TunerPro User Forum

olafu

I think the ECU mirrors the transfer functions and the table of tables to the RAM on startup and then reads them from the RAM. The ECU can only directly access data in the 0x0000-0x2000 range and to get it there it needs to perform several OPs, if the data is already in the external RAM section the...

olafu

I totally see now the first two cells being it's own reference address. The MAF has it too...that's really crazy to me.. I don't exactly know what ECU does with those own reference addresses. I think it never reads them, because it seems that ecu will work fine with anything written in those first ...

olafu

One more request? Any way to pull apart the transfer functions and thresholds between D4C8-D598? I recognize the 32x1 TPS transfer function @ D4F8 Also the Idle - PT and PT-WOT thresholds @ D53C & D540 The rest I don't have the ability to identify. Did you found RPM axis for those IDLE/PT PT/WO...

olafu

I think they can be CEL blink codes. Must to check... EDIT: They are blink codes. (pedal test - 5 times accelerator floor and CEL will blink the fault codes). Tested: all values 0 = only long flashes occurs between fault codes. all values 1 = long - short - short - short - short all values F = long,...

olafu

413 Red: 413 red with 623 bin: D002 - Start of table code - Also it seems to tell checksum starting point, with -2 offset? I did some tests, and it seems to act like this. D106 - DTC's on/off D28E - MAF table w/ header E67E - Table of Tables E7B2 - End of table code - Also tells checksum location a...

olafu

Ardustim is Arduino based crank and cam trigger signal generator. I i was understood right, it can produce only square wave output. But Motronic runs also with square wave, because it's zero crossing sensitive. It's one possible way :) Actually those ECU's will run with such ugly-looking crank signa...

olafu

For such a simple steup it's certainly provided some good data. Are you not finding that you have every DTC code under the sun stored in the memory? I have found a few more things so I am adding them to the excel file at the moment. Also discovered how to make a little text popup appear when you cl...

olafu

I will check those injection timing tables (which are known as "vanos dwell tables" in 623 XDF in site :evil:) at next. My test bench is based by looping crank sensor sound file played from computer soundcard in different speeds, but cam signal is bluffed by hooking a cam sensor signal wir...

olafu

Scalar names was crossed between "high" and "low" in TPS DTC trigger. Uploaded new XDF to dropbox.

olafu

https://www.dropbox.com/s/2ilbupogqs7hequ/idle_part_full_and_DTCs.xdf?dl=0 Some DTC triggering/limp stuff and Idle/PL/FL thresholds for 506/965 BIN. Mined from 413/623 bin and offset corrected to 506/965 . Need to be test in a car. Let me know if there is something wrong. Testing at your own risk, o...

olafu

Your right, any undefined space needs to be filed or the file size will not be correct and obviously everything would be in the wrong place as there would be nothing taking up the free space. Its just a question of how the ECU treats an FF value, possible it just disregards it, which is why FF need...

olafu

Edit - Intel manual says FF is the opcode for reset on these microcontrollers? I don't know about programming, but, in my opinion it's good to fill any "undefined" data areas with "FF" because if CPU program counter ever points opcodes from data tables or blank memory area, it's...

olafu

https://www.dropbox.com/s/7uj39x9h2581f ... 3.xdf?dl=0 <- new. still, for experimental use and at your own risk. Not tested in a car by myself.

olafu

Setting load threshold to 255 will reduce advance for some reason. Try 254, by setting it 0 knock control is always on... I was finding a flag from D000-> to disable knock control but haven't luck. O2 flag is D00A on the 413 and D00B on the 506, it should be the same on both? So wich one is the the ...

olafu

Right, that clears why that axis data was 16 and tables 32. Thanks! EDIT: Yes, thats right, they are actually 16x2 D0xD5. Now they looks more logical. :) EDIT2: Experimentally i tried to run 413 DME with BIN from 404 DME, it runs, and when i checked ignition drivers with scopemeter, there was contro...

olafu

And more knock stuff again. 0xE4F2 10x1 table: Knock window size in crank degrees. x*2.855.?

