Modifying Motronic 2.3.2 ECU hardware and software.

[prj]

Will the early urS4 engine (originally equipped with 551A) full boost with 551AA ecu?

Of course, does not make a difference.

[Val]

551A early UrS4 with pseudo dizzy and 8k boost chip
551AA UrS4 non-immo, Europe and America

Will the early urS4 engine (originally equipped with 551A) full boost with 551AA ecu?

[UrS4boy]

ahh good look, i was using an automatic 4A0 907 551 D file for comparison too. The 551 D file is from an automatic and i read several places that the rev limiter was around 6500 RPM. im tired and i've been trying to figure this out all day. maybe input the automatic values by accident, if not its back to the drawing board.

I suspected a mix-up and checked to see which ECU was the automatic one. Not 551C but 551D. 6500 for the autobox sounds right.

Here is a list compiled by Dmitri ("prj") on the S2Forum (who has cracked most of the Motronic codes)

"AAN Motronic ECU Part Numbers:
551A early UrS4 with pseudo dizzy and 8k boost chip
551AA UrS4 non-immo, Europe and America
551B UrS4 same as 551AA, but auto
551C UrS6 incorporates all software updates from RS2, different codebase, more diagnostics
551D UrS6 same as 551C but auto (see photos at the end of this post)
551E UrS6 has a small tweak to fuel on cold start
551F UrS6 same as 551E but auto.

AAN Motronic ECU Device List and T55 pin-out with hyperlinks:

http://forums.quattroworld.com/s4s6/msgs/21009.phtml

[vwnut8392]

Good sleuthing. Only one problem: The rev limiter is more like 7200 in my experience.

ahh good look, i was using an automatic 4A0 907 551 D file for comparison too. The 551 D file is from an automatic and i read several places that the rev limiter was around 6500 RPM. im tired and i've been trying to figure this out all day. maybe input the automatic values by accident, if not its back to the drawing board.

[UrS4boy]

Good sleuthing. Only one problem: The rev limiter is more like 7200 in my experience.

[vwnut8392]

Ive been looking at the 4A0 907 551 C binary for the rev limiter and i think i may have found it at 0XA37C. using the info on rev limiters from the motronic.ws web site i think i have successfully calculated the rev limiter.

to figure out the rev limiter you have to locate the binary at 0XA37C and 0XA37D. in the case of the 551C file the hex is 97 and 03. you have to take the 97 and convert it from hex to decimal. 97 converted to decimal is 151. the math goes like this to get the actual real world rev limiter, 983600/151=6513.907284768212. so this makes the rev limiter on that file 6513.90. the value of 983600 came from the motronic.ws web site for the RS2. using the 983600 value is considered a short cut to get the rev limiter. i dont exactly understand the math on there using the whole 16 bit hex code to get the rev limiter. if someone could elaborate on that method of doing it that would be great.

[prj]

I've often wondered how you deal with this chip. When tuning an ecu with this chip, do you just erase/reflash the same 257? Can it be read/written with a latch adapter board? Can it be replaced with a 256 and latch adapter board?

Thanks,
Steve

Bosch used the chip so that they could run the I/O lines multiplexed, as otherwise it would not have fit the board.
I personally use a latch adapter with an emulator for tuning and write the end result to a 87c257...

[vwnut8392]

I've often wondered how you deal with this chip. When tuning an ecu with this chip, do you just erase/reflash the same 257? Can it be read/written with a latch adapter board? Can it be replaced with a 256 and latch adapter board?

Thanks,
Steve

i cannot tell you as to why audi chose that chip. when tuning the ECU most normally use the latch adapter board on the boost side with a moates ROM emulator. once finished tuning the binary is normally burned to an SST27SF256 or SST27SF512 chip EEPROM chip. the 256's are getting a little hard to come by but the 512's are plentiful. all you have to with the 512 is burn the chip starting a offset 0X8000. a car ECU reads a chip backwards in a sense so you have to have the binary start in the middle of the 512 chip and go to the end leaving the beginning to the middle blank.

As for the timing/fuel side no latch adapter is needed. just add a socket to the board and use an SST27SF512.

[Kapn.K]

the 87C257 has a tri-state latch

I've often wondered how you deal with this chip. When tuning an ecu with this chip, do you just erase/reflash the same 257? Can it be read/written with a latch adapter board? Can it be replaced with a 256 and latch adapter board?

Thanks,
Steve

[prj]

Now all you have to figure out what they actually do and when they are used, as well as how enrichment is calculated

[-ice-]

Hi,

looked closer at this fueling sub procedure. I could find two enrichment maps. One (8dbo) is 2d and enriches depending on coolant temperature.

The other one is depending on coolant and air-temperature. There is even a third one, when 77/78 is switched at the beginning of this procedure. It's nearly the same 3D map except one value?!

Greetings

[Sonic]

bosch did not envision 2+ bar boost i guess

[-ice-]

Hehe i don't think Bosch considered or expected that it will go to zero after an overflow

Another case of "fixing other peoples bugs" nice

[prj]

I see also the calculation of load. It's the only codepart where the load-variable is assigned with a calculated result (and not with fixed values...)

Yes, but this is only 8 bit load for maps. It is not used for calculation of e.g. injection pulse length.
Internally it uses 16 bit load. Also, it is possible to de-cap the load on this ECU. If you tune this ECU correctly and hit 255 load, the 8 bit load goes to 0 (bug or feature in code... bosch did not envision 2+ bar boost i guess), but anyway, not nice for the engine to go to 30 degrees timing and lambda 1 at 2 bar ...
It is possible to fix this bug and make it stick at 255. And also remove an upper bound check for 16 bit load.

Then the ECU can deal correctly even with 3 bar of boost pressure, and I have seen 280 load

[-ice-]

Hi,

Thank you very much for the informations.

Yeah, it calculates the MAF linearization constant and 8 bit load that is used to lookup maps.

Had a short look on this procedure. It accesses the 2D Map with 12 entrys which is the MAF linearization. unfortunately i couldn't recognize that before because I thought map @8a00 would be this linearization I see also the calculation of load. It's the only codepart where the load-variable is assigned with a calculated result (and not with fixed values...)

There is only one main injection map with corrections.
You can easily find where it is accessed, and you can also find the function that processes the values and disassemble it to understand how it works...
Just a tip - normal fueling, warmup enrichment and crank fuel all have completely different ways of calculation and different formulas as to how they work.

With my actual knowledge I think this injection map is accessed in sub procedure 2130. i will see if i can discover different pathes there (i don't know anything about the enrichment map locations yet...)

But it's just 8051... try disassembling tricore if you get bored

The more i work with this, i realizie how much effort and "brainpower" is necessary to analyze and understand all of this code. respect!!
I'm not familiar with asm, i don't see the function behind the code as fast as you do. Even if the command-set of 8051 isn't that big. But it goes on in small steps

Bye