Coding M modules in a non M car

[carabuser]

9187546 is my current JBBF (JBBF70) hardware number on the Z4.

I'll need to scan the car again to get the software no# as I don't have a record of the ZB for that module.

 

[KClemente]

9187546 is my current JBBF (JBBF70) hardware number on the Z4.

I'll need to scan the car again to get the software no# as I don't have a record of the ZB for that module.

I've currently got 9329800 which was used in the 1M, X1, Z4 up until 03/15. Should be a compatible JBBF to wire in my "Power" switch as long as the software ZB lines up.

I just need to stop lacking and find a way to change my CAS ISN to match my new to me MSD81

 

[carabuser]

I've currently got 9329800 which was used in the 1M, X1, Z4 up until 03/15. Should be a compatible JBBF to wire in my "Power" switch as long as the software ZB lines up.

I just need to stop lacking and find a way to change my CAS ISN to match my new to me MSD81

I thought ISN alignment could be done with ISTA? Sure there's a routine for it.

 

[RSL]

I've currently got 9329800 which was used in the 1M, X1, Z4 up until 03/15. Should be a compatible JBBF to wire in my "Power" switch as long as the software ZB lines up.

I just need to stop lacking and find a way to change my CAS ISN to match my new to me MSD81

I'll be curious if this works at all. I said a while ago it looked like Z4 setup probably had the best chance of activating sport program in the trans with the M3 shifter setup. I don't have M3 power/DSC/EDC block and actually contemplated buying a Z4 switch block instead.

Pre-2009/MSD80 Z4 sport buttons had the exact same setup as the M3 power button (straight pin to DME). I think NoQuarter also confirmed 0x315 is on the newer Z4, which I've yet to see anywhere, so they obviously changed comm routing/programming/coding on MSD81, but gets that info to the EGS/trans. I just haven't had the motivation or time to pull the dash apart, rewire JBBF, flash and code a bunch of stuff since everything else works, so I'll be curious as hell what is found here.

 

[KClemente]

I thought ISN alignment could be done with ISTA? Sure there's a routine for it.

AFAIK, ISN needs to be manually changed via "bootleg" tools (VVDI Xhorse, CGDI, etc) and INPA/Rheingold can only align the EWS on the CAS with the DME. One of these days I'll buy one of these programming tools and finally make myself some spare keys too.

I'll be curious if this works at all. I said a while ago it looked like Z4 setup probably had the best chance of activating sport program in the trans with the M3 shifter setup. I don't have M3 power/DSC/EDC block and actually contemplated buying a Z4 switch block instead.

Pre-2009/MSD80 Z4 sport buttons had the exact same setup as the M3 power button (straight pin to DME). I think NoQuarter also confirmed 0x315 is on the newer Z4, which I've yet to see anywhere, so they obviously changed comm routing/programming/coding on MSD81, but gets that info to the EGS/trans. I just haven't had the motivation or time to pull the dash apart, rewire JBBF, flash and code a bunch of stuff since everything else works, so I'll be curious as hell what is found here..

Interesting on that MSD80 sport button. Do you by chance know which pin it is on the dme? Still rocking the MSD80 so i'll give it a try immediately.

 

[RSL]

I think I saved it on a spreadsheet, I'll try to dig it up.

 

[RSL]

AFAIK, ISN needs to be manually changed via "bootleg" tools (VVDI Xhorse, CGDI, etc) and INPA/Rheingold can only align the EWS on the CAS with the DME. One of these days I'll buy one of these programming tools and finally make myself some spare keys too.



Interesting on that MSD80 sport button. Do you by chance know which pin it is on the dme? Still rocking the MSD80 so i'll give it a try immediately.

I just found a note I made, E85 Z4 X60001 pin 5. No idea which motor, but they were all N/A then? Might be worth following up on the logic.

I ran across it on TIS a while ago. If you don't have access, ISTA should have it, but I'll dig again and see if I can verify the car/motor.

 

[KClemente]

I just found a note I made, E85 Z4 X60001 pin 5. No idea which motor, but they were all N/A then? Might be worth following up on the logic.

I ran across it on TIS a while ago. If you don't have access, ISTA should have it, but I'll dig again and see if I can verify the car/motor.

Hm, I've come up blank when looking at the diagrams. Some of the E85 Z4's had the N52 which was the MSS70 dme back then. It's funny how BMW doesn't really have any diagrams for their sport buttons. Even the M3 center console switch panel only has 3-4 wires on the diagrams.

