NefMoto > Technical > Tuning > Any hints to find Nm limiter in Aisin AL1000 gearboxes?
Pages: [1]
« previous next »
Author Topic: Any hints to find Nm limiter in Aisin AL1000 gearboxes?  (Read 5020 times)
k0mpresd
Hero Member
*****

Karma: +146/-54
Offline Offline

Posts: 1655
« on: February 07, 2016, 11:58:07 AM »
anyone have tips to finding Nm limiters or other helpful maps in Aisin AL1000 gearbox?

attached data portion from frf file > bin.

regards.
Logged
cherry
Full Member
***

Karma: +25/-2
Offline Offline

Posts: 247
« Reply #1 on: January 03, 2021, 05:00:30 PM »
Old thread, but does anyone know what is the torque limit from AL1000 0C8927750H 1885? It´s for 2012 Touareg with CASA engine 176kw 550NM. Attached Winols FRF -> BIN file, it´s data part only.
Logged
cherry
Full Member
***

Karma: +25/-2
Offline Offline

Posts: 247
« Reply #2 on: January 03, 2021, 09:17:11 PM »
In fact blocks in FRF for these TCU are not crypted, so it "should" be possible to modify FRF/ODX, calculate checksum (OLS817) and flash it with standard tools.

Does anyone know if these tcu have some kind of protection / RSA which tuning tools bypass before writing calibration? TCU is outside from gearbox and very cheap at ebay. Someone knows what is inside?
Logged
cherry
Full Member
***

Karma: +25/-2
Offline Offline

Posts: 247
« Reply #3 on: January 20, 2021, 11:37:42 AM »
If anyone needs pinout for table test...
« Last Edit: January 20, 2021, 11:40:57 AM by cherry » Logged
cherry
Full Member
***

Karma: +25/-2
Offline Offline

Posts: 247
« Reply #4 on: October 29, 2021, 02:43:30 PM »
Since i was asked in PM about these tcu controllers. There is a SH7058 in AL750 and SH7059 in AL1000. SH7058 can be read even with some Fgtech clone or i think with some other clone tools for these mcu. I bought xprog from eldb with authorization for these Renesas SuperH: http://www.eldb.eu/index.php?route=product/product&path=35&product_id=87 There is also a pinout online for AL750. To make it short, it was waste of money, support is not existant, i think SH7059 will never work. Anyway SGO from AL750 (some does not exist, e.g. the Q7 BTR from a friend) and FRF from AL1000 can be unpacked straight forward since they are not compressed or crypted, checksum can be done with OLS817. Signing from SGO / ODX is also no problem because it´s only the checksum result. Some newer AL1000 tcu has compressed FRF, this will make it a little bit more complicated. Anyway did not found informations about AISIN maps, my friend lost his driver license, so for now i canceled this...
Logged
kpematop
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 8
« Reply #5 on: August 09, 2022, 06:00:56 AM »
Does anyone has damos for 0C8/AL1000?
Many cables supports now virtual read/writing but no good damos ...
Logged
cstl3722
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 1
« Reply #6 on: Yesterday at 07:31:54 PM »
Quote from: cherry on October 29, 2021, 02:43:30 PM
Since i was asked in PM about these tcu controllers. There is a SH7058 in AL750 and SH7059 in AL1000. SH7058 can be read even with some Fgtech clone or i think with some other clone tools for these mcu. I bought xprog from eldb with authorization for these Renesas SuperH: http://www.eldb.eu/index.php?route=product/product&path=35&product_id=87 There is also a pinout online for AL750. To make it short, it was waste of money, support is not existant, i think SH7059 will never work. Anyway SGO from AL750 (some does not exist, e.g. the Q7 BTR from a friend) and FRF from AL1000 can be unpacked straight forward since they are not compressed or crypted, checksum can be done with OLS817. Signing from SGO / ODX is also no problem because it´s only the checksum result. Some newer AL1000 tcu has compressed FRF, this will make it a little bit more complicated. Anyway did not found informations about AISIN maps, my friend lost his driver license, so for now i canceled this...

On a decoded AL1000 FRF does someone know how to figure the start address of each datablock ? In this case we have 01 and 02 as SOURCE-START-ADDRESS

         
Code:
<DATABLOCKS>
            <DATABLOCK ID="EMEM_0C8927750CF3376.DB_0ERASEDATA" TYPE="ERASE">
              <SHORT-NAME>DB_0ERASEDATA</SHORT-NAME>
              <LONG-NAME>0 ERASE DATA</LONG-NAME>
              <FLASHDATA-REF ID-REF="EMEM_0C8927750CF3376.FD_0ERASEDATA"/>
              <SEGMENTS>
                <SEGMENT ID="EMEM_0C8927750CF3376.DB_0ERASEDATA.SEG_0ERASEDATA">
                  <SHORT-NAME>SEG_0ERASEDATA</SHORT-NAME>
                  <LONG-NAME>0 ERASE DATA</LONG-NAME>
                  <SOURCE-START-ADDRESS>01</SOURCE-START-ADDRESS>
                  <UNCOMPRESSED-SIZE>1048576</UNCOMPRESSED-SIZE>
                </SEGMENT>
              </SEGMENTS>
            </DATABLOCK>
Logged
IamwhoIam
Hero Member
*****

Karma: +46/-101
Offline Offline

Posts: 1042
« Reply #7 on: Today at 12:21:20 AM »
I'm sure the god Laborde will soon chime on here to try to sell you a map pack that contains no torque limiters LOL
Logged
I have no logs because I have a boost gauge (makes things easier)
Pages: [1]
  Print  
« previous next »
 
Jump to:  

Navigation
Personal Tools
  • May 14, 2024, 10:36:50 AM
  • Welcome, Guest. Please login or register.
    Did you miss your activation email?

    Login with username, password and session length
Search
 
Advanced Search
About Disclaimer
All Rights Reserved 2010 Nefarious Motosports
Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.023 seconds with 18 queries. (Pretty URLs adds 0s, 0q)