MS41 DTC list

Cloudforce · **Joined:** Wed Aug 27, 2014 11:57 am **Posts:** 259

Would that help to find those maps related to error names and environmental descriptions?

Tool32 shows the size of each map, but i couldn´t find it in full dump.

mrf582 · **Posted:** Thu Oct 23, 2014 7:22 pm

pheno wrote:

Reason I asked to run a trace is that from the tracefile you can see what bytes ecu has sent and how EDIABAS has resolved them into resultnames/values.

We could even take a normal running car, unplug things one at a time, read the OBD2 code, run the job in your trace file mode. Then we can generate a list of "ECU serial output vs EDIBAS conversion vs OBD2 code number".

mrf582 · **Posted:** Tue Nov 11, 2014 1:02 pm

So, I noticed something.

If we look at the DTC array table, byte 0 is the DTC #. For byte 1 there are only 7 values used.

Code:

decimal   hex   bin
00   0    00000000
17   11   00010001
18   12   00010010
20   14   00010100
24   18   00011000
48   30   00110000
80   50   01010000

Example codes
 0 - DTC 211 Idle Speed Actuator
17 - DTC 233 Cat Efficiency Bank 1
18 - DTC 8 HFM
20 - DTC 25 - Lambda Sensor Heater
24 - DTC 217 - CAN Bus Error or EGS signal
48 - DTC 238 Misfire Cyl 1
80 - DTC 227 Mixture Deviation Bank 1

I believe these are DTC groups. If you look at what codes belong to certain groups you'll notice a similarity. '0' may mean it doesn't belong to any group and will be ignored?

The code also seems to use different subroutines depending on which group the DTC belongs to. Here is a list. I didn't cross check whether these hold true across all codes yet.
0 - sub_27B1C
17 - sub_27B1C
18 - sub_27956
20 - sub_27D20
24 - sub_27956
48 - sub_27956
80 - sub_27B1C

So I think there are 3 different types of functions that can set DTCs.

d_munter · **Posted:** Tue Nov 11, 2014 2:10 pm

next generation system. may be we can use some info from this?

busterhax · **Joined:** Wed Jan 22, 2014 10:54 pm **Posts:** 1774

I've verified that zeroing out lines does nothing. We really need a way to disable checksums or correct them if we want to start modifying the program section.

mrf582 · **Posted:** Tue Nov 11, 2014 8:32 pm

busterhax wrote:

I've verified that zeroing out lines does nothing. We really need a way to disable checksums or correct them if we want to start modifying the program section.

Are you reading codes via INPA or OBD2 or both?

busterhax · **Joined:** Wed Jan 22, 2014 10:54 pm **Posts:** 1774

mrf582 · **Posted:** Tue Nov 11, 2014 11:26 pm

Try those same things through OBD2 as well

tkelly278 · **Posted:** Thu Nov 13, 2014 12:50 am

tkelly278 wrote:

Code:

MEM_EXT:25CC                 db   3,  0,  0,  0,  0,  0,  0,  0, 60,252,229,232,[b]143[/b],252,[b]142[/b],252; 190h
MEM_EXT:25CC                 db   1,  0,  0,  0,  0,  0,  0,  0, 60,252,229,232,[b]147[/b],252,[b]146[/b],252; 1A0h
MEM_EXT:25CC                 db   2,  0,  0,  0,  0,  0,  0,  0, 60,252,229,232,[b]151[/b],252,[b]150[/b],252; 1B0h

I think these are telling the device how to look for these codes. They are probably going through routines to check for the flag.

I wonder what would happen if you set it up like this

Code:

MEM_EXT:25CC                 db   3,  0,  0,  0,  0,  0,  0,  0, 60,252,229,232,[b]147[/b],252,146,252; 1A0h
MEM_EXT:25CC                 db   1,  0,  0,  0,  0,  0,  0,  0, 60,252,229,232,[b]143[/b],252,142,252; 190h
MEM_EXT:25CC                 db   2,  0,  0,  0,  0,  0,  0,  0, 60,252,229,232,151,252,150,252; 1B0h

Did this with the TPS and crank position sensor instead of ignition coils. The test files A & B are attached, these are the OBDII codes that came up when they were tested and the order they occurred in

A: p0121 tps p0101 maf p01765 ? [MRF582 - did you mean p1765?]

