Coding M modules in a non M car

[RSL]

I'm all stock 335is right now, I can run a log at some point and see what it does. I can almost guarante that log was a long press though, I never used DTC ever. It's either all on or all off.

0x315 only works on Z4, which is a different setup (no on/off sport, 3 modes). It should work with the switch, some rewiring, coding and maybe DME/DCT bins though. Not sure if you're trying to do this all with mix of factory parts/programming/coding or using a shield/interposer?

M button doesn't just change throttle/rng_l, it enables B_sport flag for other functions, sets EPS/servtronic and DSC. I was never able to confirm it actually did anything with DSC though. It definitely didn't turn it off and didn't seem like it did anything to change intervention from full on.

 

[dzid_]

Ok, all good info.

The reason I thought 0x315 would work on 135i DCT was the post from Olza:

About statuses (Program level, Sport and Spirited) in DCT.

Sport Status.
If Sport button (CFG) is true (x35/Z4), then Sport status triggered from Sport button (x35) or CAN 0x315 Vehicle info data bits (Z4).
Else logic compares raw Program mode with switch threshold (CFG, =5) and if >=, then Sport status in DKG enabled. This is P5-P6 (M3).
Raw Program mode is pure program level from GWS and Program button pressing. Interesting, that in Pre- and Rennstart, value is forced to 0x46 (M3) or 0x42 (x35/Z4). Seems high bits is Rennstart flag, low bits is max Program level.
This Sport status used in overrun and dynamic downshifts logic.

Program level.
Raw Program mode calculated. Then if Sport button (CFG) option is true (x35 or Z4) level is taken from 0x315 Vehicle info data bits (Z4, 1-2-3) or defaulted to P1 (x35).
Else for M3 it is taken from raw Program mode (masked low bits). Calculation of simplified Program level for x35 - if Sport status, then use Program level 2 (P2).

Spirited Drive Status.
Program level has used in Spirited drive status calculation like in this table.
View attachment 48016 GTS
View attachment 48017 x35/Z4
This status used in many logic calculations and very important.

So our target after all this manipulations with SZL and stuff to maintain correct status calculations.

About 0x399.
Status M-Drive.
As i wrote before somewhere, ST_MDRV_MOD_GRB (3 bits, 0:nochange 1:Automatic 2:Sequential), ST_MDRV_STG_GRB (4 bits, 0:nochange 1..6:Stufe) and something undocumented in DME docs which i have, lets name it ST_MDRV_ACT_GRB (2 bits, 0:not active 1:active?, 2:setdata?) - seems this is control status for incoming mdrive data interchange. Better have logs, this status is at byte 1 low two bits (mask 00000011).

, but I think I misinterpreted it that both Sport button and 0x315 are respected by non-M DCT. I think it is like you are saying, that 0x315 only listened to bu the Z4 DCT firmware.

My aim is to use stock part hardware + M DSC firmware + Servotronic + possibly a diy CAN thingy injecting extra messages. (I don't know if I care enough to manipulate its Servotronic assist level (presumably via injected 0x399))

I will not have M button, but I think DCT Sport button does the same as M button on 1M ??!!!

I think I will do one-way synchronization of the DTC using CAN injector (easy to do), so I don't have to press it or hold it (especially that its MDM status won't be visible on Kombi). My desire is:
1. GWS shifter lever to the left (M/S) shall turn fully off DTC/DSC.
2. DCT Sport mode shall just turn on DTC.

For that second one, I will have to see, because, as I mentioned, on the stock 135i, DTC-on or DSC full-off disable DCT's Sport mode accelerator pedal mapping (and "pre-boosting" thing and clutch slip snapping). Hopefully, "MDM" mode doesn't do that. I guess you can't clarify that if you never single press DTC/MDM.

PS: My car is at customs in a freaking container so I cannot test anything

 

[RSL]

I tried every which way to find 0x315 active anywhere with any mix of 335is/1M/M3 parts/bins/coding/settings. I bought the Z4 mode switch to try that setup last year, but haven't really touched anything since pulling the M3 stuff out.

0x399 works natively with IKM0S as far as MSD81 goes. 399 is fine passing to EPS and presumably DSC, but it will not pass M Drive settings to MDCT without work. The 399 message IKM0S builds has a bit disabled that MDCT needs to acknowledge it. Since 1M is MT only, that bit is hard coded off in the rom. You can pass the message on a shield with the bit enabled though and it will transfer settings to MDCT with the M button.

The only part I didn't follow all the way through on was the DSC from M button, but even M3 requires a manual long DSC press to fully disable, so that might take some work.

For the record, MDCT+M3 GWS alone will set rng_l when moving to sequential/manual mode (shifter right), but doesn't toggle the other settings that the M button does.

