Coding M modules in a non M car

[AzNdevil]

Alright so knowing roughly how BMW generally handled things in PT6 and what messages come from where here's how I believe the flow of info is in the M3. I'll confirm shortly when I get mine (hopefully it's functional enough.)

1. Initial state:
   1. DME is broadcasting M Drive and M Power off in 0x399
   2. DKG is broadcasting it's current DriveLogic/Sport mode in 0x1D2
   3. DSC is broadcasting it's current state in 0x19E (to be confirmed)
   4. FRM is looking at 0x399 to determine Power Button light
   5. KOMBI is looking at 0x399 for the M light, 0x19E for DSC status, and 0x1D2 for DL setting
2. You set your M Drive settings in the iDrive:
   1. CCC_GM will change the 0x3CA (format TBD) packet to broadcast the current desired M Drive settings
3. You press the M button the steering wheel:
   1. SZL broadcasts this press in 0x1D9 (exactly where is TBD)
   2. DME sees this press, grabs the pertinent data from 0x3CA, then advertises new M Drive and M Power status on 0x399
   3. DKG sees the M Drive is on in 0x399, grabs the DL state from 0x3CA, then advertises new DL state in 0x1D2
   4. DSC sees the M Drive in on in 0x399, grabs the DL state from 0x3CA, then advertises new DSC state in 0x19E
   5. FRM updates lights
   6. KOMBI updates indicators

BMW will not [I think] have multiple modules look for the M button press. Since it's momentary the issue is that if one module misses it then the car will have mis matched settings. I think that's the point of 0x399.. it reads the button presses, then has a steady indicator of M Drive on/off that all the other modules will use as a known good state. Everything that takes a momentary input will be read in by only one module, then that module will output it's new settings and cascade from there.

I'm thinking the path to success for a non-M car with M modules and everything is very likely going to be making a module that reads some button press, and broadcasts 0x3CA with the desired settings, and 0x399 as the trigger to adopt those settings. A good trigger for this would probably be the sport button, as that's in 0x198 from the GWS and could easily be picked up by the CAN. I believe the non-M KOMBI can be coded to display the DL settings and DSC modes but I doubt it'll have the green M indicator.

The only issue I could see may be the translation between the CAN busses by the JBFF, I'm not sure how it determines what packets to pass on but it definitely acts like a firewall between the busses.

DSC is broadcasting it's current state in 0x19E (to be confirmed) <-- i can confirm this exists in my old canbus logs
can id also matches with what i found in tool32 for the dsc

SZL broadcasts this press in 0x1D9 (exactly where is TBD) <-- jbbf is responsible for sending the 0x1D9 after receiving the keypress from szl as szl does not have a direct connection to pt-can per the docs i have seen

according to the pdf docs available on google for e90 m3 mdrive, the center console buttons (6/7/8) and steering wheel buttons (9) are connected directly to the jbbf and talks to dme eng egs through pt-can

 

[amg6975]

I need to read all this a few more times to make sure I get my head around it all.
Thanks for taking the time to write it all down @amg6975.

Still all to be confirmed. I have an iDrive M3 that's fully operational sitting in the garage now, I just need to grab some logs to confirm.

DSC is broadcasting it's current state in 0x19E (to be confirmed) <-- i can confirm this exists in my old canbus logs
can id also matches with what i found in tool32 for the dsc

SZL broadcasts this press in 0x1D9 (exactly where is TBD) <-- jbbf is responsible for sending the 0x1D9 after receiving the keypress from szl as szl does not have a direct connection to pt-can per the docs i have seen

according to the pdf docs available on google for e90 m3 mdrive, the center console buttons (6/7/8) and steering wheel buttons (9) are connected directly to the jbbf and talks to dme eng egs through pt-can

Yes, correct, the SZL is on the K-CAN and the DME, and other things on PT-CAN so the JBBF passes these messages from one to the other.

The center console buttons are wired directly to the modules... the Power button to the DME and the DSC OFF to the DSC. In a non M the DSC button is routed to the JBBF and the SPORT button to the GWS but not in the M. The steering wheel buttons create different analog voltages based on which one(s) are pressed, the SZL reads this and outputs the appropriate values in several K-CAN messages. None of the steering wheel controls go directly to the JBBF.

