Jump to content
Karter16

Karter16's E46 M3 Journal

Recommended Posts

Got a chance this morning to quickly sort out and consolidate the various parts that have arrived over the last 6 weeks. I now have most of what I need to commence on the 6 point RSM/RACP brace install. I still have a few bits and pieces to get:

  • Replacement diff fluid
  • LH side tray to go with the non-CD changer trunk lining
  • End caps for the 2x exposed tube ends on the brace
  • Rubber seals/grommets for where the brace goes through the top layer of sheet metal to the rear RACP threaded sections

I'm looking forward to getting the new rear diff cover on and enjoying the new bushes. I'm curious to see if/what difference it makes.

Not pictured below is the brace and the LH side trunk lining.

IMG_9870.thumb.jpeg.3fc7a872942b4f7096973e291e689c3d.jpeg

 

IMG_9871.thumb.jpeg.b00ac92c504e3c60da297027b1ac38ee.jpeg

 

I also now have in hand most of the OE items that I need for the airbox install. I'm still waiting on the CSL dipstick tube (that's currently slated to arrive sometime in November), and I have a few more bits and pieces to get for the wiring side of things, but most of the key bits are now in.

IMG_9868.thumb.jpeg.11519ec242de8f6914e94ac59dda4383.jpeg

 

I also ordered the airbox itself yesterday from Karbonius. With their standard 12 week lead time the theory is that it should arrive around Christmas or so, which will then mean I can play round with it over my (southern hemisphere) summer break. There'll be some downtime while I work through the install, get the wiring install just how I want it, iterate on the one piece SMG expansion tank bracket, etc. so summer break will be the perfect time for that.

I'll also be working on my own M3/CSL hybrid tune (basically doing a worse job of the amazing work that Bry5on (over on NAM3Forum) is doing). This is probably the part I'm most excited about to be honest - as someone who studied as an embedded systems engineer (and now spends their days as an IT consultant) it's great fun getting into the weeds of the DME.

The one thing for the install that I haven't 100% committed on is the snorkel. I'm 85% sure I'll go with the Haimus resin snorkel, but keep holding off actually ordering it. I like the idea of the OE snorkel, but given my approach of keeping everything reversible/as unadulterated as possible, I'm not super keen on having to add the H-Bridge and associated componentry to the DME, plus the significant additional expense for something that I'm not confident would make that much difference to the end result. 

I love the OE snorkel look (flat black contrasts well with the CF intake) and for this reason am not a fan of the Karbonius snorkel (if I went this route I'd want to paint it black and that's just silly). The Haimus snorkel seems to be the closest to the OE look, without the added complexity and cost of running a functioning flap. Maybe I'll convince myself that the flap is purely for noise control (even though I know it isn't really), and that therefore a simple snorkel with no flap is what BMW would have done in an alternate universe anyway.

Anyway - shaping up for some fun projects to work on in a few months!

  • Like 4

Share this post


Link to post
Share on other sites

Gave the car a quick wash this afternoon and was finally able to put the door trim back on the driver door. I took the trim off several months ago to adjust the drivers door window, but the rubber grommets on the clips were too hard and brittle to be able to use again, so had to wait for replacements from Schmiedmann (I ordered a significant amount for the future). Anyway, here the trim is with new clips ready to go back on.

IMG_9874.thumb.jpeg.49eb9816d65d9582f399c70bc1b01ac6.jpeg


And reinstalled.
 

IMG_9877.thumb.jpeg.7e3532fa47ab453c6fe3b40a5ed9890b.jpeg

  • Like 2

Share this post


Link to post
Share on other sites

So much fun getting all those little baggies of just the right parts in the post 👍 Looks like some fun times ahead !!

  • Like 1

Share this post


Link to post
Share on other sites

My son and I spent some time this morning removing the rear bumper and having a look at why it sits so badly and with a view to affixing the replacement speed clip brackets to the kevlar support.

IMG_9884.thumb.jpeg.4bd64b94e3a4c31f28167926f3bec2e8.jpeg


Unfortunately the reason is a little more serious than I was expecting. The rear bumper had been replaced prior to my ownership due to a collision (something I was aware of when I bought the car). I suspected that the reason that the bumper didn't sit well was because it wasn't installed properly. This was indeed the case, with the foam screws missing, etc. and the lower brackets of the rear bumper cut up, presumably to make the diffuser fit. I was expecting to have to get these items sorted and plastic weld the bumper, but I wasn't prepared for the fact that the kevlar support is damaged (in hindsight I should have realised it likely would be). The kevlar support has several folds/tears toward the centre of the piece which has broken the resin. This in turn appears to have allowed, over time, moisture to absorb into the kevlar weave. As a result the support appears to be beyond practical repair. Also as an integral part of the collision system I'm keen not to skimp on it.

