Modifying Motronic 2.3.2 ECU hardware and software.

[prj]

This situation seems to be a bit weird. I made my decision to learn (r)s2 motronic around one year ago. Since then I've been following -ice-, Acki and others making good progress in this thread. Currently I'm running E85 in my car, no tricks, just ECU with own binary. And vwnut you're still struggling with 6 bytes of code that does nothing so special. It even doesn't fiddle inputs or outputs.

But to be fair, please check out: http://www.win.tue.nl/~aeb/comp/8051/set8051.html and it should be a few minutes to solve both 6byte secrets.

PS. Thank you prj, -ice- and Acki and this thread for the pieces in my puzzle.

If he would put in even 1% of the effort it takes to write those mega posts about how everyone is so mean to him, I am sure he would have solved it long ago.

Glad the info is of some use.

Btw, for the boost chip. 551c routine addresses:
0x1657 - READ_2D_MAP
0x1684 - READ_AXIS_RPM (this is a special routine for RPM axis only)
0x1688 - READ_AXIS_16BIT
0x168B - READ_AXIS (main routine into which other axis routines go)
0x1700 - READ_MAP_VALUE (reads the actual value from the map after running axis routines including interpolation)
0x1707 - INTERPOLATE (Interpolates between two values)
0x173E - READ_3D_MAP_RPM (3d maps are only supported with RPM as one axis. It locates the first and the 2nd axis offset, then reads and interpolates first row, then reads and interpolates second row, then interpolates them between each other).

Some other stuff:
0x1B - N75 pwm output (TF1)
0x191 - IE1 - N75 override from MOT chip for diagnosis check and in case of fuel cut.
0x688 - Knock detection routine
0x8AD - The actual RESET function, not the crap at 0x00.
0xE6B - Boost control
0x1372 - Calculates whether overboost is on or not (for that it adds a value to the throttle axis when it reads the target boost map)
0x15AC - Boost cut
0x15D6 - MAP sensor plausibility diagnostics.

[kymi]

This situation seems to be a bit weird. I made my decision to learn (r)s2 motronic around one year ago. Since then I've been following -ice-, Acki and others making good progress in this thread. Currently I'm running E85 in my car, no tricks, just ECU with own binary. And vwnut you're still struggling with 6 bytes of code that does nothing so special. It even doesn't fiddle inputs or outputs.

But to be fair, please check out: http://www.win.tue.nl/~aeb/comp/8051/set8051.html and it should be a few minutes to solve both 6byte secrets.

PS. Thank you prj, -ice- and Acki and this thread for the pieces in my puzzle.

[-ice-]

You don't have to be a programmer to find out that opcode 0x00 is a special one...

[vwnut8392]

im no programmer, i dont understand any of that and i've tried. as far as i know putting 00 in a line of factory code has nothing to do with the tuner in specific. all he did was take a line of factory code and shut it off. what are they going to do sue me because they modified bosch's super secret code? if anything bosch should be mad that people are talking about their big secret in public. i went round and round with a gentleman once over the same thing, he wanted to sue me because i discovered the same thing at the same time he did. he had no patent on what was discovered nor did either of us have the right to reverse engineer bosch software but we did anyhow. just like any tuner out there, they have no patent on their code nor could they ever get a patent on it because they would have to pay bosch for the rights and have full documented permission from bosch to modify their patented software and hardware. so that makes anything a tuner does fair game to be public information. with the laws in the US anyhow you can do whatever you want with things such as this as long as you aren't profiting from it, so if you give it away there is nothing that can be done.

although MTM might be one tuner that has permission from audi and bosch to do what they want with the software and hardware and put patents on it. if i recall reading somewhere MTM was or still is very closely tied with audi sport.

[-ice-]

Hi,

Please search for 8051 opcodes and discover what these commands mean. Done in 5 Minutes. Posting source code of tuners is not a nice way.

Will start to work with the boost chip today. First goal is finding the map access routine.

Regards

[vwnut8392]

I was doing some more BIN comparison with different boost chips and i think i found one that seems to have the checksum routine disabled. i was comparing a tuner file to a stock file and i discovered a line of code thats 6 bytes long thats 00 in the tuner file and not in the tuner file. below is the actual code change from file to file. can any of you guys confirm if my suspicion is right? i dont have my emulator right now to test it.

Hex offset 0XB83
Stock file
79 E7 E7 D2 E6 F7 

Tuner file
00 00 00 00 00 00

i feel this is what this code modification does because the checksums are identical still and the tuner file has some pretty heavy modifications to the mapping.

[vwnut8392]

i have VEMS standalone. looks like im going to be banging my head for a loooong time than. as for making an management that doesnt belong on an engine is easy, i've made digifant 1 from a corrado G60 run a 10V engine NA and turbo with no hiccups or problems but enough about that. lets get back on the topic at hand.

[prj]

a waste of time to you because you know everything there is to know about M2.3, as for the rest of us stupid people as you would put it we need to look at other solutions so we can perform basic tuning on our cars.

The solution if you want to tune your own car is a standalone ECU. Period. What you are doing is repeatedly banging your head against the wall and insulting anyone who calls you out on your masochism. No amount of repeating your opinion of your entitlement to other people's hard work will ever get you ANYTHING.

Transplanting a totally different OEM ECU to work with a totally different engine is much more difficult than picking apart M2.3.2, which you are not able to do. Forget it. The only thing these engines have in common is that they have 5 cylinders.
Plus, this is completely off-topic, since in this thread we discuss modifying M2.3.2.

[vwnut8392]

Volvo is waste of time on 2.2T.
M2.3.2 does everything M4.4 does and some of it better as well, such as boost control.

a waste of time to you because you know everything there is to know about M2.3, as for the rest of us stupid people as you would put it we need to look at other solutions so we can perform basic tuning on our cars. honestly why are you wasting your time even posting here genius? dont you have some custom ECU code to write or a car to tune?

