Modifying Motronic 2.3.2 ECU hardware and software.

[kymi]

Sorry about this silence, I've tried to gather some ideas for this reply. First of all, you're working with non-rs2 boost binary. Most of us here use rs2 boost binary by nature or by prj's recommendation. This means that we have different map locations, sizes and function start addresses don't match.

Have you checked this post by prj? It will not be 1:1 with your binary, but you get the rough idea of the function address structure. If I had to guess, your 0x68C is knock detection and 0xE0C is boost control. Don't treat this as a fact, I'm just guessing (but I feel lucky). This will help you dramatically to link adc inputs, tables and real life variables.

RAM_6A is not the map sensor.

Bit hard to comment on the maps, as the addresses and sizes differ. I don't want to write assumptions of those. There seems to be a few points out of my low-priority todo list also, but I got to get my car runinng before I can confirm those...

[vincentroyc]

Perhaps I gave you too much info because you got the TPS input right. 5D holds the actual value. It's corrected with overboost into another ram location that is used for map axis. You seem to know those bigger boost control maps, so finding this shouldn't be a problem. You're also pretty close to figure out how the boost is controlled - like one 'heureka' away. I think you have all pieces of the puzzle in your hands, just go for it. And find that MAP sensor, it's the path to the heureka moment.

RPM is based directly on external interrupt and timer, no messing with adc there.

...and then there's the knock stuff...

Hi kymi,

Just little "bump" for my 2-3 last post. See if you have anything to say!

Thanks

[vincentroyc]

What sensors do you need to know specifically?
Define some maps, you will know what is what from that mostly.

I can help with the obscure ones. Probably best if you ask about specific ram addresses.

Don't know if you had notifications, but just replying to say if you can check my 2-3 previous posts and see if you have something to say about them

Thanks a lot

[vincentroyc]

Ok so here's the map I found and what I think it is for now, if someone can confirm (or not) :

0x2520 - 16x10 - N75 duty cycle
0x2480 - 16x10 - Not sure but seems to be related to boost correction or something

0x29A5 - 8x1 - boost level management (normal)
0x29B5 - 8x1 - boost level management lvl 1
0x29AD - 8x1 - boost level management lvl 2
0x2993 - 8x1 - boost level management lvl 3
0x299B - 8x1 - boost level management lvl 4
I think that all this have something to do with either baro/altitude boost correction

0x264B - 8x8 - boost correction at normal ECT ?
0x268B - 8x8 - boost correction at Hot ECT ?
0x26CB - 8x8 - boost correction at Cold ECT ?

(and sister tables)
0x270B - 8x8 - boost correction at normal ECT in some sort of backup mode ?
0x274B - 8x8 - boost correction at Hot ECT in some sort of backup mode ?
0x278B - 8x8 - boost correction at Cold ECT in some sort of backup mode ?

Those maps I am not sure they are boost related
0x2863 - 8x8
0x2823 - 8x8
0x28A3 - 8x8
0x27CB - 8x8

And I've got these maps that I am pretty sure they have sometime to do with knock but i don't know what for now :
0x21F3 - 8x5
0x221B - 8x5
0x224B - 8x5
0x2293 - 8x5

If anyone have some hint about anything in this or just comments or if you want to confirm (or not) some of the info ?

Also, I need help on something. I know and see where most of the map ar accessed and i got the routine where it probably also make the interpolation and everything, but I can't seem to understand how the result is returned and for most the maps how they are used. For example, N75 duty cycle must value must be fed to something like a PWM, but How? Ports don,t seem to be used for this, could it be specific XRAM addresses?

Thanks

[vincentroyc]

Hey Kymi, PRJ,

I think i got some info, I think that RAM_6A is olding the raw value of the MAP Sensor and @ 0xE0F is the boost control routine gathering info on the Maximum boost 8x1 table and some target pressure tables 8x1. Is this all wrong or am i on the god track?

Also I think that RAM_67 is the ECT raw value and in this same routine (0xE0F) 6 8x8 tables are accesses based on the value of this input. What should could those be? boost adjustment by temp?

I am also looking at the routine at 68C. I am not sure about his one for now, Boost or knock thing.... I don't know for sure yet but it does use ADC #0 stored in 0x62 and a corrected value of ADC #1 stored in 0x6d.

