NefMoto

I have a 2001.5 TIP S4 and I have been interested in tuning my TCU since I first got the car but paying 450 bux for it is just a bit much I think. I have been doing googling here and there and really not coming up with anything what so ever on how to read and write to the TCU and then figuring out how to mess with it. I was hoping someone has some kind of information on this it would be super cool to take tuning 1 step further to the transmission. I know there is not much time put into auto's because the transmission is just not as tight as the manual but @ 220k miles on the engine and my daily almost 100 mile commute I can't do a 6MT swap. If I find any info out in my searching I will post it here.

Thanks!

We need to know the KWP1281 or KWP2000 address of the TCU.
Then we need to figure out if the TCU supports flashing via KWP1281 or KWP2000.
Then we need to determine if the same methods used to flash ECUs work for TCUs.
Then we need to start making definition files, compare stock to tuned, etc.

The monoscan s/w seems to be able to connect to transmission controllers using a KKL cable. Might be worth a play.

Yea i do remember seeing something like that with the MonoScan.  I will try that out on my moms TIP A4 and see if theres any success Twist

My understanding of monoscan was that it was essentially a free version of vagcom? If we could figure out how to connect to the TCU and read and write, I may be inclined if no one else came forward to spend the 450 just so we could have a tuned file to play with and compare to a stock one. But hopefully someone with a TIP Chip could be so gracious to let us rip his TCU instead cause I can think of a million other things on my car that I could spend that 450 on.

I need to find some time to make the address the NefMoto ECU flasher connects to user selectable. Because I am really hoping it uses the same standard VAG protocols for flashing as the ECU. If that is the case, then we would only need to figure out which memory addresses to read from.

Ok so looks like my googling efforts may, possibly, hopefully help us in some tiny way. I found this russian forum and registered on it and got what I think, according to the chrome translator some automatic transmission files and a couple of them are Audi, I am going to attach what I found and link to the site if anyone else wants to check it out. I suggest you use google chrome as it will auto translate the site and its super smooth and easy to use that way.

This is a link to the thread in question. Translator required unless you can read Russian.

 http://www.carhelp.info/forums/showthread.php/12216-%D0%9F%D1%80%D0%BE%D1%88%D0%B8%D0%B2%D0%BA%D0%B8-%D0%AD%D0%91%D0%A3-%D0%90%D0%9A%D0%9F%D0%9F

The next step would be to load these files into IDA to determine the memory layout.

If anyone would like to test connecting to the TCU, I have a test release of the NefMoto flashing software that allows you to connect to custom addresses. Just let me know if you would like to try it out.

I am more interested in premium features at this points, I am doing lots of research on our ECU file and flashing whole thing 20 times a day is really getting to me.

Thanks.

Hah. Message received. ;D

Version 1.7.1.0 which isn't released yet is already tested and has full support for licensing premium features. I was waiting for a website update to actually offer the premium features though.

I will get it sorted this weekend. Either the website gets updated, or I will make them available before the website update.

I am working on major breakthrough for anti-lag feature for our ECU as well as no-lift-shift.

I even got "RL" cable so that the licensing works ok, I hope you can give me a break on pricing albeit I suspect it will be pretty nominal anyways.

Keep the AWESOME job up!

Just as idea...
Maybе some texts from ini-files of flash-soft will be usefull.
Compare values for ME7.1 and TCU.

[ME 7.1.1 Master]
AddressWord=$01
FileStartAdr=$800000
BlockCnt=3
Offset=$0000,$0000,$0000
StartAdr=$800000,$820000,$810000
StopAdr=$80FFFF,$8FFFFF,$81FFFF
DelStartAdr=$800000,$820000,$810000
DelStopAdr=$80FFFF,$8FFFFF,$81FFFF
CheckStartAdr=$800000,$820000,$810000
CheckStopAdr=$80FFFF,$8FFFFF,$81FFFF
Format=$00,$00,$00
Code=0x68, 0x05, 0x81, 0x4A, 0x05, 0x87, 0x5F, 0xBD, 0x5D, 0xBD, 0x49, 0x4C

[AL 600 / GS 19.04]
AddressWord=$02
BlockCnt=4
FileStartAdr=$0000
Offset=$0000,$0000,$0000,$600000
StartAdr=$8000,$B0000,$90080,$E0080
StopAdr=$6FF7F,$DFFFF,$AFFFF,$FFFFF
DelStartAdr=$8000,$B0000,$90000,$E0000
DelStopAdr=$6FFFF,$DFFFF,$AFFFF,$FFFFF
CheckStartAdr=$8000,$B0000,$90080,$E0080
CheckStopAdr=$6FF7F,$DFFFF,$AFFFF,$FFFFF
Format=$00,$00,$00,$00
Code=0x68, 0x06, 0x81, 0x4A, 0x05, 0x87, 0x6B, 0x5F, 0x7D, 0xD5, 0x49, 0x4C

gremlin, what software is that ini info from?

That info is very informative. I'm not sure what the "Code" entry is though. I will have to compare that to the NefMoto software. I wonder if that is the security access seed table.

