Modifying Motronic 2.3.2 ECU hardware and software.

[vincentroyc]

Ok so PRJ, kymi or -ice-, i found how the map lookup "table" in the boost chip is used and what maps are used from a corresponding read routine, I found the ADC reads and i am in the process of find which is used to read map tables and how the other are used. The thing is, i don't want you to tell me which ADC read is what but hint on how can I find which is what sensor input?

Because this is specific to the hardware implementation, right?

Also, a couple maps are visible if you search enough, but it semmed that not every one of them are used, am i correct? Are there duplicates?

Thanks

[prj]

What sensors do you need to know specifically?
Define some maps, you will know what is what from that mostly.

I can help with the obscure ones. Probably best if you ask about specific ram addresses.

[kymi]

Hi vincentroyc,

It's great to see activity in this thread and new faces finding out stuff.

Here's 2 easy ones:
- MAP sensor. Find the map sensor plausibility diagnosis function defined by prj earlier in this thread.
- TPS sensor. Overboost corrected TPS value is used as an axis value for some maps.

After that it's pretty much easier to disassemble around the boost chip.

PS. I tried to leave some room for you to find out things. It's better to really know and understand the functionality if you're really aiming for the knowledge.

[Error404]

Where did you guys start when learning this stuff?

[vincentroyc]

Hey PRJ and kymi,

Thanks for your answers.

PRJ I am just trying by myself to find out what are the analogs input coming in. By the nature of the boost/knock chip and it's name I would be ready to say that there should be at least these sensor readings coming in : TPS, Knock sensor 1, knock sensor 2 and MAP. To define the "demand" of the engine at a current state and be able to give feed back like N75 DC we have to have at least RPM too with TPS so I guess that the 2 big maps 16x10 which one of those is n75 DC should be RPMxTPS. Don't know about the other yet. But One thing : RPM is not a sensor the sensor is a crank position so I guess that RPM is not coming in by a ADCON channel it is calculated with the time passing between 2 crank round wich is probably that that is triggering the main external interupt (0) or another one. Any cue/hint/coment on all this and what i stated about the possible sensor input coming in?

kymi, ya thanks for the "let see if you can find those" I sure have seen many sensor input coming in and 2 of them are stored in RAM_xx which i guess one of them (5d) is the TPS if i recall some of -ice- earlier comments about this. It has actually been store in RAM_6c just before and this came from the b register value that was read from analog input #3 so this would be TPS if i am not mistaken.

So this is my progress about this and I am still trying to backtrace every analog inputs to try and know what they are but also and most of all how they are used for the map read.

On another hand I was wondering if you want to give feedback to the engine you need a way out too the only way out I see is through Port register does it make sense? I see P1, P3, P4, P5 and they are all initialized with a start value in the "program boot/reset" routine. I see feedback that should be given to N75 obviously but what else controls the engine and require feedback that the fuel/ignition doesn't already control?

Here is my state any comment/feedback/hint/ideas are greatly apreciated

Thanks

[kymi]

Perhaps I gave you too much info because you got the TPS input right. 5D holds the actual value. It's corrected with overboost into another ram location that is used for map axis. You seem to know those bigger boost control maps, so finding this shouldn't be a problem. You're also pretty close to figure out how the boost is controlled - like one 'heureka' away. I think you have all pieces of the puzzle in your hands, just go for it. And find that MAP sensor, it's the path to the heureka moment.

RPM is based directly on external interrupt and timer, no messing with adc there.

...and then there's the knock stuff...

[ejfluhr]

OMG this thread is EPIC!! Best 3 hours spent than any TV watching I have done and most movies (Star Wars excepted).
Many years ago I learned from RDH's work disassembling the MAC-02 and tweaked myself some maps for my '82 Urquattro.
I've just now transplanted a stock AAN into said Urq and am doing some "light" reading on the Motronic to learn more about it.
I just wanted to offer my kudos to EVERYBODY who has posted, including but not limited to:
- Mr. Miyagi who amazingly and patiently helps but usually makes you wax-on/wax-off the car and paint-the-fence in the process
- The League of Extraordinary Gentlemen helping each other out with so many different ways of seeing/thinking/learning this system
- Mr. Energizer-Bunny/Don-Quixote providing comic relief with unstoppable and mind-boggling determination despite not grasping what NOP means (and I so cheered after the rev limiter video!)
- The Brave Noobs who post eagerly in their hopes, asking simple but good questions that help us other Noobs, don't take offense at the sometimes gruff treatment, and become Gentlemen in their own right
- The Participating Audience who occasionally root on the home team and highlight the immense awesomeness of this effort that has no real reason to exist but the joy of learning and helping each other

I started in the Audi online community with the quattro-list email group back in 1990 as a freshmen in college, and never imagined back then the grand global connection we all have now as evidenced in these 28 pages.

As the 034 Rip-chip went away, my brother and I just bought my father a plug-in VEMS for his '84 4Kq w/ 3B from Herr Marc, which has been great (the setup w/ COP & Marc's support).
I'll be watching to see how Prj's real-time-tunable daughterboard-ish setup works out.

Cheers to all! Eric

[vincentroyc]

Hey Kymi, PRJ,

I think i got some info, I think that RAM_6A is olding the raw value of the MAP Sensor and @ 0xE0F is the boost control routine gathering info on the Maximum boost 8x1 table and some target pressure tables 8x1. Is this all wrong or am i on the god track?

Also I think that RAM_67 is the ECT raw value and in this same routine (0xE0F) 6 8x8 tables are accesses based on the value of this input. What should could those be? boost adjustment by temp?

