NefMoto

Hi guys,

here is a way to create your own measurement blocks in a VAG ME7.x
With this know how you can implement any of the 754 RAM variables out of the table at page 1555, from the Bosch ME7.1 function sheet (Funktionsrahmen) document.
So you can read all this values with a standard diagnostic tool.

It is tested and works fine.

(http://www10.pic-upload.de/02.08.12/sj4flburxrud.jpg) (http://www.pic-upload.de/view-15415621/20120802_134503.jpg.html)

I know that we have Setzi62`s "ME7logger" and Tony`s "NefMoto Flasher Logger", but this is an option for all users who want to work with
VAGCOM, VCDS, VAG1541, VAS or other diagnostic workshop tools.

Additional this is another piece of the ME7 jigsaw to understand how it works.

As an example you can upgrade your ECU software and compile a set of values you want to measure.

There is a 16bit LoHi table stored in flash that do this.

In the RS4 8D0907551K/Q software, the table starts at hex 1D7D2.
The 551M table is very close to the 551K/Q and starts at hex 1CF10.

To find this table in 8bit mode, you must search for the following hex values:   "50 00 02 00 0E 00 07 00 87 00 13 00 1C 00 1D 00 1F 00 20 00"
If you are searching in 16bit LoHi mode, search for   "0050 0002 000E 0007 0087 0013 001C 001D 001F 0020"
These values are the first 10 values of measurement block 000.

Measurement block 000 is the only exception that has 10 values.
All the other blocks from 001 till 255 have always 4 measurement values.

There are many empty "0" blocks, where you can implement your own data.

The order of the measurement blocks in flash are:

Block 000 [starts at hex 1D7D2 (1CF10 in 551M) with the exception of 10 values (16bit LoHi) in this block!]

Blocks 001 - 019 [starts at hex 1D7E6 (1CF24 in 551M) with 4 values (16bit LoHi) of each block]
Blocks 100 - 139 [starts at hex 1D87E (1CFBC in 551M) with 4 values (16bit LoHi) of each block]

Blocks 140 - 199 [are missing or can`t be identified by me, by comparing flash values with the ME7 function sheet table]

Blocks 020 - 029 [starts at hex 1DADE (1D21C in 551M) with 4 values (16bit LoHi) of each block]
Blocks 200 - 255 [starts at hex 1DB2E (1D26C in 551M) with 4 values (16bit LoHi) of each block]
Blocks 030 - 099 [starts at hex 1DCEE (1D42C in 551M) with 4 values (16bit LoHi) of each block]



As an example we have a look to measurement block 001 between hex 1D7E6 and 1D7ED.

Here you see the 8bit hex values "01 00 50 00 1C 00 1D 00" or "0001 0050 001C 001D" in a 16bit LoHi view.
If we convert it to decimal, we have the values dec 1, 80, 28 and 29.
Now we have a look into the ME7 Funktionsrahmen table (decimal values!) at page 1555, and see that measurement block 001 shows NMOT, TMOTLIN, FR_W and FR2_W.



Here a configuration-example for measuring NMOT (RPM), LAMBTS (lambda), DLAMATR_W (EGT enrichment B1) and TATS_W (EGT from B1 sensor), all together in the last
measurement block 255 (hex 1DCE6 in 551K / 1D424 in 551M).

To do this, we search for the needed RAM variables in the ME7.1 function sheet table (page 1555) and convert the decimal values into hex values.
These are:

NMOT = dec 1 => hex 0001 HiLo => hex 0100 LoHi
LAMBTS = dec 377 => hex 0179 HiLo => hex 7901 LoHi
DLAMATR_W = dec 196 => hex 00C4 HiLo => hex C400 LoHi
TATS_W = dec 152 => hex 0098 HiLo => hex 9800 LoHi

