged
Bit 7 - Set to 1 if MAF error
In this DME, it appears 0x329 byte 0 could be 0x11(17), 0x40(64), 0x80(128), or 0xC0(192). Doesn't appear to be based on anything more than DME running time, but I could be wrong
Last edited by TerraPhantm; 01-21-2015 at 11:21 AM.
Member
Maybe the MS45 has some status in the third value in the sequence. Weird.
Member
BMW CCA Member
Definitely a possibility. I guess only way to know for sure is to disassemble the software on more DMEs. Easier said than done of course
Member
I just saw your bit explanation of 0x316. Very interesting. Explains the 'idle' value of 0x05 - Bit 0 + Bit 2, which are normally both 1.
Thankfully I've never seen MAF error. That's useful information though. I wonder what the other units do if that's set. Maybe I'll have to test that.
You've been super helpful in a short time. Thanks for all your contributions!
-Matt
Member
BMW CCA Member
I do remember on my old ZHP, if the MAF was unplugged, I couldn't use the gas and the brake at the same time. I wonder if that was enforced by the DSC module rather than the DME.
Not sure how it is on the M3. Can't really test anymore since I've switched to a MAFless setup (and am using the M3 CSL software which was designed not to use a MAF from the factory)
Member
I wonder if the bit is re-purposed for a MAP sensor fault on the CSL software, as that is the load-sensing equivalent.
Tundra Mud
Agreed. I don't look at this thread and I check back and all kinds of good information.
I've been trying to Get my test bench GM ECU connected up to play with. Having trouble finding what I need on the web. Oh well. Let's talk BMW again.
I've noted some differences between years in the can bus streams on some messages. One message was even different in length. I may have some more insights on the torque request data. I'll have to look and see if i can find it. With both of you guys looking at it perhaps we can figure it out.
I do have my DSC moduled wired up now. Obviously it's missing a bunch of sensors but I connected the can bus stream. Strangely it's giving me errors saying it is missing can messages for items I didn't think were on the can bus. I'll have to look at it again. Anyway I mention it as i can try some strange stuff now without disrupting a running car. I need to wire up some wheel speed sensor simulators at some point. Might prove interesting.
Thaniel
Member
Confirmed that bit 4 of byte 0 of 0x316 is not related to brake switch status as originally thought. I moved spark control over to the M1, and during initial startup the idle surges a bit, and during that time, bit 4 gets flipped between 0 and 1 a bit...and I certainly wasn't hitting the brakes.
Tundra Mud
Not sure I follow the above statement? perhaps you can explain?
Member
M1 = MoTeC M150. Up until now, because I didn't have spark map that I trusted, I had the DME controlling the spark, even though fueling was being handled by the MoTeC. The M150 is now doing both. Trying to get idle to not suck in the first 45 seconds though (when SAP is on). My startup fueling enrichment is not correct.
-Matt
Posting Permissions
Reply With Quote
Bookmarks