Breaking the Motronic code, Redux. 404DME M60's

[Mykk]

Hey everyone, I'm going to remake this thread as an addendum to my previous thread on the same subject. I wanted to take this opportunity of photobucket destroying the internet to update this info thread with new pics and a few corrections of the the process.

I am by no means authoritative on this subject nor a pro tuner on this platform. All I can do is share the information that I have learned, collected and that I personally can currently comprehend up until this point. I am still learning new things about this process every day. Afterall; I'm a gearhead and not a programmer or engineer.

Let's start with 'How do I get the code from my car to start the tuning process?'

First remove the DME from the vehicle. Once on your work bench or preferred work space pry the 6 tabs back that hold the top plate to the DME base and pry up the plastic center pin rivit located in the middle of the DME base. More then likely those tabs will break off, don't worry about it:





Flip over the DME and remove the 4 torx headed screws holding the DME cover on.



With the DME cover removed next step is to move the top circuit board out of the way. Remove the torx headed screw that holds the top print board down.



Lift the rear of the print board to unsnap from hold down clips then begin to pry the tabs that hold the print board into place in the electrical connector side:









With the top print/circuit board loose, but still connected to bottom circuit board by way of wire ribbons you can now, Gently!, pry the chip loose from it's socket





Install chip into the chip reader/programmer: I use this inexpensive TL866CS reader and MiniPro V6.6 software to read and program chips. I also have a Moates Burn2 and Flash & Burn software but prefer the TL866CS.



Read the chip. Save the file. The stock chip is a 27C512, you can see I'm using the 27SF512 option to read it. Either setting will work. The 27C is UV erasable only, thus the exposed window on the chip. The 27SF is erasable electronically by the reader program. Here in my part of Arizona I can leave the exposed chip outside in direct sunlight for a couple days to a week in order to fully erase the information on the chip. Once the chip is blank the TL866CS can program the 27C512 chip, Burn2 can not.



So now you've got a 64kb file of binary code that gets viewed in hexadecimal. It's like looking at an alien language for the first time.



Okay, there it is. The tune that runs your vehicle.... now what? As far as editing software is concerned, you've got options. Advanced tuners like to use a program called WinOLS, I didn't find this program user friendly and sought other options. The reason this program is popular is because for several applications of all makes & models the tuner can export the engineer released damos file in A2L format and have access to every map straight from the engineers mouth. I have not found such a file for the 404DME. For very basic code viewing I use a program called HxD. HxD is also good for comparing multiple tunes side by side and viewing the differences. Another popular tuning software (my preference) is TunerPro. Or in the case of the equipment I use TunerProRT for realtime emulation. At it's basic level Tunerpro only needs two fundamental files, the .BIN which is the saved binary file that we read from the chip earlier. Then also an .XDF file that acts as the BabelFish to decipher the raw code into a human interface that we can use to tune. .XDF files are individual tuner made files specific to each application. Because they are tuner made by enthusiasts they have a likely chance of being incorrect on a lot of different variables...especially for the M60's 404DME in which very little engineer data has been released to the public. TunerPro also uses a 3rd kind of file .ADX which act's as an interface to live data as the engine is running for datalogging and even setting up virtual gauges. There is no known .ADX file for the 404DME.

The Bosch Motronic version M3.3 formatting that runs our 404DME equip'd 530's & 540's has two distinct sections of coding. The first section of code has to do with the assignments and functioning of the specific flavor of the 8051 variant of microcontroller. The 2nd section of the code is what we will be focusing on, located there are all of the ignition timing maps and modifiers. All of the fueling maps and modifiers. DTC's. Transfer functions. Scalars & functions. Everything we need in order to tune:

The maps in Motronic M3.3 have whats know as axis identifiers and header information. Several axis identifiers are still a mystery, but from my research here's what I've found:

In hexadecimal:
D0 & CE = Engine RPM
D7 = Water Temperature
D3 & D4 = Intake Air Temp
D5 = Load
D6 & CC = Throttle Position Sensor
D7 = Water Temperature
D8 = Voltage
1C = Vehicle Speed/KPH

Unkown's:

CB, CF, D2, D9, 1D

The map header format in byte sequence is; Axis identifier, how many bytes the axis is, then the axis labeling.