For instance it appears as though for flashing the ECU, they do range 0x800000-0x80FFFF, then range 0x820000-0x8FFFFF, then range 0x81FFFF-0x820000. I assume they are flashing in this order to handle changing the persistent ECU data that is backed up between sectors. The NefMoto software detects when flashing individual sectors fails an erase, and then defaults to flashing the entire chip at once to overcome the limitations of changing the persistent ECU data. The method being used here with changing the order the sectors are flashed in seems like another elegant solution.

I'm a little surprised at the gaps in the TCU memory maps. The addresses also seem to indicate that the memory ranges being erased are larger than the ranges being written to.

It's taken from DiaGRA software.
I agree that strings concern SA seed data.
See at red bytes sequence given for ME7 ECU.
Then at SA table used in ME7.
And then at blue bytes in TCU string...


Code=0x68, 0x05, 0x81, 0x4A, 0x05, 0x87, 0x5F, 0xBD, 0x5D, 0xBD, 0x49, 0x4C

Code=0x68, 0x06, 0x81, 0x4A, 0x05, 0x87, 0x6B, 0x5F, 0x7D, 0xD5, 0x49, 0x4C

I see now tiptronic dump from A6 Allroad 2.7T
Seems SA table is the same as in ME7...
---------------------------------------------------
ROM:00007CBE aSecurity:      dc.b 'SECURITY'
ROM:00007CC6 ;==========================================
ROM:00007CC6                 dc.l $A221289
ROM:00007CCA                 dc.l $144890A1
ROM:00007CCE                 dc.l $24212491
ROM:00007CD2                 dc.l $290A0285
ROM:00007CD6                 dc.l $42145091
ROM:00007CDA                 dc.l $504822C1
ROM:00007CDE                 dc.l $A24C4C1
ROM:00007CE2                 dc.l $14252229
ROM:00007CE6                 dc.l $24250525
ROM:00007CEA                 dc.l $2510A491
ROM:00007CEE                 dc.l $28488863
ROM:00007CF2                 dc.l $29148885
ROM:00007CF6                 dc.l $422184A5
ROM:00007CFA                 dc.l $49128521
ROM:00007CFE                 dc.l $50844A85
ROM:00007D02                 dc.l $620CC211
ROM:00007D06                 dc.l $124452A9
ROM:00007D0A                 dc.l $18932251
ROM:00007D0E                 dc.l $2424A459
ROM:00007D12                 dc.l $29149521
ROM:00007D16                 dc.l $42352621
ROM:00007D1A                 dc.l $4A512289
ROM:00007D1E                 dc.l $52A48911
ROM:00007D22                 dc.l $11891475
ROM:00007D26                 dc.l $22346523
ROM:00007D2A                 dc.l $4A3118D1
ROM:00007D2E                 dc.l $64497111
ROM:00007D32                 dc.l $AE34529
ROM:00007D36                 dc.l $15398989
ROM:00007D3A                 dc.l $22324A67
ROM:00007D3E                 dc.l $2D12B489
ROM:00007D42                 dc.l $132A4A75
ROM:00007D46                 dc.l $19B13469
ROM:00007D4A                 dc.l $25D2C453
ROM:00007D4E                 dc.l $4949349B
ROM:00007D52                 dc.l $524E9259
ROM:00007D56                 dc.l $1964CA6B
ROM:00007D5A                 dc.l $24F5249B
ROM:00007D5E                 dc.l $28979175
ROM:00007D62                 dc.l $352A5959
ROM:00007D66                 dc.l $3A391749
ROM:00007D6A                 dc.l $51D44EA9
ROM:00007D6E                 dc.l $564A4F25
ROM:00007D72                 dc.l $6AD52649
ROM:00007D76                 dc.l $76493925
ROM:00007D7A                 dc.l $25DE52C9
ROM:00007D7E                 dc.l $332E9333
ROM:00007D82                 dc.l $68D64997
ROM:00007D86                 dc.l $494947FB
ROM:00007D8A                 dc.l $33749ACF
ROM:00007D8E                 dc.l $5AD55B5D
ROM:00007D92                 dc.l $7F272A4F
ROM:00007D96                 dc.l $35BD5B75
ROM:00007D9A                 dc.l $3F5AD55D
ROM:00007D9E                 dc.l $5B5B6DAD
ROM:00007DA2                 dc.l $6B5DAD6B
ROM:00007DA6                 dc.l $75B57AD5
ROM:00007DAA                 dc.l $5DBAD56F
ROM:00007DAE                 dc.l $6DBF6AAD
ROM:00007DB2                 dc.l $75775EB5
ROM:00007DB6                 dc.l $5AEDFED5
ROM:00007DBA                 dc.l $6B5F7DD5
ROM:00007DBE                 dc.l $6F757B6B
ROM:00007DC2                 dc.l $5FBD5DBD
ROM:00007DC6 ;===============================================

I would definitely like to try out this test version for my bro's possible S4 tcu.  He's lookin at an S4 currently and liked the AWE tune for tcu to lower shift timing from 1 sec to .2 secs.

maybe a few tips on things I should expect, I guess.  Other than that, I'd like to test that out.

