Results 1 to 20 of 20

Thread: Breaking the Motronic code; 404 DME M60

  1. #1
    Join Date
    Oct 2014
    Location
    Prescott, Az
    Posts
    439
    My Cars
    '95 540i/6

    Breaking the Motronic code; 404 DME M60

    Hello Bimmerforians.

    I wanted to make a thread explaining the process of reading and modifying the Bosch Motronic tuning code, using my own 404DME M60B40 in my 540i/6.

    I, myself, am still a learner. Soaking up as much information about the topic as I can on the daily. Also, I'm a gearhead not a computer engineer. So really I am creating this thread for those without prior experience that have an interest in seeing what makes the computer tick or interested in the process of deciphering the code.


    The hardware I use:

    A Moates Burn2 chip reader, eraser and burner. This tool is how you get the original tuning from the chip to begin the journey.



    Moates Ostrich 2.0 Chip Emulator. This handy tool act's as the chip in your DME, you load up your modified tune via USB and it runs the car. It also has the advantage of watching in real time what bits of data are currently being used by the vehicle as it's running.



    The software involved: There are several programs designed to read and modify the binary code. A couple popular ones, WinOLSis an advanced user program that the majority of tuners like to utilize. It can blindly recognize a couple of maps in the code, although not very helpful in my case. But other tuners have created 'MapPack' files for various applications that have recognized and labeled the different maps. I have not found a user made MapPack for my application.



    The other popular tuning software is TunerProRT (TunerPro). TunerPro is freeware, with a suggested paid registration that will disable a 10 second count down at initial startup.

    In my opinion TunerPro is a more user friendly program to use. The formatting and layout seems to make navigating easier then WinOLS. So for the sake of this write up and examples we'll be using TunerPro. TunerPro also has the built in utilities to communicate with the previously mentioned Moates Burn2 and Ostrich hardware.



    TunerPro needs to have an interface file known as .xdf The interface file translates the Binary tuning file (.bin) into a human format that we can understand.

    The .xdf files available are tuner made, similar to the WinOLS MapPacks. On TunerPro's website is a vast list of available tuner made .xdf's for various applications. The available 404 DME for the BMW M60 is basic, but useful. However rather stripped down and in a few maps it's just wrong. You would need prior tuning experience to fully understand what you're looking at.

    There is a tuner made software known as the XDFcreator. When your .bin is loaded up and you specify which DME you are utilizing it will locate the majority of the maps in the code. The problem with XDFcreator, despite it's usefulness is that it will give you a long list of 3D and 2D maps that it has discovered but has no way of identifying what it is and how it's used. That is up to the end user,....you.

    If you haven't gotten the vibe yet, allow me to point out. The online tuner community actually wants to help and see everyone succeed in their own progress of information. These people genuinely want to help (Mostly). You just need to ask the right questions to get the answers you are looking for. Much like on these general purpose automotive forums.

    After working for months with the tools in front of me, I finally decided to step up my tuner game and get into the Motronic coding itself to make my own interface .xdf file for use in TunerPro.



    The Motronic 404 M60 code is split into two sections the operating information side that commands how and when things happen as well as sensor inputs, and a slew of other information I don't know how to interpret. Some advanced tuners know how to manipulate this part of the code for desired effects. I am still learning this side.

    The 2nd part of the code is the control maps and data side of the tune. This is the meat and potatoes of the tuning. This is the ignition timing maps, the fueling maps, all of the temp modifiers...etc.

    So lets begin to decipher:

    This format of motronic fuel injection uses axis identifiers and header descriptors to define a "map". Using online resources I was able to find the basic axis identifiers to aid in finding and labeling the maps.

    Here's an example of a map:

    I know from research that the hex number of D0 is the axis identifier for engine RPM and D5 is calculated Load.

    Starting at Hex address CA84 I can see there is a string of code starting with D0.



    After the axis identifier is how long that axis is in bytes, or cells. Viewing the section in decimal gives the rest of the equation:




    We can see the axis is 12 bytes long, the next 12 bytes of information is the header labeling. Since this is RPM the factor is x*40 (found through online resources). Using the header information and working backwards we can decipher the actual engine RPM points of the axis.