For example;
In hexadecimal: D0 0C 05 0A 0A 0A 04 0C 0D 07 10 0A 1E 60

Converted hex to decimal: 208 012 005 010 010 010 013 012 013 007 025 010 030 096

D0 is RPM, the axis is 12 bytes long. In order to decipher axis labeling you work backwards. In hexadecimal FF is a blank byte, it tells the programming to ignore this byte or "reset". FF in decimal is 255. Starting at 255 you subtract the last byte's value and then use an engineer designated factor and offset. For RPM it's X*40. (Occasionally axis headers reference 256 for the equation, like this one)

256-96 = 160
160 * 40 = 6,400RPM
30 * 40 = 1200
6400-1200 = 5,200RPM
10 * 40 = 400
5400 - 280 = 4,800RPM
25*40 = 1000
5120-520= 3,800RPM
7 * 40=280
3800-280= 3,520RPM
13*40=520
3520-520= 3,000RPM
12*40=480
3000-480= 2,520RPM
13*40=520
2600-520= 2,000RPM
10*40=400
2200-400= 1,600RPM
10*40=400
1800-200 = 1,200RPM
10*40=400
1400-400= 800RPM
5*40=200
800-200= 600RPM


Let's look at that code:

Here is a Map that starts with that D0 identifier. After the D0 axis identifier & header info is another identifier of D5, for Load. We can also see that this is a 12x10 map based on the header info.



Let's look at that Map in decimal format:



The 120 bytes after the header axis info (12x10) are the actual values the tuning uses for whatever this map might be; ignition timing, fuel...etc

I know from my experience that this specific Map is Part Throttle Ignition Timing. There is a separate Map for Idle ignition timing as well as another Map for Wide Open Throttle ignition timing. Using an engineer specified formula of (X*.75)-45 we can translate the raw data in the decimal format of the code into actual human interface of crank degrees that looks like this (with RPM on Y-axis and Load on X-axis, low load is on left side of map. As load increases it draws from cells heading to the right). Keep in mind, this is one of many timing modifier maps. The value expressed here isn't the actual real time ignition timing event happening in the cylinder as there are several other maps working at the same time to add or remove timing based on temperatures, RPM and load.

This is the part throttle timing map from my 540i/6:



This one is from a 540i Automatic:



..and this one is a 530i Auto:




In the code at the end of the maps is a hexadecimal index. It has the hex addresses of every map used by the DME. Equating to 130 different maps, not including transfer functions, DTC's, scalars, switches or functions.



My own 404 XDF that I've been building for a couple of years now has roughly 152 different maps and functions.

I'll be back to update and keep giving details & examples as we fall down the rabbit hole....Next I'll talk about fueling, and some of the equipment used along the way to tune. Cheers -Mykk

[84318i]

Mykk- thanks for documenting this and sharing ! You are the man, and I'll come back to this thread for more !

[Sir Montalbon]

+1, good work!

[Mykk]

An example of one of many fuel control maps:



A D0 x D5, 4x3 Map. of raw data with values ranging between 128 & 136.



I know from my experience that this table is main Idle Fuel:



In this version of Motronic the value 128 seems to be a generalized value for stoichiometric fuel. Higher numbers richer, lesser numbers leaner. if I had to guess why it's because half of 256 is 128.

By applying a conversion to the Map I can put the raw values into a recognizable AFR ratio:





A note about using these fueling tables in AFR format;These Maps are modifiers and work in conjunction with other Maps as well as many unrepresented variables. The AFR values represented here are not directly related to actual AFR burn in the cylinder. I use AFR in these tables so we can have an understanding of how drastic or subtle the changes are. If you see some extremely unusual rich or lean AFR's commanded in any one cell there is likely another table somewhere offsetting that cell. Always tune with a wideband sensor and gauge.

