Hacking the Motronic ECU (Audi RS2)

[prj]

Thanks for the file.

Coming back to emulators.
The Ostrich 2.0 supports real time ROM tracing and it is supported by TunerProRT. The cost is also not that high, 175$.
However, there is one issue... since our cars have two chips, I am not sure whether you can emulate both at the same time with this, or whether you need two units.
Any insights on the matter?

[S2central.net]

This combo works but of course you can only realtime edit one chip at a time - unless you run 2 x emulators

the other thing to know is that ostrich doesn't support 87c257 - I had to work my way round that from 1st principles with a chip converter module.

I generally find that I create the boost chip manually as it doesn't tweaked anything like as much as fuel and timing. I actually need to spend more time on emulation stuff to unlock a few more things. Finding the time is tricky though plus I really need a driver as well.

[prj]

I'd drive you around if it weren't for a little distance problem.

Regarding the Ostrich and M87C257 emulation, I found this http://www.turbo-mopar.com/forums/sh...ad.php?t=35796.

There is not a single person in my country who can tune Motronic 2.3.2... and the following of ABY, AAN and ADU cars is pretty large. But I am not sure whether I should drop 350$+ into this when I have zero experience of tuning an engine.

[prj]

Decided to give TunerPro a go, but it's pretty basic...
It is not even possible to make it calculate axes.

Unfortunately, if I am going to use an Ostrich, I don't have much choice.
I think I now understand why you wrote a PHP script in the first place, I am going to start writing a map directory parser myself it seems... (just for starters).

[prj]

After writing the map directory parser, I found some more constants.
I believe this is a list of all the constants in hex, that are used in the maps, which are referenced from the map directory:
0x36, 0x37, 0x38, 0x3A, 0x3F, 0x2E, 0x04, 0x5D, 0x86, 0x4B, 0x30, 0x03

The first half of them I know, the other half I have yet to figure out.
And then there is the conversion of the axes into real world values... to figure that out on my own I most certainly need a trace.

[S2central.net]

Trace won't help with axis calculations but will give confirmation when you have them right.

[prj]

That's basically what I meant.
As an example - If I log coolant temp and then look at a table where coolant temp is used and see, which value the ECU accesses, I can try and derive the formula from that...

[prj]

Am I remotely on the right track if I say, that 0x38 is filled from another memory location (sensor voltage?) using a transfer table?

[prj]

I will probably meet the grand wall of silence, but who cares... here we go:
Does anyone know why our turbo chips have double data?
The two halves seem to be identical... I also disassembled it and found the checksum routine, it also only sums half the chip at once (as expected).

Is there a sort of hardware switch, that chooses which image the CPU sees?

[Tommy200rs]

asking is never too much.

Because the parts are identical, it needs to remain as it is. Mod the first part as needed and then make identical copy to next half. Did not answer to your question but works... I also do manually the boost chip even though I have the converter base. Normally it is so that variety of existing boost chips are so close that "only small" mods are needed to wake the turbo in a proper way between 2000 to 4000 without too much overboost. The upper part is then easier.

Real time emulator is (mostly) needed to adjust fuel & ignition and some correction factors. The trick is to do such combo where there is lowest possible fuel consumtion and enough power. The Real time adjustment is easier when lambda steering is switched off (small map where 0 values mean off; idle to ~2000 can remain under steering when adjusting ). You can adjust the mixture so that lambda oscillation is on "lower or upper" stokiometric area ~below or above the 14.7. slightly over 15 is for best economy. high 11 / low 12 is safe for power on high boost.

use exhaust temp measuring and wide band lambda to make it safe (not melt nor knock). Note that even cruising on vacum @150km/h makes the engine exhaust glowing "hot" => adjust all areas and not just the power band. Most time is needed in outside the power area to make the chip good and drivable. Many chips have far too less ignition in vacum area and low low boost (safety margins for hig tow load).

tell us how you liked the product.

[prj]

asking is never too much.

Because the parts are identical, it needs to remain as it is. Mod the first part as needed and then make identical copy to next half. Did not answer to your question but works...

Yepp, I figured that out. Maybe it has something to do with the special 87C257 chip...

I also do manually the boost chip even though I have the converter base. Normally it is so that variety of existing boost chips are so close that "only small" mods are needed to wake the turbo in a proper way between 2000 to 4000 without too much overboost. The upper part is then easier.

Thank you. I have not looked that much at the turbo chip yet, I just recently started taking it apart and learning.

Real time emulator is (mostly) needed to adjust fuel & ignition and some correction factors. The trick is to do such combo where there is lowest possible fuel consumtion and enough power. The Real time adjustment is easier when lambda steering is switched off (small map where 0 values mean off; idle to ~2000 can remain under steering when adjusting ). You can adjust the mixture so that lambda oscillation is on "lower or upper" stokiometric area ~below or above the 14.7. slightly over 15 is for best economy. high 11 / low 12 is safe for power on high boost.

The little map I guess is dependant on temperature...
From what I have read, motronic runs open loop below 70C (when coolant temp is low) and also at high load. The rest of that time it runs in closed loop mode with lambda control and if you sway too much from the stoichometric ratio (14.7) the ECU will correct it. Everything you said makes perfect sense, thanks. I will also try to find that map to switch the lambda off. Also, I guess if the car being tuned does not have catalytic converters, then I can just leave the lambda disabled. Although I am not sure how that would affect the ECU in case of a MAF failure.

use exhaust temp measuring and wide band lambda to make it safe (not melt nor knock). Note that even cruising on vacum @150km/h makes the engine exhaust glowing "hot" => adjust all areas and not just the power band. Most time is needed in outside the power area to make the chip good and drivable. Many chips have far too less ignition in vacum area and low low boost (safety margins for hig tow load).

Thanks. I have an old soviet airstrip about 2km from my house. It is very good for testing various conditions. I appreciate the hints. I will also be buying a wideband controller with EGT display. Something like the one offered here: http://www.14point7.com/.

tell us how you liked the product.

Which product? If you mean Moates Ostrich 2, then I have been told that it does not always work correctly and can crash the ECU when reloading the firmware. I am trying to get more information on it before I buy.

EDIT: Regarding the Ostrich, as I got told, it can crash the ECU only during code changes (assembler) and reading of values that are larger than 1 byte. Everything else should be fine. This makes sense too. If the ECU is reading code and suddenly you modify it, it might read an incomplete opcode or a wrong combination. In case of map changing, this can not really happen, and with 1 byte values the probability of reading a wrong value is lower. Even if it would happen, you can not fail by a lot.

[S2central.net]

Ostrich is OK - I did have the very occasional crash when dumping new binaries in, but real-time edits are fine. I got in the habit of pulling over before doing anything too radical though just cos I couldn't trust it to be 100% reliable. I haven't used it a long time - need to find time for more explorations on this stuff.

As for two banks on turbo chip - tis something of an anomolie alright - I can't even remember which bank is used by default (just duplicate into both banks as Tommy says) but its rather convenient for mode swapping I just figure that chip is the way it is because someone at Bosch decided they wanted to choose an oddball chip with a latched bus cos it was convenient somehow - I know it suits the micro well enough, but why not do this on both chips ? Maybe there is no latched version of the chip big enough for motor chip. Odd but nice.

I would love a disused airstrip to play on - it isn't easy doing tweaks on the public road.

[prj]

Ostrich is OK - I did have the very occasional crash when dumping new binaries in, but real-time edits are fine. I got in the habit of pulling over before doing anything too radical though just cos I couldn't trust it to be 100% reliable. I haven't used it a long time - need to find time for more explorations on this stuff.

Ok, thank you. Then for just tuning and monitoring the Ostrich will be okay for me.

As for two banks on turbo chip - tis something of an anomolie alright - I can't even remember which bank is used by default (just duplicate into both banks as Tommy says) but its rather convenient for mode swapping I just figure that chip is the way it is because someone at Bosch decided they wanted to choose an oddball chip with a latched bus cos it was convenient somehow - I know it suits the micro well enough, but why not do this on both chips ? Maybe there is no latched version of the chip big enough for motor chip. Odd but nice.

Seems like our thoughts are following pretty much the same path. Oh well, I guess it is somewhat of a mystery. Though I guess it is not all that important for the actual tuning, rather more in the direction of satisfying personal curiosity.

I would love a disused airstrip to play on - it isn't easy doing tweaks on the public road.

Yeah, it's very handy, there are other things that are not that handy about this country though. Like discovering your mirror glasses being stolen in the morning

[S2central.net]

The more I think about all this - the more I need to dig up my 'engine simulator' project - in theory this makes it MUCH easier to fake the ECU into thinking it is attached to running engine... then its just a matter of tweaking some pots and/or switches to exercise all interesting areas of the chip while hooked up to an emulator. This is so much easier than driving around / burning fuel / scaring the locals / getting chased by police etc etc - and also gives one simulator that will play with all types of 20VT ECU.

I have decided to move this along in two phases. I might need some help on the simulation circuitry so I would be happy to collaborate on that in the interests of scientific exploration.

I have something that will simulate the rpm sawtooth waveform at fixed rates. A simple tooth counter could trigger a couple of astables that simulate crank reference and camshaft reference pulses at the right time... With a powered up ECU this is all we need to make it think the engine is running... Then use pots to set IAT, ECT, MAF, TPS, Altitude etc etc and make sure all ECU outputs are loaded with something to keep it happy. Add some flashing lights to simulate sparks for fun and thats it. Easy to say, but trickier to carry out properly. I have done some high level elaboration at systems for this already - just never invested time & effort to follow it through.

I would need some help to design the analog stuff that generates the crank reference signal in particular as it has a really odd shape... Could just be some fun with an old school 555 timer that can create a waveform that is good enough to be interpretated by the ECU. I am fine with designing the counter circuit to trigger that though.

[S2central.net]

Oh would probably need to fake a lambda probe signal too.