The red outline in the photo below shows the affected section.

IMG_9888.thumb.jpeg.8d76524ba4e051295ba475e15c2c1aba.jpeg

In the meantime we have reinstalled the bumper as-is, while I source a new kevlar support and a couple of other bits and pieces. Oh, and it's time to replace the exhaust hangers again...

Aren't old cars just the best!

 

Share this post


Link to post
Share on other sites
3 hours ago, Cement said:

So much fun getting all those little baggies of just the right parts in the post 👍 Looks like some fun times ahead !!

Yes installing new parts is extremely satisfying. Such a pleasant experience compared to cleaning up old dirty parts!

  • Like 1

Share this post


Link to post
Share on other sites

If you want to check out a repair option I'd start here: https://www.carbotec.co.nz/

Have had some friends go there with foiling gear and have been very satisfied, really nice guy etc apparently.

  • Like 1

Share this post


Link to post
Share on other sites

This weekend I made a start on preparation for installing the 6 point rear brace. The plan is to get as much pre-work done as possible so that the process of dropping the subframe and bolting through can be as straightforward as possible.

I got this done in a few hours here and there across Saturday and Sunday in between adventures with Mr 7, Mr 3 and Mrs Karter16.

First up is to remove the interior:

IMG_9953.thumb.jpeg.065676e5327cd7dc5d86de93b137f5cd.jpeg


I need to get the isopropyl alcohol out and clean up the rear seat and prep it for repainting some rust spots, but I won't do that until the heavier prep-work is done.

Before I got started with drilling I wanted to place the brace in the car just to see, with my own eyes, the placement of the mounting points etc. I had all the measurements from Marin at Yurkan Cages, but figured seeing it with my own eyes would help avoid any mistakes.

I wanted to make sure though that I didn't damage the paint on the brace, so spent some time first taping up all of the contact surfaces:

IMG_9957.thumb.jpeg.ef0439cbdcaee1609c158fa629d5f66c.jpeg

I carefully dropped the brace into place (obviously sitting higher than it will eventually with the floor sheet metal in the way. But this meant I could sight the approximate locations and reassure myself about the approach.

IMG_9958.thumb.jpeg.bfe3b5ab01ffa47d9dea7c2192c040c0.jpeg

Note: You don't see it in the photos because I removed some of it to get better lighting for photographs, but I was very careful to ensure that interior surfaces were covered and protected when drilling, cutting, sanding, etc. It's really worth taking the time to protect everything well.


First up to prepare for cutting the top layer of sheet metal is removing the two little brackets that sit atop the locations where the front mounts will go. The diameter of the hole for the spot weld is about 6mm, and I found a 7mm bit was necessary to drill out the weld entirely.

IMG_9965.thumb.jpeg.3ddca6c9b30692c084f7a07c9fb0f770.jpeg

IMG_9970.thumb.jpeg.2d55aebcf05668671c577ed2371d0f19.jpeg


Note that the brackets are stuck on as well (presumable to hold them in place before being spot welded). I needed to carefully encourage them to lift off with a flathead screwdriver (which I taped with masking tape to protect the metal surfaces).

IMG_9971.thumb.jpeg.baf80d60b8cdac49ef8183f680c38223.jpeg

With these out of the way I then moved on to cutting the holes for the rear two mounts. I carefully measured and remeasured several times to make sure I was in exactly the right spot. I used a centre punch (always use a centre punch) to mark the point and then drilled out with a 3mm bit. I had some old, unused, BMW M TwinPower Turbo 10W60 which I used for lubricating on the drill bits and hole saw (only ever 10W60 for my car 😂).

IMG_9972.thumb.jpeg.1c4344a9de52345c5d03cdb52a3ebf58.jpeg

Note: With things like this it's worth taking the time to clean your drill bits after each cut, that way they're clean for the next cut and aren't flinging more mess around than necessary.

I then drilled out to 6mm before making the final cut with the 44mm hole saw.