B: p0101 maf p0601 checksum p0335 crankshaft position sensor p1765

That means this is either an INPA -> OBDII conversion table, or it points to the logic for flagging INPA/OBDII DTCS and the OBDII output is somewhere else.

Bin C has the same codes as bin B. I believe if you made all of the codes point to the CEL you would not have a CEL on unless your TPS was bad.

I am still unable to understand what is going on in Testo, and I didn't notice any changes. It could easily be that I didn't look that hard while checking.

mrf582 · **Posted:** Thu Nov 13, 2014 1:11 am

tkelly278 wrote:

That means this is either an INPA -> OBDII conversion table

That's what I'm guessing. The code itself is set in the ECU regardless of how this table is modified but this table is responsible for reporting to the OBD2 logic. So we can have a code set as read through INPA but have it not reported via OBD2 by editing this table. Not super useful for us because I'd rather just delete the code in its entirety.

tkelly278 wrote:

Bin C has the same codes as bin B. I believe if you made all of the codes point to the CEL you would not have a CEL on unless your TPS was bad.

I think the CEL is set independently of this based on what I'm seeing in the IDA. Keep in mind not to trust anything I say about IDA unless I demonstrate with pictures and flowcharts. I think the way it goes it like this. Detect Error -> decide if it needs to be reported to OBD2 by checking array at x25CC -> set CEL. (not sure if the CEL is dependent on whether the code is reported by OBD2 or if just having that error via INPA is enough)

tkelly278 wrote:

I am still unable to understand what is going on in Testo, and I didn't notice any changes. It could easily be that I didn't look that hard while checking.

INPA (and Test-O) doesn't care about what's reported to OBD2. It's only reading BMW proprietary DTCs and reporting them.

I think this relationship between INPA and OBD2 stems from the MS41 being designed before OBD2 was around. Then the software engineers simply made a 'if INPA code X then OBD2 code Y' table and I think that is what we're seeing at x25CC.

mrf582 · **Posted:** Thu Nov 13, 2014 1:27 am

Looks like my guess from a couple days ago was correct?

tkelly wrote:

A is a slightly modified MS41.2 full read with DTC code in stock form

B is the same bin as A but it has the code for DTC 12 and DTC 83 swapped

C you tell me which codes should be thrown when the TPS is unplugged.

mrf582 wrote:

B would be a good test. my guess is that INPA will report the correct code being thrown but OBD2 will throw the swapped code. I would run A, pull the TPS sensor and check INPA and OBD2 codes then run B and check again.

C looks like B but with the lines for code 41, D6, 0E, 0A, 4B, 4C using the rest of the bytes from 0C. My guess would be that if the TPS is pulled with bin C, then INPA will show a TPS code 12 dec and the OBD2 code will match. But if the other items are in error, INPA will report correctly but OBD2 will show a code for TPS for all.

tkelly278 · **Posted:** Thu Nov 13, 2014 1:40 am

I agree that it is a DTC to OBDII conversion. I also agree that the correct way to shut off the OBDII code is with the systems that are flagging the DTCs. This will allow us to prevent the limp mode and or power cutting which are so annoying when you want more power.

Does anything around this table give any clues to where the DTC flags are stored? If you can see the system this conversion code uses to check for DTC flags then that would tell you where the flags are stored in the RAM. If you can find where the flags are stored then you can find the logic that turns the flag on. You might already be doing that, this project is quickly getting very complicated for me.

This could be a temporary solution for someone needing to shut their CEL of right now. I will try replacing everything with the TPS code and see if all of the OBDII codes go away. I could also connect OBDII codes with DTCs using a wiped out OBDII table

Is monitor readiness attached to obdii codes or is it separate? If it is separate then it is probably very close to this table, potentially after it. Knowing that obdii was something that needed to be added to this ECU is encouraging. It is all probably in one spot :-)

Yeah, I didn't disconnect anything else, but that is what it is looking like.

I am still unable to get the DTCs out of the information given to me by Testo when I request it.

mrf582 · **Posted:** Thu Nov 13, 2014 2:26 am

You're on the same page as me. I've started creating a list of which bits get set when a particular DTC is set. Here is a WIP. The ones that have a 'FDxx.xx' prefix indicates which ones I've looked at. The others still need to be analyzed. For example, if the code decides the HFM is bad, it sets FD30.1.