 

[RSL]

Hm, I've come up blank when looking at the diagrams. Some of the E85 Z4's had the N52 which was the MSS70 dme back then. It's funny how BMW doesn't really have any diagrams for their sport buttons. Even the M3 center console switch panel only has 3-4 wires on the diagrams.

Agree, kinda wishing I bookmarked the page now or took better notes. Those seem to show it on pin 3, so wouldn't have gotten it from them, but not sure where I ran across it. Maybe it was pre-2007, but was sure it said MSD80. It's bugging the hell out of me that I can't find it at all now.

Either way, I think you're on the right track with the Z4 angle for getting it working. E89 Z4 is still the most similar even if routed differently. The Z4 button block is dirt cheap, might be a worthwhile upgrade even without any M3 anything if it works. Button block, program, coding, JBBF rewire and seems like we should have sport/sport+ options without an actual sport button. More importantly (for me at least), should actually get a sport program active in DCT.

 

[General.Massacre]

May be over my head here and probably already thought of.
But I am 100% sure that when I flashed the Z4 35is TCU ZB# to my E92, I lost use of the Launch control feature. This is because the way launch control is activated is different between the 2 cars Sport buttons. As RSL said, the E89 Z4 has a different button block. And the E92 just has the single Sport button.

If that TCU update effected how the launch control worked. Then perhaps it may help how things are communicated to assist with this current conundrum.

There may still be the need for the Z4 button block, but if you just trying to have the sequences work that is being discussed. I don't know the back end and the coding side so forgive me if I don't reference them as thats all still above me.

As I said. This is just a thought, may have already been thought of.

Justin.

 

[RSL]

There are switches for different logics in the DCT bin that go along with all these different hardware/comm setups. I've run the full Z4 DCT calibration on mine (stock shifter/sport button) with everything coded stock (335is) and everything seemed to work normally, but I did not try LC. I've also coded JBBF as Z4 before, but can't remember if that was before or after I had the M button working.

I don't always trust TIS and found no concise pinout for Z4 JBBF, but wiring diagram shows Z4 console buttons to X14271 18 and 36 and X14272 pin 4 for DSC. On the 335is JBBF pinout, X14272 pin 4 is DSC, so that's a match at least.

For pin 18, 335is pinout description shows as an in/out "Diagnosis signal DC/DC converter". Another diagram for Z4 shows X14271 pin 18 is also DC/DC converter, so that raises some question as to which is actually going to those JBBF pins on the connector, button or converter? It's not clear if these diagrams may be internal connections.

I haven't found 36 (Z4 normal), but 335is pinout says its X14271 #36 is return contact, wiper rest position (output). That obviously seems unrelated to anything having to do with modes, trans, etc., so that one remains a mystery what it actually is on Z4 at the moment.

Maybe next time anyone with a Z4 has their JBBF accessible, check what color wires are in 18 and 36 in X14271 connector (blue I think). Maybe we can at least verify if the wire colors match the converter or button as shown.

 

[amg6975]

Sorry I've been slacking on this but this discussion is kind of in my wheel house. The E90/E82 does not appear to have 0x315, I think that's an E60 SZM thing? Maybe the JBFF generates it in the E90 but I haven't seen it in any logs, so I don't thing so.

The sport button press comes from the GWS is 0x198 Byte4 bit2. The status of the transmission sport mode comes from DKG in 0x1D2 Byte3 bit 2. I believe this is what the DME uses to determine it's sport mode? 0x1D2 is what the FRM uses to turn the Sport mode indicator on/off, so I assume this is the car's "I'm in sport mode" message.

The M button is an interesting topic... the M3 SZL sends the button press to the DME in 0x1D9 then the DME broadcast's "I'm in M Dynamic Mode" with 0x399. I'm not at all sure how the 1M does this, but I doubt the 1M has a handshake for this with the DCT since it was never intended to be made like that. The DME won't output 0x399 because the rest of the car doesn't care, and the DME won't care about the DKG broadcasting 0x1D2 because it never needed to. I don't know about the DSC module... does the 1M even have the M Dynamic DSC mode?

E90/E82: GWS says "go to sport" DKG says "I'm in sport"
M3: SZL says "go to sport" DME says "I'm in sport"

So basically because the 1M DME doesn't care what a DCT has to say and also won't tell the DCT what to do I doubt using the M button to enable Sport mode in the DCT will work without reading the SZL message and spoofing the GWS message, but that's not actually a straight forward task.

On a semi related note I'll have an M3 in stock on Friday so I can/will data log all the MDM messages and stuff.

Foot note: on the M3 the center console Sport button goes directly into the DME, which the DME then (probably) reports back in 0x399.

