Karter16

After a few days of Mr Three being in hospital we got him home yesterday morning. Yesterday evening and today I tested v3,4 and 5 of the tune. 3 and 4 were duds (in comparison to v2) in various ways (pushing the boundaries of the theory covered above too far, but on the plus side helping me get a feel for the various adjustments) but I’m very pleased with how v5 has turned out and am happy that I have a good base now to build on. To that end I ran the first round of logging for VE tuning this evening as the tune is currently rich across the board. After a few rounds of VE tuning I’ll then start making fine adjustments to the tune as needed once the larger adjustments are out of the way. I managed to force some pinging under heavy load from about 1100rpm, which is interesting as I’m entirely Euro tune in that range so would be interested to know if that happened on my original tune as well - I don’t recall having come across it before. But aside from that it’s feeling good.

Yes I’ve been following Bryson’s work closely - it was him proving it out that led to me getting started on this 🙂

Ok I think this approach is helping my brain. Here's another interesting view - this is the difference between the Euro M3 tune and CSL as it pertains to the crank degrees at which the intake valve is completely closed. And correspondingly for when the intake valve opens: Arguably the point at which the intake valve completely closes is the most important of the 4 (intake close, intake open, exhaust close, exhaust open), so I wanted to isolate that and examine the difference between the two maps. The intake open difference is directly related, plus an offset to account for the extra duration of the CSL cam. As could be expected we can see that at higher RPM the CSL is configured to to close the intake valve later (by between 5-10 crank degrees) than the Euro M3 tune which will drive more top end power. we can see at low load between 4300 and 6300 RPM that the CSL closes the intake valve earlier than the Euro M3 tune. I presume this is to keep drivability decent with the bigger cams, as presumably is the other island at low RPM thru mid and high load.

To Bry5on's point I need to make sure I understand the theory of cam timing well. I understand the individual concepts, but where I've been struggling is putting it all together and visualizing what it means in different scenarios. To this end I decided that some spreadsheets would help (spreadsheets always help). First up I took the interpolated AVAN and EVAN tables for both the Euro M3 and CSL tunes and calculated the cam overlap for each for each point on the tables: As you'd expect we have low overlap at idle, high overlap in the midrange, sloping down to high RPM. So how does that work out as a difference between the two? The CSL generally runs more overlap everywhere apart from high rpm low load, and particularly in a few different islands in the low and mid ranges. However - we need to remember that the CSL cams have somewhat greater duration than the standard M3 cams. For the purposes of comparison then we should account for this. That's cool and all, but what it still doesn't tell us is whether the Euro M3 tune and the CSL tune differ in where the centre of the overlap occurs (e.g. before or after TDC) which is also important information in understanding the differences between the two and why. So I calculated the centre of the overlap for each of the tunes And from there we can compare the difference in overlap centre between the two: Interesting stuff to look through anyway - I feel now with this view I can better visualize and understand the impact of the various tweaks etc. that I'll make. I've only just put these together and haven't worked through them in detail to look at various areas of interest but will update here as I do.

Well the initial couple of drives have been very successful. Couple of one time codes on first start up related to TPS and 1 misfire code, which I think was the engine being mad at the change of program plus blowing out the carbon from the throttle body cleaning. No repeats of any codes in the two 20 minute drives I've done since. First impressions: the base CSL tune was not as bad as I was expecting. The warm up was rubbish as expected and lots of idle hunting, etc. going on. Once the SAP turned off things settled down. Driving around at slow speed was much smoother than I was expecting. The up and go was a bit muted, but tip in with the SMG was exactly the same as before and there wasn't any jerkiness under light/moderate acceleration. I presume that the reason for this is that my car is a Euro car, which differs less from the CSL than a US spec car does. I know that the US and Euro tune vanos maps differ significantly in places, so that would explain why the standard tune is worse on a US spec car. The car was quite reasonable to drive in the various conditions I tested it in. Given this I wasn't entirely sure how much of a difference I would notice with v1 of my tune (which I must point out again is simply me making my own version of the approach which Bry5on has pioneered). I loaded it up and the improvement was immediately noticeable. The CSL tune wasn't rough driving around the neighborhood and it wasn't enormously noticeable that it lacks in peppiness under those conditions, but when you bring the peppiness of the standard M3 tune back at those low load, low speed conditions it is immediately noticeable as an improvement. I've logged the run in TestO and will go through it later. I need to adjust a couple of the timing maps in the 3300-3900 rpm range (I haven't quite got the crossover lined up right with the VANOS maps crossover and need to adjust slightly, but it's not off by much). Extremely happy with how this has all gone. No installation issues, no programming issues and a good success with v1 of the tune!