In my own 540i, with O2's/Lambda turned off for open loop. I set the fuel Maps to 14.7, then once the engine is up to operating temperatures I adjust the Injector Constant value until the wideband O2 gauge matches the commanded AFR in the Maps. Once the 14.7 in the Maps matches the 14.7 displayed on the wideband. Tuning these tables by AFR seems fairly accurate, when I command 13:1 or 12.5:1 for power the actual AFR's on the wideband follow suit. Command 15.5:1 for lean cruise, the AFR's again match the wideband.

[Mykk]

I've always been interested in EFI tuning. I started with GM OBDII (Silveradeos, Vettes, GTO's), this BMW was my first experience not only with OBDI tuning but also Bosch Motronic. It is also my first experience with code. It has been quite the learning experience. Although, I personally still enjoy the old carburetor and distributor tuning.

I started this project with a Miller W.A.R chip. I ran it for a while but was underwhelmed by the available control tables.



I decided to go back to the original Motronic operating system and just learn how to modify it.

The available .XDF from TunerPro website leaves much to be desired. Very basic tables, a few are incorrect...and viewing the raw code info without conversions. It can be discouraging when you don't know what you're looking at. But it's a starting point.



After a few years of not going out on the weekends; studying the hex code, comparing and adapting similar versions of Motronic, asking for help on tuner forums. I feel I now have a usable XDF that can cover most of the 404 M60 tuning needs. However, I am still making corrections and discovering new things everyday. Just when I think I figured out a mystery map in the code I learn a couple days later that someone else figured out what it does years ago and how wrong I was. You can also see how many maps and functions are still a mystery and I need to test them.

[Mykk]

One of the neat tricks some tuners do when they don't want to run a MAF sensor. They unplug the MAF harness, fire up the car and then tune a table located @ hex address C8CD, It's a 6x7 map of engine RPM vs Throttle Position.



It's really meant as a limp home mode in case of MAF failure. But tuners are treating this as an option to have Alpha-N.

Some guys even make their own much bigger map in the blank space of the end of the code and then change the address in the index so that the tune will draw information from the new, bigger, custom map for better tuning resolution.

Another trick. Not on the 404, but done on the 506DME and the 413DME. The Engine Rev Limit RPM is a vehicle speed based map. If you change the header info so the first cell reflects 0kph and then adjust the rev limit to a lower rpm. You now have a 2 step launch control.



Strange thing is; there is a map in the 404 DME that is vehicle speed axis and is very similar to the 506/413 RPM limit vs speed map. A quick test this morning showed that my tuning didn't draw information from this map. But more testing needs to be done as there is another map with same axis and header info that may be threshold/entry point for this map.

RPM limit/ Launch control map 506DME from M3, Bosch Motronic M3.3.1:



Unknown map in 404DME from 540i, Bosch Motronic M3.3:

[Mykk]

Here are few tables that have cleaned up some driveability issues for me. Have you ever been cruising around town at very light throttle probably between the 1800-2500rpm. Then occasionally the car will do a nose dive as if you've taken your foot off the accelerator pedal like you're decelerating but you were just cruising?

These tables are the switching points for TPS to go from Idle tables to Part Throttle tables and then Part Throttle to WOT tables:

[dangerwillrbnsn]

Such cool information Mykk! Keep going, I'm reading with great interest. I'd volunteer to let you play with the tune on my 540/6. Or my 525/t.

[Mykk]

I've got a 540i/6 factory tune. Anything you would like to know?

[motorokr718]

This is all amazing! Always heard about how powerful the motronic stuff is but never really understood why/how. Good on you for taking the time to figure this all out. I'm running megasquirt 3x on my turbo 540, but some of this information is still immensely helpful; like the part throttle/WOT switching values and ignition timing values. DUD helped me out with my timing table since he's turbo'd as well. But being able to get stock driveability by going off of some of the OEM parameters will definitely be a long-term goal that this thread will help with.

[Mykk]

I've been focusing the past couple of days on this bit of code here:



These are two 56x2 tables of diagnostic trouble codes. One table is the CEL enable, the other is the blink code from the stomp test.

The first table of CEL enable is viewed in decimal it's a two byte format of code and then on/off. "0" being no CEL enable, "16" means turn CEL on when this code is present.