I can't imagine why it would take away rng_l for DTC on 135, it doesn't on 335is.

 

[amg6975]

Btw, I was stupid. In all these BMW messages I always thought there are two counters. Of course, it is probably one counter and second one is a checksum that looks like a counter for mostly static messages. I thought the offset between them is the checksum - well I guess that is one way of thinking actually.

I would be extremely surprised if there was a checksum. There are several packets that have two counters. 0x399 is actually the only one I've ever seen with a true checksum.

 

[dzid_]

0x399 works natively with IKM0S as far as MSD81 goes. 399 is fine passing to EPS and presumably DSC, but it will not pass M Drive settings to MDCT without work. The 399 message IKM0S builds has a bit disabled that MDCT needs to acknowledge it. Since 1M is MT only, that bit is hard coded off in the rom. You can pass the message on a shield with the bit enabled though and it will transfer settings to MDCT with the M button.

Do you think xHP DCT flash then would react to 0x399? I suspect xHP is based on M3 GWS, since it has some features (like kick-down clutch-open in 1st gear), that I haven't experienced on stock 135i DCT firmware.

For the record, MDCT+M3 GWS alone will set rng_l when moving to sequential/manual mode (shifter right), but doesn't toggle the other settings that the M button does.

I can't imagine why it would take away rng_l for DTC on 135, it doesn't on 335is.

I am assuming rng_L = better throttle response.
Then this thing is definitely happening and is super annoying. I have 135i N55, and it might be specific to its firmware. MHD didn't fix it. Someone mentioned that maybe 135is doesn't have that safety quirk.

 

[RSL]

XHP for DCT is definitely not based on M3 anything for non-Ms. Everything it does is available in non-M DCT, it just changes to activate/use it the logics.

At the lowest level, 0x399 is only available if car is determined to be an M Drive variant. It may work in non-M DCT if that can be set, but I haven't dug that far. XHP will have no bearing on it though.

Might be N55 or 135i only thing, but that would be annoying. Glad I don't have it lol

 

[aus335iguy]

This is probably a better place to source info on and discuss this…

M-Drive and MDM in non M cars

HI All This thread is as per the title M drive and MDM in non M cars and is a natural progression of what was being discussed in this thread here . In short M(2,3) and 1M modules have specific programming and features and as such the functionality they bring is highly desirable in non M cars...

www.spoolstreet.com

 

[dzid_]

Final note on that:

I would be extremely surprised if there was a checksum. There are several packets that have two counters. 0x399 is actually the only one I've ever seen with a true checksum.

These "second counters" I saw are in fact checksums.
It can be surprising,... because why would they add checksums if CANbus has CRC already on a hardware level? Well, software checksums are still useful to detect if a sender had for example a memory corruption of some sort.


I used your algo as a starting point and I run it on different messages.

I only saw a 4bit checksum on 0x130, besides the 0x399.

The most common checksum is 8bit though. Ids : 0x19e, 0xb8, 0x1a0, 0xaa, 0xbf, 0xba, 0x3b1
- Very similar algo to yours, but without adding "upper nible".
(The checksum for 0x194 (cruise control buttons) was different because message id was not added to the other bytes.)

def calc_checksum(work_data, msg_id):
  checksum = msg_id
  # checksum = 0  #0x194

  for byte in work_data:  #checksum removed stripped from the data first
    checksum += byte     #add up all the bytes

  checksum = (checksum & 0xFF) + (checksum >> 8); #add upper and lower Bytes
  checksum &= 0xFF #throw away anything in upper Byte

  # checksum = (checksum & 0xF) + (checksum >> 4); #add first and second nibble 0x399, 0x130
  # checksum &= 0xF; #throw away anything in upper nibble

  return checksum

(Additionally, some checksums for accelerometers and angle position messages etc, are, I believe, CRCs since they don't change linearly. ...And there are also checksums that seem to use previous sample memory, which doesn't make sense to me.)

 

[Buhala21]

Keep up the good work guys!! You are unreal. I have been following this thread for a long time and now that I bought 135i i can do these things.

 

[JohnDaviz]

Today i tried to flash the M3 DSC but we couldn´t flash.

We found everything by going from the instructions from page 1 and 2 but when we entered to the below window, there the zsub and hardware number were blank. We simply couldn´t continue from there.

I forgot to make a screenshot but we were at the below one smiply without the two numbers.

PABD and P-SGBD were according to the instruction from @Begood69

What did we wrong?!

 

[RSL]

Did you select the file in the Develop folder?

 

[JohnDaviz]

yws

 

[RSL]

Develop folder is in the right location: EC-APPS\NFS\DATA\DEVELOP and WinKFP can connect to the TCU?