    005 010 010 010 013 012 013 007 025 010 030 096


    Starting at 256 - 96 = 160
    160 x 40 = 6,400RPM
    30 x 40 = 1,200.
    6,400 - 1,200 = 5,200RPM
    10 x 40 = 400
    5,200 - 400 = 4,800RPM
    25 x 40 = 1000
    4,800 - 1000 = 3,800RPM
    7 x 40 = 280
    3,800 - 280 = 3,520RPM
    13 x 40 = 520
    3,520 - 520 = 3,000RPM
    12 x 40 = 480
    3,000 - 480 = 2,520RPM
    13 x 40 = 520
    2,520 - 520 = 2,000RPM
    ....etc

    The next Axis identifier of D5 is Load, followed by how long the axis is and it's axis labeling. (I don't know how to decipher the load factor). So instead I use the raw data of the header just as a guide point.

    010 010 010 010 010 010 010 020 050 096

    256 - 96 = 160
    160 - 50 = 110
    110 - 20 = 90
    90 - 10 = 80
    80 - 10 = 70
    ...etc

    After the header axis information begins the actual map, we've got ourselves a 12x10 map here of raw data starting at address CA9E



    I know from my experience that we're looking at ignition timing values. Usually ignition timing in this Motronic format range from numbers 60-120ish, fuel tables range from 118-160ish+. I also know from experience we're looking at a part throttle ignition timing table. There is an idle ignition and wide open throttle ignition timing tables too, as well as a slew of timing modifier tables usually based around coolant temp.

    After applying the equation (x*.75)-48 to the table (equation found from online resources) it will give us human interface of crank degrees.



    An important thing to keep in mind, yes we are looking at the part throttle ignition timing map expressed in human figures we can understand. But there are several ignition timing modifiers that will alter the actual ignition timing event happening in the combustion chamber. So the figures expressed here are not actually whats happening at the crank in real life.

    So now lets take a look at a completely different table:

    At address C6DE is axis identifier D4 that starts the header information for a different map.





    D4 is Intake Air Temp and the next identifier is D7 for Coolant Temp. So this is a 5 x 8 MAP of IAT vs Coolant Temp at address C6EF

    The values inside the map tells me this is a fuel control.



    In the Motronic world the figure 128 is the middle ground, probable because it's exactly half of 256 (the highest allowed dec value that usually refers to a blanked out byte) lower numbers take fuel away and higher numbers add fuel. I've found online a calculation that converts the raw fuel numbers into a human recognizable Air to fuel ratio value: 1/(x/128)*14.7



    Again, since this is one of many fueling tables and due to variables outside of the computer, the commanded AFR in this MAP will not directly translate to actual AFR's in the combustion chamber. But in AFR format it gives us an idea of how much fuel it adds and takes away.

    You notice the axis labeling is blank? That's because I haven't figured out how to apply the Motronic temperature Factor and Offset to the header information to give accurate temperature read outs. But I'm working on it.

    There you go, there are two maps inside the code. Using this process I've found 117 MAPs in this code. I've identified the function of 18 MAPs out of the 117. But, in my defense they have been the most crucial MAPS for tuning.

    Bet you didn't know that early OBDI Bosch Motronic fuel injection was so complicated huh?... I didn't when I started all of this.

    One of the glitches I've found in my experimentation was that the 404 M60 stock .bin appeared to open and could be viewed in the Miller WAR chip tuning software.

    However, Miller uses it's own flavor of .bin language to run on it's chip. Despite that the coding gets jumbled, all of the same maps are located at the same Hex addresses as a stock read.

    I've noticed that if you open a stock OE .bin, and save it in Miller software as an .mpc format it changes the coding into their version of the language. Then using another .bin reading programmed called HXD you can compare two bin's side by side and find the differences.

    For example:
    Looking at the Part Throttle Ignition map mentioned before. On the left is TunerPro with my XDF reading the same Stock E34 chip read .BIN that is loaded in Millers software on the right:



    ou can see discrepancies in the lower timing values, but some of the higher values have a match....and the RPM axis information from the maps header info gave the Miller program enough to match the RPM points.

    Lets save the Stock .BIN in .MPC format with the Miller software....and then do it again making one change to the tune, let's turn off the O2 sensors in the stock tune in the Miller software.



    Now we'll compare the two tunes in HXD software to see what changed?! The great thing about HXD is that it will automatically find the differences between two bins.