If you work in 8bit mode, you must write

hex 00 to address 1DCE6 in 551K (1D424 in 551M)
hex 01 to address 1DCE7 in 551K (1D425 in 551M)
hex 79 to address 1DCE8 in 551K (1D426 in 551M)
hex 01 to address 1DCE9 in 551K (1D427 in 551M)
hex C4 to address 1DCEA in 551K (1D428 in 551M)
hex 00 to address 1DCEB in 551K (1D429 in 551M)
hex 98 to address 1DCEC in 551K (1D42A in 551M)
hex 00 to address 1DCED in 551K (1D42B in 551M)

If you work in 16bit LoHi mode, you must write

hex 0001 to address 1DCE6 in 551K (1D424 in 551M)
hex 7901 to address 1DCE8 in 551K (1D426 in 551M)
hex C400 to address 1DCEA in 551K (1D428 in 551M)
hex 9800 to address 1DCEC in 551K (1D42A in 551M)

Done...



To see the right value descriptions in VAGCom / VCDS, you will paste in the following lines into the VAGCom / VCDS lable-file (8D0907551.lbl):

;**********************************************************************
;
255,0,Own lambda stuff
255,1,NMOT, rpm
255,2,LAMBTS, Lambda
255,3,EGT enrichment B1,%
255,4,measured EGT B1,°C
;
;**********************************************************************



For a better understanding, I have uploaded the original 551K and a moded 551K with a changed MWB 255 to compare.
A 551K.csv file for all known measurement blocks, and a VCDS lable file for the MWB 255 example is also uploaded.  

Wish you have fun with this stuff.

Regards Thomas

(http://www10.pic-upload.de/02.08.12/w8ilcxf7wrb9.jpg) (http://www.pic-upload.de/view-15414540/Messwertbl--cke.jpg.html)

(http://www10.pic-upload.de/02.08.12/7cc5arbzmv14.jpg) (http://www.pic-upload.de/view-15415328/Tabelle.jpg.html)

(http://www10.pic-upload.de/02.08.12/bb8pjobskf15.jpg) (http://www.pic-upload.de/view-15414593/20120802_134503.jpg.html)

WOW. Incredible information. Thank you so much!

A absolut great info.

It is a pleasure to see what detailed informations and ideas you are posting.

Thats the stuff who makes me happy.

I will try it immediately in my 551D.

THX Thomas :)

So, I have find all the needed addresses in my 551D.

I have made a set of my logging favorites in the upper blocks from 240 to 255 and it works perfect with vagcom :)

By the way, a brilliant How To.

Thx a lot.

Simply amazing. Great work, man!  :o

Wow, just found this today.

Unbeliveable.. Great work!!

Cant wait to try out after vacation...

Great find!  :)

I have begun defining these on a 1.8T SM box. For those of you who want to find it on yours, the first block for most tranverse 1.8t's will start with:
0001
0050
001c
000d

In 16-bit lo hi of course.

Thank you for this block "001" info on an 1.8T ECU... ;)

I'm really interested in doing this. Is there an easy way to recognise these locations in ME7's without having to go into assembler?

I imagine though finding the RAM locations maybe hard but I do have some A2L files which have RAM locations in.

Hey, anyone knows how to fix label file so that adaptation channels would show correct data instead of 0-255 values? for example idle speed -1280-1270 rpm?

Is it possible for MED9?
I`ve try to find same data on my dump but did`n found it.

a little bump to this thread
thanks RS4Boost,great work!

here is mine xdf for 06A906032HN_0002 with some vcds groups
no need for hex work here
just paste variable index from funktionsrahmen page 1555

Thank you very much guys! Awesome  ;)

How have I missed this before?! This is pretty epic information and an excellent, easy to understand write-up. I believe a Thank You is in place, better late than never.

Friends are those values definitions a standard in measuring blocks and in Funktionsrahmen? I mean between different Motronic versions M1xx M2xx M3xx M5xx ME7xx MED9xx MED17xx ??? ??? ???

Hello, I'm interested in trying this but in the vagcom folder I do not have any files for the 032rp, in vagcom it tells me none where the lbl file should appear.

How can I know which one I should modify? thnks