The 2nd table is viewed in hexadecimal and is in little endian format, which means we read the 2nd byte of information first. These are all of the 12XX flash codes.. or "one blink" "two blink" "four blink" "two blink"



In order to identify which code has a CEL enable we reference the codes used by the scanning software for diagnostics.

1 Fuel Pump Relay or RPM Signal
2 Idle-Speed Controller
3 Injectors (4cyl-1,3; 6/8cyl-1,5; 12cyl 2,4,6 or 8,10,12)
4 Injectors (DME 3.3.1 Cyl 4,6)
5 Injectors (DME 3.3.1 Cyl 3,5)
6 Injectors- General
7 VANOS Relay or Injector cyl6 (DME 1.7.2)
8 “CHECK ENGINE” Light Failure
12 TPS or Lambda Sensor (M3.3.1)
13 Lambda Probe
15 Knock Sensor 1 (DME 1.7/DME 3.1)or Ignition Fault (DME 1.7.2)
16 Ignition System or Cam/Crank Position Sensor
17 Cam Position Sensor
18 DISA Valve (DME 1.7.2)
19 Electric Fan Output Stage
20 Cruise Control
22 Ignition Fault Cyl 7
23 Ignition Fault Cyl 4 or 6
24 Ignition Fault Cyl 4 or 6
25 Ignition Fault Cyl 1 or 5
26 Voltage Supply
29 Idle Speed Controller
31 Injector on Cyl 3 or 5
32 Injectors (4cyl 2/4; 6cyl 2/6; 8cyl 8/2; 12cyl 1,3,5 or 7,9,11)
33 Injector on Cyl 1 or 3
35 Injector on Cyl 2
36 EVAP Canister Valve
37 Lambda Heater Relay
38 Lambda Heater Relay
41 Air Flow Sensor
42 Speed Signal or Knock Sensor 2 (DME 1.7.x or 3.3.1)
46 Electric Fan
48 AirCon Compressor Shut Off Relay
49 Injector on Cyl 2
50 Ignition Fault on Cyl 1 or 3
51 Ignition Fault on Cyl 2 or 8
52 Ignition Fault on Cyl 5 or 3
54 Voltage Supply
55 Ignition (Final Stage)
62 Signal (EML)
63 Torque Converter Lockup Clutch
64 EGS/DME Connection Error
65 AirCon Compressor
66 Theft Warning System (DWA)
67 Crank Position Sensor or Knock Sensor 4 (DME 3.3)
68 Knock Sensor 3
69 Knock Sensor 2
70 Lambda Sensor (DME 1.7.x or 3.1) or Knock Sensor 1
73 Vehicle Speed Signal (VSS) or TPS
76 Idle Speed Setting – CO Adjustor
77 Intake Air Temperature Sensor
78 Coolant Temperature Sensor
81 Theft Warning System (DWA)
82 MSR Engine Torque Regulation or AirCon Compressor (1.7.2)
83 ASC (EML)
85 AirCon Compressor Relay
100 Amplifier 1 in DME Control Unit
101 Amplifier 2 in DME Control Unit
150 Knock Sensor 1
151 Knock Sensor 2
152 Knock Control
153 Knock Control Voltage
200 DME Control Unit
201 Lambda Regulation
202 Control unit
203 Ignition system or Lambda Sensor
204 Idle Speed (EML)
205 Ignition Timing Intervention
206 Knock Control Test Pulse/Control Modules
207 Knock Control Regulated Voltage
210 CAN Interface
220 EWS 2 Immobilisation
252 EVAP Canister Valve
255 Control Unit -Internal error
333 Control Unit -Internal error


The stomp test blink codes in the 2nd table decipher as :