IMG_9973.thumb.jpeg.888f46385a5e645a316d893a8f0cf46f.jpeg

You can see in this photo that there was some overspill from when the BMW RACP "foam" resin procedure was done. I've only just realised I didn't take a photo, but the way I cleaned this up was to carefully down down as far as I dared with the hole saw (not wanting to damage the next layer of sheet metal) and then use a chisel to very careful chip away at the resin bit by bit. By carefully doing this I was able to completely clear it from the vicinity of the hole without causing any damage to anything else.

Side note: calling this stuff "foam" does a disservice to people's understanding of it. The stuff is much better described a plastic-like resin - It's absolutely solid stuff.

I then did the other side (the resin had only just domed up from underneath so didn't need to clean it up like on the left hand side. Pretty soon I had the rear points taken care of:

IMG_9975.thumb.jpeg.3841c601514caac6e95f069dbc5da51d.jpeg\

IMG_9976.thumb.jpeg.0f9d5fe2f7649140e2d554ce75d2805a.jpeg


Then it was on to the front points, which are certainly the harder pair to do. I realised, as I went to write this, that I didn't take any photos of this in progress, probably because I was cramped in the back of the car and carefully concentrating on what I was doing. Essentially though it's a case of carefully measuring in from the sides and then siting the pilot hole in the right place. In order to do this correctly I used a flat edge on the top of the RACP and measured out and down to find the bottom edge of the pocket. I then split the distance in two horizontally and dropped down to get the centre point at which to drill the pilot hole. I then drilled this out to 6mm and "verticalized" it to guide the hole saw. I then cut down vertically from the top using the hole saw, and then cut out the bottom of the pocket with a cutting disk on the Dremel (highly recommend having/getting a Dremel if you're taking this job on).

Working carefully resulted in this (wife's beauty product as a conveniently sized stand in for 40mm tube steel):

IMG_9985.thumb.jpeg.daaa8b94695ee1982bf11c548aff0606.jpeg

 

After some careful work on both sides (including removing burrs with the sanding attachment on the Dremel) I then took the time to use a magnet to remove all trace of the cutting, including from inside the cavities. Handy tip - if you use a medical disposable rubber glove as a cover for your magnet it makes cleaning up easy. Each time the magnet is "full" just invert the finger of the glove and move on to the next finger, after 5 goes throw the glove away and grab the next one.

IMG_9986.thumb.jpeg.b9a0dfabc798d3daf4ad2e013d99a1bf.jpeg


The front now looked like this:

IMG_9987.thumb.jpeg.c96ab664ef00d77136aaa25007db68ac.jpeg

 

I then dropped the brace back in to check the fit. Fitted into place first time! (obviously still sitting higher as it's resting on top of the rear shock mount nuts).

IMG_9989.thumb.jpeg.21d61e96ad825bbb6645173b3758b17f.jpeg

IMG_9990.thumb.jpeg.7ba41707ef67b5d7b6048ea466ca9541.jpeg



Having reached this point and confirming the fit I then took the brace back out and cleaned up the cuts and area around them (inside and out) with isopropyl alcohol, before applying a coat of kill rust undercoat to the exposed edges of the cuts. I have an enamel top coat in the same colour as the e-coat BMW used which I will apply as well, but only after confirming the fit once the new extended subframe bolts are in and I can check the fitment exactly. Until then the undercoat will protect the edges from rust.


I'm glad that I decided to tackle this part of the project separately, as it took a number of hours to do and means the top side is ready to go when we drop the subframe.


Oh, and in an entirely expected and predictable turn of events, the top side of the front right RACP mount has cracks in it. I'm unsurprised given the cracks that we welded on the bottom side when Dad and I did the reinforcement plates. We'll stop drill the cracks and weld prior to dropping the subframe. I wish it hadn't been quite so long between doing the plates and getting to the top side, but such have been the realities of dealing with medical kids. On the plus side the car has done very few km's since the plates were done!

IMG_9991.thumb.jpeg.5ebf916b631de957ca2c7f5ba85825f5.jpeg

Edited by Karter16
  • Like 4

Share this post


Link to post
Share on other sites

Id expect the wheel arches to have cracks or popped welds too, the seam sealer is good a hiding them.

Share this post


Link to post
Share on other sites
On 7/28/2024 at 2:23 PM, Karter16 said:

IMG_9590.thumb.jpeg.2428e8351742a9b5f0de917be9338c26.jpeg

Hey,

Just checking in, might be too soon to judge the longevity of this fix but wondering how it's holding up so far? Stumbled upon this thread on E46 Fanatics (shouted you out a bit on there too, sorry :D ) where there seem to be some mixed views on this approach. Did you treat it with any sealant/protectant type product to hopefully prolong the fresh look?

