Control Bits

mrf582 · **Posted:** Tue Oct 21, 2014 5:35 pm

Most of these can be easily toggled using MS41 ECU Portal
http://www.romraider.com/forum/viewtopic.php?f=58&t=17262
* Byte 5 CAN bus and MT/AT related stuff not yet supported.
* Byte 8 DTC/MIL related stuff not yet supported.

*** Reference Information ***

Byte 4 (need to analyze all references to PARAM04)
Bit 5 = 0 = VANOS delete

Byte 5
Bit 0 to 5 = CAN bus and MT/AT related.
Bit 6 = unused?
Bit 7 = 0 = Knock Sensor delete

Byte 6 - MS41.2 & MS41.1
Bit 3 = 0 & Bit 4 = 1 = 2 channel O2 (2 pre-cat, 2 post-cat)
Bit 3 = 1 & Bit 4 = 0 = 1 channel O2 (1 pre-cat, 1 post-cat, only bank 1 active)

Byte 6 - MS41.0 only
Bit 2 = 1 = 2 channel O2
Bit 2 = 0 = 1 channel O2

Byte 7
Bit 0 = 0 = ASC Ignition Retard delete (Bit 1,2 also related?)
Bit 3 = 0 = AKF delete
Bit 4 = 1 = Checksum disable for 24KB Calibration Data section only
Bit 7 = 0 = ORVR delete?

Byte 8
Bit 0 = DTC/MIL Related
Bit 1 = DTC/MIL Related
Bit 2 = 0 = Idle Air Control Valve delete
Bit 3 = 0 = Muffler Flap Solenoid delete
Bit 4 = 1 = Evap Allowed
Bit 5 = 1 = Evap Not Allowed
Bit 4,5,6 = 0 = Evap MIL and Evap disabled
Bit 7 = 1 = EWS delete

Enabled · **Posted:** Tue Oct 21, 2014 6:38 pm

Byte 08, bit 3 is Muffler flap according to

busterhax wrote:

mrf582 wrote:

ms41.1 is 1111 at 0x08. Note the 3rd bit is 1 as expected for the muffler flap from Matt's post(thank you, you too 328ijunkie!). However the 4th bit is 1 on the ms41.2. Not sure what this is.

I will go in and test the 3rd bit on my ms41.1 328 as soon as I finish up my flares in the next couple of days.

...

Looking at all of this....
It looks like the 7th bit at x08h is ews related, 3rd bit is muffler flap.

MRF582 - thanks, added.

Enabled · **Posted:** Tue Oct 21, 2014 7:17 pm

Also, the following may be helpful in discovering what this does.

In Byte 5:

My M Coupe (MS41.2) after a flash has C0 - 11000000 . Stock M Roadster file "MRoadster_Testzwecke_Q1407152.bin" is the same.

The stock M3 "BMW M3 Unknown.bin" has EB - 11101011 . This is the same as it appears in "S52B32US98 M3 /2 /4 /C Auto" from the google doc
The Alpina B3 has AB - 10101011
MS41.1 ID960 from 328is manual has EC - 11101100

I had to edit the above, as I got some copy and pastes switched. Makes a little more sense now.

Here are some of my comparisons in decimal form.

Now I wonder if my M Coupe SHOULD be 00001000 (like the M Roadster above) instead of the current 00001001 at byte 7. I'll have to use the Shark Injector to bring it back to stock and see what it used to be.

busterhax · **Joined:** Wed Jan 22, 2014 6:54 pm **Posts:** 1773

C0 is manual only and EC is either or IIRC.

mrf582 · **Posted:** Wed Oct 22, 2014 2:47 am

d_munter wrote:

busterhax wrote:

Regarding bits 0, 1, 2 of x08h - Are you saying that they may be related to EVAP? I believe that there is more to EVAP than just bit 3 of x07h

nope. EVAP bits is 4, 5, 6 only. 10h or 20h.

offset #08 bit 2 - if "0" ECU do not fire DTC "53 Idle Speed Actuator" and "27 Idle Control Valve - Malfunction". NO ICV?
offset #04 bit 5 - if "0" ECU do not fire DTC "21 VANOS -Electrical Fault". NO VANOS?

d_munter wrote:

To Test:
0x07h bit 0 - 0 for some ASC warnings disable. ASC?
0x08h bit 2 - 0 for ICV disable
0x04h bit 5 - 0 for disable VANOS errors?

and yes, there is no flag for SA valve/pump ignoring...

d_munter wrote:

not yet. now i am trying to figure out proper TCO, TIA, MAF, TPS analog to digital values and define them in disassembly.