DME Control Unit	1211
Air Mass/Volume Sensor	1215
Throttle Potentiometer	1216
Output Stage, Group 1	1218
Output Stage, Group 2	1219
EGO(O2) Sensor 1	1221
EGO(O2) Sensor 2	1212
Lambda Control 1	1222
Lambda Control 2	1213
Coolant Temp. Sensor	1223
Intake Air Temp. Sensor	1224
Knock Sensor 1	1225
Knock Sensor 2	1226
Knock Sensor 3	1227
Knock Sensor 4	1228
Battery Voltage/DME Main Relay	1231
Throttle Idle Switch	1232
Throttle WOT Switch	1233
Speedometer A Signal	1234
A/C Compressor cut off	1237
A/C Compressor	1242
Crankshaft Pulse Sensor	1243
Camshaft Sensor	1244
Intervention AEGS	1245
Ignition Secondary Monitor	1247
Fuel Injector 1 (or group 1)	1251
Fuel Injector 2 (or group 2)	1252
Fuel Injector 3	1253
Fuel Injector 4	1254
Fuel Injector 5	1255
Fuel Injector 6	1256
Fuel Injector 7	1257
Fuel Injector 8	1258
Fuel Pump Relay Control	1261
Idle Speed Actuator	1262
Purge Valve	1263
EGO Heater	1264
Fault Lamp (check engine)	1265
VANOS	1266
Air Pump Relay Control	1267
Ignition Coil 1	1271
Ignition Coil 2	1272
Ignition Coil 3	1273
Ignition Coil 4	1274
Ignition Coil 5	1275
Ignition Coil 6	1276
Ignition Coil 7	1277
Ignition Coil 8	1278
Control Unit Memory Supply	1281
Fault Code Memory	1282
Fuel Injector Output Stage	1283
Knock Control test Pulse	1286

[Billyj]

Thank you so much for your hard work. I haven't read through all of this yet but I'm playing with a low boost turbo build and tuning is the one aspect I'm still not comfortable with (maybe welding too haha). I kinda want to make a donation now

[Mykk]

Here's an engineering/programming mystery that will take someone smarter than I to figure out. At the end of the code are 10 hex addresses written in the code:



C0 00, C1 1A, C2 A6, D03E, D1 4A, 42 EA, 44 04, 1A 2E, 1E 2E, C0 00


When you visit those addresses in the code you get two bytes that self describe that exact address location in little endian format:





...etc.

C0 00: Beginning of control data, Rev Limiter, Speed Limiter, Injector Constant, Target AFR...etc

C1 1A: Beginning of DTC data, CEL enable, Flash Codes, DTC entry/exit protocols & fail-safes.

C2 A6: Beginning of MAF table, Transfer Functions and MAPs/Tables.

D03E: Beginning of Index of MAPS, or known as Table of Tables.

D1 4A: End of all Data, Maps & controls.

----------------Here comes the tricky part----------------

These tables are in the microcontroller side of the code in the 1st section of the tune, it's the first time I've seen any code point direction to the controller code.

42 EA: This section mimics the format of the Control Data, Rev Limit, Speed Limit, Injector constants..etc. But some values are different then whats in 2nd part of code.

44 04: This section mimics the DTCs, CEL enable, Flash Codes, Entry/Exit protocol. Again, with a couple differences compared to 2nd part of code. All CEL enables in this part are turned off.

1A 2E: The next two addresses reference a blank section of code at the beginning. The theory here, since addresses 0x0000 - 0x2000 are used for RAM and we can not read nor see that code these two pointers reference information currently being used in the RAM.

1E 2E: If these two address follow the pattern as the previous, that would mean there is a version of the MAF table, Transfer functions, Maps, and Table of Tables being used and modified in RAM. Unfortunately that couldn't be because the RAM size isn't nearly large enough to accommodate.

C0 00: Beginning of Data in 2nd part of code.

[84318i]

That's cool ! Does Carsoft adapter plug into the diagnostics port and is able to read all that libe data in the screenshot from it ?

[Mykk]

I've been plugging away a bit more on the 404xdf, I have some cleaning up to do yet but a few drastic corrections have been made. I've also had the pleasure of adding an Alpina B10 M60B40 tune to the collection and seeing what and how was tuned in the Alpina, the Alpina .BIN shifted a few things around so the 404xdf wouldn't work with it but all of the same maps with the same functions in the same coding order were present as in the 404.