Share this post


Link to post
Share on other sites
On 10/19/2024 at 12:11 PM, Eagle said:

Id expect the wheel arches to have cracks or popped welds too, the seam sealer is good a hiding them.

Yeah quite possibly - there's no visible evidence through the seam sealer (which there wouldn't be unless there was bad damage) but agree that popped welds could well be hiding underneath the seam sealer.

Share this post


Link to post
Share on other sites
6 hours ago, Vass said:

Hey,

Just checking in, might be too soon to judge the longevity of this fix but wondering how it's holding up so far? Stumbled upon this thread on E46 Fanatics (shouted you out a bit on there too, sorry :D ) where there seem to be some mixed views on this approach. Did you treat it with any sealant/protectant type product to hopefully prolong the fresh look?

Haha - well currently they look like they've recently had plastic trim protectant applied 😂 so they look great.

Yeah I definitely wouldn't suggest repeatedly doing this trick as you'll destroy the plastic. I chose to do it once to "restore" the plastic and am regularly treating with protectant to prolong it as long as possible. Worth noting that I left it untreated for about a month or so to give plenty of time for the plastic to harden up as much as it was going to before putting any protectant on it. Since then they've looked great, but it hasn't really been very long.

I'm very happy I did it because it looks massively better than it did before, and in the absence of any other realistic solution the alternative to more permanently fix it remains buying new ones.

  • Like 1

Share this post


Link to post
Share on other sites

@Vass here’s a photo I took just before - unfortunately the camera captured the red quite saturated so not sure if it’s very helpful, but this is what they are currently like.

Will try to remember to report back on this in another 6 months or so.

IMG_0044.jpeg

  • Like 1

Share this post


Link to post
Share on other sites

This weekend I spent a bit of time finishing up the first cut of my CSL clone tune.

Essentially I'm making my own clone along the lines of the approach Bryson has taken with his Mullet Tune, but doing it myself for the entertainment/learning value. All credit to Bryson for pioneering this approach, I'm basically just building my own version of what he's already done. If you haven't read up already I highly recommend following along in his journal.

When I do the swap, I'm going to do it in two stages.

Stage 1: Flash the car with the base CSL tune. This will give me a baseline datum point and is a known configuration to start with and ensure that the install has been successful.

Stage 2: Flash the car with V1 of my customised tune. This is a starting-point tune which blends Ignition, Injection and VANOS tables from my current Euro M3 tune with the CSL tune. The hope is that this will be an improvement on the base CSL tune and a starting point for iterative fine tuning.


(I'm getting in to a bit of detail now, so those who know more about this than me will be able to point out my mistakes :-))


Scope

  • For a vehicle with MSS54HP DME (not modified for flap)
  • Vehicle is running a Euro tune
  • Vehicle has a CSL airbox conversion using a MAP sensor (OE 1.0 Bar so no conversion factor required)
  • Vehicle is MSS54HP so does not require IAT conversion factor


For Stage 1 I'm starting with Terra's 0401 PD31 Full binary. This binary is a modified version of the 0401 full binary with support for the non-CSL boot loader, error codes, etc. I'll be loading this full binary at the time that I do the install. I'll then be flashing the CSL tune (partial binary) as well. There are a number of changes to be made to the original 0401 PD31 partial.

  1. Change 0xE002 from 00 to 01 to make the partial work with Terra’s modified full binary (support for the non-CSL boot loader)
  2. Enable Alternator light over canbus
  3. Set non-CSL cam offsets
  4. Set CSL intake flap control to always be open
  5. Disable DTC 124 (CSL flap)

I used TunerPro to make the above changes to the partial, and now have this saved ready to go when I do the airbox install.


For Stage 2 I then took the partial I'd just generated and then added the modified ignition, injection and VANOS maps that I'd prepared. The preparation of these maps were of course the bulk of the work.

The merging of the maps is an interesting maths challenge. For this first version I took the following approach:

1: Take the standard M3 and CSL tables and interpolate both tables to allow for direct comparison.
2: Compare the difference between the tables (allowing for any conversion adjustments between the two)
3: I then manually applied a mask to blend the 2 tables together into the output table.
4: We then finish up with a nice optimisation problem. Finding the x-axis points that best describe the table as a whole and thus minimising the error. The M3 tune tables tend to have more x-axis points in the lower half of the RPM range and the CSL tune tends to have more in the upper half. This of course means that you can't just use all of the x-axis points from both maps. Ideally I would dust off my very rusty Matlab skills and write something to do it, however for now I simply added some calculations in the sheet to identify absolute change, rate of change, inflection points, etc. and then rank them by importance, this made it fairly straightforward to more manually identify the most important x-axis values to bring across.