UPDATE:
hmm. it seems options offset byte 06h is for CATS. mask #1Ch used for this.
offset 06h = 0Ch - one CAT, 14h - two cats.
empty 2,3,4 bits guess no CAT efficiency, SECONDARY lambdas voltage and other checks.

so we need to test also.
0x06h bit 2,3,4 - 0 for disable CATS errors(?)

offset 0x04h mask #1Fh seems to be AIR CONDITION flags.

busterhax wrote:

328ijunkie wrote:

Correction

.

d_munter wrote:

offset 06h = 0Ch - one Channel O2, 14h - 2 Channel O2

As 328ijunkie confirmed...
X06h-
0Ch - throws code for lambda heating probe 1 and 3.
14h - throws code for lambda heating probe 1, 2, 3, and 4.

Performing the known post cat o2 disable will only throw a heating probe 1 code if set to 0Ch

Now for some logic.. For a na car, is there any benefit to running dual channel o2s? Will it be more accurate?

I have a track pipe that has a bung on a 3" collector. Will there be any compromise to running a single channel o2 from it?

busterhax wrote:

As 328ijunkie confirmed...
X06h-
0Ch - throws code for lambda heating probe 1 and 3.
14h - throws code for lambda heating probe 1, 2, 3, and 4.

Performing the known post cat o2 disable will only throw a heating probe 1 code if set to 0Ch

Interesting. Both bits 3 and 4 of 0x06 need to be flipped. I was hoping each bit was for primary and secondary single channel. Flipping only one of the two bits (either or) will still throw codes for all 4 sensors.

d_munter wrote:

this is just reseting unused bits. i guess logic uses bitmask 1Ch for masking 4-3-2 bits to define CATS status.
in example, if we have 01010101 value, after bitmask (AND) 1Ch (00011100 binary) we will have 00010100.
offset 06h = 14h usually on M3. this is 00010100 binary already, so bitmasking is usless (but logic do not know it

.
so, we need to test values:
00h - no CATS checks (?)
0Ch - single CAT
14h - double CATS (M3 default)
also there is interesting bit 0. i cant say yet what it does. but we can test value 15h too (both CATS and unknown flag).

0x06h- 00h and 15h did nothing relating to cats that I could tell.

d_munter wrote:

busterhax wrote:

Regarding bits 0, 1, 2 of x08h - Are you saying that they may be related to EVAP? I believe that there is more to EVAP than just bit 3 of x07h

nope. EVAP bits is 4, 5, 6 only. 10h or 20h.

offset #08 bit 2 - if "0" ECU do not fire DTC "53 Idle Speed Actuator" and "27 Idle Control Valve - Malfunction". NO ICV?
offset #04 bit 5 - if "0" ECU do not fire DTC "21 VANOS -Electrical Fault". NO VANOS?

0x08h bit 2 disabled ICV.

Still confused on exactly which you want me to test for EVAP. I believe bit 3 of offset x07 disabled AKF only(tank pressure sensor, purge valve, charcoal canister in trunk)..not EVAP.

mrf582 wrote:

busterhax, can you test bit 4 of x7h with an uncorrected checksum? I guess you'll have to write with something other than MS41 Flash Tool since that automatically corrects the checksums.

My other one isn't working for some reason

I'm stuck with only flashing corrected checksums..what is this world coming to.

mrf582 · **Posted:** Wed Oct 22, 2014 3:07 am

The following is confusing...

d_munter wrote:

and now useful things. it seems bit 4 at 07h offset of configuration parameters data disables CRC check for calibration data file.

328ijunkie wrote:

mrf582 wrote:

328ijunkie wrote:

Checksum CEL error disable at x0007 works.... *globally*

By globally, do you mean data and program section?

Yes

328ijunkie wrote:

Checksum disable does not work globally....

d_munter wrote:

it seems we found how disable CRC check for full flash. 328ijunkie?