I am also looking at the routine at 68C. I am not sure about his one for now, Boost or knock thing.... I don't know for sure yet but it does use ADC #0 stored in 0x62 and a corrected value of ADC #1 stored in 0x6d.

Any good comment/info is greatly appreciated

Thanks

[vincentroyc]

Ok so here's the map I found and what I think it is for now, if someone can confirm (or not) :

0x2520 - 16x10 - N75 duty cycle
0x2480 - 16x10 - Not sure but seems to be related to boost correction or something

0x29A5 - 8x1 - boost level management (normal)
0x29B5 - 8x1 - boost level management lvl 1
0x29AD - 8x1 - boost level management lvl 2
0x2993 - 8x1 - boost level management lvl 3
0x299B - 8x1 - boost level management lvl 4
I think that all this have something to do with either baro/altitude boost correction

0x264B - 8x8 - boost correction at normal ECT ?
0x268B - 8x8 - boost correction at Hot ECT ?
0x26CB - 8x8 - boost correction at Cold ECT ?

(and sister tables)
0x270B - 8x8 - boost correction at normal ECT in some sort of backup mode ?
0x274B - 8x8 - boost correction at Hot ECT in some sort of backup mode ?
0x278B - 8x8 - boost correction at Cold ECT in some sort of backup mode ?

Those maps I am not sure they are boost related
0x2863 - 8x8
0x2823 - 8x8
0x28A3 - 8x8
0x27CB - 8x8

And I've got these maps that I am pretty sure they have sometime to do with knock but i don't know what for now :
0x21F3 - 8x5
0x221B - 8x5
0x224B - 8x5
0x2293 - 8x5

If anyone have some hint about anything in this or just comments or if you want to confirm (or not) some of the info ?

Also, I need help on something. I know and see where most of the map ar accessed and i got the routine where it probably also make the interpolation and everything, but I can't seem to understand how the result is returned and for most the maps how they are used. For example, N75 duty cycle must value must be fed to something like a PWM, but How? Ports don,t seem to be used for this, could it be specific XRAM addresses?

Thanks

[vincentroyc]

What sensors do you need to know specifically?
Define some maps, you will know what is what from that mostly.

I can help with the obscure ones. Probably best if you ask about specific ram addresses.

Don't know if you had notifications, but just replying to say if you can check my 2-3 previous posts and see if you have something to say about them

Thanks a lot

[vincentroyc]

Perhaps I gave you too much info because you got the TPS input right. 5D holds the actual value. It's corrected with overboost into another ram location that is used for map axis. You seem to know those bigger boost control maps, so finding this shouldn't be a problem. You're also pretty close to figure out how the boost is controlled - like one 'heureka' away. I think you have all pieces of the puzzle in your hands, just go for it. And find that MAP sensor, it's the path to the heureka moment.

RPM is based directly on external interrupt and timer, no messing with adc there.

...and then there's the knock stuff...

Hi kymi,

Just little "bump" for my 2-3 last post. See if you have anything to say!

Thanks

[kymi]

Sorry about this silence, I've tried to gather some ideas for this reply. First of all, you're working with non-rs2 boost binary. Most of us here use rs2 boost binary by nature or by prj's recommendation. This means that we have different map locations, sizes and function start addresses don't match.

Have you checked this post by prj? It will not be 1:1 with your binary, but you get the rough idea of the function address structure. If I had to guess, your 0x68C is knock detection and 0xE0C is boost control. Don't treat this as a fact, I'm just guessing (but I feel lucky). This will help you dramatically to link adc inputs, tables and real life variables.

RAM_6A is not the map sensor.

Bit hard to comment on the maps, as the addresses and sizes differ. I don't want to write assumptions of those. There seems to be a few points out of my low-priority todo list also, but I got to get my car runinng before I can confirm those...

[vincentroyc]

Sorry about this silence, I've tried to gather some ideas for this reply. First of all, you're working with non-rs2 boost binary. Most of us here use rs2 boost binary by nature or by prj's recommendation. This means that we have different map locations, sizes and function start addresses don't match.

Have you checked this post by prj? It will not be 1:1 with your binary, but you get the rough idea of the function address structure. If I had to guess, your 0x68C is knock detection and 0xE0C is boost control. Don't treat this as a fact, I'm just guessing (but I feel lucky). This will help you dramatically to link adc inputs, tables and real life variables.

RAM_6A is not the map sensor.

Bit hard to comment on the maps, as the addresses and sizes differ. I don't want to write assumptions of those. There seems to be a few points out of my low-priority todo list also, but I got to get my car runinng before I can confirm those...

Thanks for your reply, I was half on the right way. Sometime talking with someone helps because i think now i found the map sensor. I discovered the max boost check function and map that is 0x29f6 and the function cpl A and add the MAP value which
is held in 0x6D and uses the C bit to do some check if i am not wrong, is it?

Yes sorry, I am using the 551AA since my car is a 93 URS4. Important to mention.

[kymi]

Now this sounds better. Keep on going!

Talking is cheap and it always helps. My wife just ignores my disassembly chat at home, but still talking to that "wall" has helped me a lot.

[vincentroyc]

Now this sounds better. Keep on going!

Talking is cheap and it always helps. My wife just ignores my disassembly chat at home, but still talking to that "wall" has helped me a lot.

But one thing I can't seem to get to is how does the value is used at then end when interpolating in the maps I just don't understand where the values are put at the end to be used A lot of 3D maps are read by the same routine but I don't figure how the same routine knows where to put or how to return the final value. Any hint on that or general basic motronic knwoledge?

Also, I was thinking about it and knock sensor are not a sensor that has a vule maintained its more of an event, so i would have probably think it generates an interrupt, but are the values readable via ADC too?

thanks