 

[aus335iguy]

Thanks for the explanation @amg6975!
So the way to make a M3 TCU/EGS and N54 both respond to the SZL button press is...
Generate 0x198 Byte4 bit2 with an SZL button press(perhaps we can make it work on a non M to make the cost lower). FRM will illuminate the sport indicator
N54 DME /something needs to respond to this with 0x399 to tell the now M3 DKG and DSC that its in M Drive mode ... Have I understood this correctly ?

 

[aus335iguy]

Id like to understand the logs from the M3 when you get them. The single message (0x399) that the DME broadcasts has me stumped because i cant understand how the various modules take that and apply the user setting stored by the M drive menu in the CIC... How does it know for example i want and saved in the CIC
drivelogic level 5 and DSC set to off ?

 

[amg6975]

Thanks for the explanation @amg6975!
So the way to make a M3 TCU/EGS and N54 both respond to the SZL button press is...
Generate 0x198 Byte4 bit2 with an SZL button press(perhaps we can make it work on a non M to make the cost lower). FRM will illuminate the sport indicator
N54 DME /something needs to respond to this with 0x399 to tell the now M3 DKG and DSC that its in M Drive mode ... Have I understood this correctly ?

Yeah I think that's about it. Those are two different things depending on the DKG software I believe.

If you're running 135/335 software you'll need to read 0x1D9 from the SZL and intercept 0x198 from the GWS and set Byte4 bit2. This will put the DKG into sport mode which it will advertise in 0x1D2. The FRM will light the sport mode button and all would be happy.

If you have M3 software you need to read 0x1D9 from the SZL then generate 0x399 to tell the DKG it's in sport mode. If you want the Sport Mode light to light up you'll have to intercept and change 0x1D2 so the FRM lights it.

I think.

 

[amg6975]

Id like to understand the logs from the M3 when you get them. The single message (0x399) that the DME broadcasts has me stumped because i cant understand how the various modules take that and apply the user setting stored by the M drive menu in the CIC... How does it know for example i want and saved in the CIC
drivelogic level 5 and DSC set to off ?

Yeah, same. The M3 I got does have iDrive so I should be able to sort that out fairly easily. Without any clue I would bet that 0x399 broadcasts the modes everything should be in. Someone somewhere had the contents of 0x399 broken down, I thought?

Edit, changed my mind, I don't think 0x399 has anything other MDM on/off and M-Power on/off. The M power will likely just be used to turn the LED on the button on/off. I think 0x3CA that comes from the CCC_GW contains all the default settings.

Edit 2: Interesting thought: you may be able to just spam 0x3CA and 0x399 to get desired results with M3 DSC and DKG software.

 

[RSL]

Looking forward to the results. If the actual ID and bits can be determined, I can try on the shield. For all I know, DCT is in sport program and can't tell it to anything else on the bus that I can read/log, but it sure doesn't feel like it is.

Sport button does about 20 things in one press, 1M seems to rely solely on the wheel button to activate everything instead.

MDCT bin looks specifically for 0x315, but I can't say if that's maybe just for traction/limit purposes or if it includes sport program. Either way, it seems non-existent on E9x K or PT, but I think NoQuarter verified it being on E89 Z4 PT. That doesn't mean 0x315 isn't in there on 1M though, it may just not be broadcasting through the gateway or maybe as something else on non-M E9x.

I have seen an error that referenced 0x315 and that was in ISTA when IKM0S was on with 1M DSC flash with no coding IIRC. This is only time/place I've seen anything about 0x315 anywhere and it's Kombi and DME only (not trans). No idea which bus, maybe F to JBBF if it's from DSC? I've logged PT and K probably 20 times looking for it and have yet to capture one. I have captured 0x399 somewhere.

I've tried broadcasting several IDs, but have yet to get MDCT to enter it's sport mode. Not sure if incorrect IDs, bits, timing, if counter or something needs to go with it or what, but am far from a CAN whiz, so glad you're back.

IKM0S is fully setup for DCT, right down to trans program level definable in DME, but by all appearances would not use anything like the M3 setup, so seems like the same snags for comms as any non-M with sport button to M3 GWS/EGS. DME gets signal from M button on IKM0S and all signals seem out there, the one for the trans just isn't making it on the M3 shifter/bin in any useable way.