Yesterday morning I completed the install of the airbox. First up I took the wiring loom and laid it out in the engine bay to work out the best way to route everything (note the red ties temporarily holding it in place). Once I'd done that I then temporarily installed the TB half of the airbox to get the position and orientation of the IAT sensor just right. I made sure to mark on the loom the orientation of the loom to the connector so that it sat just right. Then I uninstalled the airbox, removed the loom and attached the connectors for the MAP sensor and IAT. The finished loom I then installed the loom for real, cable tying at appropriate points: And here's how the MAF connector end looks: With that done the only wiring left to do was to relocate Pin 1 of the X6003 connector to Pin 18 which was a quick job: Then it was back in with the first half of the airbox for reals this time. All of the hoses and connectors fitted perfectly - I didn't run into any of the issues heinzboehmer did - maybe Karbonius have refined since? The only annoying thing was installing the 10mm nut for the rear vibration isolator - there's not much room to get in there. I clamped up the throttle body boots and moved on to installing the MAP sensor. I'm super happy with how the MAP sensor adapter has turned out - it's worked out exactly how I envisioned it would (I've got more to say about this which I'll do as a separate post). Filter in place: Various top-side connections done: Then it was a quick job to install the front half of the airbox and the snorkel: And finally with the rest of the engine bay back together (you'll have to excuse the dirty car - I'm in the middle of significant landscaping and renovations at the moment at home and it simply isn't worth me spending much time cleaning anything up as the clay dust gets everywhere: Then in the evening I flashed the Terra 0401 program binary to the car (after taking read backups of the current prog and tune) and then the partial binary with what I'm calling the "base modifications" to make the 0401 work with non-CSL cams, code out the DTC for the flap, etc. This morning I started the car briefly to confirm it would start and there were no major issues. A bit later today Dad is coming round to (a) come along for the first test drive and (b) hold the data-logging laptop while I drive. The plan is to take it for a run on the "base modifications" binary, log and make sure things are working as they should be and for me to get a feel for what the base CSL tune is like (my exceptions are for it to be rubbish like everyone says). Then I'll flash V1 of my tune and do the same thing and cross my fingers that it's an improvement. We'll find out 🙂

Boxing Day today and did some bits and pieces in between lunch with friends and playing with the kids. First up - I cleaned the ICV and throttle bodies with CRC throttle body cleaner. I hate to think what's in it, but it works very well. The ICV wasn't as gunked up as I was expecting, and the throttle bodies were worse than I was expecting. Of note is that I decided to use reusable screw-type hose clamps on the ICV - I intend to make cleaning it a semi regular exercise so decided screw clamps made sense given they are hidden anyway. I swapped the oil dipstick tube out for the CSL one. Connected the CSL SMG reservoir (and annoyingly split some CHF-11s in the process - best laid plans...). The final design of the bracket is still to come, I'll get to that once the airbox is fitted and I can play around with it. And installed the CSL secondary air rail Mr 3 and I came back from lunch a bit earlier than my wife and Mr 7 as Mr 3 had expended his socialization fuel tank. So I spent some time getting a nice finish on the 3D printed adapter for the MAP sensor. The adapter is printed in PETG-CF which comes up beautifully with a wet sand and then polish with some cutting compound and the polishing disc on the Dremel. The key is to go slow and not heat up the surface of the plastic too much. It came up beautifully - the photo doesn't do it justice, it's a very nice finish indeed and matches the sensor well. I've epoxied the sensor to the bracket and will get some photos of the finished product when I install it tomorrow. Lastly I spent some time this afternoon getting the MAF connector end of my extension wiring loom done. Because I don't want to hack up my wiring loom, etc. and want to retain the ability to return to stock I'm taking the approach with the wiring for the MAP and IAT sensors of making an extension from the MAF sensor connector which splits out and runs to the IAT and MAP sensor respectively. I'll follow the trunk that goes from the distro box by the ECU box across to the distro box underneath the ICV, and from there to the sensor locations. In terms of the pinouts - all I need to do is to de-pin X6003 pin 1 (MAF signal) and re-pin it to X6003 pin 18 (MAP signal). I'll put a warning label in the ECU bay to note this so that I don't forget in the future and have an easy reference to return to using the MAF sensor if so desired. Tomorrow the plan is to do a mockup routing of the extension loom, a test fit of the airbox, determine the final lengths for the extension loom, remove it, attach the connectors at the sensor ends and then reinstall. From there it's then on to the actual installation of the airbox, and then flashing the DME.