    Apparently at Hex address CCD6 there is an entire table that get's zero'd out to turn off O2 Sensors....Cool. Let's see what that table looks like in TunerPro in the original .BIN




    Sure enough, there is a 5x4 MAP of RPM vs Load at that address, and by zero'ing out this table that is how Miller Performance disables O2 sensor feedback in their Mille WAR chip tunes, keeping a vehicle in open loop.

    I've used this same method to find the Speed Limiter address and how Miller disables it, as well as the Idle RPM Speed control

    I've been collecting 404 M60 tunes and chips. Scavenging the interwebs for 404 .BIN downloads, as well as collecting 404 DME's from junk yards with the intentions to read the chips. Simply to educate myself on the differences amungst the tunings.

    I've got tunes for an E32 740i, Two E34 540i Autos with different build dates, A downloaded 530i tune and a downloaded Euro/German spec E34 540i Auto. I've also an E38 484DME 740IL chip.

    Comparing the German 540i chip to the U.S. 540i chip, the information in the first half of the code is about 90% different. This is the part of the code that tells what, when, how and why stuff happens. The parts I'm still trying to learn, but it takes a computer programmer already familiar with the 8051 series of microcontrollers and it's language of codes.

    The 2nd half of the Motronic code is mostly similar compared between the two. The MAP addresses and sizes are the same. A few of the axis header labeling information has changed between the two. But really it's all the same MAPS in the same locations with the same functions.

    The blaring difference between the Euro spec and U.S tunes are in the ignition timing. Again referencing that Part Throttle Ignition timing....check out these tunes side by side:



    The upper left is the Euro spec E34 540i Auto, the upper right is a U.S. spec E38 740IL 484DME, Bottom left is U.S. Spec E34 540i Auto, bottom right is U.S. spec E32 740i.

    Just some food for thought.

    Note: The 484 tuning has all of the same MAPS in the same sequence and same functions as the 404, but the MAPS are at different addresses starting further down the coding so the 404.xdf for TunerPro won't work reading the 484 BIN. I quickly threw an xdf together just to view the MAPS but didn't label any axis as that is the most time consuming part of creating the XDF. I would be to afraid to remove a 484 chip, read the BIN, modify, burn to chip and reinstall in the vehicle without the proper equipment to re-align the EWS module code hoping with the DME. I hear there is a way to make the 484 DME "Accept all codes" in this tuning and then there would be no need to re-align the code hoping. I just don't know how to do that in the code.

    Hidden in the ASCII string (the hieroglyphics to the right of the Hexcode) is an easter egg from the original programmer, along with what I assume is his signature.



    Gute Fahrt! translated to English is "Safe Travels!" or in saying as Bon Voyage! I like it so much I've included the Gute Fahrt! in ASCII string in my own XDF's.


    At this point you are as caught up in this tuning world as I am, so....Gute Farht!

    If you would like to take a look around for yourselves.

    Download link for TunerProRT:

    http://www.tunerpro.net/download/Set..._v500_9088.exe

    Here is the basic, stripped down version of the XDF using the tables I've identified.

    https://drive.google.com/file/d/0B3E...ew?usp=sharing

    And here is a chip read of a U.S. spec E34 540i Auto 404DME:

    https://drive.google.com/file/d/0B3E...ew?usp=sharing
    Last edited by Mykk; 06-08-2017 at 05:26 PM.

  2. #2
    Join Date
    May 2017
    Location
    Kansas
    Posts
    78
    My Cars
    525
    In about 5 years, when my grandson turns 10, I'll ask him to explain this thread to me clearly. Until then its saved. Great post sorry I don't get you but its clearly well researched great post.

  3. #3
    Join Date
    Oct 2014
    Location
    Prescott, Az
    Posts
    439
    My Cars
    '95 540i/6
    It's crazy, & cool for an almost 30 year old fuel injection technology huh. I've been having fun learning all I can about it.

    I've got so many hours invested in research and interpreting this code, I might just be stuck with mid 90's BMW M60 V8's for the rest of my life to justify learning this stuff....no complaints here.

  4. #4
    Join Date
    Jul 2016
    Location
    Chicago, Illinois
    Posts
    3,842
    My Cars
    are slow
    Quote Originally Posted by Mykk View Post
    It's crazy, & cool for an almost 30 year old fuel injection technology huh. I've been having fun learning all I can about it.