Any good comment/info is greatly appreciated

Thanks

[ejfluhr]

OMG this thread is EPIC!! Best 3 hours spent than any TV watching I have done and most movies (Star Wars excepted).
Many years ago I learned from RDH's work disassembling the MAC-02 and tweaked myself some maps for my '82 Urquattro.
I've just now transplanted a stock AAN into said Urq and am doing some "light" reading on the Motronic to learn more about it.
I just wanted to offer my kudos to EVERYBODY who has posted, including but not limited to:
- Mr. Miyagi who amazingly and patiently helps but usually makes you wax-on/wax-off the car and paint-the-fence in the process
- The League of Extraordinary Gentlemen helping each other out with so many different ways of seeing/thinking/learning this system
- Mr. Energizer-Bunny/Don-Quixote providing comic relief with unstoppable and mind-boggling determination despite not grasping what NOP means (and I so cheered after the rev limiter video!)
- The Brave Noobs who post eagerly in their hopes, asking simple but good questions that help us other Noobs, don't take offense at the sometimes gruff treatment, and become Gentlemen in their own right
- The Participating Audience who occasionally root on the home team and highlight the immense awesomeness of this effort that has no real reason to exist but the joy of learning and helping each other

I started in the Audi online community with the quattro-list email group back in 1990 as a freshmen in college, and never imagined back then the grand global connection we all have now as evidenced in these 28 pages.

As the 034 Rip-chip went away, my brother and I just bought my father a plug-in VEMS for his '84 4Kq w/ 3B from Herr Marc, which has been great (the setup w/ COP & Marc's support).
I'll be watching to see how Prj's real-time-tunable daughterboard-ish setup works out.

Cheers to all! Eric

[kymi]

Perhaps I gave you too much info because you got the TPS input right. 5D holds the actual value. It's corrected with overboost into another ram location that is used for map axis. You seem to know those bigger boost control maps, so finding this shouldn't be a problem. You're also pretty close to figure out how the boost is controlled - like one 'heureka' away. I think you have all pieces of the puzzle in your hands, just go for it. And find that MAP sensor, it's the path to the heureka moment.

RPM is based directly on external interrupt and timer, no messing with adc there.

...and then there's the knock stuff...

[vincentroyc]

Hey PRJ and kymi,

Thanks for your answers.

PRJ I am just trying by myself to find out what are the analogs input coming in. By the nature of the boost/knock chip and it's name I would be ready to say that there should be at least these sensor readings coming in : TPS, Knock sensor 1, knock sensor 2 and MAP. To define the "demand" of the engine at a current state and be able to give feed back like N75 DC we have to have at least RPM too with TPS so I guess that the 2 big maps 16x10 which one of those is n75 DC should be RPMxTPS. Don't know about the other yet. But One thing : RPM is not a sensor the sensor is a crank position so I guess that RPM is not coming in by a ADCON channel it is calculated with the time passing between 2 crank round wich is probably that that is triggering the main external interupt (0) or another one. Any cue/hint/coment on all this and what i stated about the possible sensor input coming in?

kymi, ya thanks for the "let see if you can find those" I sure have seen many sensor input coming in and 2 of them are stored in RAM_xx which i guess one of them (5d) is the TPS if i recall some of -ice- earlier comments about this. It has actually been store in RAM_6c just before and this came from the b register value that was read from analog input #3 so this would be TPS if i am not mistaken.

So this is my progress about this and I am still trying to backtrace every analog inputs to try and know what they are but also and most of all how they are used for the map read.

On another hand I was wondering if you want to give feedback to the engine you need a way out too the only way out I see is through Port register does it make sense? I see P1, P3, P4, P5 and they are all initialized with a start value in the "program boot/reset" routine. I see feedback that should be given to N75 obviously but what else controls the engine and require feedback that the fuel/ignition doesn't already control?

Here is my state any comment/feedback/hint/ideas are greatly apreciated

Thanks

[Error404]

Where did you guys start when learning this stuff?

[kymi]

Hi vincentroyc,

It's great to see activity in this thread and new faces finding out stuff.

Here's 2 easy ones:
- MAP sensor. Find the map sensor plausibility diagnosis function defined by prj earlier in this thread.
- TPS sensor. Overboost corrected TPS value is used as an axis value for some maps.

After that it's pretty much easier to disassemble around the boost chip.

PS. I tried to leave some room for you to find out things. It's better to really know and understand the functionality if you're really aiming for the knowledge.

[prj]

What sensors do you need to know specifically?
Define some maps, you will know what is what from that mostly.

I can help with the obscure ones. Probably best if you ask about specific ram addresses.

[vincentroyc]

Ok so PRJ, kymi or -ice-, i found how the map lookup "table" in the boost chip is used and what maps are used from a corresponding read routine, I found the ADC reads and i am in the process of find which is used to read map tables and how the other are used. The thing is, i don't want you to tell me which ADC read is what but hint on how can I find which is what sensor input?

Because this is specific to the hardware implementation, right?

Also, a couple maps are visible if you search enough, but it semmed that not every one of them are used, am i correct? Are there duplicates?

Thanks

[vwnut8392]

I think you're a bit overcomplicating your needs. If you're unable to build the logic inside of the ecu, why not use some tiny external chip to suit your needs? For example with arduino nano you can easily create map switcher. When certain conditions (resistors, switches, speed, etc) are met it will do the map switching, without huge array of relays. And you can fit that "match box" easily behind the dash.

