TunerPro User Forum

Hairyscreech

Go with D3 then. probably a mistake I have picked up somewhere.

0x3C25 did not trace as active when the ECU was running. I will have to look into that.

Hairyscreech

I started marking the ROMs on the disassembly with an A_"name" for active all the time and B_"name" for active only when waiting for crank signal. This has the advantage of making the fully active ROMs hit the top of the list. I have a ton more data to add in to complete the A_ l...

Hairyscreech

I have looked extensively for something that explains the actual creation and structure of the ADX files but haven't been able to find much. Can anyone explain what the perpose of each of the values in the Hex cmd string is? For example I have an ADX I have managed to knock together that works with ...

Hairyscreech

I have just used my bench test ECU to take hit traces of the full binary in tuner pro under both running (1500rpm) and waiting for crank trigger conditions. I have dropped these onto the "413 and 506 maps and notes" excel file and it clearly highlights the areas of code that are running an...

Hairyscreech

General FYI - the square wave from daquarta is enough to create a cam sync if just pin 17 is hooked up to the right channel and daqarta is set to 1-0 every 360 degrees. Correct cam offset is 40 degrees and I have the Vanos table switching functional. You can then switch off and on the right channel ...

Hairyscreech

Ok, INPA worked fine. The obvious mistake became clear when I started scanning the ECU though. I put my ostrich back into the E30 to do a test on a break upgrade and a new AEM wideband and because of that I dropped the stock ROM chip in place on the ECU. A stock ROM chip complete with EWS. :shock: :...

Hairyscreech

Ok, stuck a small transformer into the crank line to decouple the sound card output and that allows me to maintain a waveform of about 5v peak to peak on the scope when the ECU is powered up.

Also am now able to get the CEL to light.

Going to try scanning it with INPA.

Hairyscreech

Its a 484 v8 ECU. I have a 300w desktop PC power supply as a bench test supply so it is hooked up to the 11.97v from that. Mostly cause it gives a very well regulated 33.v, 5v and 12v. 12v rail is 19A I believe I can pull 15v out of the supply as well with some trickery but I'm surprised if the 11.9...

Hairyscreech

No Isolation transformer. I assume that could be part of the problem. In fact nothing in there at all at the moment, I was hoping the 5v output from the car would be enough to trigger things without any trickery. I have a few transformer coils scavenged out of an old power supply. Not checked for fa...

Hairyscreech

Thanks, seems to all be working on the daqarta front but I'm still not getting any life from the ECU. How do you have your VR sensor input wired up? I have a feeling there is some fundamental of what I am trying to do that I am not understanding at the moment. At the moment I have tried direct to le...

Hairyscreech

I have in my notes file courtesy of our man in Finland: "actually timing table for primary current switching on before desired ignition event, and same x*0.75 conversion works with it. if you want to calculate new dwell table for different coils, correct formula seems to be (this includes all, ...

Hairyscreech

My new sound card arrived, is now installed and working, my logic analyser should arrive early next week. I had a play with daqarta and an oscilloscope and it does a fairly passable job at making a square wave form so cam sync should be possible. The square signal dipps about 0.2v across the top at ...

Hairyscreech

The biggest advantage to the INPA output that I can see is the ability to put out the data in the registers contained in the ECU processor, there are a few in the low numbered addresses that are not on the RAM chip but are in the MCU. If you are trying to connect to a Red label 413 ECU then you will...

Hairyscreech

From what I know of the code the crank decoding is the biggest single part of the code, if the function I have labeled as the CPS detection is correct then it's a massive task to understand. A hall effect would be easy as its interpreting a digital input but with the VR sensor there is tons of thing...

Hairyscreech

Hmm, 5.9%. In that situation its not too bad, certainly if I was turning something faster than 8000rpm then it wouldn't be running Motronic. I am waiting for another cheap sound card (picked up a PCI not a PCIe by mistake :oops: ) but then I should be able to do some trials with Cam sync and see wha...

Hairyscreech

Just solved the question about the single ignition driver in the M1.7 and why the M43 coil packs are individual inside the block of coils. The simple answer is there was a single ignition coil E36 316i that used a distributor. The M43 with the big coil packs uses a slightly different version of that...

