Modifying Motronic 2.3.2 ECU hardware and software.

[vwnut8392]

we spoke about that before, you said you did something with the ram and tunerpro to help you trace things out. i dont remeber in specific though. i figured setting this up would help though because i can manipulate the sensors and such manually plus it saves me on gas driving around running one of the cars.

[prj]

You won't really get trace to work well on the boost chip, don't bother trying or wondering if something is wrong with your emulator...

[vwnut8392]

As of today i have another 93 URS4 coming in that has a bad engine, im swapping a built AAN, modified engine harness and a VEMS ECU into this car from a wrecked one. so the blown up engine, harness and computer are going to be just spares and i have an idea to setup the engine on a work bench, remove the rods, pistons and spark plugs out of it, wire up the harness/computer to a power supply and use a large 220V electric motor on the crankshaft to rotate the engine and log all the info to figure out what maps are exactly doing what. i feel doing this i can control air temperature, coolant temp, RPM ect and watch the maps while tracing with my ostrich 2 and see what maps change. also another idea i have for the boost chip is to use my air compressor with a pressure regulator on the line and trace the boost chip and see what changes happen on it. its gonna be a bit of work to set it up but i think it will be beneficial in figuring this ECU out. i did something similar to this years ago with digifant 1 and it worked out great so why not give it a shot with M2.3.2.

its kind of nice right now that i have 4 S-cars sitting in my garage at my disposal weather for parts or to drive and experiment with. here's some pics of the cars im working with.

This is my AAN powered 84 4000 quattro AKA the beating child.



My buddy Steve's 93 URS4 that had an ill fate
Before the accident

After the accident


The 500WHP power AAN power plant


The other URS4 to replace the wrecked one hasn't made its way here yet, im in PA and the car is coming from Idaho.

My 93 URS4 parts car i snagged for 1200.00. i drove it around for 2 months before parting it.



The minty fresh 1995 URS6 avant. My buddy picked this gem up off the owner of the local audi dealer, its 110,000 miles new.



Also i recently found a white 83 UR coupe quattro thats been sitting in a warehouse since 1994. The guy who owns it is one of my good friend's uncles and he offered it to me for 1700.00!!! its a no run but its a UR coupe. i need to save up money and sell off some of my parts and get this thing ASAP. i think the spare AAN would suite the car very well.

[vwnut8392]

Improving MAF range.

Thanks PRJ, i was sitting at my desk staring at an ECU and that question struck me.

[prj]

Improving MAF range.

[vwnut8392]

i was just thinking eariler about the mod to R201 and what exactly is its purpose? what does changing the resistance value do? i jsut know its part of converting an ECU to RS2 spec but what its purpose?

[vwnut8392]

That's because you are tracing the wrong maps... the IGN map you're tagged is mostly not used.
Ostrich's tracing isn't the best though, to find what's going on I wrote custom data logging code in the ECU and logged RAM variables, and based on that traced the assembly code and found out exactly what maps it is reading and when.

Don't think there's any other way unless you have the FR. I know someone who has it wilting away in his cellar, but he doesn't have the time to scan it.
I don't think you'll get very far with Bosch, unless they are in a really good mood. The NDA on the FR for M2.3.2 has expired some years ago already, so they would probably not be breaking contract by giving it out.

i assumed i was tracing the wrong ones, i jsut started tracing them as of last week because my car was down for a little because i smoked the clutch out of it doing flat spins lol. turns out my pressure plate isnt strong enough. anyhow i had tracing issues with digifant 1 and my ostrich too. i discovered a little add on board that allowed it to trace properly but the company who made it doesnt seem to exist anymore so i was out in the cold on it. thats a shame that guy has it and wont share it. i would assume if there is one copy in the wild there has to be more as well. i've been pretty persistant with bosch and getting some sort of documentation. its been a 5 month process so far that has involved several phone calls and emails. the last email i got said they did have documentation on it but it was like it was on a shelf somewhere and they had to find it, this was a few weeks ago. I've been jumping through hoops with them to get to the right person and i think i found that guy in the company. the guy seems to be an audi fan because i told him about my AAN swapped 4000 quattro and how i was just an aspiring audi fan and a DIY guy who wanted to be able to tune the ECU in my car. He seemed really cool so i'll see how it goes.

[vwnut8392]

Which Real time emulator do you suggest? Is the Ostrich 2.0 unit any good or would you advise something else?

The ostrich 2 is the best emulator out there in my opinion. i have one and im in the process of getting a second one. For the price of it its very worth it plus it works in conjunction with tunerproRT which is a big plus.

[prj]

but its still sort of difficult to tell because the emulator doesnt always trace right in the maps.

That's because you are tracing the wrong maps... the IGN map you're tagged is mostly not used.
Ostrich's tracing isn't the best though, to find what's going on I wrote custom data logging code in the ECU and logged RAM variables, and based on that traced the assembly code and found out exactly what maps it is reading and when.

Don't think there's any other way unless you have the FR. I know someone who has it wilting away in his cellar, but he doesn't have the time to scan it.
I don't think you'll get very far with Bosch, unless they are in a really good mood. The NDA on the FR for M2.3.2 has expired some years ago already, so they would probably not be breaking contract by giving it out.

