NefMoto

I know it's some kind of Top Secret information but maybe someone could give me a hint how can I change tacho needle position?
I read FR and found the following variable:
NEngInd_nOpt anzeigeoptimierte Drehzahlanzeige die an den CAN verschickt wird
But seems this is not what I'm looking for. I've found only one reference and nop it. Nothing changed.

It is what you are looking for.

Thanks, gonna try it tomorrow one more time.

Seems it's not. I changed it to 0x7FFF and still nothing. Tacho works as always.

AFAIR it depends on ECU configuration, not every ECU sends it over CAN to the cluster.

But somehow Tacho shows RPM...

On many tachos it reads message 1 and gets the RPM from there.
You can change it of course but then every module on the car sees the wrong RPM so you get a lot of warning lights if you try to do it like that.

I see, thanks. I've just tried to zero Epm_nEngRaw Rohdrehzahl f¨ur OBD Tester and now diagnostic tool shows 0. Tacho shows RPM just fine.

Diagnostic tool is irrelevant, open the FR and look what goes into Engine 1. You need to patch it on CAN level.

On some Bosch ecu’s it may be a better idea to modify the value before it goes to the message buffer (if it indeed has one in your case) rather than directly trying to modify the tach signal variable. So intercept it before it writes to the buffer with your register. This may still cause issues though as your sending a modified CAN message that other modules may be dependent on.

Still a noob on the subject though so take my advice with a pinch of salt.

As I understand the variable is called Epm_nEng.
CAN ID is 0x280 but I believe it's only for TP20.

TP2.0 has nothing whatsoever to do with inter-module communication.
The more you write the more it seems you have absolutely no idea what you are doing. All the information is already in this thread, no more empty talk is required.

MED17 UDS has no 0x280 ID, MED17 TP20 has.

If I had idea I wouldn't ask.

Again UDS and TP2.0 does not have anything to do with it.
CAN ID is also not important. Try to read what was written to you, by people who did what you are trying a long long time ago.

How i did it on my ME17.

Monitor canbus messages, change rpm and find the value that changes directly inline with engine RPM, now search for that message ID in the disassembly. Heres how my canbus messages work, and you can see D0003425-D000342B are 0x-1 or 0xFF. Once you find the one that sends the RPM, you now know you need to modify that one.

I would find the function that writes to the rpm parameter, change the store to a call/jump to your own small piece of code that outputs a value depending on if you want your rpm to display or the engine rpm to display. then return it as normal (if that made sense).

See below for my canbus message generation and the actual canbus message on my ecm. D0003424-D000342B contain the 8 bytes for the message with ID D5 (at the bottom). Only the first byte of this message contains anything, the rest are just 0xFF. This also allows me to add my own monitored values via canbus if i need to, just overwrite one of the unused byte positions.

(https://i.postimg.cc/rmj0grrR/Capture.png)
(https://i.postimg.cc/8z7R5trK/Capture.png)

Thank you for the honest answer! Could you please attach original file?

Sure. Its a SxS, not an on road vehicle so it probably wont be much help.
https://easyupload.io/ik1bhh

ENG01 message contains RPM as prj wrote. I patched the message and everything works fine. Unlike ME7, MED17 has no oil pressure warning.
Thanks for the help

I trying to do the same you did, are you sure ENG01? from FR ENG01 is CAN ID = 80h, maybe you meant ENG1?
i reading the FR and looks like the can messages sends from FRMAPPL_STD_ENG function, also ENGECU_ENG10MS ENGECU_ENG20MS ENGECU_ENG100MS is related to CAN ID 280h(if i correct).
i found some reference to a RAM variable that sends to 280h but only Epm_nEng is missing, what i missing?
if someone can give some idea/tips that will helpfully for learning.
thanks