Forgot to add as well that Dad made up a threaded guide for a long 5mm drill bit for drilling through the RACP mounts 🙂

This morning I removed the LHS radiator cowl. My objective with these modifications remember is that I retain the ability to return the car to stock. I therefore didn't want to cut-down or cut off the cowling. It was a quick job to detach the top radiator pipe and slide the cowling out. Then right on cue the CSL oil dipstick tube showed up (along with the silver-coloured hardware I was waiting on for the airbox as well). So I carried on going... I didn't have a turkey baster for removing the SMG fluid from the reservoir, but I do have an abundance of my son's old enteral syringes and feed pump tubing 🙂 All pretty straightforward - the little connector on the bottom at the back is a bit of a pain, but all done without too much fuss. Next up will be a quick general clean up, as well as cleaning the ICV and throttle bodies (might as well while I'm in there) 🙂

Yesterday afternoon I conditioned the intake boots and clamped them to the airbox. The tool for the Oetiker clamps works out at about $100NZD however you approach it so I saved $85 dollars by using the dremel to modify some standard $15 SuperCheapAuto clamp pliers. This worked very nicely - I'll paint the pliers so they don't rust and they can go in the toolbox for next time. I also installed 2x new rubber isolators - Being 20 years old the rubber in the current ones is probably soft and perishing. Plans for between now and whenever the dipstick tube turns up is to remove the LHS radiator cowl shield in preparation for installing the airbox. Yesterday I also took the car for a drive and logged the relevant variables with TestO to get a baseline capture before I go making any changes to the car. I want to make sure I'm as prepared as I can be for moving across to the 0401 program. To that end I will also be doing another full review of each change I've made to the partial as part of v1 of my tune. It's been long enough now since I did it that I should be able to do a good review of it and make sure I haven't made any mistakes.

Finally made it to my summer break! Did a quick fitment check of the airbox, filter and Haimus snorkel to make sure I don't get any surprises during install. I've noted others have found the hose attachments to be tight so am prepared that I might need to do some adjustments there like heinzboehmer did to get them to click in correctly. The CSL dipstick tube is finally with the local courier for delivery, more than 6 months after I ordered it, so should get it in the next few days. The only other thing I'm waiting on is the silver replacement screws for the two halves of the airbox, but they aren't a blocker given I can use the ones the airbox came with and swap out easily later.

I've spun up a thread (https://nam3forum.com/forums/forum/special-interests/coding-tuning/287069-csl-0401-program-binary-disassembly-notes) in the Coding section which I will keep updated as I work through the disassembly. Aim is to make the info easy to find and also splits it out from this build thread.

I've been going through the public XDF for the 0401 binary and sorting out some of the incorrect references. They're usually pretty easy to confirm by looking at whether the data makes sense. This one made me chuckle 😛

Pleasant find on my lunchtime stroll.

Today I cleaned up the top front RACP points and sprayed with the e-coat matched enamel I have. First up I masked the area around the mount (photo taken prior to clean up). Then I used a ziploc bag as a miniature spray booth by taping it to both the RACP and the spray can. I also made sure to cover/block every other hole/exit point in the RACP so I didn't get any over spray wafting out anywhere. This approach worked really well, the whole thing only took about 15 minutes to do. And the end result (paint is still wet here): I have some clean up to do on a few rust spots on the seat bench, but will do this once I have the A08 in hand and can touch it up properly. At this point though the front mounts are ready for the installation of the brace (drilling and tapping will be done at the time of installation of the brace as I need to take the subframe off to tap the threads.