 

[aus335iguy]

A little ways back I linked to a post by Superwoofy on e90 post. He posted up an arduino sketch for people with Active cruise so the m button press would toggle the 1M DME m drive but would also interface with a standard DSC

BMW 3-Series (E90 E92) Forum - View Single Post - Pete's toy with a licence plate - E92 335i Build Thread

Forum for BMW 1-Series 3-Series 5-Series 7-Series M3 M5 M6 Z4 X1 X3 X5 X6 Z2 Z4 325i 330i 335i 535i 550i 755i BMW Forums

www.bimmerpost.com

Link to GitHub

GitHub - superwofy/N54-Mdrive-MCP

Contribute to superwofy/N54-Mdrive-MCP development by creating an account on GitHub.

github.com

Can we branch off his development and add the other bits like drivelogic etc ?

 

[amg6975]

Alright so knowing roughly how BMW generally handled things in PT6 and what messages come from where here's how I believe the flow of info is in the M3. I'll confirm shortly when I get mine (hopefully it's functional enough.)

EDIT, updated after doing data logging:

1. Initial state:
   1. DME is broadcasting M Drive off in 0x399 (once for the other modules, and once for KOMBI)
   2. DKG is broadcasting it's current DriveLogic/Sport mode in 0x1D2
   3. DSC is broadcasting it's current state in 0x19E
   4. FRM is looking at 0x1D0 to determine Power Button light - To be confirmed
   5. KOMBI is looking at 0x399 for the M light, 0x19E for DSC status, and 0x1D2 for DL setting
2. You set your M Drive settings in the iDrive:
   1. CCC_GM will change the 0x3CA packet to broadcast the current desired M Drive settings
   2. The DME sees this change, updates 0x399 settings
3. You press the M button the steering wheel:
   1. SZL broadcasts this press in 0x1D9
   2. DME sees this press, broadcasts M Drive on in 0x399
   3. DKG sees the M Drive is on in 0x399, grabs the DL state from 0x399, then advertises new DL state in 0x1D2
   4. DSC sees the M Drive in on in 0x399, grabs the DL state from 0x399, then advertises new DSC state in 0x19E
   5. FRM updates lights
   6. KOMBI updates indicators

BMW will not [I think] have multiple modules look for the M button press. Since it's momentary the issue is that if one module misses it then the car will have mis matched settings. I think that's the point of 0x399.. it reads the button presses, then has a steady indicator of M Drive on/off that all the other modules will use as a known good state. Everything that takes a momentary input will be read in by only one module, then that module will output it's new settings and cascade from there.

I'm thinking the path to success for a non-M car with M modules and everything is very likely going to be making a module that reads some button press, and broadcasts 0x3CA with the desired settings, and 0x399 as the trigger to adopt those settings. A good trigger for this would probably be the sport button, as that's in 0x198 from the GWS and could easily be picked up by the CAN. I believe the non-M KOMBI can be coded to display the DL settings and DSC modes but I doubt it'll have the green M indicator.

The only issue I could see may be the translation between the CAN busses by the JBFF, I'm not sure how it determines what packets to pass on but it definitely acts like a firewall between the busses.

Now a couple questions for the hive mind:

• If there is no iDrive, there will be no 0x3CA so there must be default "M Drive" settings? How dies this work?
  • I thought I read that some of these were still configurable without iDrive so I'm not at all sure how that would work
  • Looks like pressing and holding the M button locks settings in. I'm not at all sure how that would work. Maybe a different module saves the settings in that case. I don't think it would be that each module is now saving it's own settings or it would probably also be that way with iDrive.

EDIT:

Ok so non iDrive M3s the M button just puts the DSC in MDM, the steering to servotronic to sport and then recalls power setting and DL setting so I would think:

1. DSC looks at just 0x399 and sees the switch and enables MDM... no 0x3DA needed
   1. DSC off is not an option here because that would be a function of 0x3DA
2. Servotronic is controlled by the ECU so that's no problem only has two settings so M Drive on/off likely corresponds to Sport/Normal
3. Power is controlled by the ECU so that's no problem.
   1. Sport Plus is not available, because that would be a function of 0x3DA, the DME only knows M drive on/off.
4. This leaves us with Drive Logic as the only setting that would have to get stored somewhere to be recalled when M Drive is enabled. I don't think it's unreasonable to expect the DKG could do this. @Olza could probably confirm where this would come from if not from 0x3CA.
   1. I think this is exactly how it works. DME looks for the long press and saves the current setting to 0x399

EDIT 3:

I'm back to my original assumption. 0x399 sets everything up when M Drive is enabled. 0x3CA just tells the DME what those requested settings are. So the DME would register the long press from the SZL to save the settings. That makes sense.

^EDIT 3 seems to be correct.

 

[aus335iguy]

I need to read all this a few more times to make sure I get my head around it all.
Thanks for taking the time to write it all down @amg6975.