The VANOS maps in particular are quite fascinating. There is a very significant difference in the lower RPM range between the M3 Euro and CSL tunes (example of the difference in the exhaust maps below). It's easy to see why cars with standard cams struggle so much in the lower RPM ranges with the CSL map.

389662380_Screenshot2024-10-28at7_04_36PM.thumb.png.97eacfcff8efe156646dbe0c59e037f6.png


Methodically working through these maps took me a reasonable amount of time (although to be honest a lot of that was diving into researching various topics to help make sure I understood correctly.

The end result was updates to the following maps:

KF_TI_N_RF_VL: Fuel Injection Full Throttle
KF_TZ_VL: Ignition Full Throttle
KF_TZ_GRUND: Ignition Ground
KF_TZ_MIN: Ignition Minimum
KF_TZ_LL: Ignition Idle
KF_EVAN1_SOLL: Intake Target
KF_EVAN1_SOLL_KATH: Intake Target Cold
KF_EVAN1_SOLL_DMAX: Intake Target Max Deviation
KF_AVAN1_SOLL: Exhaust Target
KF_AVAN1_SOLL_KATH: Exhaust Target Cold

KF_TZ_MIN and KF_TZ_LL are the ones that concern me most. For both I've erred on the side of taking the values from the CSL map, as for KF_TZ_MIN at least they appear to be more conservative. and for KF_TZ_LL it is different enough that I can't be sure there aren't changes in the 0401 program that interpret this map differently. I'll find out I guess when I get the tune running.


It's worth noting that once I have the tune up and running I'll also be doing the VE map tuning process described here.


Oh and the Haimus Racing snorkel arrived today. Well packaged and in a lovely soft bag. It seems to be a fairly nice piece. You can certainly see it's 3D printed when you look at it closely, and there is evidence of printing errors in places. The exterior has been post-processed to a fairly nice finish, and unless you look closely it looks good. It also feels nice and light for its size, but seems sturdy. All in all I'm ambivalent about it given the price (especially with shipping to NZ) (that said I haven't actually looked into how much it would cost to get one printed from CAD file), but it will look pretty nice in the engine bay I think once all is done.

IMG_0090.thumb.jpeg.cbe99b588e8238780fd279111fe6ff1a.jpeg

IMG_0091.thumb.jpeg.e02b4bd6e8ee26c419214bf013035ebf.jpeg

IMG_0092.thumb.jpeg.b1bc9c309e6a8253923a43a32433dfa1.jpeg

IMG_0093.thumb.jpeg.e3d09f447ce064e77ed67d3e9dafc90c.jpeg

 

Edited by Karter16
  • Like 3

Share this post


Link to post
Share on other sites

Well look what arrived yesterday, less than 6 weeks after I ordered it! I saw a few months ago that Karbonius had made another mold for the CSL replica airbox to speed up production and certainly would seem to have helped!

Can't really say anything about this piece that hasn't already been said. It's spectacularly good. The memory of the cost simply melts away when you hold it in your hand and look at it.

I'm still waiting on the CSL dipstick tube plus a few minor pieces of hardware, but hopeful of having everything by the time the Christmas break rolls around!

In the meantime all these parts continue to clutter up my spare room!
IMG_0116.thumb.jpeg.403808082365a5b69c8b0a132ebd4430.jpeg

 

IMG_0125.thumb.jpeg.07c56172a38de18dd566060f05d2dd3d.jpeg

 

IMG_0122.thumb.jpeg.a5e11c5c4bc4f11d68953abeb0245bec.jpeg

 

IMG_0119.thumb.jpeg.702e88b1b06145520a97fae9ba47f9e5.jpeg

 

 

  • Like 6

Share this post


Link to post
Share on other sites

Some of the bits of hardware I was waiting on for the airbox install arrived today.

07119905016 - original silver bolts that hold the two pieces of the airbox together. The black ones that come with the Karbonius look great, but I'm wanting to replicate the original CSL look with the silver hardware.

