RomRaider

Because it was probably 00 from the factory.

You can do what I did before the major disassembly began and and 00 one byte at a time for a couple hours until you find what you're looking for.

Any idea why MS41.1 threw these codes that is supposedly can't throw?

204 unknown error - "Idle speed not plausible"

at a later date:

220 unknown error - Lambda Voltage Range Bank 1 Sensor 1
221 unknown error - Lambda Voltage Range Bank 2 Sensor 1


I'm not worried, since these have only shown up once each over the course of 2 months, but I'm just wondering.

What command reads DTC information?
viewtopic.php?p=105926#p105926

Is the format of a DTC read known?

Yeah. I've built it into the next release of MS41 Quickflash.

tx: 12 05 04 01 12
rx: 12 4b a0 (07) (0c 71 01 28 00 00 0b ff 00 00) (1b 74 01 28 00 00 00 f3 00 00) (35 74 01 28 00 00 00 f3 00 00) (3e 72 01 28 00 0b 0b 7c 00 00) (14 64 01 28 00 00 0b 7c 00 00) (45 64 01 28 00 00 0b 7c 00 00) (12 64 01 28 0b 0b 00 7c 00 00) 1b

-(07) is the amount of DTCs present
-The first byte in each group of parenthesis is the DTC. The remaining bytes in each group are the freeze frame data which I haven't put any time into defining.

What's the difference between?
tx: 12 05 04
tx: 12 05 14
tx: 12 05 24

There appears to be absolutely no difference. All 3 commands call the exact same subroutine to send DTC stuff.

I can sniff later but they are likely read shadow codes and read quick (both functions in inpa)


Sent from my iPhone using Tapatalk

There must be a difference as the function checks that control byte multiple times and branches differently on the result. One must be the for active and the other for memorized faults.
The third?

04 is definitely read DTCs. Verified by sniffing inpa. 14 and 24 I’m guessing are probably shadow codes and quick read. I can verify

Shadow codes appears to be pending codes.
Quick read gives some basic info such as hours since last dtc clearing


Sent from my iPhone using Tapatalk

You're right. I didn't look through the sub-routine that was called. I think Kyle has the answer on this.

Has there been any work the cross reference these codes to OBD P codes?

Not that I know of. The OBD2 command to read DTC is probably different than the BMW DS2 command.

04 = # of DTCs present
04 01 = # of DTCs present + DTCs and freeze frame
04 00 = Quick read
14 01 = shadow/pending DTCs
24 (xx) = ???

See below for testing.

Here's a standard DTC read on the bench:
Write: 12 05 04 01 12
Read: 12 55 A0 08 64 78 01 28 FF 00 03 00 00 00 0C 71 01 28 00 00 0B FF 00 00 1B 74 01 28 00 00 00 F3 00 00 35 74 01 28 00 00 00 F3 00 00 3E 72 01 28 00 0B 0B 7D 00 00 14 64 01 28 00 00 0B 7D 00 00 45 64 01 28 00 00 0B 7D 00 00 12 64 01 28 0B 0B 00 7D 00 00 C3

Here's some 24 XX testing:
Write: 12 04 24 32
Read: 12 06 A0 08 00 BC ;number of dtcs? 8

Write: 12 05 24 00 33
Read: 12 09 A0 08 00 00 00 03 B0 ; number of DTCs? 8

Write: 12 05 24 01 32
Read: 12 65 A0 08 64 78 01 28 FF 00 03 00 00 00 71 00 0C 71 01 28 00 00 0B FF 00 00 40 14 1B 74 01 28 00 00 00 F3 00 00 40 0A 35 74 01 28 00 00 00 F3 00 00 40 0A 3E 72 01 28 00 0B 0B 7D 00 00 40 0A 14 64 01 28 00 00 0B 7D 00 00 00 00 45 64 01 28 00 00 0B 7D 00 00 00 00 12 64 01 28 0B 0B 00 7D 00 00 00 00 9C


I could not find command 0x24 anywhere in the INPA source file meaning this function is not built into inpa. It seems 24 01 returns the same DTC list, but there are an extra 2 bytes associated with each DTC.

Perfect, thanks.

Welcome.
I have a question regarding the error code 209 ews signal fehlerhaft
ews I have turned off in control bits, however, I have this error.
can it be caused. I have not put in the car yet.
I do not have this error on another driver with this error disabled.