E38 Documentation attempt - Starting from the DTC functions.

[MPC001]

Awesome progress. Cool stuff. E38 fan here for 18 years.

[Xnke]

Pretty sure I found the main fueling polynomial function. 0xc4568 looks at gain x (C1 * MAP^2 *RPM + C2 * MAP * RPM + C3 * MAP^2 + C4 * MAP + C5 * RPM + C6 + C7 + C8) - some offset. It repeats this same equation 7 more times, with one RPM looking axis but uses three seperate coefficient locations and six different plug in values that look like MAP affiliated code? not 100% sure yet.

I'm focusing on the 4088 BINs I have first, once I have that mapped out as much as I can stand, I'll start comparing it to other OS files.

[Xnke]

OK so that one is NOT the main VVE polynomial. It doesn't have RPM as a variable, instead it uses Spark Advance? Maybe it's a torque modeling table, and looking at how spark advance factors into torque?

I need an adult. (Preferably one who's mathematics training on matrix mathematics and bivariable polynomials is much more recent than mine.)

[Tre-Cool]

likely the torque calculations, if it factors in ethanol content & DOD mode, that'll be it.

[Xnke]

It seems to. It is the only bivariate polynomial in the whole program, so I guess the whole "it's governed by a big equation instead of lookup tables" is a load of crap by the other tuning companies.

I have 33 tables related to fueling discovered so far, and six more that I suspect are used but haven't worked out yet.

[Xnke]

OK! Roughly 8% of the total codebase has been documented. 650 out of 8159 total functions.

I figure by the time I have decoded the first 1000 functions, I'll have a good codebase to start poking at a live PCM while it's connected. The target goal is to get live tuning going by utilizing the already-existing RAM-to-Flash routines.

[Tre-Cool]

if it were me, i'd look at one of the newer oses like 12639270. the 4402 was only used for that 2008/09 year. but the later calibrations have a lot of similarity.

[Xnke]

Currently I'm using the 4088, but I have enough of the 7631 BINs and I have been looking for the holden BINs that have hardware flex fuel sensors enabled. Once I have the functions that I think I need worked out in 4088, the plan is to start applying pattern matching to identify functions in the other bins. I was looking at a BDM read of the slave OS last night that I got from here, so the main OS that goes with that slave is next on the list.

After I have 4088 and 7631, I'm thinking maybe 2384 will be next. 4088 is a typical split airflow table OS, 7631 is a single airflow table OS, and 2384 is the corvette 2008.

I also want to go after the LZ4 3.5l V6 pcms, ultimately I want to replace the 5.3l in my Colorado with a turbo 3500V6.

[kur4o]

I did some code pattern searches long time ago and looked at some disassemblies, and found there is 3 major e38 code revisions by year.
early 2006-2007
late 2008-2011
latest 2012+

[Xnke]

That is true. The hardware is all the same though, best I can tell. I now have several 2007's, three 2008's, and a 2011 PCM and other than the code loaded, I can't find anything different physically. Might be a difference in the FLASH chips or something, though.

Up to 11% disassembled now. Working through the bidirectional control PID group to chase down the CASE relearn functions at the moment.

7631 has substantially the same functions, but arranged differently. It will not take long to achieve the same level of disassembly between 4088 and 7631.

I have not jumped into the Malibu bin yet, but it's where my particular interests really lie. I want to get the LZ4 in my Canyon, and I wanna either supercharge it with the tvs1320 from the Jaguar 3.0L v6 or the audi V6, I have a few of each blower on the shelf of power. I could turbocharge it as well, would be just as much fun.