Chris

You dont need to modify TCU software in first stage tuning (2.5TDi 3.0TDi DSG-DQ200-DQ250 boxes with setup on serial DSG cluthes).

Just need to find map/maps that send to TCU information about calculated "engine Nm" and twaek them.

Regards.

Ps. its my first post - HELLO TO ALL :-)

My car has a sheared exhaust valve and I am trying to find some heads for it right now. But once I get my car back up on the road, I am down to try to read it and or write it.

Is there anything out there that can read/write the tcu ......has anyone looked into this....I know tips are not popular.... Just wanted to see if this has been researched ...im wanting to flash my tcu with a tip chip

Doesn't look like this went anywhere ultimately -- I'd love to try to start to figure this out.  Not sure my pea-brain will get very far, but I'm willing to try.

Agreed.... Any new info?

Yeah me too anything new?

3B0927156T
29F400B
24C16

Excellent.  A start.

try this instead. the adapter for my programmer is really flakey. and its a byte swap file anyways. which i did not do on the previous upload. i think this is a good file.

jtag!

(http://i795.photobucket.com/albums/yy231/k0mpresd/D7420626-3EB8-426C-AF11-9126AD543C80-4421-0000020AFCAA6EDC.jpg)

The TCU can be reprogrammed using the pass-through reflashing procudure the dealers use. You would need to get the .bin to flash to the TCU EEPROM. Then using KWP2000 protocol, flash the TCU with the tip chip .bin. over OBDII port.

I would pay for someone to write me a tip chip and somehow be able to flash it too my tcu, but i doubt it possible ...nobody really wants to upgrade a tip

I've found what I take to be maps and am beginning to disassemble, but haven't been able to spend much time on it, unfortunately.  Maybe over the holidays...

I would be more interested in the flashing aspect (as opposed to the tuning). Memory layout, addresses, OBD flashing?, etc.

Any ideas?

exact same thread is here basically: http://nefariousmotorsports.com/forum/index.php?topic=453.15

where do your maps start? i havent looked at the tcu dump i posted in a while but from what i remember it looked like all the maps were pretty near the end of the code. some of them had bosch 8 bit axis definitions in front.

Yes, exactly.  Most of them start about 2/3 of the way through.  Like this one at 63F26.  Sure looks like torque (or maybe airflow) vs. RPM.

Based on the Freescale/Motorola 68376 (extension of 68020) so there's some hope for this.  TouCan (printed on CPU) is reference to a built-in CAN controller.

it has bdm as well.

So the next thing is to disassemble the binary and see how it works.
What would help would be a tracing of the pins to the main processor.

If that could be gotten down that'd help a lot.

The CAN messages we already now - because of the spec on the ECU side.
If that can be read, one can see how the values are used.

I'm going to pick a spare up off of fleabay and start playing.  Unfortunately the exact match for the one in my car is pricey.  May just learn with a cheaper version and transfer knowledge to the in-car TCU once I'm confident I mostly know what I'm doing.  Seems like there's not much knowldege out there on interchangeability.  I want to keep traction/stability control so need to be careful with that aspect.  I've downloaded CodeWarrier (thinking that it would be better than Ida Pro in this instance -- any views on that?).  As soon as I can get the stupid registration that didn't work resolved...

I think IDA will be much better...

Ida (5.X, anyway) using the 68330 definition file... chokes on the TouCan module making it difficult (for me anyway -- noob alert) to find the proper entry point for what we're really interested in.  A way around that seems to be to run it through the HCS12 definition file (the sub model with RAM, ROM and EEPROM).  The CAN instructions associated with TouCan show up even if most of the rest of it is wrong and show the correct entry point for use with the (correct) 68330 definition file at 4000h.  All of the labels show up properly using the HCS12 definition file also.  (Which, now that I think about it, I haven't been able to achieve using the 68330 definition file, so could be that 4000h is wrong and off slightly.)  

Trivia:  the file posted by k0mpressed in the other thread is from a W8-powered car.

The processor is definitely a 68376; ZC439616CFT16 is listed in a product-change announcement for the part on the Freescale site.

Just posting in case anybody else is interested.

Editing the above crap info lest anybody waste time trying to duplicate, it looks like the correct entry point is (may be?) 0x412h.  Not sure why TBL lookup instructions don't seem to be used, since they are 'new' to the 6833x series.  Or maybe I just don;t know what I'm looking at (a definite possibility).

As it turns out, the Nefmoto flash software can connect with the TCU, address 0x02.  I had never noticed that the address is selectable from the KWP2000 Settings page.

The software won't negotiate timing properly and some precondition isn't met (among other things?) and so won't read the flash, though.

Anybody able to provide guidance?

Log attached.

On the bench, K is pin 88, power to pins 26 and 55 (switched) and ground pin 34.  Cable connections as usual.

audi a6 c5 2001 original tcu dump. I wish i could tune it

This would be so great if someone could tune it ....... How did you pull it?

