Thank You prometey1982 and s60rawr!
Two successes...

1. Rear lambda
 - rear lambda sensor diagnostic   CDLSH found at 0x1800B , enable 0x01, disable 0x00
 - rear lambda heating diagnostic CDHSH found at 0x18004 , enable 0x01, disable 0x00

2. Decreasing engine fan starting temperature
      I've found such a sequence of bytes:  CC  C0     E7  D3     D9  CF starting at 0x1882A
                                                                   |      |          |      |          |      |
                                                                  on   off       on   off       on   off
      and for now I checked first two bytes CC C0 and it is TM1LF - engine temperature threshold 1 for cooling fan control step 1
CC = 204 dec  (204*0.75)-48 = 105 C deg - fan starts
C0 = 192 dec (192 *0.75)-48 = 96 C deg - fan stops

     I've changed these two bytes onto:
BF = 191 dec, it gives starting fan temperature = 95.25 C deg. In testing car fan started exactly at 96 C deg
B8 = 184 dec it is stoping fan temperature = 90 C deg. Fan stoped at 90 C deg .
        and the sequence is:   BF  B8     E7  D3     D9  CF
So...I experimentally checked the operation of these settings. Analogically temperature can be increased if sb want to...

It should work for the rest bytes from this sequence , but I didn't check the other two pairs of bytes

It looks like CC C0 is a TM1LF and fan works at 25% speed,
I suspect that lower value bytes pair D9 CF is a TM2LF (50 % fan speed) and  higher E7 D3  is a TM3LF (100% fan speed)

In this MY fan has 3 gears acording to ViDA, and it is matchig at least theoretically as it is written above

All these changes refers to software 20FWHJ from testing car V70 B5244T3 200hp, AT, 2WD, 2000 MY


                   

Its not that simple

You got TM1LF, TM2LF, TM3LF, TM6LF, TM7LF, TM8LF following byte constants starting from 0x1882A

First 3 bytes are for fan step1, byte 4 for step2, byte 5 for step3.
But its not only factor for fan control.
Algorithm for fan control is actually quite complicated because it combine engine temperature control/air conditioning condenser temperature/EGT control/safety features/ECU temperature (yes! its for cooling processor like in ordinary PC somehow also, but don't ask me how and why, ask BOSCH engineers
There are way more constants and conditions (vehicle speed constants, A/C pressure constants, calculated EGT constants, many timers - from engine start, after engine stop, ECU temperature! and more...).
One of the interesting parameters is temperature hysteresis DTMLF at 0x18781 (1byte)

Fan rpm at steps 1/2/3 is also not constant. Actually its unknown
ECU Doesn't set fan rpm but PWM signal to fan control module. PWM value depends on battery voltage. Its for example 50%@10V or 30%@14V to get fan step1.
Maps for fan PWM are KLTVLFx (x=1/2/3)
KLTVLF1 is at 0x1879C - 1dim table, axis right before data.

For basic tune (simple stage1/2, daily usage car) all that matters is just TM1LF and TM2LF and maybe DTMLF. Just lower TM1/2 a bit like 5deg less and that's it.

Попытка убрать ошибку по несоответствию контрольной суммы. Идеей является то, что мы можем посчитать контрольную сумму, но не отдавать ее CEM. Для этого необходимо убрать установку бита готовности контрольной суммы. Вот код из 50WRHJ:


На машине еще не проверял, возможно будет ругань от CEM на то, что контрольная сумма не посчитана. Но, мне кажется, ругаться не должно. Это же длительная операция и ответ в срок не гарантируется.

Good advice. Can be done by copying variable from the memory. And even if checksum is lost it can be found in 256 iterations. Need to log the bounds of checksum calculations.

Is the Cruise Control Function at the P80 Me7 Cars activated by the ECU? (Different Bins with cruise / without?)

Thanks!

P80 MJ99 an MJ2000 (Cabrio up to MJ2003) have CAN Network. There is no P80 with CAN wires directly from ECU to OBD2 port.

They have a CDM in between. Serves the functionality of holding car confg and being CAN Master. CC is globally enabled by it. Not talking about CC Buttons.