Hairyscreech

It would make sense if it was a CC195 given the era and the commonality of that chip. I did a bit more digging into the 0x2000 to 0x3FFF speed penalty issue. It seems that most of the code in that area is either only read once or is jumps to another ROM. The only one I can see that may be impacted i...

Hairyscreech

Your right that is odd, the firing order is 135624 so that sequence is correct for 624 but 3 and 5 are reversed. I think this is due to the ECU running in wasted spark mode when there is no Cam signal for sync. If they are laid out in firing order then it means the channels are triggered in an uneve...

Hairyscreech

The 30131 on this 8 cylinder is pretty much the same but the ignition drivers are set out 15486372 (going from pin 2 to pin 9).

Hairyscreech

Seems like this B58039 PLCC44 chip, number "S750" has significant role in injection output stage (and maybe something else) controlling. Chip "S705" sends eight pieces of data packets in burst to that "S750" on every injection event, three times at one crankshaft rotat...

Hairyscreech

From 80196 user guide: "The execution times for the instruction set are given in Figure 3-3. These times are given for a 16-bit bus with no wait states. On-chip EPROM/ROM space is a 16- bit, zero wait state bus. When executing from an 8-bit external memory system or adding wait states, the CPU...

Hairyscreech

If that's the case then maybe this is of use to you:
https://sigrok.org/wiki/Hantek_4032L

Looks like a 3rd party application for the 4032.

Hairyscreech

I will have to take a look when I get home. I was thinking of writing a bit of simple arduino code to do it but outputting two digital square wave signals is easy, generating a VR sensor signal is not. I was wondering how well the ECU would function if it was fed a square wave crank signal or given ...

Hairyscreech

I just dropped an old 8051 onto that M1.7 board to try it out on a few pin, was so easy after doing two I went direct to to M3.3 Bit of heat with the iron and a pair of the tweezers below and out it came, run a jumper over the top of the chip and around to a ground pad. https://www.thonk.co.uk/wp-co...

Hairyscreech

Great news. That paves the way to custom firmware and possibly better access to the current firmware. I think even if we did not have that ROM section on the EPROM then we could have pulled it off the MCU, it would just have been more difficult. How did you go about lifting that pin? Iron onto the e...

Hairyscreech

I am inclined to say everything in your post below is correct, which is good cause it means everything I can see on the disassembly so far is also correct... :lol: I will send you a link to a live copy of the disassembly I have so far, that way you can keep up to date easily. 0x4000 is 5AA5h and is ...

Hairyscreech

I will double check, the EWS I have for the E36 does not include the M43 so you could be right. I was under the impression they were "smart coils".

I dropped the most up to date info into the dropbox with as many pins listed as I can achieve at the moment.

Hairyscreech

Yep we have the 30117 chip connected to the knock sensors. I will upload some (probably a bit bad due to lighting) pictures of the board I have on my desk to the dropbox right now. I have also been working out pins on the processor. I have put a bmp file in the dropbox photos folder listing everythi...

Hairyscreech

I have also just been through the wiring diagrams for the M3.3 V8 ecu and the M3.3.1 I6 ECU and can report that they are nearly perfectly pin compatible. The only changes I can see are that the V8 ecu uses a VR cam sensor vs a Hall effect on the I6. Pin 7 is used for a fuel injector on the V8 and VA...

Hairyscreech

Something I have just found out for future reference, the AN82526 chip on the board is an Intel CAN communications chip and seems to hooked up to the transmission control module lines. It looks from the traces on the board like it is only wired up to transmit and it receives its information from tha...

Hairyscreech

Yes and no, that value is actually a constant used in the load calculation so changing it will adjust the fueling but it also screws with every calculation that uses the load value which means spark, acceleration, knock control, diagnostic checks, literally everything will be adjusted by the same am...

Hairyscreech

The older 3L M3 ECU is a Motronic M3 with a dual vanos expansion board.

This means all of the same old motronic rules apply.
Thus there is not really a true "injector constant" as far as I am aware.

What are you trying to do?

Hairyscreech

I just got hold of a 484 V8 M3.3 ecu, not sure if it is a 3l or 4l ecu but it was super cheap as it is an EWS version of the V8 404 and people here dont seem to understand they are all the same bar the software. I will add the BIN to the folder with the others once I rip it. I might have to get my h...