    I've got so many hours invested in research and interpreting this code, I might just be stuck with mid 90's BMW M60 V8's for the rest of my life to justify learning this stuff....no complaints here.
    At least you don't have two of them working together. 30 year old tech is scary stuff.

    wait, Germans have humor?
    Last edited by XAlt; 06-08-2017 at 11:03 PM.

  5. #5
    Join Date
    Jun 2005
    Location
    Texas
    Posts
    20,728
    My Cars
    E21, E24, E34, E46
    Top notch thread! I appreciate the time you put into writing this down.

    Besides being an M60 driver for 12 years, my interest in the topic is this: I have an M88 engine (euro M6) that I converted to megasquirt some years ago. While satisfactory, it's not OEM level of satisfactory, and I'd like to take it to the next level by installing Motronic 3.3 on it. I plan to use an M50 DME with a larger M60 MAF. Most of the sensors are the same between the engines and can be easily adapted to the M88. The M50 has vanos but that function will just be ignored. Obviously this will require both tuning to the engine and tuning for the wrong sized MAF. Up to this point my knowledge on 3.3 chip tuning was that it "is possible to do". Meanwhile I coincidentally acquired a Miller WAR chip, which I understand will work in the M50 DME, however my understanding is that Miller does not facilitate changing the MAF table. So it may or may not be useless. As a side note, the S38B38 was factory equipped with 3.3 and the whole system would almost certainly work on the M88, but the parts are ungodly expensive. It uses a different type of MAF (6 pins) that is virtual unobtanium. So ripping off the maps from the B38 chip may or may not prove of any use.


    P.S. Frankly I hate software. I'd rather rewire an 850i using only yellow wire than update windows. But I'm sure I could get it done eventually.

  6. #6
    Join Date
    Jul 2016
    Location
    Seattle, WA
    Posts
    90
    My Cars
    2004 R32, 2011 A4 Avant
    This is really awesome. I've thought a lot about digging into this sort of stuff, without actually doing anything. Sounds like you've given me the keys to get started. I appreciate it!


    Sent from my iPhone using Tapatalk

  7. #7
    Join Date
    Oct 2014
    Location
    Prescott, Az
    Posts
    439
    My Cars
    '95 540i/6
    Here's the list of already available xdf's and .bin's for BMW platforms.

    http://www.tunerpro.net/downloadBinDefs.htm#BMW

    The available .BIN's for download for your application is great as a way to learn how & what is going on. For any actual tuning to be done on your vehicle I encourage you to read the original chip already in your vehicle as the base for your tune.

    This is the chip reader/burner:
    http://www.moates.net/burn2-chip-pro....html?cPath=94

    This here is the chip emulator that plugs into the chips socket in the DME. This may not work on your application. It works great on my 404DME, it would not work on a friends E30 with a 173DME.

    http://www.moates.net/ostrich-20-the....html?cPath=95

    I am more then willing to help any way I can, just understand that I am only familiar with my own project vehicle as that's what I've learned and have been tuning. Every BMW platform, application, engine and DME number uses a different variant of the code. And, I don't mean subtle changes to adapt to engine types. I mean completely re-written entire codes.

    I can not express this enough; Please have a firm understanding of engine tuning before contemplating making changes in your own vehicle. Also understand that making a small change in one table might make drastic changes in the operation of the vehicle. Please don't make blind changes to fueling tables without the use of a Wideband O2 sensor and gauge to give you real world AFR's.

    As you can see from the inside of my own 540i. I've got a permanently mounted wideband gauge with a seperate wideband sensor welded in the exhaust. As well as mechanical coolant temp, mechanical oil pressure, vacuum gauge and mechanical fuel pressure gauge just to take any of the guess work out of the operating conditions of my own M60.

    Last edited by Mykk; 06-09-2017 at 09:44 AM.

  8. #8
    Join Date
    Sep 2012
    Location
    Melb, Oz
    Posts
    136
    My Cars
    1993 BMW 540i
    Great resource. Thanks for taking the time in putting this together.

    1993 BMW 540i

  9. #9
    Join Date
    Oct 2014
    Location
    Prescott, Az
    Posts
    439
    My Cars
    '95 540i/6
    While comparing the works of other tuners that have made xdf's for other BMW platforms that utilize a similar version of the Motronic fuel injection. (413DME from the E34 525i, both red & silver label variants, also the 506DME from the U.S. E36 M3 & 075DME from the Euro E36 M3) I was able to translate and test in the real world on my car a couple more functions.