So is this a working tcu tune or are tree any? If I could get my shift times down my car would e incredible and I'm not a fan of the cookie cutter tubes offered. Did connectivity ever get figured out here

Haven't worked on it in a while -- decided to convert to 6MT.  Sorry.

I have had a TCU with TIP file on it sitting on my desk for 4years, mine is a soldered version, if anyone thinks it could be of use, I will try to dump the file

You'll have to desolder the chip and read it in a programmer.

My experience is that all this "quicker shift time" stuff is mostly hogwash.
All that the big tuners do is raise the torque limiter and modify the torque limits on upshift and downshift, so that torque is not reduced as much during shift.

But you can't feel almost any difference - even side by side runs...

Not a problem, just need some direction and I'd be happy to do it. 

I do agree with PRJ, I never noticed the night and day difference that was claimed

I have a spare TCU that I would gladly donate to the cause if this can get underway.  I would be willing to do legwork myself with guidance.

As I said, there's nothing really much to do apart from lifting the torque limiters.

I think most of the crap posted on the forums about this is just "I paid for it, so it must be better" type stuff.
The difference is almost nonexistent.

Credence good ftw

I can tell you of the tip chips I've seen, the differences have been very small, and not necessarily in the maps.

If that's the case , then this can be done in the flash...

I have been entrusted with a few examples, I was asked not to openly post them but I don't think the individual would have an issue if shared privately (with contributing members).

If you lie to the TCU about mdnorm, it's going to have incorrect pressure applied -> Trans slip, especially on RS6.
If you exceed the spec. mdnorm you are eventually going to hit limp mode.

I don't think this can be done in the flash.

I was talking about migs.

Maybe I misunderstood your reference to torque limiters.

migs is not the problem. If you lie to the ECU about migs and then mdnorm goes above migs the TCU is not going to like it.
If you lie to the box about mdnorm then the shifting pressures will be wrong.

The box needs to see the correct torque and it needs to request the correct torque limit.

Yea, I misunderstood you.

After reading your first post again, I get it.

I thought you meant that they were just raising migs_can.

There has to be adjustments for line pressure, and shift strategy.  The stock tip trans amazes me as it tries to shift into 5th at what is honestly 35mph.  A line pressure increase, particularly at higher torque loads, would certainly help the clutch disks hold up to higher torque levels. 

What values have you seen changed on TIPchips from OTS tuners?

As I told you, this is not done by anyone. It's just yadda yadda. All they do to make the load dropout slightly smaller is change req torque during upshift and downshift...
Which in turn somewhat increases line pressure, but as I said before, the difference is barely noticeable at all.

I'm not saying that they do it, just that the TCU has the ability to adjust these parameters.  That in itself makes the idea of TCU flashing very worthwhile on a otherwise failure prone trans.

Kind of sad if that is all the vendors do and then charge so damn much.

i unsoldered the eprom with chipquik, dumped with tsop adapter + willem usb then resoldered it when i saw i could not correct checksum for this =P

I'm going to go ahead and bump this for those that care. The file in the flash (29f200bb for 00-01, 29f400bb for 02-up) is byteswapped when read in a chipreader. For those brave enough to modify the files, make sure to byteswap before modifying, then again before writing it back.

i have a giac tip chip as well as a stock one for 01 s4.

If you have a way of removing and reading the files, please do so and send them to me (or post them). If not, I can do it. PM sent.

Anything ever become of this??

Yes. I have several examples of tuned files, and a method for checksumming (the 512kb files). All I need now are a few more originals for comparison. Anyone with stock TCU's, PM me with the Vag numbers.

I don't have the EXACT original for this file, but the one I do have is very close. As a result, I was able to do a bit of comparing. I need more original files!

From the file:

4B0927156DJ AG5 01V STAGE2T

Wasn't aware there were different stages of TIP chips, but I guess it'd make sense.

(http://i41.tinypic.com/2rc7rt0.jpg)

RPM and Load for axis?

(http://i39.tinypic.com/10p1pxw.jpg)

There are some 15 'maps' that show up, many of which seem to be duplicates.

http://nefariousmotorsports.com/forum/index.php?topic=2555.msg27638#msg27638

These aren't winOLS detected maps. They're significant because these maps make up the majority of the changes between the tip chip tcu's I've seen and the stock files.

Oh, got it, cool.  Progress!

Makes the most sense to me to have RPM and Load, but I am not very well versed

Load is not sent over the CANbus.

Mostly RPM, vehicle speed, and torque values.

Torque,

Load not sent until MED17.

I'll get mine tomorrow for you

Well, the 3.0 TCU I flashed with a 2.7t file still functions and connects with vag-com, so that's a step in the right direction. Apparently TCU's cannot be recoded on the bench, so I have to wait until it's installed in a car to know how it'll work. They did look identical inside however.

Confirmed. These things are all the same hardware wise. The difference is the software. I put the 2.7t s4 file on the 2.8tcu, recoded it and it works flawlessly. Same with 01 a6 and 3.0 TCU. As long as it has the 29f400bb chip, any tcu will stand in for a rarer, more expensive model.

I'v dumped this few month ago, this is useless for me, i shot it here before delete.