 

[AzNdevil]

Still all to be confirmed. I have an iDrive M3 that's fully operational sitting in the garage now, I just need to grab some logs to confirm.



Yes, correct, the SZL is on the K-CAN and the DME, and other things on PT-CAN so the JBBF passes these messages from one to the other.

The center console buttons are wired directly to the modules... the Power button to the DME and the DSC OFF to the DSC. In a non M the DSC button is routed to the JBBF and the SPORT button to the GWS but not in the M. The steering wheel buttons create different analog voltages based on which one(s) are pressed, the SZL reads this and outputs the appropriate values in several K-CAN messages. None of the steering wheel controls go directly to the JBBF.

awesome, it would be nice to have some logs to look at

anyways i discussed this a bit with @RSL and i agree with him that the z4 normal/sport/sport+ mode might be more suitable for this case since it has DCT and m /non m cars have different hardware configurations

for 6MT, a 1M configuration would be better since theres no need to deal with the gearbox and technically it runs a MSD81 and the configuration is relatively similar

 

[amg6975]

awesome, it would be nice to have some logs to look at

anyways i discussed this a bit with @RSL and i agree with him that the z4 normal/sport/sport+ mode might be more suitable for this case since it has DCT and m /non m cars have different hardware configurations

for 6MT, a 1M configuration would be better since theres no need to deal with the gearbox and technically it runs a MSD81 and the configuration is relatively similar

Yeah the direct wire will only work with the MSS60. I think all the DSC units have a codable option to use either a hardwired button or CAN bus commands but I'm not 100% sure.

From my digging, and I suspect the logs will confirm, there's no easy way to get M Mode without the MSS60 ECU. Maybe RSL or someone can build M Mode into a release of software for other cars, it's just a single CAN message (0x399.)

 

[Olza]

So whats the questions to DCT, i can see most things.
Offtopic. There are some parameters in calibration data about LC init conditions, so i can make to work LC in x35 cars with Z4(is) calibration data.

 

[aus335iguy]

So whats the questions to DCT, i can see most things.
Offtopic. There are some parameters in calibration data about LC init conditions, so i can make to work LC in x35 cars with Z4(is) calibration data.

Question is How does M3 dct deal with 0x399 or any of the other can messages to change drivelogic level?
or rather what does the m dct need to hear to change the drivelogic level besides the messages from the drivelogic button/gws?
We are trying to make M drive work on non M car.

 

[AzNdevil]

Yeah the direct wire will only work with the MSS60. I think all the DSC units have a codable option to use either a hardwired button or CAN bus commands but I'm not 100% sure.

From my digging, and I suspect the logs will confirm, there's no easy way to get M Mode without the MSS60 ECU. Maybe RSL or someone can build M Mode into a release of software for other cars, it's just a single CAN message (0x399.)

edit: DSC CAN SWITCH OFF = ABILITY TO DISABLE DSC ALTOGETHER, NOT DISABLE DSC THROUGH CAN

yep, looks possible through ncsexpert coding on both 1M and M3 dsc definitions

from my digging, the code is there in the dme to send the 0x399 message

 

[amg6975]

Question is How does M3 dct deal with 0x399 or any of the other can messages to change drivelogic level?
or rather what does the m dct need to hear to change the drivelogic level besides the messages from the drivelogic button/gws?
We are trying to make M drive work on non M car.

@Olza: Yeah, what happens in the DKG module with 0x399. How does it switch to M Drive setting, and how does it go back to "normal." I'm also beyond curious where you got that description of 0x399 and if you have the other messages....

from my digging, the code is there in the dme to send the 0x399 message

Very interesting. That's what would really be needed to enable M Drive in a non M car, other than a add-on module.

 

[aus335iguy]

I like where this is going

 

[RSL]

I do look at it primarily from DCT standpoint since I have one and the difference between M and non-M DCT performance isn't small.

