Coding M modules in a non M car

RSL

Lieutenant
Aug 11, 2017
590
He has some traces on github, but not sure where they're from. If nothing else works, I'd send a sport signal on the media button, but need to find the ID/bits/timing. It might be in those traces, but I just glanced at them.

Looks like PT CAN wires are red and red/blue.
 

RSL

Lieutenant
Aug 11, 2017
590
I wasn't able to pick up anything on the PT-CAN wires at the GWS. Not sure why, but didn't see any connection issues. I used the same sketch I've been using (known good) and just changed the speed, but nothing. I'll try again next weekend when I have more time.
 

amg6975

Corporal
Oct 27, 2019
145
The button presses from the SZL are not going to be on the PT-CAN unless the JBBF allows them to be. You may need to flash the JBBF to an M3 version?
 
  • 1Like
Reactions: RSL

RSL

Lieutenant
Aug 11, 2017
590
The button presses from the SZL are not going to be on the PT-CAN unless the JBBF allows them to be. You may need to flash the JBBF to an M3 version?
I'll try M3 flash on JBBF this weekend. I did try M3 flash/coding on everything, but that was pre-SZL swap. Everything is 1M flash/coded now and was hoping IKM0S had the same mode message out to DKG as M3 DME, but it either doesn't, uses a different ID or it's just not making to the TCU.

If we know it's just not there at all, sending 0x315 or something externally may be the only way.
 

RSL

Lieutenant
Aug 11, 2017
590
Just standing on the shoulders of those who did it before and streamlining/confirming things. Glad to share that info for anyone that does it from this point on.

Torque request table changes are a given with the wheel button working, but that button only works on IKM0S as of now. At least it's some on-the-fly adjustment. Last thing to at least get functional are modes seen by DKG, which is what I'm trying to do now.

IKM0S has specific M Drive parameter measurement addresses, but the reference tables for them don't seem to exist in any MSD80.prg and I've logged 0s on all of them at any stage of swap/flash/coding. Seems the 1M rom may be set up to handle selectable M Drive options, but no interface or we just haven't found it yet. Perhaps some CIC hacking/custom values are needed.

There are M Drive reference tables in MSD80.prg, but they don't match the table names used in IKM0S.

A few from 1M IKM0S:
state_spt_disp_can = CAN M Drive light status = _CNV_S_5_RANGE_STAT_635_R_CM
state_spt_ecu_can = CAN MDrive ECU sport mode = _CNV_S_4_RANGE_STAT_636_CM
state_spt_esp_can = CAN M Drive ESP mode = _CNV_S_5_RANGE_STAT_637_CM
state_spt_step_gb = CAN M Drive default drive logic level for trans
state_spt_mod_gb = CAN M Drive default mode for trans
etc.

What are in MSD80.prg and probably why anything at all shows up when M3 $2MD is coded to CIC:
_CNV_S_2_RANGE_STAT_1008_CM_9ZCE401S
_CNV_S_2_RANGE_STAT_1008_CM_9ZCE401S.png


_CNV_S_4_RANGE_STAT_1009_CM_9ZCE401S
_CNV_S_2_RANGE_STAT_1009_CM_9ZCE401S.png


_CNV_S_5_RANGE_STAT_1007_CM_9ZCE401S
_CNV_S_5_RANGE_STAT_1007_CM_9ZCE401S.png


_CNV_S_4_RANGE_STAT_1006_CM_9ZCE401S
_CNV_S_4_RANGE_STAT_1006_CM_9ZCE401S.png


_CNV_TABLE_STATUS_CONFIGMDRV_STATE_SPT_PSTE_CAN
_CNV_TABLE_STATUS_CONFIGMDRV_STATE_SPT_PSTE_CAN.png
 

derekgates

Lieutenant
Feb 23, 2018
661
NW FL
Just standing on the shoulders of those who did it before and streamlining/confirming things. Glad to share that info for anyone that does it from this point on.

Torque request table changes are a given with the wheel button working, but that button only works on IKM0S as of now. At least it's some on-the-fly adjustment. Last thing to at least get functional are modes seen by DKG, which is what I'm trying to do now.

IKM0S has specific M Drive parameter measurement addresses, but the reference tables for them don't seem to exist in any MSD80.prg and I've logged 0s on all of them at any stage of swap/flash/coding. Seems the 1M rom may be set up to handle selectable M Drive options, but no interface or we just haven't found it yet. Perhaps some CIC hacking/custom values are needed.

There are M Drive reference tables in MSD80.prg, but they don't match the table names used in IKM0S.

A few from 1M IKM0S:
state_spt_disp_can = CAN M Drive light status = _CNV_S_5_RANGE_STAT_635_R_CM
state_spt_ecu_can = CAN MDrive ECU sport mode = _CNV_S_4_RANGE_STAT_636_CM
state_spt_esp_can = CAN M Drive ESP mode = _CNV_S_5_RANGE_STAT_637_CM
state_spt_step_gb = CAN M Drive default drive logic level for trans
state_spt_mod_gb = CAN M Drive default mode for trans
etc.

What are in MSD80.prg and probably why anything at all shows up when M3 $2MD is coded to CIC:
_CNV_S_2_RANGE_STAT_1008_CM_9ZCE401S
View attachment 45466

_CNV_S_4_RANGE_STAT_1009_CM_9ZCE401S
View attachment 45467

_CNV_S_5_RANGE_STAT_1007_CM_9ZCE401S
View attachment 45469

_CNV_S_4_RANGE_STAT_1006_CM_9ZCE401S
View attachment 45468

_CNV_TABLE_STATUS_CONFIGMDRV_STATE_SPT_PSTE_CAN
View attachment 45470
This is fascinating stuff. At this point are you thinking we need a CAN shield (if JBBF enabled) to emit the messages?
 