Got a few bits and pieces done this weekend. On Saturday morning dad and I welded up the cracks in the top of the front right RACP mount. As usual I did a bad job of taking photos as we went, but I did get a couple here and there. As a recap, this is what the front right looks like from the top: As you can see in the photo above the crack coming down towards the bottom of the photo is hidden behind the rear seat sheet layer. So that we could see how far this crack went we inspected the bottom side of the top layer of the RACP with my boroscope. As can be seen the crack extends just to the point that the RACP bends down to layer up with the rear seat sheet. For reference the threaded insert visible on the right hand side of the image is for the seatbelt buckle. Knowing how far down the crack extended meant that I was easily able to cut the small section of the seat layer out so that we could access the end of the crack to drill and weld. We found that a rounded nose carbide burr in the die grinder was the best way to clean up the surface around the cracks. Dad then MIG welded the cracks up - I unfortunately didn't get any photos of this as I was running extraction and lighting while dad welded. A couple of comments though: - We used some ceramic fibre insulation segments to pack the RACP cavity to prevent sparks, grindings, etc. from traveling inside the cavity. the ceramic fiber insulation is good in that it's non-flammable. - I had previously measured the thickness of the RACP layers to be welded and dad had obtained some equivalent sheet metal to run some trials on and dial in the settings on the MIG. - We went slow to avoid heating everything up too much, even so the cavity wax on the underside of the top RACP layer tends to melt and smoke along where you've welded, good extraction is advised. - We used the boroscope again to check the other side of the welds (where they are on a single layer of sheet) and confirm good penetration of the weld. With the welding done I then cleaned up the top surface with the carbide burr to level out the welds and leave an, as flat as possible, surface for the brace to mount to. I unfortunately didn't get any photos of the welds prior to cleaning up and putting a protective layer of undercoat on. As you can see the surface is not perfectly smooth (the flash from the phone actually makes it look more pronounced than it is in reality - it is less than 1mm, which will be perfectly fine for this situation. The OE welds stick up a couple of mm anyway. I didn't want to take away too much material at any point with the burr, so played it safe and left a small amount of extra material in place. You may also notice that we welded the little cutout that we made to access the end of the crack back in place and smoothed it out with a little body filler. Not really necessary given it's going to spend the rest of its life under the seat again, but for the sake of an extra 20 minutes work it's worth it in my opinion. I hand painted on the under coat as I wanted to make sure I could get it into all of the corners well, there's not a lot of room in there to rotate a spray can. I'll do another layer of undercoat, and then sand it back a little, mask up, build myself a little spray booth inside the car and do a couple of coats with the e-coat matched enamel I have. I'll then dust on some A08 on the seat bench (when I can finally get some, whole other story) to replicate the original surface as much as possible. Secondly the DIN7984 hex head bolts for the MAP sensor arrived, they're identical to the original items except 18mm long to address the greater thickness of the 101 sensor mounting point, plus they're stainless rather than the zinc-coated original bolts. I'm happy with how these have turned out:

Well I've made some excellent progress this evening in item 2 on my list. I've located the series of routines that calculate ignition timing and have mostly figured out the routine that retrieves values from the maps I'm interested in understanding. The below is a C-style reasonable-equivalent of the assembly code. In this I've added comments as I've figured bits out and have managed to give my own names to most of the local and global variables involved. The key thing of interest I've uncovered is confirmation that use of the KF_TZ_GRUND, KF_TZ_LL and KF_TZ_VL maps are mutually exclusive based on operating mode. I'm pleased to have confirmed this as there is some ambiguity on the matter depending on where on the internet you look and this greatly aids in my understanding of blending the M3 and CSL maps. Secondly I now have the addresses of where the global variables TMOT, RPM and Relative Fill are stored. Given these are commonly used variables knowing what they are will be useful in further understanding the code. Next is to continue to follow the chain of TZ (ignition) related routines to understand the rest of them. From a quick look the next function appears to overlay adjustments from the MomentManager in response to signals from ASC/DSC.

Well I feel like a bit of a muppet but I've figured out the memory reference issue - it's a very simple reason and I should have realised sooner.. The MSS54HP has 2x processors operating in a Master/Slave arrangement. The full binary that I'm ingesting has the individual binaries for the master and slave conjoined together. The issue with this is that both Master and Slave have the parameter space at 0x00008000 - 0x0000ffff. This is then mapped to virtual location 0x00088000. FOR BOTH PROCESSORS. What I was missing was that when loading and disassembling the binary as a whole, the code on both the master and slave were together referencing the same 8000 bytes between 0x00088000 and 0x0008ffff. What made this tricky to spot is that the full binary for the Master is 0x80000 bytes long, so the virtual offset aligned perfectly to the offset of the start of the slave binary plus the 0x8000 physical offset of the slave's parameter space in the binary. It made it appear as though the references to the slave parameter space was just fine. Anyway, the solution is to simply split the binary in two, ingest them both separately into Ghidra and offset the 0x00008000-0x0000ffff memory space to 0x00088000 for both. On and I've also labeled all of the memory locations used by the Internal Register Map which shows me where the code is accessing things like the QADC, CTM4, QSM, TPU, etc. which will further help to identify what various functions are doing. In loosely related news the CSL dipstick tube finally shipped today so I should have it in time for the Christmas break 🙂 Onwards and upwards.

Haha, I don't code for a living, but I have coded since I was about 14. I did a BE majoring in Mechatronics (which is marketing for Robotics and Embedded Systems Engineering), and worked in that space for a period of time. So I have a reasonable grasp of embedded systems (which is what DMEs are), assembly language, etc. I would describe myself as someone who has some background in this space, rather than an expert. I certainly don't have any prior experience with disassembly, so am figuring it out as I go (although tbh understanding the concepts and being able to read technical documentation are pretty much all you need anyway). Ghidra as a tool is super-impressive at what it can do and makes a lot of it significantly easier when it comes to identifying patterns, likely function entry and return points, etc. which saves a lot of time.

hahahaha such a good show!

