NefMoto

Any reason why disabling SAI via minipulation of UBSLMX wouldn't work, setting it to, say, 2v (from 16v)? (Per the FR, UBSLMX is normally used to inhibit SAI during jump/boost starting).  Does anyone know of any other functions that rely on UBSLMX?  FR doesn't mention any.

Planning to code out SAI for a variety of reasons.

 

Any particular reason CWKONABG wouldn't work for you?

So leave B_katfz at 1 and set  B_slsfz to 0 (i.e. set CWKONABG to 1 instead of 5)?  At this point I want to take an incremental approach and retain the other functions associated with the cats.  Indeed that's probably a 'purer' approach if I have it correct.

looks like a very clean and simple way. Still need a couple more adjustments to be able to remove the relay and n112 without resistors.

Can you say what exactly elRey?
I know the fuel trims will stop learning. I just removed all that on my RS4. I guess I will figure it out, just thinking if perhaps you'd like to share the codewords so I don't have to spend the time :P

ESKONF:SLV and SLP

Wait, which will cause the fuel trims to stop learning?

Can we summarize what is needed for two cases?

1) simply disable SAI (leaving hardware in place)
2) allow complete removal of SAI

Thanks!

if you 00 that whole set of 01's @ ~18194 area that will cause fuel trims to stop learning.

also, you can remove all parts of the sai system just by flipping those few bits except for the n112 valve.
for some reason unplugging the n112 will also cause the adaptation to stop working as well.
never figured a way around that one. maybe someone else knows.

Are you referring to CWKONABG?

So what should one do if you ONLY want to disable SAI (and DTCS) but leave all the hardware/wiring intact?

I think, leave B_katfz at 1 and set  B_slsfz to 0 (i.e. set CWKONABG to 1 instead of 5 in TunerPro, or edit directly in WinOls).  From the Alfa FR:

B_SLSFZ=Condition flag: secondary air system installed in the vehicle
B_KATFZ = Condition flag: cat fitted in vehicle

I should have my car back together by the weekend and will try this out.

 In CWKONABG, bit 0 is B_katfz and bit 2 is B slsfz  (B_kath is bit 1, and would be set if cat heaters are installed).

To elRey:
 Do you mean Fehlerklasse CLASLPE and CLASLVE  when you say "SLP SLV"?
Because it does remove the DTC, but if you physically unplug the SAI solenoid, it cuts the fuel trim (short and long term)

If you want fuel trims to work you have to kill D***** functions.... Make it impossible for them to start by setting enormous voltages or speed or rpm or whatever. If you disable Error Class id doesn't stop ecu from setting certain variables. To completely stop it you have to force ecu to never start the diagnostics.

To test this you can try following: take out your diverter valve and leave gap. Now air will come inside after maf and you will get some DTCs and LIMP. Now disable those DTCs by zeroing out error classes. Start the car and drive for a while. You won't get any DTCs but you'll still have LIMP. Now disable Dxxx function completely by setting either start voltages very high or starting rpm very high. No more LIMP and no more DTCs.

Let me say it again:

You set "CWKONABG"  and "CDSLS" to "0" to disable the SAI function.
Then you disable the Fehlerklasse "CLASLPE" and "CLASLVE".
If you unplug the solenoid or the relay, closed loop lambda control is disabled  :(

No. I'm talking about SLP and SLV bits in ESKONF. This tells ecu whether or not to test power stage of solenoid or relay.

Please, can somebody provide a coherent summary I can put into the wiki?

What is needed for:

1) simply disable SAI (leaving hardware in place, including cats)
2) allow complete removal of SAI, but leaving cats
3) removal of SAI and cats

but preserving fuel trimming.

1)   Raise value of UBSLMN, UBSLSTMN above the max voltage of your alternator output.
(though there are atleast 2 other similar ways to prevent SAI from starting which is the target of your first question)

Thanks, jooo. I assume if the SAI never starts, if the valve is dead i wont throw a DTC?

2) Leave B_katfz at 1 and set  B_slsfz to 0 (i.e. set CWKONABG to 1 instead of 5).  Tells the ECU that SAI is not installed, but cats are installed.  (CWKONABG to 0 tells ECU no SAI and no cats.)  At least, no one has yet said that this is wrong.

Set CDSLS to 0 to deactivate SAI diagnostic functions.

Can't say if trimming requires the solenoid and relay to be installed.  Doesn't seem like a major deal to leave them plugged in in any case, although I can understand why it is bothersome on some level.