[prj]

Volvo is waste of time on 2.2T.
M2.3.2 does everything M4.4 does and some of it better as well, such as boost control.

[S2central.net]

I genuinely think that is your best way forward - use jimstim to run the 60/2 configuration the Volvo ecu and then set about porting it onto the AAN. I think you are right about some VW engine having a 60-2 configuration that can be adapted. Great you have done that already with VEMS as that is fundamental.

[vwnut8392]

I think there is a 60-2 option on VEMS now that some people have used on the 20VT engine - that same arrangement will get you rolling on Volvo M4.4 assuming you can suitably customise that for 2226cc and the throttle body mods for IAC and such.

i run my AAN in my 4000 on 60-2 with single window cam sensor. i tested it with my jimstim on the bench and i got around 12,200RPM before i started getting trigger errors in VEMS. i was using a hall effect GM crank sensor with a custom 60-2 trigger wheel and the stock hall cam sensor. this time around its going to be an OEM VW/audi VR crank sensor and the hall cam. still staying 60-2 as well. the volvo engine is a 2.5 so it shouldnt be that tough to configure. the IAC shouldnt be that bad, i have a full machine shop at my disposal along with a trusty tig welder so making an adapter or custom intake wont be that bad.

[S2central.net]

I think there is a 60-2 option on VEMS now that some people have used on the 20VT engine - that same arrangement will get you rolling on Volvo M4.4 assuming you can suitably customise that for 2226cc and the throttle body mods for IAC and such.

[vwnut8392]

The unicorn document you speak of does exist but it's closely guarded by the few who have it and it's in German as well for another layer of obfuscation. I did once get very close to a copy but it never happened - it's paper only too by the way.

I did manage to get ABY / AAN schematics which are amazing but I am not at liberty to share them for obvious reasons.

It's a pity you had a bad experience with VEMS as that (or similar aftermarket) is probably best for your needs.

The Volvo 5-CYl motronic is an interesting idea. I have never looked at how that could be integrated. The flywheel related sensors could be most challenging. I wonder was that reverse engineered by a tech savvy hack community or simply because someone leaked the "unicorn" document for that system.

I just posted circuits for ESIM on my project thread - those are bespoke for 20VT. I did once look at mega squirt in the past and felt there was as much work to alter it for 20vt as opposed to just building something bespoke. Maybe it's a lot more generic these days.

At least on a bench with a tracing emulator you can track down the constants you want to change for rpm etc.

The other advice I would have is to focus on a single software stream - you maybe already know that things are different between versions of aan, Aby and adu code.

The volvo triggering is just your typical 60-2 crank and single window cam sensor. so a custom trigger wheel setup might be in order for the 60-2 but im sure it would all work out the same. the engine have the same firing order as well and are COP. other than that its very similar to M2.3.2. i think the idle air control is in the throttle body so a custom throttle body solution would be in order. other than that the volvo community has it all figured out. the ECU has a flash instead of an eprom so that makes life easier, they have full data logging through tuner proRT, to do the flashing and data logging all you need is a cheap ebay vag com cable. the tuner pro definitions are free and fully defined along with matching stock binaries.

have a look at what they've done for yourself in this wiki.
http://m44.wikia.com/wiki/M44_Wiki

The jimstim was designed by megasquirt guys but it is a universal tool. like i said i use it with my VEMS ECU on the bench all the time. The megasquirt guys have got the AAN to run on MS3X with a divider board from the same guy who makes the jimstim. it takes the 2 crank signals and converts them to a single crank signal the MS3X ECU can understand.

as for the simulator the jimstim seemed like the easiest solution to me because i dont have an oscilliscope or any tools of that nature to sit down and figure out each signal one by one, design a board and all that stuff. i figured id work with whats already available to me.

i understand some of the difference between the AAN, ADU and ABY files. i look at it more on the ECU part number and ending prefix instead of engine code though. i do know that the AAN was the first to get COP and that the 551A is like a modified version of the 404/3B code to be COP. the 551AA is when audi migrated to the cam sensor on the front of the head and the cam gear. the 551B is just the automatic version. the 551C is where audi remodeled the file a bit because i seen that how the rev limiter works completely changed from the eariler versions. as for engine specific the 551C is where all the engines seem to come into play. The AAN and the and the ADU are going to have alot of different mapping because of the ADU having so many hardware upgrades like larger turbo, larger MAF, larger injectors etc. i never really looked at ADU files honestly because i always forget about them. the S2 was never sold in the US so it always seems to slip my mind. so in a round about way i think i get whats changed as per revisions by bosch.

[S2central.net]

The unicorn document you speak of does exist but it's closely guarded by the few who have it and it's in German as well for another layer of obfuscation. I did once get very close to a copy but it never happened - it's paper only too by the way.

I did manage to get ABY / AAN schematics which are amazing but I am not at liberty to share them for obvious reasons.

It's a pity you had a bad experience with VEMS as that (or similar aftermarket) is probably best for your needs.

The Volvo 5-CYl motronic is an interesting idea. I have never looked at how that could be integrated. The flywheel related sensors could be most challenging. I wonder was that reverse engineered by a tech savvy hack community or simply because someone leaked the "unicorn" document for that system.

I just posted circuits for ESIM on my project thread - those are bespoke for 20VT. I did once look at mega squirt in the past and felt there was as much work to alter it for 20vt as opposed to just building something bespoke. Maybe it's a lot more generic these days.

At least on a bench with a tracing emulator you can track down the constants you want to change for rpm etc.

The other advice I would have is to focus on a single software stream - you maybe already know that things are different between versions of aan, Aby and adu code.