07119901780 - original bolts that attach the snorkel to the airbox. The Haimus Racing snorkel comes with silver through-bolts and nuts, plus insertable collars to go in the 3D-printed mounting holes. I'm not sure whether the Haimus Racing airbox doesn't have threaded mounts on the airbox, but anyway the Karbonius does. I did a quick test fit and confirmed that using the Haimus collars with the OE bolts works.

07119902626 - original bolts for the MAP sensor to secondary air rail. As George Hill noted some time ago these are too short to fit on my MAP sensor adapter, but with them in hand I was able to confirm that these are DIN7984 spec bolts, and have ordered some  M6x18mm DIN7984 bolts which will fit perfectly.

Only item (I think) I'm waiting on now is the CSL dipstick tube. I realised I have a bit of a problem when I went downstairs to find something and couldn't even remember what's in all of the boxes of parts on my shelves. Need the Christmas break to come round so that I can get some of this stuff installed!

  • Like 1

Share this post


Link to post
Share on other sites
12 hours ago, Karter16 said:

07119901780 - original bolts that attach the snorkel to the airbox. The Haimus Racing snorkel comes with silver through-bolts and nuts, plus insertable collars to go in the 3D-printed mounting holes. I'm not sure whether the Haimus Racing airbox doesn't have threaded mounts on the airbox, but anyway the Karbonius does. I did a quick test fit and confirmed that using the Haimus collars with the OE bolts works.

That's exactly what I did with mine.

12 hours ago, Karter16 said:

07119905016 - original silver bolts that hold the two pieces of the airbox together. The black ones that come with the Karbonius look great, but I'm wanting to replicate the original CSL look with the silver hardware.

From memory these don't fit the karb box. Pretty sure I ordered those as well and ended up having to use the karb supplied bolts. I put a small rubber washer under the head of the bolt so it didn't damage the finish of the airbox.

12 hours ago, Karter16 said:

Only item (I think) I'm waiting on now is the CSL dipstick tube.

The downside to the CSL dipstick tube is that you have to remove the unfiltered section of the airbox just to check the oil level. You can very easily bend the stock dipstick tube to the side and it's way more functional, that's what I ended up option for.

Edited by Harper
  • Like 1

Share this post


Link to post
Share on other sites
3 hours ago, Harper said:

From memory these don't fit the karb box. Pretty sure I ordered those as well and ended up having to use the karb supplied bolts. I put a small rubber washer under the head of the bolt so it didn't damage the finish of the airbox.

The downside to the CSL dipstick tube is that you have to remove the unfiltered section of the airbox just to check the oil level. You can very easily bend the stock dipstick tube to the side and it's way more functional, that's what I ended up option for.

Haha yeah have had the same conversation on Nam3Forum - my bad, I thought I'd seen someone else do that but clearly not. FYI the Karbonius box needs M6x18. I've ordered some suitable items 🙂

Re the CSL dipstick - yeah I did look into that, but a couple of things made me ultimately go with the CSL dipstick, firstly not everyone seemed completely satisfied with the mounting arrangement for the bent dipstick, and secondly I may well want to revert to stock at some point in the future and would rather my standard M3 one not be bent :-). Appreciate it's going to be a pain though...

  • Like 1

Share this post


Link to post
Share on other sites

A couple of things have been playing on the back of my mind while I've been working on CSL tune file.

1: Confirming that the lookup tables are definitely linear interpolated - Given the MC68336/376 has the CPU32 TBL instructions built in it would make sense, but it would be nice to see it with my own eyes.
2: Identifying exactly how some of the ignition/injection maps are utilised in the program.

I decided the best way to figure this out would be to do some disassembly of the full (program) binary. After a number of sessions playing around learning Ghidra (and adding the CPU32 instruction set to Ghidra) I've managed to confirm #1.

I've found the Curve/Table lookup functions in the program code and confirmed their use for things like interpolating between VANOS table values (Below is a snippet of part of one of the lookup functions).

338601316_Screenshot2024-11-24at7_29_40AM.thumb.png.79c2d8ce8e9e71dcdfdc3b803aab6e58.png


I don't think there was ever really that much doubt that this wouldn't be the case, but it's good to know for sure. Having identified the lookup functions in the code means that I can now use them to look "backwards" to their calling functions and more easily identify where the various tables are used. This leads into #2 on my list which is to identify the functions that use tables like KF_TZ_LL so that I can see exactly how those tables are used and how they influence the final calculated ignition timing (the draft FunktionsRahmen floating around is unfortunately not complete in this regard).