I've been leaning towards the Z4 button setup for a while (or tossing sport button back in with M3 GWS) and more or less solidified 2 assumptions talking to @Olza:

1) 0x315 is only on cars with center console button blocks (M3 and Z4)
and
2) only way to get sport program active in the DCT is either with 0x315 or the sport button, which is the battle I've been having. With M3 GWS swap, neither the power button works nor is the sport button present by default.

Still not sure why broadcasting 0x315 on PT hasn't yielded results though. Either way, Z4 DCT and M3 DCT comm/logics are similar and Z4 console setup obviously works on MSD8x, so seems a good route to bridge the last missing piece with M3 bin.

0x399 is only going to work on IKM0S as far as MSD8x roms go, I *think*. @AzNdevil, did you find 0x399 in a different rom? Maybe they double for sport mode on non-M?

Superwoofy's script should do it though, basically reads for media source MFL press (non-M wheel button) and sends M button press data when it sees it. Hold it down long enough and it will also send DSC button press message as well. To do it without a shield, need M Drive SZL, 1M/M3 DSC program/coding, JBBF coding and CIC coding (IIRC).

I think the M3 drive level logic is GWS LIN to trans. I don't know if that's used anywhere other than trans, but think it's on PT CAN also and I don't remember the ID (1Dx or 19x maybe?). I read somewhere they have GWS LIN comms redundant on CAN in case of a failure.

I haven't looked at my CAN logs in so long, I'd never remember button presses to match data changes, but if someone needs, I can do capture of PT with just drive logic button presses to verify.

Since there is an actual M3 bouncing around now, CAN capture of 0x315 timing/data with power button presses might be good info to nail down.

 

[Olza]

About statuses (Program level, Sport and Spirited) in DCT.

Sport Status.
If Sport button (CFG) is true (x35/Z4), then Sport status triggered from Sport button (x35) or CAN 0x315 Vehicle info data bits (Z4).
Else logic compares raw Program mode with switch threshold (CFG, =5) and if >=, then Sport status in DKG enabled. This is P5-P6 (M3).
Raw Program mode is pure program level from GWS and Program button pressing. Interesting, that in Pre- and Rennstart, value is forced to 0x46 (M3) or 0x42 (x35/Z4). Seems high bits is Rennstart flag, low bits is max Program level.
This Sport status used in overrun and dynamic downshifts logic.

Program level.
Raw Program mode calculated. Then if Sport button (CFG) option is true (x35 or Z4) level is taken from 0x315 Vehicle info data bits (Z4, 1-2-3) or defaulted to P1 (x35).
Else for M3 it is taken from raw Program mode (masked low bits). Calculation of simplified Program level for x35 - if Sport status, then use Program level 2 (P2).

Spirited Drive Status.
Program level has used in Spirited drive status calculation like in this table.

GTS

x35/Z4
This status used in many logic calculations and very important.

So our target after all this manipulations with SZL and stuff to maintain correct status calculations.

About 0x399.
Status M-Drive.
As i wrote before somewhere, ST_MDRV_MOD_GRB (3 bits, 0:nochange 1:Automatic 2:Sequential), ST_MDRV_STG_GRB (4 bits, 0:nochange 1..6:Stufe) and something undocumented in DME docs which i have, lets name it ST_MDRV_ACT_GRB (2 bits, 0:not active 1:active?, 2:setdata?) - seems this is control status for incoming mdrive data interchange. Better have logs, this status is at byte 1 low two bits (mask 00000011).

 

[RSL]

This Sport status used in overrun and dynamic downshifts logic.

And shift speeds!

About 0x399.
Status M-Drive.
As i wrote before somewhere, ST_MDRV_MOD_GRB (3 bits, 0:nochange 1:Automatic 2:Sequential), ST_MDRV_STG_GRB (4 bits, 0:nochange 1..6:Stufe) and something undocumented in DME docs which i have, lets name it ST_MDRV_ACT_GRB (2 bits, 0:not active 1:active?, 2:setdata?) - seems this is control status for incoming mdrive data interchange. Better have logs, this status is at byte 1 low two bits (mask 00000011).

These are active with M button on IKM0S, but don't comm with M3 GWS/EGS, maybe they would on stock EGS/DCT bin. Sport in DME at least turns on though.

