RomRaider

Hello,

I'm new here, but not new to BMWs. Until now I've mostly been interested in the MSS54/HP (E46 M3) DME, but I've recently acquired a 330i which I plan on converting to MS43, so I thought it's about time I start learning a thing or two about this DME. I do find the C167 code to be rather unintuitive to follow, but I'm sure I'll eventually figure it out.

For now I'm interested in seeing how the MS43 deals with the CAN-bus. I'm looking at this for a coupe reasons:

1) The E46 CAN-bus is well documented and I have a complete disassembly of the analogous MSS54 code - might make it easier to identify certain variables.
2) I'd like to see if it's possible to broadcast some things that over CAN that the MS43 normally doesn't. For example, the RPM warning field messages found on the E46 M3 and E39 M5

To start off, the DMEs of this generation BMW broadcasts messages on 3 arbitration IDs (ARBIDs). They are:

ARBID 0x316 ("DME1")
ARBID 0x329 ("DME2")
ARBID 0x545 ("DME4")

With my own logs and disassembly, and the help of some work done by members on bfc, I was able to figure out the following about those DME messages


0x316



0x329


0x545


So getting back to the MS43, I decided to focus on finding ARBID 329 for now since that cycle of numbers is kinda noticeable. I believe I found the sub routine for this ARBID. In MS430056, I believe it's sub_D43F4, largely because I see a value C0 being OR'd, and c_tq_stnd (standard torque?) being right shifted 4 bits. On the 330i, c_tq_stnd is set to 400, which when right shifted by 4 = 25 = 0x19; this matches what I found when logging the MS43 CAN bus. If I am correct, it seems like this subroutine is significantly more convoluted than the analogous code on the MSS54.

Anyway, that's where I'm at for now. I'm going to keep exploring. And if any of the rest of you have an interest in figuring out the CAN-bus stuff, I hope this information helps you.

Edit: Upon farther examination, it looks like that subroutine handles all the CAN messages, rather than a single ARBID per subroutine like on the MSS5x

It's nice to have another smart mind on ms43! It would be nice to be able to program ms43 to use the s54 cluster properly.

Well I think I figured out where that particular byte of the CAN reply is dealt with:



(byte_EFCA being what's pushed to with the CAN message)

Going back to the information in my original post, here's how ARBID 0x545 byte 3 is deciphered:



Looks like the MS43 (at least MS430056) only uses bit 3. As you can see, it looks like some checks are done against the coolant temperature, and depending on how those checks go, bit 3 can be set or cleared (which corresponds to the overheat light as per previous investigation). Based on NCS Dummy definitions for the instrument cluster, it does look like it's only the MSS54, MS45, and ME9 that deal with the oil level errors via the CAN-bus, so bit 3 being the only one used on the MS43 matches known behavior.

So to get the oil warmup LEDs to work, you'd have to manipulate bits 4, 5, and 6 of 0xFDAA/0xEFCA. One can write code to OR 0x20 with it (set bit 5) so that the 6500 RPM and below LEDs will be constantly illuminated (that way at least the M3 cluster will display an appropriate redline, especially if you change the LED colors). Or one can implement some code that checks the oil temperature, and sets the RPM lights to be somewhere between 4000 and 6500 RPM based on what the oil temperature currently is (ideally with a hysteresis of at least 5ºC).

Frankly doing either modification is a bit beyond my skill, at least for now.

word_FD1E.6 is the boolean for lv_teng_state i think its a bad abbreviation for state_engine_temperature.

FDAA.* is used from 0-14

These bits are used for diagnostic handling and error calculation as far as i see.

To me it looks FDAA doesn't store anything permanently, it's just temporarily manipulated before being copied to the target address, like a data register would be used. Notice it is zero'd out before being used in this section of the subroutine. FD1E.6 being the engine temperature status does make sense give how it's used here. 1 = overheat and 0 = no error from what I can tell

Well, we could maipulate EFCA directly without messing with FDAA

Should work.

Edit: I just did a quick and dirty test by modifying the code to move "ONES" (rather than rl4) to EFCA, and it worked as I predicted; all the lights turned on (along with the oil error light and coolant overheat light). So that proves EFCA is definitely what gets sent on ARBID 0x545 byte 3.

So only code is missing?

Do you know the exact meaning of bit 4-6 in MSS54 and how its interpreted? I think i should be able to write you the code.

(edit) checked at MS430066 and its the very same!

For E46 M3 cluster:




For E39 M5 cluster:

EFx7 is the start of the CAN message 8 byte area for CAN mailbox x where x is in the range 1 to F. The 7 bytes before are the control registers for each mailbox.

I want to use a few unused mailboxes to continuously spit out relevant engine logging data at high speed. Would need to check where the are initialised and then just do the appropriate control register writes each time.

Would also like to use them to do memory read and write much faster than DS2.

terra, what kind of frequency are these packets arriving on the bus on MSS54 and MS43?

Message box - CAN ID
1 - 43F
2 - 613
3 - 615
4 - 153
5 - 1F3
6 - 43D
7 - 1F5
8 - unused
9 - unused
A - unused
B - unused
C - 545
D - 329
E - 316
F - unused

There is a data section at EC430 that is not referenced in my disasm by code but it has a clear CAN bus configuration layout that matches what code and info above is available. It will be copied on setup, the routine Terra mentioned checks some of these.
D43B2 D43DE copy.

Will edit with any info I find re transmit or receive.

IIRC the E46 CAN-bus operates at 500 kbit/s



1 - 7 in your list are messages that are sent by other devices (43F and 43D come from the auto/SMG transmission, 613 and 615 from the instrument cluster, 153 I believe is the steering angle sensor, 1F3 and 1F5 from the DSC module). 545, 329, and 316 are the messages sent by the DME.

Thanks. What I was meaning by frequency, was not the frequency of the bus, but how often these packets are transmitted. Need to get my CAN bus wired to my OBD II and break out my trusty Innovate OT2 and get it to do a dump.

Oh gotcha. I have some wireshark logs of my M3 somewhere on my other laptop. I'll check it out and get back to you. I don't have any logs of an MS43 car (my 330i won't be MS43 until next month probably).

The transmit and receive match the info above. The only things of note is that two of the receivers are 5 byte (1f3 DSC and 615 cluster). Everything else is 8 byte.