EDIT - 11/13/14 - I checked all the codes and updated this list.

Code:

Err_Flag   DTC Description   0 DTC # (dec)
FD30.0    12 TPS or Plausibility   12
FD30.1     8 Air Flow Meter (HFM)   8
FD30.10   201 Lambda Regulation Bank 2 Pre Cat   201
FD30.11    25 Lambda Sensor Heater -Bank 1   25
FD30.12    55 Lambda Sensor Heater -Bank 2   55
FD30.13   202 Lambda Regulation Bank 1 Post Cat   202
FD30.14   203 Lambda Regulation Bank 2 Post cat   203
FD30.15    68 Tank Venting Valve   68
FD30.2    83 Crankshaft Sensor   83
FD30.3    65 Camshaft Position Sensor (Inlet MS43)   65
FD30.4   214 Vehicle Speed Signal (VSS)   214
FD30.5    14 Intake Air Temperature Sensor   14
FD30.6    10 Coolant Temperature Sensor   10
FD30.7    75 Lambda Sensor Voltage -Bank 1   75
FD30.8    76 Lambda Sensor Voltage -Bank 2   76
FD30.9   200 Lambda Regulation Bank 1 Pre Cat   200

FD32.0     6 Fuel injector Cyl 1   6
FD32.1    33 Fuel Injector Cyl 5   33
FD32.10    1 Ignition coil Cyl 2   1
FD32.11     2 Ignition coil Cyl 4   2
FD32.12    56 Ignition Current Feedback Resistor - Open Circuit   56
FD32.13   210 Ignition Feedback Resistor (ZSR)   210
FD32.14    57 Knock sensor -Bank 1   57
FD32.15    59 Knock Sensor -Bank 2   59
FD32.2    22 Fuel Injector Cyl 3   22
FD32.3    23 Fuel Injector Cyl 6   23
FD32.4     5 Fuel injector Cyl 2   5
FD32.5    24 Fuel Injector Cyl 4   24
FD32.6    29 Ignition Coil Cyl 1   29
FD32.7    31 Ignition Coil Cyl 5   31
FD32.8    30 Ignition Coil Cyl 3   30
FD32.9     3 Ignition coil Cyl 6   3

FD34.0    53 Idle Speed Actuator   53
FD34.1    27 Idle Control Valve - Malfunction   27
FD34.10    82 ABS/ASC Interface -Advance Adjustment   82
FD34.11   215 Lambda Sensor Bank 1 or ASC/MSR/EML -Interface not plausible   215
FD34.12   100 DME Control Unit -Self-Test Failed   100
FD34.13   216 Lambda Sensor Bank 2 or EGS Position Signal   216
FD34.15   219 CAN module -CAN Offline   219
FD34.2   211 Idle Speed Actuator -Mechanical   211
FD34.3    74 AirCon Compressor Relay   74
FD34.4    69 Fuel Pump Relay   69
FD34.5    21 VANOS -Electrical Fault or Activation VANOS Inlet Valve (MS43)   21
FD34.6   212 VANOS Bank 1 -Mechanical   212
FD34.7    52 Solenoid Valve -Exhaust Flap   52
FD34.8    80 ABS/ASC interface   80
FD34.9    81 MSR Signal -Active too Long   81

FD36.0   217 CAN bus error -EGS Signal not present   217
FD36.1   209 EWS -Message Error   209
FD36.2    18 EWS Signal or Camshaft Sensor (MS43)   18
FD36.3    16 AirCon Compressor - PWM Signal or Plausibility Intake Air Temp (MS43)   16

FD4C.0    11 Tank Pressure Sensor (EVAP System) or Radiator Outlet Temp (MS43)   11
FD4C.1   253 Activated Charcoal Filter Shut-off Valve Stuck Shut   253
FD4C.10   232 Lambda Sensor Switching Bank 2 Pre Cat   232
FD4C.11   248 Pre Cat Converter Efficiency -Bank 1   248
FD4C.12   249 Pre Cat Converter Efficiency -Bank 2   249
FD4C.13    79 Lambda Sensor Heater -Bank 1 Post Cat   79
FD4C.14    61 Lambda Sensor Heater -Bank 2 Post Cat   61
FD4C.15   244 Crankshaft Interval Timing   244
FD4C.2   254 Tank Ventilation System -Large Air Leak   254
FD4C.3   255 Tank Ventilation System -Valve Stuck Open   255
FD4C.4   252 Tank Ventilation System Vacuum   252
FD4C.5   251 Tank Ventilation Diagnosis Error   251
FD4C.6   250 Tank Venting Valve -Function   250
FD4C.7   233 Catalytic Converter Overall Efficiency Bank 1   233
FD4C.8   234 Catalytic Converter Overall Efficiency Bank 2   234
FD4C.9   231 Lambda Sensor Switching Bank 1 Pre Cat   231