Both of those leave alternate ways SAI can be activated:

B_kh = && imlpr > IMLSLMN will circumvent UBSLSTMN
MLSLMX and DPSLV will circumvent UBSLMN

For #1 of nyet's request we have to prevent B_slpena AND B_dspe from being set. Sure we can just set B_slsfz = 0 via CWKONABG, but that doesn't stop B_dspe from being set. And who knows if B_dspe (diagnostic) is set and it never tests or gets a result, will a code be thrown?

B_slpena AND B_dspe should be the focus for nyet's #1.

To prevent B_slpena from being set:
set CWSLS bit 0 = 0 AND IMLSLMN high

To prevent B_dspe from being set:
option 1 via B_cwdslt : set CWDSLSY bit 0 = 0 AND CWDSLSA bit 1 = 0
option 2 via B_dsls via B_sls : set B_slsfz = 0 via CWKONABG (already done, yea)

So, set B_slsfz = 0 via CWKONABG does seem to disable B_dspe (diagnostic). Couple that with set CWSLS bit 0 = 0 AND IMLSLMN high to disable B_slpena and all should be good for nyet's #1. (AND B_cdsls = 0 via CDSLS as mentinoed above)

Please correct me if I'm wrong.

Thanks for your answer.
Unfortunatly, playing with ESKONF is not an easy job.
You need to have the assignment of each bit of the ESKONF bytes (usually 7 or 8 bytes).
You usually find it in the ME7 doc related to the engine, but we only have it for the 1.8T ME7 or alfa ME7.
It may be a disassembly job.

Is there any other way to unplug the device, and still preserving fuel trimming?

Since my car has a decat, I just set CWKONABG to 0.
Even after removing the pump, I never had any DTC's without actually disabling any DTC's.

I also removed the N112 now and I will check what happens.

For the M-box it should be around 10C7D and the assignments should be the same. Easy way to test is trial and error with removing solenoid/relays.

SLP is for diagnosis of the pump itself. I don't need to touch that it seems, because it never runs this diagnosis with SLS off via CWKONABG, as my pump has been disconnected for a while, and I never got any codes or problems with fuel trims.

As for ESKONF. Do you know what to adjust on ME7.1? We don't have a public FR fr ME7.1 and I really don't want to spend time disassembling this when instead I can resistor it.
I will look at FR and see why the fuel trims stop learning...

ECU never tests the pump itself. Instead it tests the pump relay since there is no direct connection from the ECU to the pump. I'm betting you still have your relay plugged in. The SLP in ESKONF is for testing that relay.



Post the file. I can try to find it. It normally start with 170 255 in 8it.

Fuel trim are affected because the ECU tests the power stage based on ESKONF regardless of what the CW are set to for diagnostic functions. And even if you disable the DTCs the power stage tests fail and fuel trims are turned off.

Ah yeah, I have the relay plugged in still I think.
I can find 0xAA 0xFF right before MLHFM.
Goes like this:
AA FF FF FF FF FF FF FF FF FF

The rest of AA FF I find are part of some maps.
Can you tell me what maps are around it? Otherwise, I am just using the standard 551K RS4 binary.

I understand this. But where exactly does it "turn off" the fuel trim. I scanned LRA diagonally, and I can't seem to see it right away.
As I understand it it is because of E_SLVE and E_SLPE, which become E_SLS.

That gets used in EVAP diagnosis I think... I need to look more, but perhaps you know the answer ;)

LROFF calcualtes B_esls...  and after that I lose the trail :)

Also, I believe because I have a 6 cylinder it can't possibility start with 170 255....

First 12 bits would probably be all filled with 10... or any combination of that.

So could be AA AF, AA FA and so on.

try address 10B78

Mbox = 170 250 085 085 085 255

Yeah just wanted to post that it's 10B78, and it is indeed AA FA like I thought. Before I saw your post :)

Cool, thanks for the assistance.

Description from Alfa FR:
Pair of Bits:
1. Bit 2. Bit
0 0 Diagnosıs active with OBDII-malfunction storage with test of healing
0 1 Diagnosis active without OBDII-malfunction storage with test of healing
1 0 Diagnosis active without OBDII-Fehlerspeicherung without test of healing (-> EKP)
1 1 Diagnosis not active

Full values:

AA - 10 10 10 10 - ZUE4 ZUE3 ZUE2 ZUE1
FA - 11 11 10 10 - ZUE8 ZUE7 ZUE6 ZUE5
55 - 01 01 01 01 - block is skipped
55 - 01 01 01 01 - block is skipped
55 - 01 01 01 01 - block is skipped

I wonder if it does start at AA FF though. My guess is - it does not. Might easily start earlier etc.
I bought a second ECU today to play with, I will install my emulator in it, and then have a go.
The 7E EE after it is BFGRO...