So does setting Bit 4 of Byte x7h disable checksum for the data section AND full flash? Or just data?

busterhax · **Joined:** Wed Jan 22, 2014 6:54 pm **Posts:** 1773

It ended up only disabling crc for the 24kb section.

mrf582 · **Posted:** Sun Nov 09, 2014 7:33 pm

I traced out the entire logic tree for Byte 4, Byte 5, and Byte 6 to see what bits they set etc. This will come in handy for reference later. Still need to do one for Byte 7 and 8 but I'm not very good at this so it takes some time to do.

mrf582 · **Posted:** Sun Nov 09, 2014 8:10 pm

Enabled wrote:

Also, the following may be helpful in discovering what this does.

In Byte 5:

My M Coupe (MS41.2) after a flash has C0 - 11000000 . Stock M Roadster file "MRoadster_Testzwecke_Q1407152.bin" is the same.

The stock M3 "BMW M3 Unknown.bin" has EB - 11101011 . This is the same as it appears in "S52B32US98 M3 /2 /4 /C Auto" from the google doc
The Alpina B3 has AB - 10101011
MS41.1 ID960 from 328is manual has EC - 11101100

I traced PARAM05 for these 4 different values. See the tree attached above with comments. It tells you what engine operation bits are set depending on what bits are set in Byte 5. The relevant lines of code are commented which should give you clues of how it works. Still need to figure out what exactly those 'engine operation bits' control. See the other thread where I plan to analyze each one.
If FD5C.7 is 0 then it uses the M/T maps for engine speed limiter. Of course, that depends on if we have those maps labeled correctly... Has anyone ever tested those maps individually to verify?

deni2s · **Joined:** Thu Aug 13, 2015 5:52 am **Posts:** 154

Byte 6 needs to be set to 18h for post-cat o2 sensor delete on MS41.0

renneimer · **Posted:** Sat Aug 29, 2015 7:43 am

deni2s wrote:

Byte 6 needs to be set to 18h for post-cat o2 sensor delete on MS41.0

MS41.0 never had post cat O2 sensors :wink:

"Normal" MS41.0 328i has 1Ch at Byte 6, maybe it means something different in Z3 file. Does your Z3 have 1 or 2 pre cat O2s?

deni2s · **Joined:** Thu Aug 13, 2015 5:52 am **Posts:** 154

renneimer wrote:

deni2s wrote:

Byte 6 needs to be set to 18h for post-cat o2 sensor delete on MS41.0

MS41.0 never had post cat O2 sensors :wink:

"Normal" MS41.0 328i has 1Ch at Byte 6, maybe it means something different in Z3 file. Does your Z3 have 1 or 2 pre cat O2s?

I don't know what it means, but in my stock bin it is 18h for one precat o2 sensor (at least it is only one part, maybe it has 2 channels, because in INPA (Status>Analog 2) it shows 2 columns for it). With 1Ch it always gives o2 sensor heating error for postcat o2 sensor which is not present.

renneimer · **Posted:** Sun Aug 30, 2015 4:32 am

So Z3 2.8 just has 1 cylinder bank instead of 2 banks like a "normal" 328. This option just hasn't been added to the definition, yet. I thought that some early M52B20 were the only 1 bank MS41.0, seems there are some more.

tjabo · **Joined:** Tue Apr 21, 2015 4:18 pm **Posts:** 166

In Byte 7 bit 0, what does "ASC Varning" mean? Is it just the switch that enables or disables the "ASC is active" warning light on the gauge cluster?

Also, if I have a "30" in my Byte 8 window which translates to 11110, does that mean that my bit 0 is 0, bits 2 through 5 are 1s, and bits 6 through 7 are zeros?

EDIT: Disregard that last part for now, somehow I glossed over the line in the table description that says bits are counted from right to left. I think I am getting close to understanding this now! :lol:

Enabled · **Posted:** Tue Nov 15, 2016 8:24 pm

For MS41.2 M3 ONLY

Control Byte 5

Manual transmission flash = Decimal 192 (C0h)
Automatic transmission flash = Decimal 235 (EBh)

Found this out the hard way after doing all the correct auto to manual coding on a 98 M3 automatic sedan, and still had the EGS Timeout code in MS41. Edited Control Byte 5 to 192, and it finally went away.
This does not seem to be the same for MS41.1

RomRaider

Forum rules

Control Bits

Who is online