Modifying Motronic 2.3.2 ECU hardware and software.

[Ur20V]

Yeah, Marc's is definitely modified and soldered to its own custom PCB. The one in the photo I linked to appears to be a bare sensor (with its useless 5 extra legs clipped off).

Here's a bare Freescale 4 bar sensor for reference:

[prj]

I don't clip anything, it's just focused on the ECU board and not on the sensor itself.

[kaross]

Can anyone identify the MAP sensor in this photo?

http://gm.mainframe.no/pics/mapsensor.jpg

Is it simply a Freescale 6300 or 6400?

You can't identify it. They are 100% equal. only numbers on them differ, but these are from other side.

Why do you want to know which exactly it is?

for example Freescale 6400.

[-ice-]

Hallo,

my name is Daniel and I come from germany. I drive a black UrS4 AAN 2.2t.

I try to unterstand the code which is running on the "fuel/timing" chip and i have some questions

My ecu is type 551AA...
There is the map address-table which contains the addresses of the different maps. The maps aren't called by their static memory addresses. There is a "map-reading" procedure which gets the table address in form of two (four) variables. For the address I think it's 0x75:0x76 in my code.
There are several code parts where these variables are loaded with static values. These point to region near to 0x8800 where the address table is. So i think i'm not totally wrong.
I try to found out, why and when the ecu uses which tables. I'm stuck at this point an decided to buy an eprom simulator soon. My plan is to modify the vag-com uart routines. For example to modify the part where it puts descriptor 0x3A in the serial buffer sbuf. Maybe i can give out the curent map indexes this way. To those who have done it already, is this a good plan? Or is there an easier way?
I also have a question about the general behavior of the code. I think there must be a main loop (beside some interrupts). Does anybody know where it is or has hints to find it? I saw some code which calls many subroutines after another. Mabye that's a main loop?

Greetings and sorry for my not so good english skills!

[prj]

Main loop is painfully obvious, there's one that's run with ignition on, and one during normal operation.

I don't see what you want to do with descriptors... the table access is pretty simple, 77/78 contain base location for the index table, R2 contains the offset for the given map from 77/78. 75/76 contain the base offset in the map table. The value from 77/78+R2 is read, if it's odd, it's a 3D map, and 1 is subtracted from the value, if the value is even it's a 2D map. After that the value is added to 75/76 and that's where the map is read from.

The map read routine in the boost/knock chip will do your head in though. But good idea to start with fuel/ign chip as it's like all other Motronic of that era

Glad some people digging in IDA for a change. Pleasant difference from the "give me everything for free right now" attitude.

[-ice-]

Thank you prj,

i will simulate the read routine with some test data to make it clearer to me.

I would like to modify the serial communication to vag com. Instead of sending f.e. rpm, the ecu should send the content of a specific variable (not the axis decriptor ). I think its a better way to "trace" specific data. I don't have the emulator yet (..ordered ostrich). I don't know if its fast enough to trace every change of data. I can imagine it jumps fast from address to address while tracing and you can't really find what you were looking for.
I have to look closer at the serial communication. I think i have roughly identified the initialisation, where it send's the partnumberstrings, puts data in the buffer... But to modfiy it i think i need a "live" communication to learn how it works.

It cost's very much time to understand this bit by bit. You can't demand to get "everything for free"

I have heard of this extraordinary boost chip

Bye

[prj]

I just dropped the whole comms layer of the ECU and wrote my own from scratch.
I started also by modifying, but it's too slow.

Right now I am using 187500 baud and I get around 30 variables out of the ECU 15 times per second.
This includes knock retard for each cylinder, N75 duty cycle and so on

Having the two processors work in tandem and not fight each other takes some doing. Also timing the data so it does not overload the ecu or clip is more work.

Start with emulator and bench setup. Connect 24, 27, 18, 13 and 55 and the ECU will be running. Then you can start experimenting.

[prj]

P.S. The map read routine - all you need to know I already wrote. Well there are some small details such as two routines - one with interpolation, one without.

And you are correct, tracing is pretty useless. Data logging is the way to go.
I have tracing setup in tunerpro via ALDL, so I can trace all maps at the same time and precisely.

I must take a video of it in action, but it is very useful for dyno tuning or when you are tuning on the road in the passenger seat.

[vwnut8392]

Its been a while since i've posted in this thread but i found some time work with my cars some more and come up with a little more info. basically i stumbled across some old tuned chips that are a stage 1 tune and through comparison i can now see what is all involved in creating a stage 1 file. mind you stage 1 is running on the stock 250KPa map sensor and with minor modifications to the engine like having an exhaust and an free flowing intake for starters.

Now im working with the 551AA ECU that came in the URS4/URS6 so if your using any other part number ECU the maps will be offset differently but they are there.

I'll start with the timing/fuel board chip.

The first map that needs to be modified is the fuel map also known as the lambda control map. in the case of of my 551AA ECU the start of that map can be found at 0X8DEA and is a 16X16 map. its axis is 0X3A and 0X3F. i know 3A is the RPM scale but i forget what 3F is, sorry. anyhow here is a screen shot of the modified map overlayed on the stock map. the black wireframe is stock and the red is the modified stage 1 file.
It seems to be backwards on the 3D view as the stock file looks richer than the modified file.


This is the 2D map showing only what has changed. as you can see at the right side of the map there are positive numbers that show an increase in that range.