They probably also make the updates/changes in CIC that don't actually do anything.

datazap.me | RSL | LC2 stage 3 set M button only

datazap.me

 

[amg6975]

I do look at it primarily from DCT standpoint since I have one and the difference between M and non-M DCT performance isn't small.

I've been leaning towards the Z4 button setup for a while (or tossing sport button back in with M3 GWS) and more or less solidified 2 assumptions talking to @Olza:

1) 0x315 is only on cars with center console button blocks (M3 and Z4)
and
2) only way to get sport program active in the DCT is either with 0x315 or the sport button, which is the battle I've been having. With M3 GWS swap, neither the power button works nor is the sport button present by default.

Still not sure why broadcasting 0x315 on PT hasn't yielded results though. Either way, Z4 DCT and M3 DCT comm/logics are similar and Z4 console setup obviously works on MSD8x, so seems a good route to bridge the last missing piece with M3 bin.

0x399 is only going to work on IKM0S as far as MSD8x roms go, I *think*. @AzNdevil, did you find 0x399 in a different rom? Maybe they double for sport mode on non-M?

Superwoofy's script should do it though, basically reads for media source MFL press (non-M wheel button) and sends M button press data when it sees it. Hold it down long enough and it will also send DSC button press message as well. To do it without a shield, need M Drive SZL, 1M/M3 DSC program/coding, JBBF coding and CIC coding (IIRC).

I think the M3 drive level logic is GWS LIN to trans. I don't know if that's used anywhere other than trans, but think it's on PT CAN also and I don't remember the ID (1Dx or 19x maybe?). I read somewhere they have GWS LIN comms redundant on CAN in case of a failure.

I haven't looked at my CAN logs in so long, I'd never remember button presses to match data changes, but if someone needs, I can do capture of PT with just drive logic button presses to verify.

Since there is an actual M3 bouncing around now, CAN capture of 0x315 timing/data with power button presses might be good info to nail down.

I think that some of tthe assumptions here are incorrect, I don't think any modern cars have an SZM so I don't think 0x315 will be present. As far as I know that function moved to the GWS/JBBF somewhere around the LCI E60. The E9x non M Sport button goes to the GWS, M3 Power goes directly to the DME, and Z4 buttons all go to the JBBF:

As for the GWS DL buttons and such that's an easy one. The DL rocker switch is wired directly to the GWS and its presses are transmitted in 0x198 on the PT-CAN. The LIN is just redundant, I do have a LIN logger and I'm going to grab a capture of that, but I can tell you the car works perfectly fine without the LIN hooked up.

One big mystery I'm hoping to solve is how the DSC and DKG know to go back to "normal" settings once M Drive is turned off. I'm 99% sure they use 0x399 to know when it's on... I'm thinking 0x399 must go back to "unchanged" once M Drive is deactivated and the modules are responsible for reverting themselves back.

EDIT: Maybe some early E9x's have the SZM? Not really sure, but later cars definitely do not.

 

[amg6975]

@RSL do you know what the 0x399 format is for IKM0S? I think it will be different than the M3 because the 1M uses the JBBF to drive the Servotronic where the M3 does it with the DME. The M3's 0x399 does not include steering settings, but I'm thinking the 1M must. The 1M also has no use for the DKG settings to be in 0x399.

 

[Olza]

And shift speeds!

These are active with M button on IKM0S, but don't comm with M3 GWS/EGS, maybe they would on stock EGS/DCT bin. Sport in DME at least turns on though.

Shift speeds is from other table, and other factors related - Sequential mode, P4-P5-P6, deceleration level or PWG value. Sport related only to Program level.

that 0x315 and 0x399 always accepted by DCT. but mdrive info only used in M-GWS part of code. stock bin includes both routines.