It's very possible the address is 10B76 like you suggest.

243 255 170 085 085

about where exactly it turns off adaptation, here's my 'theory'

e_sls -> func DTEV -> b_dteenf -> b_dtezam -> b_dteaa -> func LRAEB -> b_gasp

b_gasp = 1 = disable adaptation

SY_CONFSL would disable it...
But yeah, that's a compile time flag.

So you are correct, there is no way to disable it without disabling it in ESKONF or an ASM hack.

It is presumably 7 bytes long, so F3 FF AA FA 55 55 55 or 243 255 170 250 085 085 085.
The odd thing is that leaves only one location to try - 10B76 -> 0xFF.
If that does not fix it, then it means the diagnosis for the valve is done differently on ME7.1

What I don't like is that there are no references in ASM to F3 FF in the 551K bin. Might be loaded differently for all I know, but there is a reference to 0xAA and the next block which has 0x55.

Looking at it again, I think it's @ 10B78.

170 = 10 10 10 10 (coils for 1-2 cyl)
250 = 11 11 10 10 (coils for 5-6 cyl)

I'll disassem to make sure. nm looks like you did already.

The older 7.3 doc looks like it starts with injectors (EV) = 00
Does your car use a ICM for coils? If so it wouldn't have ZUE which is what I'm basing 'starts with' my logic on.

You have two power output stages and then the coils are connected to them. There is no separate module, or well, at least I hope you are not referring to the POS-s as ICM-s as they are simple switches.
I took a look at an ME7.5 binary and that has no references to the bytes after the ZUE config either which are picked up by IDA.

So they are probably checked differently - loaded indirectly. I guess you could alt+t and look for #55h, and then go through all the code ;)
I'll try FF-ing that first byte... and well I can FF all of it as well I guess to see if it is what is needed.

I found the same in the M box. Different location, but the exact same results. Same two bytes had a direct reference and I didn't see any promising indirect references.

I only took a brief look because I only had a few minutes. I will look a little deeper later when I get the chance.

It looks like it is referenced with an offset from 10C75 in the M box.

i.e. movb    rl5, [r4+byte_810C75]

function DECJ on Mbox @ 04EB88

But is ESKONF is indeed @ 10C75, that doesn't align with the fact that 10C7D is referenced similar to an 032HS file for ZUE.

Changing 10B76 did nothing for me as expected.
The ZUE diagnosis is for sure 10B78, 10B79 because the routine that references is exact the same as in a 1.8T file I checked.

I am talking about 551K here.

M-Box is 10C7D indeed.

Assuming this would make it 0x10B70 for 551K:
00 C0 EF FC 0C 00 F3 FF AA FA 55 55 55

And 0x10C75 for 551M:
00 FC E3 FF 3C 00 F3 FF AA FA 55 55 55

Looks quite different to me.
I will try to rig up my emulator today and I will just FF the entire region...

E_sls doesnt effect B_dteenf on 551K

Oh... then I am wasting my time.
I never bothered to check if the fuel trims are learning or not.

Thank you matchew.

Trying to clarify the ESKONF parameters i end up to the following results:
ES-Blocks:  0      1       2        3        4         5      6
Amplifiers: 170   255     0       48      255      248   48  (the example of ESKONF is from 032HN)

We are interested for blocks 5 & 6 where amplifiers of SLP & SLV are checked for working status.
00 is active, 01 is skipped (bin format).

Those are original values from documentation for 1.8L 5V turbo:
5 | NC | NC | ERP 65 | SLP 66 | 11 11 11  10  = 251

6 | ULT 105 | EEGR 114 | SLV 9 | NWS 115 | 11 00 11 00 = 204


If i am correct, values of amplifiers from box to box are different.
How can i find the block bin sequence or to be more precise the bin value of its amplifier?

No help guys?

I manage to "01" the SLP inside ESKONF and car runs without DTC with working fuel trims (cat and SAI/EGR off completely).
But that was easy since it is located last on block 5 ;)

I tried with IDA but got stuck after disassembling the image.

EDIT: Figure it out, such times you feel so idiot ^^