The current problem I have is that the data space (which holds the contents of the partial binary) is split into to sections in the memory space. The lower half of the partial (addresses 0x0000-0x7FFF as you would read them in TunerPro) is at offset 0x88000 and the upper half (0x8000 - 0xFFFF) is at 0x8000. Ghidra is linking references to the lower half (so with the offset 0x88000 - 0x8FFFF) just fine, however it is not for the upper half (0x8000 - 0xFFFF). I suspect that this is probably because when BMW compiled the original code the assembler has used relative offsets for accessing the low memory as doing so is more efficient that using calls that are capable of accessing high memory. This makes perfect sense from an efficiency perspective, but makes it difficult when it comes to disassembly. 

I simply need to spend some more time working through this.

Why do all this? Just because it helps reduce the room for error if I better understand exactly how the maps are used. I might also discover something new/useful along the way that might be helpful knowledge for the community. Also my 3 year old was up at 4am and there's only so many things you can do in the middle of the night when the rest of your family is asleep 🙂

Share this post


Link to post
Share on other sites

Out of cusriosity. Do you code for a living or hobby? Reverse engineering systems level code and following it isn't light reading 🙂

Share this post


Link to post
Share on other sites
12 hours ago, deedub said:

Out of cusriosity. Do you code for a living or hobby? Reverse engineering systems level code and following it isn't light reading 🙂

Reminds me of this scene, such a funny series from back in the day 🤣

 

  • Haha 4

Share this post


Link to post
Share on other sites
7 hours ago, Cement said:

Reminds me of this scene, such a funny series from back in the day 🤣

 

hahahaha such a good show!

Share this post


Link to post
Share on other sites
19 hours ago, deedub said:

Out of cusriosity. Do you code for a living or hobby? Reverse engineering systems level code and following it isn't light reading 🙂

Haha,

I don't code for a living, but I have coded since I was about 14. I did a BE majoring in Mechatronics (which is marketing for Robotics and Embedded Systems Engineering), and worked in that space for a period of time. So I have a reasonable grasp of embedded systems (which is what DMEs are), assembly language, etc. I would describe myself as someone who has some background in this space, rather than an expert. I certainly don't have any prior experience with disassembly, so am figuring it out as I go (although tbh understanding the concepts and being able to read technical documentation are pretty much all you need anyway). Ghidra as a tool is super-impressive at what it can do and makes a lot of it significantly easier when it comes to identifying patterns, likely function entry and return points, etc. which saves a lot of time.

  • Like 2

Share this post


Link to post
Share on other sites

Well I feel like a bit of a muppet but I've figured out the memory reference issue - it's a very simple reason and I should have realised sooner..

The MSS54HP has 2x processors operating in a Master/Slave arrangement. The full binary that I'm ingesting has the individual binaries for the master and slave conjoined together. The issue with this is that both Master and Slave have the parameter space at 0x00008000 - 0x0000ffff. This is then mapped to virtual location 0x00088000. FOR BOTH PROCESSORS.

What I was missing was that when loading and disassembling the binary as a whole, the code on both the master and slave were together referencing the same 8000 bytes between 0x00088000 and 0x0008ffff. What made this tricky to spot is that the full binary for the Master is 0x80000 bytes long, so the virtual offset aligned perfectly to the offset of the start of the slave binary plus the 0x8000 physical offset of the slave's parameter space in the binary. It made it appear as though the references to the slave parameter space was just fine.

Anyway, the solution is to simply split the binary in two, ingest them both separately into Ghidra and offset the 0x00008000-0x0000ffff memory space to 0x00088000 for both.

On and I've also labeled all of the memory locations used by the Internal Register Map which shows me where the code is accessing things like the QADC, CTM4, QSM, TPU, etc. which will further help to identify what various functions are doing.

In loosely related news the CSL dipstick tube finally shipped today so I should have it in time for the Christmas break 🙂

Onwards and upwards.
 

  • Like 1

Share this post


Link to post
Share on other sites

Well I've made some excellent progress this evening in item 2 on my list. I've located the series of routines that calculate ignition timing and have mostly figured out the routine that retrieves values from the maps I'm interested in understanding. The below is a C-style reasonable-equivalent of the assembly code. In this I've added comments as I've figured bits out and have managed to give my own names to most of the local and global variables involved.