    So now we've got Injector Constant, used to scale for injector flow rate. As well as Target AFR, used to make adjustments for fuel type.



    I've also adjusted the Ignition timing from (x*.75)-48 to (x*.75)-45, which seems to make some of the ignition maps and coolant modifiers make a bit more sense.
    Last edited by Mykk; 06-13-2017 at 09:17 AM.

  10. #10
    Join Date
    Jun 2009
    Location
    Macon, GA
    Posts
    1,224
    My Cars
    '94 530iT/A|'95 540iT/6
    Great stuff! Keep 'em coming!

  11. #11
    Join Date
    Oct 2014
    Location
    Prescott, Az
    Posts
    439
    My Cars
    '95 540i/6
    This morning I've found what is supposedly the Water Temp Sensor transfer Map, as well as the TPS Transfer Map. I've also isolated three more unknown maps without header axis info. It'll be a bit before I can verify the accuracy of the new finds as I've currently got my 540i/6 torn apart and should be back on the road in a week or so. When that time comes I'll upload my Master 404.xdf with all of the maps, known and unknown.

  12. #12
    Join Date
    Jun 2009
    Location
    Macon, GA
    Posts
    1,224
    My Cars
    '94 530iT/A|'95 540iT/6

  13. #13
    Join Date
    Jun 2017
    Location
    Chicago
    Posts
    295
    My Cars
    1995 540i & 1996 328i
    Really interested in engine tuning, thanks for the fantastic write up. When I'm done with suspension, steering, brakes and bushings, I'll probably be annoying you with questions lmao

  14. #14
    Join Date
    Feb 2014
    Posts
    5
    here to bump thread and hopefully grab another 404/484 xdf

  15. #15
    Join Date
    Oct 2014
    Location
    Prescott, Az
    Posts
    439
    My Cars
    '95 540i/6
    I've given up on posting in forums since photobucket c*ck blocked images. But if you'd like I can send you my 404 and 484 XDF. Although incomplete, it should be enough to get the ball rolling on your 404/484 projects

  16. #16
    Join Date
    Jun 2017
    Location
    Chicago
    Posts
    295
    My Cars
    1995 540i & 1996 328i
    I know someone with spare engine computers, well to be fair Ross knows him, but I bought a car from him. I think he has one auto and one chipped manual. I no longer have his number but ross1 should have it
    Last edited by Billyj; 09-06-2017 at 08:14 PM.

  17. #17
    Join Date
    Oct 2014
    Location
    Prescott, Az
    Posts
    439
    My Cars
    '95 540i/6
    Curious to see whose chipped manual dme he's got

  18. #18
    Join Date
    Jun 2017
    Location
    Chicago
    Posts
    295
    My Cars
    1995 540i & 1996 328i
    Found his number I'll let you know what he says about them

    The manual computer is dinnan chipped and is for the b40

    I'll pick them up probably around the 15th or 16th. I will be out of town until then unfortunately. If you need them sooner I can give him your number and you two can work out a purchase/shipping price
    Last edited by Billyj; 09-06-2017 at 10:15 PM.

  19. #19
    Join Date
    Oct 2014
    Location
    Prescott, Az
    Posts
    439
    My Cars
    '95 540i/6
    I've already got a M60 dinan tune. I've been collecting chips from all tuners. ;-)

  20. #20
    Join Date
    Feb 2014
    Posts
    5
    Quote Originally Posted by Mykk View Post
    I've given up on posting in forums since photobucket c*ck blocked images. But if you'd like I can send you my 404 and 484 XDF. Although incomplete, it should be enough to get the ball rolling on your 404/484 projects
    that would be great. thanks

Similar Threads

  1. E34 WTB:0 261 200 404 DME m60 530i SOCAL
    By Robiniscool in forum BMW Parts Wanted
    Replies: 1
    Last Post: 10-13-2012, 07:45 PM
  2. E34 WTB: 404 DME For M60 engine
    By E34M60 in forum E34 Classifieds (closing soon)
    Replies: 0
    Last Post: 04-23-2010, 01:15 PM
  3. Replies: 0
    Last Post: 02-07-2008, 06:14 PM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •