Hacking the Motronic ECU (Audi RS2)

[s2dude]

info removed on request :mischeif:

[s2dude]

You're on a good mission here. I asked few years ago about this stuff and.. well I was attacked and flamed etc etc. That didn't stop me. Hopefully this thread doesn't end up that way.

Fuel and Ign main maps are quite straight forward. The rest are the pain as without doing a full disassemble you're not able to know where all the corrections are and how they are used. Changing injectors means you should be able to change all the fuel maps....

Converting the load axis to real world values is not interesting. The rpm stuff you wrote is correct.

Tommy mentioned the emulator. With real time emu you're able to see where data is read and those parts are the most interesting ones. Getting an emu is crucial if you plan to do more than just learn.

You will need to buy an emulator. + invest lots of time.good luck.

[porkkis]

RPM stuff is correct.

Ostrich is useless as it does not have a trace.

[s2dude]

My bad...rpm is ok.
and Ostrich is not useless at all...
many people have had great successes with it.
And some people have had it successfully tracing....just not on all eproms/ECUs

[cid]

An emulator with trace is needed for sure. But the big question is? Finding the maps are the easiest, but are they fuel, ignition, egr, fan switch and others. If anyone has open my xdf in Tuner Pro will see a lot of maps I have found, most of them I dont know what they are used for. Besides you have to know what the number in the table means. You can look the number in decimal knowing is fuel, but a x% increase in that decimal format number will it bring x% in fuel increment, maybe not. The same is true for ignition.

If you have VAG connect to the ECU and plus an emulator you could change the ignition table easier as you would know how many degrees you have changed.

I wish I could understand assembler easier, I have disassemble the RS2 bin file using IDA PRo, but well that has no meaning to me. I would first have to learn disassembler first.

By the way, I am also working in the boost bin, but that one works a little diferent from the fuel and ignition bin. Have a look at the www.rs2.ch, under tuning you gonna see a few maps that we have spoken here. The table name is in german, but at least you know what they are for.

My big guess is that decimal format 55 and 56 are correction tables for ECT and/or IAT there are lot of them under 1D (linear map) format. I am trying to figure it out. Also a good map is the MAF table, as this would help when someone changes the MAF for another one, you can just change that furve to suit the new MAF and basically you wont have to correct many table afterwards, as you have said about injector size.

I think the MAF table could be under B04B - 15 x 1

[porkkis]

There is no such MAF table. Sorry.

[cid]

I thought it had one, because other cars do have MAF tables, just open one of the bins that came with Tuner Pro and the XDF file and you goona see it. It is not a motronic unit tough, but I dont see why motornic wouldnt use one. Otherwise, would be a pain in the *** even for the factory tuners to tune an engine everytime the MAF is changed they would have to change the whole fuel curve.

Unless you are 100% sure about, that means you know the motronic unit as deep as possible. Otherwise I still think there is a MAF table. That is why I think there must be a MAF table

http://motronic944.com/amtf.htm

http://motronic944.com/famvtp.htm

This was taken from another forum:

"MAF transfer is what I'm doing at the moment.This is a conversion chart to convert a voltage from the MAF to hex value the the computer understands.By manipulating this table we should be able to change the MAF to whatever size we want.I just need to figure out how the ecu uses these values in the conversion for load.

Load is a calculation of what the car will need to keep the motor running at stoich.To do this the ecu needs a MAF voltage calibration(see above)engine rpm and injector size.This calculation will then be converted to a theoretical point that will keep the car at stoich(14.7 a/f ratio).

The rest of the tables fine tune everything from O2 voltage to battery voltage ac on and so on.These are set up to betweakable for every condition known to man.

If the proper load conversion was done for the larger MAF and larger injectors then you should only need fine tuning on a few of the tables because most of the other operating conditions will still be the same.

If you start jacking the fuel tables to make up for larger injectors(which is what most tuners are doing)you have to retune every condition that was factory tuned.This is not desirable and we would like to avoid this."

Another point, you look at the pdf file below of an Bosch Hot air mass system you gonna see that it has a similar curve the one a pont it out.

http://modshack.info/images/sensors_airmass.pdf

Maybe I am missing something here.

[porkkis]

Yes you're missing the point that the porsche system uses VAF sensor (flap type air flow, not air mass!).
Flow sensor ecus have the transfer function...

[cid]

porkkis,

Ok I see it now. I though it should have one, because what the eprom sees it is voltage, so you need to now that a X voltage is equal to a X grams/s of actual mass of air. Just like in any MAP sensor. So from 0-5V is like 10-100 grams/s, if you know that then you tune the engine over that. This to me is a transfer function from a electrical signal to a physical value. Now on a table you gonna have the LOAD axis that can be MAP or MAF, and most of the software I know that are dedicated shows the values as an actual MAP or MAF value. So if you change the MAF for another that goes from 10-120 grams/s you only need to make a new trasnfer function from 0 - 5V in respect to the new values. Because if the ECU uses the value in voltage, that means that a 2,5V was 45 grams/s and now is 55 grams/sec (for exampl), so you would need to tune the entire fuel and ignitions table. But if the ECU goes into a transfer function, the tables are not going to chaneg much, as you are saying that at 45 grams/sec you need a x amount of fuel (it does not matter if was 2,5V and now is 3V). So, at the end it does not matter which MAF sensor you are using as long the transfer table is correct.

Anyway this is not an easy task. Perhaps I should leave this. I dont plan to enter in the chip tuning business anyway, and I sold my RS2. Basically I am just loosing my time. Would be good if someone could do to the Audi S motronic units (from 92-95) what some people had done to the Honda ECUs (92-95), where a group of people with a variety of skills got together and developed a software for tuning those ECUs. It has a free and a paid version, I dont know if anyone has ever seen ou heard of Crome. But if we could do something similar would be great for those people that likes to tune their own engines.

Someone could say what would gonna happen to MTM and such companies, not much we are talking here about only a few cars, and more this kind of software would only be usefull for someone with the knowledge to tune an engine, because for someone that has not this knowlegd is better to look a chip tuning company or he will blow his engine.

[diesel des]

I have got a emulator but have only used it in read/burn mode. Its a dataman S4 (just like my audi ) Here is a link. http://www.digitalgraphics.com.au/datas4.html

Would this be upto the job of this work eg enough memory/fast enough? This is very interesting to get into.. Cheers des

[cid]

I have got a emulator but have only used it in read/burn mode. Its a dataman S4 (just like my audi ) Here is a link. http://www.digitalgraphics.com.au/datas4.html

Would this be upto the job of this work eg enough memory/fast enough? This is very interesting to get into.. Cheers des

I think is up to the job. But you need an emulator with a trace, and usually the trace function is on a chip tuning softwware, like Tuner Pro or Winols.

[Jensk]

hmm.. if one could find out what CPU's the motronic units use, then one might be able to emulate the whole process in a de****** like IDA Pro. At least it should give some info on where the program searches for values

[kwlw]

hmm.. if one could find out what CPU's the motronic units use, then one might be able to emulate the whole process in a de****** like IDA Pro. At least it should give some info on where the program searches for values

CPU's are 8051 clones by siemens SAB80C535. IDA will not help you a lot, because inputs and outputs are multiplexed. Some day I will post that data here , but not this year...

Sau

[Mihnea]

It's good to see that some people actually got their fingers out of their *****es and figured some stuff out by themselves. It has cost me way too much time and money to get where I am so this is why I can't really help out a lot, but it sounds like some people are definitely on the right track. Now whether they'll figure out all the subtleties of M2.3.2 or not, only time will tell. I'm not bothered about people figuring stuff out by themselves, as S2s only become scarcer and the only cars I get to tune now are high HP cars where non-realtime tuning can be fatal in a split second, so I'm not worried at all.


Mihnea

[Mihnea]

If I had more time available, I would have definitely started working on an S2/S4/S6/RS2 Hondata type of program, but unfortunately I don't have the time or the funds involved in developing something like this from scratch....