2.7tt dump
45Z4977251A 6  GA 510 V.2l7V5.TU AS. 200600724633733685124141.

I have two different modified RS6 tip files, if they are useful to someone shoot me a PM with your email and i'll send them over.

I don't want to openly post them since they are reputable companies work.

I'd love to be able to tweak some things in my TCU.

What software version? I may have an original I can set you up with for comparisons sake. I have so many TCU's right now it's ridiculous.

This is TCU file from Audi Allroad 2.7t 4z7 907 551R 0003 ECU. Maybe will be useful for somebody)

60580063014Z7927156M  AG5 01V 2.7l5VT. USA .026000285910300401182122

Both are RS6 4B0927156FL

BTW are you in NY?
I'm in PA

Yes, I am in NY. Shoot me an email.

DD

On the way...

I know I sold you one too lol

I stopped counting at 47.

I have desoldered and read them ALL.

lol.

LOL now that's funny ;)

Could anyone tell me please is it possible to swap TCU?
I have one TCU and I want to sell it to one guy, but it has a different software number.
And the question is how many memories TCU have? Only 29f400? Or it has soic8 or smth like this?

It depends on the software numbers. Allroad TCU's are not compatible with A6's, A6's are not compatible with S4's. If the car is the same chassis, and has the same options (tip controls, sport mode on the shifter, etc) then it MAY work.

All B5 S4's TCU's that I've seen were able to be interchanged.

Thanx again for the info)

There are 2 allroads, but mine has 156M soft 2003 MY, and allroad of that guy has 156F (156 if I remember correctly, but its "F" for sure)2002MY. And there were 3 version of allroad on the market.
1. 2001 year, ME7.1 ECU, "old" gear box.
2. 2002 MY, ME7.1 ECU (4z7907557M) but different instrument panel, audio and a little different gear box.
3. 2003 MY another ECU ME7.1.1 (4z7907557S or R), looks like the same gear as 2002.

I can see only one side of scheme and it has only 29f400. And I supposed it will be work if I desolder this flash from 2002 TCU and solder it to 2003 TCU. But as I know ECU has internal rom, soic8 eeprom and flash. And I'm afraid TCU has soic8 and different internal rom too.

If you desolder the PSOP44 29F400BB, and solder it into the other one it will be 100 percent identical. The data on the soic8 is rewritten when booted with the new flash. You will have to properly softcode the unit, and that cannot be done on the bench, MUST be done in the car.

Great! Thanx, really very useful info, will try it.
I think it can be easy coded with VAG-COM.

2002 and 2003 should be interchangeable as both are sport mode aka PRNDS.

The 2001 is different since it doesn't have sport mode but instead PRND432.

You could put a 2002 or 2003 tcu in a 2001 if you also changed the shifter bezel to match.

If you read the files, make sure to post them.

I'm goin to start calling you the tip king LOL

Are you getting anywhere with being able to decipher the files?

I have a euro s8 tcu on its way.

Want to read it before I put it in?

I know what they modify, and I have a good idea of what it does. I can replicate the results across multiple files, but I'm not comfortable enough to release anything without figuring out what ISN'T safe (doesn't seem like much honestly).

Yeah, read the S8. I don't have any of those.

Well if you come across needing any testing done on a TIP which I know you don't have LMK. I'll be willing to test something if need be. If you remember ddillenger I have a A6 2000 L-box.

I do remember, and I'd be petrified to try anything on a car with an already failed converter. Damage an all.

True

Planning to swap it on Monday  ;)

Can you confirm please, it has ST 24c16 eeprom?
As I understang there are no memories on the back side of the scheme.

I have installed M-box instead of F-box. Seems everything is ok, gearbox works without any problems and DTC  :) I even didnt make any adaptation.

If you can, read the file off the dead one. If you're not capable, send it to me so I can!

Desoldering is not problem for me, but F-box is not my TCU, but Allroad owner.
If smth will work incorrectly I will swap the files.
if its not secret, why do you collect TCU files?  :)

Because noone has them.

Here's few :)

Hope you still need it

4Z7 927 156F from Audi Allroad 2.7t 551M

So not all TCU's are compatible-lol

I have experienced the following:

2000 A6 4.2-in a league of it's own so far
4B0927156CT-cannot be used in a 2.7t, hardware is not compatible
3B0927156AC-cannot be used in an S4, it will have a voltage error after it shuts down/powers back up (but otheriwse works)

2001+ 2.7t tcu's appear to all be interchangable, at least on a hardware level. I have used a 2001 4Z7927156A box in a 2004 4B0927156FE car (once programmed) without any issues.

If you have to crossflash, get the closest match to your car you can. Open it up, and you will quickly see the differences.

Well done sir.... ;D

Next question what about Euro flash on NA box and vica versa?

I am pretty sure that would be fine, but I don't have any euro tcu's.

Well my euro one should be there Monday or Tuesday.