Should just need to set ipo, prg, module address, select the program file and go.

 

[JohnDaviz]

That is weird. I guess we made somewhere a mistake.

 

[JohnDaviz]

So another dumb question.

I tried to follow this thread although i never was into coding or anything similar.

Because of logging with additional sensors i will install an arduino into my new engine build. So i though about other things that are possible with an arduino and can shield.

Basically what i am not sure about how to use the MDM mode.
Can i simply send can messages to the DSC only to activate MDM and set the value for the level 1-6 i want to have?

i know found also the post #110
"Yes, the DSC button and MDM button are wired exactly the same. They go to the JBBF then over F-CAN to the DSC. The steering wheel buttons go to the SZL which then goes over F-CAN to the DSC."

We may get a GWS from the M3 into our hands to see which can messages are sent where. But i fear that before that i have to activate mdrive and wasn´t sure if the DSC button will do that after flashing to M3DSC. On some earlier pages i read that after M3DSC flash the DSC button didn´t work anymore at all.

Basically ST_MDRV_DSC 101
and being able to set with an arduino connected device
ST_MDRV_STG_GRB 1-6

 

[RSL]

GWS/DKG sets DriveLogic level (1-6), which has no effect on DSC. DSC must be off for level 6 in the trans, but that's about it.

DSC button will full on/off DSC on M3DSC if it's rewired directly to the DSC module. Without rewiring, it will be TPMS reset like M3 if you use a default M3 JBBF coding. On 1M DSC, button works for on/off, but we're still not sure how to get MDM/DTC short press active.

 

[JohnDaviz]

GWS/DKG sets DriveLogic level (1-6), which has no effect on DSC. DSC must be off for level 6 in the trans, but that's about it.

DSC button will full on/off DSC on M3DSC if it's rewired directly to the DSC module. Without rewiring, it will be TPMS reset like M3 if you use a default M3 JBBF coding. On 1M DSC, button works for on/off, but we're still not sure how to get MDM/DTC short press active.

Oh dear. Okay i have to read the information here more thorough and take notes as it seems..

So the Drivelogic is set in the DME or are these tables in the TCU? Below i found posts from Olza and Carabuser talking about the Drivelogic level.

we discussed already this. there is conversion table for gws level >> program level for m3/Z4
View attachment 48465

in x35 its just P1 from GWS or if "Sport" button pressed P2 (configurable).
used for spirited trigger.
View attachment 48466

logic modes selects for MUEDE (lol) for P1-2-3 M3 or P1 x35/Z4 and MUNTER for P4-5-6 M3 or P2-3 x35/Z4. there many other conditions also for sure.

I tested this on my Z4 and 335i, the Z4 references the table at 0x10F4C. The first cell is drivelogic mode for Normal, second is for Sport and third is for Sport+.

The 335i I could only get to accept 1 drivelogic mode which was set in byte 0x10F5A which is active when sport button is pressed.

Been using those values for the last 6 months and 100% that they work. Drivelogic 6 is pretty obvious when active.

So does this mean if i have the tables defined in an XDF i can change the Drivelogic lvl at least with a flash? (As it seems to be a TCU bin...sounds like no)

 

[RSL]

Oh dear. Okay i have to read the information here more thorough and take notes as it seems..

So the Drivelogic is set in the DME or are these tables in the TCU? Below i found posts from Olza and Carabuser talking about the Drivelogic level.






So does this mean if i have the tables defined in an XDF i can change the Drivelogic lvl at least with a flash? (As it seems to be a TCU bin...sounds like no)

Drive logic level values are in the TCU and can be changed with a flash, at least in Z4/M3 roms.

M3 rom would need to be configured to work with non-M GWS and sport button first. I assume that's what you're looking at because if you had M3 shifter/drive logic button, you'd obviously have all modes selectable.

 

[JohnDaviz]

Drive logic level values are in the TCU and can be changed with a flash, at least in Z4/M3 roms.

M3 rom would need to be configured to work with non-M GWS and sport button first. I assume that's what you're looking at because if you had M3 shifter/drive logic button, you'd obviously have all modes selectable.

I am on XHP Stg3, so no M-Rom.

I guess i would need to be able to pull the XHP Flash and have an XDF to change the value in the table then. Sounds.. unrealistic

 

[RSL]

You might be able to flash M3 rom with XHP, I don't know if anyone has confirmed. If so, you would hopefully be able to modify the calibration and flash changes to it without check and signature issues. Olza might be able to offer some service as well.

I'll double check this weekend or dig through logs. Now I can't quite remember if drive logic level changed on non-M bin or not. It might've been something else that I was thinking of being limited to a value on non-M.