NefMoto

at first, thanks a lot for the big bunch of information here in and
of course for the forum itself. Really great stuff on many different areas.

Probably some of the "reverse-engineers" might be able to help:
analyzing the code of ME7.1 images, I found that there is a second device
besides the eeprom, which is also connected to the SSC (sync serial intf) of the CPU.
This device gets selected via the CS4\ pin and exchanges messages with the CPU
consisting of 96 x 16bit words, the last word is checksum of the previous words.

Could it have something to do with the second CPU on ME7.1? On ME7.5
there's only the eeprom connected to SSC. I have neither a physical ME7.1 nor
any circuit diagrams to verify. So anybody has an idea what's this device?

While reverse engineering my 2001 S4 ECU I found that the serial eprom and the second CPU were both on the SSC bus. I have not taken the time to determine what the second CPU is doing. I know that it only has internal ROM, and is not connected to the external RAM or flash memory. My guess is that it is a watch dog for the main CPU.

This may also be a second CPU for ETC monitoring. Normally keeps an eye on basic driver inputs and key sensors for a load estimation and can take control of the electronic throttle for safety.

thanks for the answers, helps a lot to save the time digging into wrong direction.
Just for curiosity: has anybody ever read out the internal ROM of the second CPU?
Shure that reading would not work straightforward and most probably need some
HW-modification ...

Does anyone have a handle on where the knock sensor input signal goes?, other ECUs I've worked on used a DSP to transform the knock signal before doing a DMA type transfer to memory for the main CPU.

which ram addresses do the 96 words get written?

You can read out the internal ROM in boot mode. But you need to use a real tool for boot mode like Minimon to do it.

I think knock voltages are processed by a separate Bosch-IC.
For the ME7.5, this is most probably the CC650 as stated by Camden
in http://nefmoto.com/wiki/index.php?title=Reverse_Engineering_ME7.5

The SSC data buffer is located in XRAM at E42E. PECC-Transfer is used
to send/receive from/into this buffer (sent via PECC0 and received via PECC4).

To use the boot mode/minimon, the async serial line would needed. Probably you have
first to connect the RX/TX pins of the second CPU manually to some line driver to
make boot mode working  :(.

For the main CPU you can read the internal ROM through the K-line interface. For the secondary CPU, I soldered some wires to the TX/RX lines of the CPU and then ran that through a max232 to convert TTL to RS232.

:)  impressive work with the iron!

Are you willing to post the binary?

I think I used some 25 gauge wire to make the connections. It was a couple years ago when I was figuring out the ECU circuitry. I attached the two files I have from the second processors internal ROM. One is from my 2001.5 Audi S4, and the other is from an Audi A6. I think the memory range 0 to 7FFF is the total range of the internal ROM for this CPU.

 :D wow, is there anything you have not already done with these ECUs Tony?

The A6 rom looks at first glance like a standard bootrom with ercos kernel,
but its a version 05.32 which I not saw before (saw 05.12, 06.02, and 06.05 up to now).

The S4 rom is different and will need a closer look ...

I haven't finished tuning my own car, or actually finished an ECU tuning product yet.  ::)

Not to mention I seem to incapable of replying to all my emails, or adding useful info to the wiki.  :P

It's nice to finally find some people that know what ERCOS is. You guys are pretty good at hiding.

One thing I haven't done is figured out the code that sends and receives messages over the CAN bus. I would like to do that one day...

Oh yes, about the motor CAN there is not much information flowing around. From code
inspection it is very hard to find out which IDs contain which kind of information and how
the 8 data bytes in each CAN message are used.
But for tuning there is not much you can do with the CAN if you have one of the older ECUs.
Better to spend the energy on tools using the K-Line ...

There is a LOT of very good information flowing around...IAT, boost, HFM, clutch switch, rpm, coolant temp, asr status, signed rpm derivative, torque before reduction, torque after external reduction request and also a lot more than I can remember off the top of my head...and its flowing at 500 kbytes/s

My interest in the CAN bus is to figure out the information being sent around for traction control, and the display on the instrument cluster.

It is broadcast, basically the torque "allowed" by ASR, or whatever is the min of torque demands.

When I was looking around some time ago, the IDs and data formats used on the
motor CAN were always a big mystery. Would be glad to get some link to good information.

On ME7.5 ECU I saw the following IDs (always 11bit standard IDs used):
Receiving: 011 (immo), 050, 0C2 (steering angle), 1A0 (brakes), 200, 21F,
               320 (instruments), 420, 440 (gearbox), 520, 540, 5E0
Transmitting: 010 (immo), 201, 280, 288, 380, 38A (cpu-time?), 480, 488, 580, 588
The bus running with 500kbaud leaves about 340kbaud for information when
taking into account the protocol overhead. And it is shared between all the devices on
the bus, but still quite good compared to 125kbaud on K-line...

The only info I have on the VAG CAN bus are posted in these two documents:
http://www.nefariousmotorsports.com/forum/index.php?topic=236
http://www.nefariousmotorsports.com/forum/index.php?topic=226

thanks for the docs, they give a good general overview of CAN and diagnostics over CAN.
Still no idea where good information is available about IDs and formats used to
transfer information like ASR state, rpm, whatever.
But fortunately there are more interesting areas of investigation besides the CAN topic ...

To give a short result summary for this thread, here is what can be revealed from
the bootrom of the 2nd CPU on ME7.1 of the S4, that Tony extracted:

The 2nd CPU is just a slave I/O extension unit for the main CPU, no higher sophisticated functions are
included in the slave CPU. Data is exchanged between the two CPUs via the SSC in packets of 96 words.
The main CPU can set many hardware registers of the slave (e.g. for port directions, capcom's,
pwm's, adc's, asc) via a configuration message.  Then data messages are exchanged to make use of the I/O
functionality in the slave CPU.
During normal operation, the main CPU reads the values of input ports, ADCs and CAPCOMs of the slave CPU
and sends output port values & PWM data via the message exchange on SSC each 10ms.

There are over 10 digital input signals, the two EGT sensors, many (>10) analogue signals,
and about 20 digital output signals connected to the slave CPU.
Also, the control interface of the knock control IC (most probably the CC195) is connected to the slave.
For the analog knock voltage signal I'm not shure wether it is connected directly to the main CPU or the slave.
And the slave CPU has sensor signal G79 connected to its ADC, the main CPU reads this value and compares against its own ADC value thereby performing ETC monitoring.

Awesome work, thanks for posting what you found out.