Feel free to give her a test run :)

Update:

(http://i.imgur.com/FaPxOIul.jpg)

I've been able to read information from the TCU, but so far have been unable to get it into debug mode to get any sort of full file. Thinking it's some sort of watchdog that prevents the mcu from shutting down (it powers down, then immediately restarts when issued the reset command-the thinking here is that it's part of the design). Have a TCU on the way to the creator of the BDM I've purchased, he's going to see what he can find. We're both very optimistic on creating a working BDM flashing protocol. I know, it's not OBD, but it beats desoldering, and the MED9 BDM adapter that many already have works well. The BDM adapter is around 70 bucks with shipping.

Will update this thread when I have more info.

Well done sir. Can't wait for more info, but this is a huge step forward IMHO

From Allroad 2003 2.7t

We can now read/write via BDM. It requires jumping two pins to shutdown the hardware watchdog, and disabling the software watchdog, but even so, the days of desoldering are over :o

Tested today on 4 different TCU's ranging from 1998-2004 without incident.  A read takes approximately 10 seconds, a write 30.

(http://i.imgur.com/J6CsCB4l.jpg)

Still working on reading/writing to the eeprom, but it won't be long.

I plan to create a writeup to do this. It'll cost you about 75 bucks with shipping for the BDM, then another 40 for the frame I'm using (with the adapter). If there are enough people that are seriously interested in making this happen, I will gladly take the time to walk you through the process of reading/writing.

This is great, but I have no info how to tune it... I know that transmission works incorrectly after 350-400hp.

I'm still working on that myself. I've come a long way, but still have a distance to go. My hope here is that others will start reading their tcus and looking for maps.

I think the main problem with load. After 350-400 hp TCU change 5 gear to 4 gear then 4 to 5 etc. And maybe I did smth wrong but I could not raise RPM, cause TCU change gear after 6800.

hey

i just watched this thread and must say nice work ddillenger very interesting like your work you put into the bdm stuff!! great!!

We can now read/write the eeprom, as well as the main flash. I think this is about as done as it's going to get. We can read and write across the entire line of Bosch AG5 TCU's quickly and reliably.

Big thanks to USBJTAG. Without his interface, and help, this would not have been possible. Anyone interested in giving this a shot should go to their site:

usbjtag.com

and order an interface :)

Interesting stuff DD. Do you get full access to the MCU with this kit while the processor is running?

good morning,

i came across this thread a few hours before, while searching for OLS816 plugin. I´m very impressed by the results so far and i would like to ask if anyone is able to do checksumm correction on those files?

i´m not directly using the same EGS/TCU, but i´m using the ZF5HP19, too. While yours is front- or 4wd, mine is used in rearwheeldrive, but overall its pretty the same.

The inside of the TCU looks very identical to yours and the files look pretty identical, too. that said, if obvious that the maps are somewhat shifted in position and therefore much difference in winols while comparing.

i´ll attach some files i´ve taken so far and hope they will help others.

Can you show points for WD shutdown on the board photo or using MC68376 CPU pins description ?

Take a look one page back. You see the wire I added to the BDM? Just pull that high (12v with a 130ohm resistor) and that disables the hardware watchdog.

I've seen the wire and +12V connection point.
But it's difficult to determine exactly on this photo what pin on BDM connector is used.
Which pin number?

Pin 7 (reset). You should find that pin 11 is +12v and can be used to pull the reset high.

TNX!

Searching for the Dump´s
4D0927156AA 3,3tdi
4D0927156EG 6.0 W12
4B0927156FB 4,2T RS6

I want to change the shift rev´s of the W12 and am hopeful to find it with those other dumps, because the transmission of these cars are nearly the same type. If I am sucessfull I´ll post it here.


@ddillenger: I´m interested in your read/write method: If I understand it right you don´t need much more than a good jtag programmer and power supply? Or do I need a appropriate software for the jtag programmer?
I don´t got a good jtag programmer yet, so I would order your suggested tool, but I would like to know if there is something more that is needed?


If someone is interested: I got serveral Dumps of 2,5tdi tcu´s where (imo) torque limiter and shifting time is been adapted (Only 3 values on hexdump), but I dind´t tested so far. I could send ori and mod via pm to those who are active here and are willing to share information here, too...

I am very frustrated with myself at this point.  >:(

 I have my usbbdm hooked to the corresponding pins on the tcu board.
I also have a 12v power supply connected and supplied +12v to 55 and 54
-12v is connected to 34 and 35

I have 3 390ohm resistors in parallel and they give me 130ohms. I have this connected to pin 12 (verified +12v) also tried direct to my +12v source.
On the other side of the resistor I have pin 7 from the bdm and pin 7 from the tcu tied in. They are seeing roughly 5v.

I don't see anywhere in the tread regarding connecting to the K-line is this needed? ???

It populates info and performs a read but doesn't read anything from the eeprom
Code has plenty of info.
BDM does stay ON once the reset is sent to it.

I am in the process of uploading a video.
I have been bugging ddillenger a LOT and I am sure he is tired of my elementary questions.
Hopefully this can help someone else in the future.

This is on a 2002 audi a8 tcu for reference.