74833881_Screenshot2024-11-28at9_20_09PM.thumb.png.0ef030431315292ab01804d1d528c379.png

The key thing of interest I've uncovered is confirmation that use of the KF_TZ_GRUND, KF_TZ_LL and KF_TZ_VL maps are mutually exclusive based on operating mode. I'm pleased to have confirmed this as there is some ambiguity on the matter depending on where on the internet you look and this greatly aids in my understanding of blending the M3 and CSL maps. Secondly I now have the addresses of where the global variables TMOT, RPM and Relative Fill are stored. Given these are commonly used variables knowing what they are will be useful in further understanding the code.

Next is to continue to follow the chain of TZ (ignition) related routines to understand the rest of them. From a quick look the next function appears to overlay adjustments from the MomentManager in response to signals from ASC/DSC.

Edited by Karter16

Share this post


Link to post
Share on other sites

Got a few bits and pieces done this weekend.

On Saturday morning dad and I welded up the cracks in the top of the front right RACP mount. As usual I did a bad job of taking photos as we went, but I did get a couple here and there.

As a recap, this is what the front right looks like from the top:

IMG_9991.thumb.jpeg.8538baa769dcc6d28914fe9abe815da9.jpeg


As you can see in the photo above the crack coming down towards the bottom of the photo is hidden behind the rear seat sheet layer. So that we could see how far this crack went we inspected the bottom side of the top layer of the RACP with my boroscope.

IMG_0248.thumb.jpeg.176d600ad128015b24f909b05e00bd51.jpeg


As can be seen the crack extends just to the point that the RACP bends down to layer up with the rear seat sheet. For reference the threaded insert visible on the right hand side of the image is for the seatbelt buckle.

Knowing how far down the crack extended meant that I was easily able to cut the small section of the seat layer out so that we could access the end of the crack to drill and weld. We found that a rounded nose carbide burr in the die grinder was the best way to clean up the surface around the cracks.
 

IMG_0250.thumb.jpeg.aa81542fc80091236b395be3f8df444c.jpeg


Dad then MIG welded the cracks up - I unfortunately didn't get any photos of this as I was running extraction and lighting while dad welded. A couple of comments though:

 - We used some ceramic fibre insulation segments to pack the RACP cavity to prevent sparks, grindings, etc. from traveling inside the cavity. the ceramic fiber insulation is good in that it's non-flammable. 
 - I had previously measured the thickness of the RACP layers to be welded and dad had obtained some equivalent sheet metal to run some trials on and dial in the settings on the MIG.
 - We went slow to avoid heating everything up too much, even so the cavity wax on the underside of the top RACP layer tends to melt and smoke along where you've welded, good extraction is advised.
 - We used the boroscope again to check the other side of the welds (where they are on a single layer of sheet) and confirm good penetration of the weld.

With the welding done I then cleaned up the top surface with the carbide burr to level out the welds and leave an, as flat as possible, surface for the brace to mount to.

I unfortunately didn't get any photos of the welds prior to cleaning up and putting a protective layer of undercoat on.

IMG_0253.thumb.jpeg.eff8c6f718ed16aa80ee47a18dfc4ebd.jpegfetch?filedataid=60317&type=large

As you can see the surface is not perfectly smooth (the flash from the phone actually makes it look more pronounced than it is in reality - it is less than 1mm, which will be perfectly fine for this situation. The OE welds stick up a couple of mm anyway. I didn't want to take away too much material at any point with the burr, so played it safe and left a small amount of extra material in place.

You may also notice that we welded the little cutout that we made to access the end of the crack back in place and smoothed it out with a little body filler. Not really necessary given it's going to spend the rest of its life under the seat again, but for the sake of an extra 20 minutes work it's worth it in my opinion.

I hand painted on the under coat as I wanted to make sure I could get it into all of the corners well, there's not a lot of room in there to rotate a spray can. I'll do another layer of undercoat, and then sand it back a little, mask up, build myself a little spray booth inside the car and do a couple of coats with the e-coat matched enamel I have. I'll then dust on some A08 on the seat bench (when I can finally get some, whole other story) to replicate the original surface as much as possible.


Secondly the DIN7984 hex head bolts for the MAP sensor arrived, they're identical to the original items except 18mm long to address the greater thickness of the 101 sensor mounting point, plus they're stainless rather than the zinc-coated original bolts. I'm happy with how these have turned out:

IMG_0225.thumb.jpeg.cc6f6a235fbba864317fe6794ef1b95c.jpeg

 

IMG_0226.thumb.jpeg.7c79c131919b5384b71050ec103d8c88.jpeg

 

  • Like 1

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...

×
×
  • Create New...