The Alpina tune also uses the same microcontroller section of code as the U.S. 530's and Euro 540's. For those interested in the Alpina M60B40 ignition timing:



I'll upload and share the most recent version of the 404xdf in a couple of days. This may be my final 404 xdf version as I've decided to switch over to a standalone EFI. I have a few race events coming up soon and won't have the standalone wired, running and tuned in time. So I'll will be using the 404DME for at least a little while longer.

[Mykk]

A correction in the axis descriptors mentioned above. It turns out D5 and D6 are both "LOAD" axis. D5 is a smoothed and buffered simulated LOAD and D6 is a raw LOAD value. There are a few tables to control a max cap on the simulated LOAD value as well as the delay/latency from when D5 reacts to changes in D6.

Also a few developments in accel enrichment have made, tables for Enrich Quantity, Temperature Correction and Fade Out Rate have been found and identified.

A few more Knock control tables have been identified as well. It will all be in the next 404.xdf release, I've decided to make a 484.xdf using the same tables at modified addresses in case anyone wants to take on tuning their 484 DME (EWS alignment may be necessary). I've also made an XDF for the Alpina B10 4.0L tune but couldn't imagine many people would need it seeing as only 49 of these cars were made.

BTW, I've currently got a slightly modded version of the Alpina B10 tune loaded on my emulator running my car...I can't report on how it runs yet as I need to remove transmission and replace clutch before I can drive it again. But it sure sounds cool.

[Mykk]

A cleaned up, revised and corrected version of the 404.xdf.

Still some information missing. But should be enough to get the ball rolling for most:

https://drive.google.com/file/d/1WZM...ew?usp=sharing

[hakentt]

I created that original XDF file for this DME back in 2009 and sent it to Tunerpro for them to post it up. My goal was for people to get on it and start discovering more about it. Seeing this thread makes me happy. You don't need to discover everything but just things that are needed for tuning

[Mykk]

HakenTT, do you know how to apply the temperature factor and offset to the header info to get accurate temp axis?

[hakentt]

HakenTT, do you know how to apply the temperature factor and offset to the header info to get accurate temp axis?

I do not.

I just opened one 404 ecu today and I see it has factory eeprom marked 1 267 358 772* with (*) at the end, I think this is where BMW tried to change the software to save the nikasil engine block from US fuel and ultimately didn't work. So I wonder if anybody has original software that came with the car back in 1995?

[Mykk]

Here's my collection of stock 404 chip reads. See if the Dropbox link will work for you.

https://www.dropbox.com/sh/9bhg4mjk7.../BINs/404?dl=0

[hakentt]

Here's my collection of stock 404 chip reads. See if the Dropbox link will work for you.

https://www.dropbox.com/sh/9bhg4mjk7.../BINs/404?dl=0

Do you have any Euro 540i reads?

[Mykk]

The 404 tune downloadable from TunerPro website is a "Euro" version of the code. The majority of the differences between Euro and U.S is in the firmware side of the code.

As weird as it sounds, if you wanted a stock .BIN to run as an upgrade for the 540i 404, run the 530i .bin, it uses the "Euro" version of the firmware (even the U.S. models) and has a more aggressive timing map

[jehu]

has anyone who's studied this seen how the Map deals with an O2 fault specifically in a 'short to ground' fault? Like is there a way to understand default values that control timing , fuel, firing etc if an O2 sensor is shorted to ground and not operational?

Just wondering how much performance is left on the table in such a state.

[Mykk]

has anyone who's studied this seen how the Map deals with an O2 fault specifically in a 'short to ground' fault? Like is there a way to understand default values that control timing , fuel, firing etc if an O2 sensor is shorted to ground and not operational?

Just wondering how much performance is left on the table in such a state.

If I understand correctly, you're wondering how the system functions if kept in open loop.

Everything is Load based, and how the sensor inputs affect the calculated Load. All Injection maps and timing maps use Load as an axis, for the exception of temperature based tables.

There is a table in the motronic code that switches on/off O2 sensor feedback based on current Load so under heavy acceleration and WOT the system ignores O2 sensors.

I kept mine in open loop with narrowband O2's removed from vehicle. It ran fine.