 

[RSL]

I think that some of tthe assumptions here are incorrect, I don't think any modern cars have an SZM so I don't think 0x315 will be present. As far as I know that function moved to the GWS/JBBF somewhere around the LCI E60. The E9x non M Sport button goes to the GWS, M3 Power goes directly to the DME, and Z4 buttons all go to the JBBF:

View attachment 48062

As for the GWS DL buttons and such that's an easy one. The DL rocker switch is wired directly to the GWS and its presses are transmitted in 0x198 on the PT-CAN. The LIN is just redundant, I do have a LIN logger and I'm going to grab a capture of that, but I can tell you the car works perfectly fine without the LIN hooked up.

One big mystery I'm hoping to solve is how the DSC and DKG know to go back to "normal" settings once M Drive is turned off. I'm 99% sure they use 0x399 to know when it's on... I'm thinking 0x399 must go back to "unchanged" once M Drive is deactivated and the modules are responsible for reverting themselves back.

EDIT: Maybe some early E9x's have the SZM? Not really sure, but later cars definitely do not.

Don't confuse having buttons in the console with having an actual SZM module. There's no SZM module in these that I can tell either, but that doesn't preclude 0x315 from being used, it just has to be triggered/routed differently. That's why Z4 is probably the way to go, setup works on DCT and MSD with no special rom, but DME may need some logics enabled for non-Z cars.

As long as we can get it to work, I don't care how it does it lol

@RSL do you know what the 0x399 format is for IKM0S? I think it will be different than the M3 because the 1M uses the JBBF to drive the Servotronic where the M3 does it with the DME. The M3's 0x399 does not include steering settings, but I'm thinking the 1M must. The 1M also has no use for the DKG settings to be in 0x399.

I can dig it up when I get home, but there is a post with byte/bit layouts for M Drive CAN messages in IKM0S in one of these threads.

 

[AzNdevil]

0x399 is only going to work on IKM0S as far as MSD8x roms go, I *think*. @AzNdevil, did you find 0x399 in a different rom? Maybe they double for sport mode on non-M?

same code is in both IKM0S and INA0S for activation of sports switch

@RSL do you know what the 0x399 format is for IKM0S? I think it will be different than the M3 because the 1M uses the JBBF to drive the Servotronic where the M3 does it with the DME. The M3's 0x399 does not include steering settings, but I'm thinking the 1M must. The 1M also has no use for the DKG settings to be in 0x399.

servotronics are handled with JBBF on a M3 as well as we have discovered for servotronics retrofit in another thread
0x399 message structure is the same between 1M and non M cars from what i see in the DME code

however, i cant find any reference to 0x315 so i suspect they are either sent out by the SZM/M3 center console button module or a correctly coded M3 JBBF

 

[amg6975]

servotronics are handled with JBBF on a M3 as well as we have discovered for servotronics retrofit in another thread

So it is. I could have sworn I looked it up. Now I'm super curious how that gets triggered in M Drive since I don't think 0x399 has any data for steering.

 

[RSL]

same code is in both IKM0S and INA0S for activation of sports switch



servotronics are handled with JBBF on a M3 as well as we have discovered for servotronics retrofit in another thread
0x399 message structure is the same between 1M and non M cars from what i see in the DME code

however, i cant find any reference to 0x315 so i suspect they are either sent out by the SZM/M3 center console button module or a correctly coded M3 JBBF

That's interesting. I was able to get the M Drive light in Kombi with INA0S, but not active for sport DME, etc. The logic switches between INA0S and IKM0S aren't in the same spots, so I had to make some guesses. I might've gotten it wrong, but seems there may be hope M button will actually work on INA0S or others.

Edit: sports switch, yes, they are the same. Curious if the wheel button will set M Drive on INA0S. Curiously, some indication that comm is on 0x315 (ISTA), but never ever see it on K or PT.

Z4 doesn't have a sport button and presumably no SZM, so 0x315 is coming from somewhere. If it's not DME, maybe DSC (which is wired a little differently on them).

 

[aus335iguy]

@doublespaces @fmorelli can we branch off discussion from this thread at post #183 to here please?

M-Drive and MDM in non M cars

HI All This thread is as per the title M drive and MDM in non M cars and is a natural progression of what was being discussed in this thread here . In short M(2,3) and 1M modules have specific programming and features and as such the functionality they bring is highly desirable in non M cars...

www.spoolstreet.com