RSL

Lieutenant
Aug 11, 2017
590
I'm thinking that may be the easiest solution instead of all the digging/flashing/coding testing, but a last resort. It's only one message, but an important one (0x315 vehicle mode). I'll exhaust all options before I concede to needing a shield.

At this point, still can't be sure if the mode messages are there and I'm just not able to grab in a log or if they just aren't being passed to where shield is tapped. If they are present, they aren't making it to the trans either right now. I'll flash everything M3 first, then try tapping PT-CAN at the shifter again if that is still fruitless.

Starting to wonder if those M drive tables are in there for Z4 because they don't appear to be there for 1M and certainly not for M3. Maybe limiting coding to 1M or M3 is a bit shortsighted. Z4 is probably the closest thing to MDCT with an MSD81 that was actually produced. From my understanding, Z4 DCT bin is much more aligned to M3 than 335is as far as logics for modes/bus.
 
  • 1Like
Reactions: aus335iguy

Begood69

700 HP Club (N54)
Nov 13, 2016
188
Fayetteville, NC
I'm thinking that may be the easiest solution instead of all the digging/flashing/coding testing, but a last resort. It's only one message, but an important one (0x315 vehicle mode). I'll exhaust all options before I concede to needing a shield.

At this point, still can't be sure if the mode messages are there and I'm just not able to grab in a log or if they just aren't being passed to where shield is tapped. If they are present, they aren't making it to the trans either right now. I'll flash everything M3 first, then try tapping PT-CAN at the shifter again if that is still fruitless.

Starting to wonder if those M drive tables are in there for Z4 because they don't appear to be there for 1M and certainly not for M3. Maybe limiting coding to 1M or M3 is a bit shortsighted. Z4 is probably the closest thing to MDCT with an MSD81 that was actually produced. From my understanding, Z4 DCT bin is much more aligned to M3 than 335is as far as logics for modes/bus.
I tried coding the cic with the z4 option in the coding and it did allow the dsc control.
 
  • 2Like
Reactions: aus335iguy and RSL

RSL

Lieutenant
Aug 11, 2017
590
I flashed/coded every which way this weekend (1M/M3/Z4), combos of them and custom manual changes. I'm convinced the info is there and active, it's just not making it to modules outside the DME.

Logged in the DME, on M button press:
- CAN trans sport mode = 1
- CAN drive logic step = 3 (defined in DME)
- Status mdpwg mdrv (sport throttle table) = 1
- State mdrv DSC = 1
- State mdrv mod getrieb = 1
- State mdrv stage getrieb = 3
- State mdrv esp (servtronic) = 1
etc.

Despite all that, trans program mode stays 0, DSC does not disable with M button press, drive logic level stays 2 as defined in the TCU bin. The values from DME will populate in CIC, but the true states remain as defined by buttons/TCU defaults.

From errors I've seen previously, it looks like JBBF sends 0x315 to Kombi and either Kombi or SZM sends it to DME (back through JBBF?). I am not sure now if DME or JBBF mails it out to modules, but JBBF coded as 1M/M3/Z4 doesn't change the lack of mode acknowledgement in TCU.

I did get a good connection on PT-CAN finally, but still no 0x315. I suspect it's for the same reason trans mode isn't making it to the TCU, whatever that is.

ikmos_szl.png
 
  • 1Informative
Reactions: derekgates

aus335iguy

Major
Nov 18, 2017
1,852
Down under
I’m not 100% sure where to go from here but what you’re doing is the closest anyone has come to this so please don’t give up. Superwoofey’s can shield code works in that it disables the DSC perhaps there’s a clue there?
If it is the physical KOMBI I have an M3 one I can post you for cheap. We know the M3 KOMBI is physically different as it’s the only one that has the M mode light.
Also could it be using another bus network between modules ?
 

aus335iguy

Major
Nov 18, 2017
1,852
Down under
How sure are you that the 1M DME is replicating M3 DME messaging? The M3 (and M5) are the only vehicles that have M drive. The only module that’s not common here is the DME.
I believe the way it’s supposed to work is all settings are input in CIC and then recalled when the button is pressed. They need to be stored somewhere. DME is the most logical place is it not ?
 

RSL

Lieutenant
Aug 11, 2017
590
Yes, the DME settings seem to be recalls only. DL and DSC go to what is set in DME in CIC, but their actual states don't change based on it. M3 would update their states from it, but CAN may not be the same. Power just sits on unchanged because there's no setting for it in the DME that I've found.

I think the only recourse at this point is to send a flag for power/mode on CAN to at least see if it works and then can continue trying to find out what the story is with the messages/statuses that it sets itself.

Is superwoofy's sketch/code in here somewhere? I assume 0x315 needs to sent, but maybe it's something else. I don't think all the messages are the same between M3/M5 and non-M's, but 0x315 looks like it has been used for mode on 325/330s, but maybe different data.
 
  • 1Like
Reactions: derekgates

aus335iguy

Major
Nov 18, 2017
1,852
Down under
Yes, the DME settings seem to be recalls only. DL and DSC go to what is set in DME in CIC, but their actual states don't change based on it. M3 would update their states from it, but CAN may not be the same. Power just sits on unchanged because there's no setting for it in the DME that I've found.

I think the only recourse at this point is to send a flag for power/mode on CAN to at least see if it works and then can continue trying to find out what the story is with the messages/statuses that it sets itself.

Is superwoofy's sketch/code in here somewhere? I assume 0x315 needs to sent, but maybe it's something else. I don't think all the messages are the same between M3/M5 and non-M's, but 0x315 looks like it has been used for mode on 325/330s, but maybe different data.
The code is in the GitHub link...
 
Top