-Richard

Hello Guys and a big hello ddillenger.
Have absolutely no experience in this project .
I've already bought the USBBDM tool and am now put at all in motion .
I still have few questions to you all, the connector on the controller what actually dare to go why do I need and what is the pinout here ???

hi guys.
can anybody help me a little?
need for connection plan from the connector on the TCU which color of the cable are with how much power ????

Pins 55 and 54 power
Pins 34 and 35 ground
Pin 88 k-line

Hello people , wanted to ask who can grab me a bit under the arms and help me !
Have now installed the Usbjatg tool , the problem was standing in the BDM tool to off and remains !!!
have all tried setting is always set to off :- (
Now want the 10 Color cable to solder on the TCU someone has the pinout cable which comes to which pin?
And in the Tool ask please detect Blitz what is this?
Many thanks for your help !!!

Put the software in english, the translation is obviously done by google translate.

It translated "flash" as a "lightning flash" or "blitz" in german lol.

Could be worse I suppose, it could be jinglish lol

Anyone pulled any TCU bins off of a 5spd TIP from a 1.8t?

Yes. B5, B5.5, B6? What do you want? Vague question is vague.

Sorry about that ddillenger.  I thought I was taking a total shot in the dark to start with.  I'm looking for both tuned and stock for B5.5 and B5.

Tuned files will not be posted here. If you give me a tcu number I can post an ori.

3b0 927 156 ah

Hello people and hi ddillenger:-)
Hope someone can help me with my problem.!
Have the NT Tool USBBDM my TCu the code read 512kb size.
I am now Modify this file, for example, lifting torque and again in my examples the TCU TCU does not work: :-(
Have the cockpit everything is black no gear indicator and no connection With VagCom on TCU :-(
Write The Original what i have Read from TCU the TCU Work?
Am I doing something wrong ??
Or do I do something else ??
Would appreciate help very much !!!
Thanks in advance.

How are you handling checksums?

Good morning ddillenger .
the cheksumm is fine .
I also tried using a file which already has been modified , and is not .
when I burn deauf I have no communication with the TCU .
I play it the original , it runs !?




Best reg

Post the files you are flashing, and your original.

No hear ddillenger.
Im Send you on your Email o.k?




Best reg

You have Email ddillenger:-)

Hi There,

Great work on this topic, it really helps me getting the right TCU for my Passat3BS 2.7T Swap.

Just wanted to show up with the information that AFAIK no 5HP24 TCU is Interchangable with any 5HP19 TCU.
I found a little different pinout on a research a while ago. That should explain the two first mentioned incompatibilities.

Greetz, Julian

The Audi dealers can flash reprogram the TCU over OBD, I don't understand why this method is being ignored here. It seems to me that using the same protocol used to perform the pass through flash reprograming would allow access to the flash eeprom hex dump and subsequent flashing of a modified .bin back to the eeprom. Am I missing something fundamental here?

I think it's more a matter of enough demand for this feature and research from the community rather than whether or not it can be done.

I don't have a tip car. Noone else seems to care where this goes, and I have put a ton of work in already. I'm more than happy to just BDM it. Takes 2 minutes, no risk of a crash, etc.

Thanks DD for your work on this, karma sent. I might shoot you with PM as I have time to check the TCU version of my car. I have european Audi A6 2.7TT Tip and I have been curious to see if there can be any improvement on Tip as I plan to tune for E85 and stage 1 during this autumn

I would very much love someone to do some testing for me.

There is a least one german tuner who´s capable of modifying the tcu. Unfortunally he´s pretty quiet on how to reverse-engineer it.

At least its a good sign to see someone already did it. Just a matter of time and hard work until we can tune it.

I am super capable at this moment. The only thing that is still out of my grasp are torque converter clutch diagnostic limits, but even that won't be long. I just need a car to emulate with a bad tc.

Anyone that wants to try some tip tuning, happy to shoot some files your way.

i sent you an email about this yesterday i believe. :)

You´re files are probably pretty different to mine (BMW vs. Audi), so i´m probably not much help. Nevertheless, if you wanna share something usefull to work with IDA, i´m more then willing to listen. Otherwise i need to wait until MSS54 guys are starting to develop open source.

They are very similar. Shit, I've adjusted my Range Rover tcu as well to eliminate the partial lockup.

If so, send me a file for testing at MS43info at yahoo.com and i´m more then willing to give it a test.

Changed differential is my biggest concern as there is software for my 3.91:1 over the stock 3.38:1

Did you read your tcu yet? The BMW's are easy as you can use something like BMWscanner to read raw binary. Send it to me, let me take a look.

For shure i did ;)

http://nefariousmotorsports.com/forum/index.php?topic=453.msg58926#msg58926

First read is with shorter diff, like 3.73:1, second the exact same car just with stock diff (guess its ~3.15:1) and third read is from Z4 which should be a bit more sporty.

Daz, what about F series BMW. Any idea how to read the TCU ZF8HP70?

Would need to see it. Pics? Is that mechatronic?

From ZF6HP the control unit is build in the transmission. I don´t know if the software is changeable within a reasonable amount of work and time.

You can write to the mechatronic. I think Magic does it now. Maybe Ian will chime in.