A couple of things have been playing on the back of my mind while I've been working on CSL tune file. 1: Confirming that the lookup tables are definitely linear interpolated - Given the MC68336/376 has the CPU32 TBL instructions built in it would make sense, but it would be nice to see it with my own eyes. 2: Identifying exactly how some of the ignition/injection maps are utilised in the program. I decided the best way to figure this out would be to do some disassembly of the full (program) binary. After a number of sessions playing around learning Ghidra (and adding the CPU32 instruction set to Ghidra) I've managed to confirm #1. I've found the Curve/Table lookup functions in the program code and confirmed their use for things like interpolating between VANOS table values (Below is a snippet of part of one of the lookup functions). I don't think there was ever really that much doubt that this wouldn't be the case, but it's good to know for sure. Having identified the lookup functions in the code means that I can now use them to look "backwards" to their calling functions and more easily identify where the various tables are used. This leads into #2 on my list which is to identify the functions that use tables like KF_TZ_LL so that I can see exactly how those tables are used and how they influence the final calculated ignition timing (the draft FunktionsRahmen floating around is unfortunately not complete in this regard). The current problem I have is that the data space (which holds the contents of the partial binary) is split into to sections in the memory space. The lower half of the partial (addresses 0x0000-0x7FFF as you would read them in TunerPro) is at offset 0x88000 and the upper half (0x8000 - 0xFFFF) is at 0x8000. Ghidra is linking references to the lower half (so with the offset 0x88000 - 0x8FFFF) just fine, however it is not for the upper half (0x8000 - 0xFFFF). I suspect that this is probably because when BMW compiled the original code the assembler has used relative offsets for accessing the low memory as doing so is more efficient that using calls that are capable of accessing high memory. This makes perfect sense from an efficiency perspective, but makes it difficult when it comes to disassembly. I simply need to spend some more time working through this. Why do all this? Just because it helps reduce the room for error if I better understand exactly how the maps are used. I might also discover something new/useful along the way that might be helpful knowledge for the community. Also my 3 year old was up at 4am and there's only so many things you can do in the middle of the night when the rest of your family is asleep 🙂

Haha yeah have had the same conversation on Nam3Forum - my bad, I thought I'd seen someone else do that but clearly not. FYI the Karbonius box needs M6x18. I've ordered some suitable items 🙂 Re the CSL dipstick - yeah I did look into that, but a couple of things made me ultimately go with the CSL dipstick, firstly not everyone seemed completely satisfied with the mounting arrangement for the bent dipstick, and secondly I may well want to revert to stock at some point in the future and would rather my standard M3 one not be bent :-). Appreciate it's going to be a pain though...

Some of the bits of hardware I was waiting on for the airbox install arrived today. 07119905016 - original silver bolts that hold the two pieces of the airbox together. The black ones that come with the Karbonius look great, but I'm wanting to replicate the original CSL look with the silver hardware. 07119901780 - original bolts that attach the snorkel to the airbox. The Haimus Racing snorkel comes with silver through-bolts and nuts, plus insertable collars to go in the 3D-printed mounting holes. I'm not sure whether the Haimus Racing airbox doesn't have threaded mounts on the airbox, but anyway the Karbonius does. I did a quick test fit and confirmed that using the Haimus collars with the OE bolts works. 07119902626 - original bolts for the MAP sensor to secondary air rail. As George Hill noted some time ago these are too short to fit on my MAP sensor adapter, but with them in hand I was able to confirm that these are DIN7984 spec bolts, and have ordered some M6x18mm DIN7984 bolts which will fit perfectly. Only item (I think) I'm waiting on now is the CSL dipstick tube. I realised I have a bit of a problem when I went downstairs to find something and couldn't even remember what's in all of the boxes of parts on my shelves. Need the Christmas break to come round so that I can get some of this stuff installed!

Well look what arrived yesterday, less than 6 weeks after I ordered it! I saw a few months ago that Karbonius had made another mold for the CSL replica airbox to speed up production and certainly would seem to have helped! Can't really say anything about this piece that hasn't already been said. It's spectacularly good. The memory of the cost simply melts away when you hold it in your hand and look at it. I'm still waiting on the CSL dipstick tube plus a few minor pieces of hardware, but hopeful of having everything by the time the Christmas break rolls around! In the meantime all these parts continue to clutter up my spare room!

yeah from memory I think I had to drill it out slightly, but aside from that was straight forward.