I have never done a single day of programming for living if you don't count some html back in the 90s. I see this ecu more as a programmed math device. After you know what goes in and what goes out, all you have left is pure math functions and comparing the values. And that's the way you can inject some code. For example really simple launch control: if speed=0, rev limit=x, ign map=y, fuel map=z.

Sorry, this is starting to go a little bit offtopic as we're not speaking modifications underneath the ecu cover.

i understand what your getting at. as for the ECU i understand what goes in and what goes out as for how and where it goes in and out is one of the problems in front of me. once the signals from sensors hit the main montronic connector thats the end of it for me as there is no schematic for the ECU. when i started tracing the board with high resolution pictures i was scolded and called stupid for doing that. for the math part well its never been my strong suit in general. as for off topic i started this thread a long time ago and i think we're still talking about the ECU just not on a super technical level like the yourself and others have been.

its still on my mind to just go buy another VEMS ECU for my S6 and be done with it. when i started the stock ECU adventure with my swapped 4000 quattro i figured the community would be more friendly and open about stock ECU tuning but i was waaayy off on that. so they lead me to just go buy VEMS for that car because i needed to upgrade injectors and i have no idea where the injector scalar is in the stock ECU let alone what the variable is that the injector scalar is based on. now that im on my last spare MAF on my S6 i fear finding another replacement later so migrating to VEMS for speed density and ease of being able to tune the car freely.

i was told PRJ was working on some sort of daughter board for the stock ECU that would allow a form of open source tuning but im not sure what happened to that project because i did have an interest in having one of those on my S6 vs VEMS. i know the old motronics are just as capable of not more capable of great things like old DSM, honda, etc ECU's but it totally baffles me as to how the old motronic ECU's never evolved like the japanese ECU's did in the tuning department. i have a friend with a 1G talon that's putting down 856whp to all 4 paws on a stock ECU with DSMlink V3. thats pretty impressive to me for a stock ECU thats modified.

[kymi]

I think you're a bit overcomplicating your needs. If you're unable to build the logic inside of the ecu, why not use some tiny external chip to suit your needs? For example with arduino nano you can easily create map switcher. When certain conditions (resistors, switches, speed, etc) are met it will do the map switching, without huge array of relays. And you can fit that "match box" easily behind the dash.

I have never done a single day of programming for living if you don't count some html back in the 90s. I see this ecu more as a programmed math device. After you know what goes in and what goes out, all you have left is pure math functions and comparing the values. And that's the way you can inject some code. For example really simple launch control: if speed=0, rev limit=x, ign map=y, fuel map=z.

Sorry, this is starting to go a little bit offtopic as we're not speaking modifications underneath the ecu cover.

[vwnut8392]

Ok, if that's the case. Why don't you use that same map for NLS? When launching you have revs limited lower and with NLS you're at normal rev limiter.

PS. It's not madness going on in the ECU.

at the current point im not using the stock clutch switch to enable/disable the launch control, im using the set button for cruise control to enable and disable it so i have the option for rolling launch control. the issue with the stock clutch switch is that it works backwards for starters so when the pedal is up the circuit is closed and when the pedal is down the circuit is open so im thinking i have to use a relay to flip the switching. as for the inputs between the ECU and the WOT BOX the ECU uses a ground to switch and the WOT BOX uses 12v to enable/disable. so i have the set button wired to complete the ground circuit to the ECU and a relay that switches on letting 12V to the signal wire on the WOT BOX at the same time.

now to incorporating the NLS into this is where its getting tricky because of how i have the LC wired in. if i just tie the clutch switch in to the circuit i'd have to be holding the set button in to enable either or feature and id lose rolling launch. so ultimately my idea was to add in another whole independent NLS circuit to start and make sure it was going to work right. i wanted to use the on/off switch on the cruise to to enable NLS but it turns out that the set button and the on/off switch are tied together and do not work independently from each other so i ruled that out as an option. over all i wanted to have an on/off switch wired in parallel to the clutch switch to make or break the circuit for daily driving. as for the flipping of the clutch switch i havnt figured that out yet but i know i can invert the signal in the WOT BOX so it would play nice with the clutch switch as is but for the ECU not so much.

all this relay nonsense is why i wanted to just add another independent circuit to start. i've been sick and sitting around over analyzing this whole thing really, i just need to get healthy and take a fresh look at this again from zero really.

The ECU may not be madness to you guys who do programming for a living but for us non programmers its japanese. trust me, i have tried to understand it but i just cant get my brain around it thus why im doing things like this to achieve the same things as you guys would do when patching custom code into the ECU. im just working with what i understand. if there was more real concrete documentation out there im sure i could understand the ECU better but there isnt so that leaves me out in the cold. i do understand that this ECU is an odd one compared to the rest of the motronics developed at its time thus the lack of documentation on it. i hope someday someone comes forward with a self published document atleast on the function of the ECU because it would be great to see more things happening like in the ME7 and up world because i know there's tons of potential in this ECU but it will never be unlocked or flourish with only a few people that have the knowledge of it.