Hairyscreech

Worked out something else as well, it looks like ROM 5081 is the beginning of the main program loop. I might try to get hold of a 413 to take even higher res photos and strip like has been done in that M1.7 thread over on R3v, I started trying to map out the pin inputs on the processor a while ago b...

Hairyscreech

You might be on to something there. A little while ago I patched in Olafu's RAM dump and some data I managed to capture via INPA to fill out the missing regions of the code. (I can't say the missing data is correct or perfect as they were snapshots taken from running engines, for all I know the data...

Hairyscreech

Thank you Acki. I will take a look and see what is lurking in the code this week if I get time (its cold outside so I expect I will). Can I ask what makes you suggest that? From what I can see the 80196 processor is quite different to the older 8051 and the code is nowhere as easy to follow. https:/...

Hairyscreech

Nope, but I guess I have now :) A bench test ECU might be the final destination of the ECU in the car at the moment as I have a RusEFI unit to go into the car once I have worked a few things out. If the square wave is not very good then it would be trivial to send that signal to an arduino and have ...

Hairyscreech

Sorry for the pretty late reply, work commitments meant a slightly abandoned project for the summer/autumn. Check your CTS sensor against the measured values for the M20 and M50 sensors in the excel file in the dropbox in the M3.3.1 thread. They are very carefully measured true resistances for OEM a...

Hairyscreech

Unfortunately not as we don't know how they work yet. I have had very little time to play with the car due to work commitments and the landing of a RUSEfi unit on my desk. However I still intend to keep playing with this one and maybe implement some of the functions into the RUSEfi unit as it is sim...

Hairyscreech

Be careful that you are not tuning to a new but still incorrect MAF.

If you can I would validate the cheap MAF against a known good working Bosch MAF.

Hairyscreech

Sounds like it could be. Set your knock activation load to "FE" and see if that helps, that should make it only activate at very high load (a load value of 12+).

Hairyscreech

PM evil, I am sure he can send you a copy and repost the link.

Hairyscreech

I think there is only about 4 different offsets/map positions that fit the different versions of the M3.3.1 (early non EWS nonM, Early non EWS M, Late EWS nonM and Late EWS M) Which means the info in the big motronic thread will guide you on finding the maps in the 715 chip. {I am not counting the A...

Hairyscreech

Another quick update. I spent a couple of late nights on this to get the interface working with the tunerpro ADX files. I found an ADX from a LS V8 and took a bit of time to work out how it all fitted together, the upshot of that is I was able to create a similar ADX file that connects to the ELM237...

Hairyscreech

I'm getting very close to having the arduino logger working at least for RPM, Load, MAF, CLT, IAT, TPS and Lambda which should be enough to tune with. I have been struggling with similar issues getting the tunes right with this hacked onto an M20 due to the difficulty of getting the acceleration rig...

Hairyscreech

Wanted to put an update into this since it was looking pretty dead, I have just been a bit busy make in my car work first (you know, helps sometimes :x ) I have been bashing away on this and now have the following bench tested and believed working: Vanos on/off RPM Spark angle Cam angle CLT temp Int...

Hairyscreech

The idle target will work if the IAC table is within the correct range for the engine, the M50 maps will be too much air flow for the M20 at idle, the IAC table only alters the IAC valve but the idle speed tables adjust ignition timing to alter idle as well. The ignition is varied at idle around the...

Hairyscreech

They should both work just fine on the 413 as there are practically no changes to the hardware even between the 6 and 8 cylinder M3.3.1 Ecus. (we have seen a 6 cylinder ECU try to pulse the 2 missing Inj/Ign drivers if loaded with an 8 cylinder BIN). The best way to be sure is to check out the BINs ...

Hairyscreech

Very similar to the way a 413/506 works, you should be able to find 90% of what you need in the discussions on here.

Hairyscreech

I was actually getting similar up until this weekend, I have been struggling to get the acceleration enrichment right for the M20 and first changed the "0xDC21 D0*D5 4x4 Acceleration enrichment quantity by RPM and LOAD" to reflect the equivalent in the 173 maps and this had some effect but...

TunerPro User Forum

Search found 196 matches

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

ADX file ELM setup (Hex cmd String)

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: M3.3.1 motronic (413 and 506) tuning and XDF update?

Re: Has anyone on here disassembled the 413 code?

Re: DME 413 (silver) knock correction

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?

Re: Has anyone on here disassembled the 413 code?