And 0xE4B8 10x2 D0xD5 - Knock window start timing. TDC is about 26(dec)..?

olafu

MAF table is pure conversion function to convert MAF volts to a MASS AIR.

olafu

More knock stuff found. Here is XDF for testing, use at your own risk. https://www.dropbox.com/s/cfylzxjtg09r2pe/knock_control_413_623.xdf?dl=0 No checksums or anything else. Tested with 413/623 with simulated input signals. Use +12(dec) offset to 506/965. EDIT:better version. Old version deleted. h...

olafu

There are rpm dependent 32x1 knock threshold (or nominal engine noise) curves for every cylinder. In total 8 curves, but 2 of them are not in use. They starts from 0xE550 in 506/965BIN and all curves are in a row without any descriptors. I did 32x6 XDF Table for that, must set to "Column" ...

olafu

Are you using charge cooler with your blower? And where your MAF locates? Bypass or blow out valves? Your symptoms looks like there is BOV installed, and blower blows out part of the metered air . -> less air goes through than MAF tells to ECU -> VERY rich. If you have scanner, look what's the realt...

olafu

Tried to catch running parts of software/bin with that. Seems to fit with IDA output...

olafu

Like that: http://ibb.co/kWeddk

It draws almost immediatelly graph look like this. Then it's colors partly other 16 bit cells, but if either byte of 16 bit address is read, i think it means whole address it is read at least once.

olafu

Tools -> Hardware utility -> Address watch utility. ( CTRL- W ) in TunerPro.

olafu

I tried that with 413/623 dme, tracing area was set from E680 to E7AF and fitted to match with "Map address table". It ends on E7AA, but i thik it's better to see like this. That seems to indicate quite clearly what maps are in use or not in use... Picture below is edited with Paint to fit...

olafu

Nice to see you have problem solved

You only need a big sauna to go, take dyno and car with you and tune

I don't know why that correction map is filled with 80H in 413 dme.

olafu

My assembly or any other programming skills are about zero, but i was thinked many times, how powerful tool some kind counter can be, which is counting how many times ecu reads some rom addresses when using an emulator. If those counter values can be align on to the ROM dump in hex editor, coloring ...

olafu

I also used that 0xD7E5 8x5 map as multi purpose measurement tool, by rescaling it to style like this https://ibb.co/gOJAdk - and watch it by Tracing. By changing descriptors is possible to view what these descriptors/variables do. Map data is still 80H so there's no correction at any case. FF's in ...

olafu

What BIN number you are using? I did some research about that at last year with 623 BIN. Unfortunately seems like there is no IAT correction for TPS based "Alpha-N" limp map. BUT there is somekind "knock prevention map" or something at E044. It is air temp and engine coolant temp...

olafu

I tried to change other bits, but i can't certainly say what they are. In some combination there was no ignition angle control. Advance was fixed -8 degrees. I never get this act like that again. Once i noticed there is one bit to force PT ignition map use on idle, but i don't know why and what else...

olafu

Hi! I have propably found a some kind of version coding bit, or something like that. In address 0xD00B bit2 is "1" in default. When it is turned to "0", there are no closed loop active, and no control of evap valve. Also, there is no DTC:s stored from lambda or canister valve, if...

olafu

Hi! We have strange problem with M50B25 -413. Rev limit is raised to 7400, and when we run it on ~7000rpm few seconds (for example sliding at long gentle curve on ice track, or long straight) afr goes suddenly very lean, like 17:1 or leaner, and power is lost. Then it goes back to 13:1, when revs wa...

olafu

Hi! I did some research with those -413 623 vanos actuator dwell tables. I think they have nothing to do with vanos control: I filled experimentally all four tables first with 0, then 128 and finally 255 - nothing changes in vanos control, but they have something to do with throttle response. With 0...

olafu

For example 14.7kg air and 1kg fuel induces 14.7:1 AFR.
Best power comes about 12.5-13 AFR, if using gasoline.
If your AFR gauge shows 19.00+ AFR and engine still runs, your AFR gauge fails, or your engine misfiring, when unused oxygen gets in exhaust. Unused oxygen causes error to AFR calculation.

olafu

I think CC is TPS, because it is used in MAF fault table. By the way, what that "vanos dwell table" actually means? I did some research with 2channel scopemeter and manually switching vanos valve on and off.. There is lots of oil temp and pressure related lag in vanos travel, and i think t...

olafu

Is that Miller chip just designed to emulate EPROM? In your case i would try to put that miller chip in to a eprom reader... But in your own risk to blow it in smoke. And if it is possible and you succeed to have a BIN out from that chip, and it works in ordinary eprom, it could be hard to modify it...

olafu

Hi! Have anyone a list of 3.3.1 map axis descriptors? I already have some: D0 = RPM D2 = RPM negative delta? D3 = Intake air temp D5 = Load, filtered D6 = Load, unfiltered D7 = Coolant temp D8 = B+ voltage CC = Throttle position Is these correct? At least chip number 609, 623 and 965 seems share sim...

TunerPro User Forum

Search found 186 matches

413 red label -623 lambda and charcoal canister disable

M50B25 -413 red label AFR surging at high rpm?solved

BMW -413 DME Axis descriptors?

Search found 186 matches

413 red label -623 lambda and charcoal canister disable

M50B25 -413 red label AFR surging at high rpm?*solved*

BMW -413 DME Axis descriptors?

M50B25 -413 red label AFR surging at high rpm?solved