Next is the ignition mapping. now if you've made it this far you should already know that there are atleast 8 fuel maps and those maps are referenced based of fuel quality.
in the case of stage 1 or any stage for that matter you only need to modify one of these timing maps. now you can make all of the timing maps identical but doing that creates a margin for error or as i like to say your engine will make boom boom. The map that will be modifed in the 551AA file will be at offset 0X9224, its a 16X16 map as well and it uses the 0X3A and 0X3F for its axis. here is a 3D screen shot of the 3D fuel map with the stock map being in black wireframe and the modifed being in red.


The last part i found to be modified is the rev limiter. that is a 5X1 map that is located at 0x8CBF. here is a screen shot of the rev limiter. black is stock and the red is the modifed version.



Next is the boost chip. remember to be able to use a modified chip you must have the odd ball 27C257 chip or the latch adapter board from boostbutton.com to allow you to use the more common 27C256/SST27SF256 chips. anyhow i dont know horribly much about the boost chip but i will elaborate on what i feel is right. also keep in mind the chip doubles itself so you have to modify 2 maps and make them identical, this includes the checksum which i covered how to correct eariler in this thread.

The first map is the boost pressure map. they are located at 0X2520 and 0X6520, they are both 16X10 maps. i figured out that one axis is RPM but im not sure what the other is so bear with me. here is a screen shot of the map, black is the stock map and red is the modified.


The next map i think is the N75 pulsewidth, correct me if im wrong. these maps are located at 0X2480 and 0X6480. they are 16X10 maps. the axis of these maps and the actual values of these maps i do not know so if you know please feel free to fill in the blanks. here's the screen shot of this map.


now there's the max boost pressure map. this is the map that you dont want your boost to go over or the car will fuel cut and go into limp mode. these are 8X1 maps and there located at 0X29F5 and 0X69F5. here's a screen shot of both maps over each other.


Now the last bit of maps on the boost chip im not sure at all what they do, im still trying to figure them out. here is a screen shot of them in binary form.
Stock file



Modified file



Well thats all i have for now. i felt the need to share so here's some more of my findings. if anyone would like to elaborate on the unknown's or correct info that i have wrong here please do. im not looking for criticism im here to give to the community what i know. i feel every little bit helps.

[prj]

1. Boost/knock controller will never ever cause fuel cut.
2. 5x1 is not RPM limit.
3. Leaning out top end while adding more boost = recipe for disaster.
4. Only two IGN maps are used at any given time, rest is variant coding via coding plug.
5. There is only one part throttle fuel correction map.
6. Boost chip is stacked twice. There is never any need to modify both halves, unless you do things with A15.

[vwnut8392]

yup. 3/4 of this information does me no good. what happens when i tighten down the gate spring and go over the boost mapping because its like the ECU kills the fuel pump relay for a second, 5X1 is not rev limit? well than im clueless as to what it is, just took a shot in the dark, i do understand the coding plug now as its comparable to what is done in some porsche ECU's as to what market the car was sold in, tried to only edit half of a boost chip and my car threw a fit and wouldnt run, checksum was correct on both chips so i copy and paste what i did of the first half to the second half jsut to be safe and for A15 i have no idea what your talking about.

1. Boost/knock controller will never ever cause fuel cut.
2. 5x1 is not RPM limit.
3. Leaning out top end while adding more boost = recipe for disaster.
4. Only two IGN maps are used at any given time, rest is variant coding via coding plug.
5. There is only one part throttle fuel correction map.
6. Boost chip is stacked twice. There is never any need to modify both halves, unless you do things with A15.

[prj]

Boost/knock chip has nothing to do with it cutting fuel. It has no concept of injectors, so how can it cut fuel - that's right, it can't.
A15 - If you ever take a look at the datasheets of some of the components in the ECU, you will know what it is.
As to your description of editing one half and not editing other and it not running - you messed something else up when you did that. Runs just fine that way.

[vwnut8392]

i cant locate any data sheets on this ECU, searched high and low and i keep coming up empty handed so developing a full understanding of A15 for me is a far cry. when i said fuel cut i mean by the ECU shutting down the fuel pump relay as it has full control of it. i fought with getting the fuel pump relay to power up properly with my last AAN swap. i realized it the type 85 fuse box is missing a pin needed to make the swap easy and allow the fuel pump to act as the factory intended so i ended up using a fuse box from a 1993 audi 90 that had all of the provisions i needed for the AAN swap and was still plug and play with all of the 84 4000's connectors.

[prj]

i cant locate any data sheets on this ECU, searched high and low and i keep coming up empty handed so developing a full understanding of A15 for me is a far cry. when i said fuel cut i mean by the ECU shutting down the fuel pump relay as it has full control of it. i fought with getting the fuel pump relay to power up properly with my last AAN swap. i realized it the type 85 fuse box is missing a pin needed to make the swap easy and allow the fuel pump to act as the factory intended so i ended up using a fuse box from a 1993 audi 90 that had all of the provisions i needed for the AAN swap and was still plug and play with all of the 84 4000's connectors.

1. Look at the 87c257 datasheet.
2. ECU never shuts the fuel pump relay unless RPM falls below 13.

[vwnut8392]

been trying to figure out a way to run a manual boost controller on my car now i seen theres a way to piggy back it on with the N75 but i dont like that idea. i think if i could find the proper maps in the boost chip i could just FF them and run it straight up on a manual boost controller. any hints on what i do to make this possible?