[prj]

Which Real time emulator do you suggest? Is the Ostrich 2.0 unit any good or would you advise something else?

That's the one I linked in a previous post - I think it's very good...
To emulate the other chip you need the latch adapter though. I helped the boost button guy re-design the adapter, so it would fit in the Motronic ECU

What are you trying to do though? Just have a go at it?
If you want to learn mapping as such, it's much better to start with a standalone ECU, because there you have already all the tools made available for you.
Then you can concentrate on tuning the car, not fighting the ECU.

But if you want to have a go with the Motronic, it's a good idea to have a good understanding of mapping, and engine control systems, as otherwise it is very hard to figure stuff out. I would say impossible.

[vwnut8392]

what PRJ said as accurate as it gets. My way of explaining it is when using tunerpro i consider it as an interface, the BIN file is the actual information that is on the chip inside of the ECU and the XDF file in a sense is the key or bridge to viewing the maps in a form that lesser experienced people can understand and see the maps in a 2D or 3D view. the XDF basically translates the BIN file for tunerpro.

well the XDF and BIN will help you get a feel of what you are looking for in the binary in my opinion. through the XDF and some of the things i attempted to figure out what they do you can get the addresses in the HEX and look at the BIN in a HEX editor or winOLS and than it could start making more sense as to where the maps are located in the BIN file. The XDF i posted is from PRJ's map finder program but as you can see it only tells you the axis and the adress where that map is located. as for what each and every one of those maps does is unknown to me still but im still trying to figure them out. the biggest help i've had in figuring the maps out though is the Moates ostrich 2 which interfaces with tuner pro and allows you to watch what is going on in each map but its still sort of difficult to tell because the emulator doesnt always trace right in the maps.

basically when you look at the maps that PRJ's program output it goes like this.

i'll use the first table in the XDF labeled driving ignition. if you put your cursor over it some other info pops up but the first line is what you want to focus on.
it looks like this-0x935F - 0x3A by 0x3F 16x16
0X935F=the address where the map starts
0X3A=designates the first axis of the map
0X3F=designates the second axis of the of the map
16X16=the size of the actual map

now if look at the address 0X935F in a hex editor there will be a 3A in the binary.
after that 3A there are 16 more hexidecimal bits. the 3A designates that this is the RPM axis and the 16 bits after it are the RPM scale. so at the 3A count 16 bits and you should find the 3F. 3F is the next scale on the axis which is load. after the 3F count 16 more bits and this is where the actual 16X16 map starts and what you see when you have the driving ignition table open in tuner pro.

Also if you scroll down the parameter tree in tuner pro and find 0X935F you will notice its there twice.
the first one looks like this-0x935F - 16x1 - 0x3A. this is the RPM scale for the driving ignition map.
the second one looks like this-0x9371 - 16x1 - 0x3F. this is the load scale for the driving map.
and the next 0X935F after that is the actual 16X16 map. Also in reality the real start of the 16X16 map is at hex address 0X9383. this is the address after the RPM and LOAD maps.

i hope this info helps you understand a little more of whats going on.
follow this link to motronic.ws and you will see a visual of what i explained.

http://www.motronic.ws/map301.htm

once you look at that site it should make complete sense on how the maps are laid out.

[Tonks4x4]

Which Real time emulator do you suggest? Is the Ostrich 2.0 unit any good or would you advise something else?

[prj]

Thanks Dimitri, So using something like tunerPro to view the *.bin and the *.xdf file together should give me a better understanding?

You won't really get too much understanding.
The maps are mislabeled in this xdf. There are 6 ignition maps defined, how do you know which one is actually used?
There is also no such thing as "emergency ignition" and so on and so forth.

Basically what my tool does, is take out the manual labor of defining maps. The maps that are not labeled have been found by my tool... The ones that are labeled have been renamed.

All that has been done to this xdf are a few factors thrown in, most of the info can be found here: www.motronic.ws.
But the map labels are wrong - and it is impossible to really know how to label them unless you have a real time emulator with trace or go through the assembly code.

I am afraid you won't get much understanding by looking at this - to get understanding, you need to invest in some hardware, generate the XDF from scratch with my tool, and then have a go at it and see how things respond to changes. Just as starters.
Unless you fancy bashing your head repeatedly against the wall and trying to figure out stuff from the assembly code alone. This is extremely difficult.

[Tonks4x4]

Thanks Dimitri, So using something like tunerPro to view the *.bin and the *.xdf file together should give me a better understanding?

[prj]

The .bin is the firmware from the ECU.
An XDF is some metadata from TunerPro that tries to describe structures within the .bin.

The XDF's posted here are basically what my map finder program finds by analyzing a motronic binary and dumping it's master map table.
However, there are no constants defined.
There are also no conversions defined or what map really does what and how they all work together.

So pretty much useless really, unless you have a real time emulator and want to tinker with the maps, and know what to monitor for changes, and then start putting labels on the maps.
But that is not really enough, it's impossible to deduce what the maps do by playing with an emulator alone, to really understand what the ECU does, you either need to have someone from Bosch who is willing to leak factory information on the ECU, or you need to disassemble the ECU's program code, and basically read through machine code, label common routines and functions and find out how it works inside.