FD4E.0   238 Misfire Cyl 1   238
FD4E.1   242 Misfire Cyl 5   242
FD4E.10    51 Shut-off Valve -Charcoal Filter or Request Control Unit Reset (MS43)   51
FD4E.11    50 EVAP Control Valve or Response Monitoring Level 2 (MS43)   50
FD4E.12    77 Lambda Sensor Voltage -Bank 1 Post Cat   77
FD4E.13    78 Lambda Sensor Voltage -Bank 2 Post Cat   78
FD4E.14   235 Lambda Heater Bank 1 Post Cat or Pre Cat Signal (MS43)   235
FD4E.15   236 Lambda Heater Bank 2 Post Cat or Pre Cat Signal (MS43)   236
FD4E.2   240 Misfire Cyl 3   240
FD4E.3   243 Misfire Cyl 6   243
FD4E.4   239 Misfire Cyl 2   239
FD4E.5   241 Misfire Cyl 4   241
FD4E.6    62 Aux. Air Injection System -Switching Valve   62
FD4E.7    35 Aux. Air Injection System Relay   35
FD4E.8   245 Aux Air Injection System Bank 1   245
FD4E.9   246 Aux Air Injection System Bank 2   246

FD50.0    20 "CHECK ENGINE" Light Failure   20
FD50.1   229 Lambda Sensor Switching Bank 1   229
FD50.10   204 Idle Control System -Idle speed not plausible   204
FD50.2   230 Lambda Sensor Switching Bank 2   230
FD50.3   227 Mixture Deviation Bank 1   227
FD50.4   228 Mixture Deviation Bank 2   228
FD50.5   225 Cat Efficiency Bank 1   225
FD50.6   226 Cat Efficiency Bank 2   226
FD50.7   222 Low Coolant Temperature or Lambda Sensor Control (MS43)   222
FD50.8    46 ??   46
FD50.9   247 Aux Air Injection System -Incorrect Flow Detected   247

DTC 218 does not exist in code so no flag is associated with it.

The way the code works for ALL DTCs is it goes through a bunch of checks, and if there is a problem, it calls the address of the "DTC->OBD2 table" then evokes a function which sets an OBD2 code. Following that and irregardless of what is in the OBD2 code array, it sets a bit like FD30.1 to 'on'. So I think once a problem is found, it sets the OBD2 code AND sets the INPA code bit. Our goal would be to bypass it from ever running this function that does the 2 things mentioned. This will prevent both the OBD2 and INPA reported codes from being set.

Keep in mind, that we can disable the OBD2 code (by editing the array at x25CC) but the underlying functions that result from the INPA code being set will still exist. This may include things like the CEL, failsafe functions, alternate maps/logic etc.

One thing I would like someone to test is if disabling the OBD2 code will also disable the CEL for that code.
To test this, set the OBD2 code for 'checksum error' or 'DME Self-Test Fail' or 'DTC 100' to some other code like TPS. This should in theory set an INPA code but not report via OBD2. Then we can check if a CEL happens.

d_munter · **Posted:** Thu Nov 13, 2014 6:53 am

also we need to play with calibration offset #08 bit 1 (set to 0) in parallel.

it sets DPRAM_FD58.1. some manipulations when DTC management.

mrf582 · **Posted:** Fri Nov 14, 2014 12:30 am

word_DPRAM_FD38.6 is always responsible for setting DTC Error Flags after a DTC check. If we trace every function that it is involved in, we will know every DTC check in the code. Then we can analyze that function and see how to trick it into returning FD38.6=0

I also updated the DTC code <-> Error Flag bit table above.

RomRaider

Forum rules

MS41 DTC list

Who is online