Nor sure and no way of seeing the unit without taking a lot of the car apart. I will look up the part.

However thinking about it, i don't think it's going to be an easy job. You cannot flash anything over can/uds on this car. Can only do via built in ethernet or the bmw diag / most.

ZF6HP and up is OBD flash.
All BMW trans can be flashed using the factory tools if you can correct the checksum.
I'm not sure if ZF8HP boxes have an RSA check or not. The 6HP ones did not. Decode 0da, modify in OLS, correct checksum, re-encode 0da, flash with WINKFP.

The factory development toolset allows you to flash anything you like into any ECU. If the bootloader has RSA then it's more difficult though (needs to be patched first).
You can do a full or partial write always as well.

If you are going to be flashing stuff I recommend a BMW ICOM, as the D-CAN cables are flakey as hell.

How do you know which ZSBN you need to choose to flash with WinKFP?

http://de.bmwfans.info/parts-catalog/E60/Europe/530i-M54/feb2002/browse/automatic_transmission/

There is no list like at GS8***

You will not be using dcan on f series. Icom or enet.

Are you able to confirm that there is a value/map for gear ratio or rear axle ratio?

I wonder if its within the TCU or if its broadcasted over the bus system by the ECU.

I have found no single value specifying gear ratio. I know in vehicles with Denso ecus and EGS, it is in the ecu.

I found a constant value for rear axle ratio in Siemens MS43 (which i use), so i really wonder if its broadcasting it to the TCU. That would be so much easier to change then messing with the TCU.

I'd just like to chime in and would say that I would be very onboard with a community project if we can get faster shifts out of the tiptronic.... these things shift slower than molasses.  Then again, anything shifts slow after you've driven a Ferrari 458 and you've experienced instant shifts lol.

If I remember correctly, TCU sends the shift request to the ECU which then cuts ignition to reduce torque. If the demanded torque is reached, the TCU is shifting the gearbox.

One way to reduce shift-lag would be to increase ramp down and ramp up of the ignition advance before and after the shift. I can´t quantify how much improvement that would be, but having shift times in the range of 0.7s and 1.2s should have some decent improvement left.

Is there any constant or map that could be used to rev-match at downshifts?

ICOM is an interface, DCAN is also an interface.
ICOM does K, CAN, MOST and ENET.

You will not be able to use WinKFP to flash on F series though, you need E-sys for that. And with E-sys I don't know if someone was able to feed it modified files.

As for shift speeds. With a hydraulic torque converter based transmission the shifting speed is heavily affected by the valve body itself.
It's not like DSG where you can just increase the speed of the actuation of the clutches in software.

Any improvements you are going to have from just modifying the software will be fairly marginal. To drastically improve shift speed you will need to modify the valve body.

Yes I'm fully aware of what ICOM is. Like i said you will not be using a DCAN interface on an F series.

And yes ICOM can do ENET and it will work. There is also a separate ENET interface that can be purchased, or you can make one yourself by patching an rj45 cable to the correct obd pins. Then plug the rj45 into your computer.

I have TIP 01 S4, 00 2.7t A6, 03 AVK A6, and 02 1.8t Jetta's for loaner cars, and a bunch of TCUs around if you need anything tested.

I´ve had my last exam at Tuesday and i´m willing to get this going.

@ddillenger

How can we help you? I don´t think you´ll be willing to share an idb file or information from Bosch about the EGS?

So, as it seems that not many people are interested, at least i found the confirmation that transmission ratio is handled within the TCU controller/software.

Gear ratios, or final drive ratio?

At least rear axle, as the transmission ratio is the same for all the engines i have access to (straight six from 2.2 to 3.4L displacement)

Actually, if you check the factory SSP, what they did on the later 6HP gearboxes was to do a 'pre-fill' of the valve body by activating it with a brief square wave pulse before any torque transfer/overlap starts taking place. I believe it would be for the side of the clutch pack that would be receiving the torque load.

from there, then the opposing solenoids responsible for the two sides of the clutch pack do the usual simultaneous ramp up and ramp down to overlap for a smooth shift.

I'll try and post a pic of the graph when I get a chance.

PM sent  ;)

I found it. You are correct.

So are you willing to modify it?

Did you post your file? I haven't seen it.

This would be the one i would need Diff ratio 3.91:1 on. Should be 3.73:1 right now and is still limiting top speed.

Your firmware is just so fundamentally different I'd need another example with a different ratio to narrow it down :(

Diff ratio 3.46:1 ;)

I messed the diff ratio here! Its 3,46 instead of 3.38 like at my E46

I looked, and while a few were hopeful, nothing I'd consider definitive. What I will tell you is this:

It is a 16 bit variable, HI/LO (motorola), with a factor of .000977

So, to summarize i´m not doing it wrong:

As i know either diff is 3.46 or 3.73, i´d divide that by 1/1024 which equals either 3543 (DD7h) or 3819/3820 (EEB/EEC)?

Comparing both files in Ols there should be a changed word between both files that has such a value?

Yes, BUT you're not going to get an exact value. It's close, but not perfect.

IE, 3.52 when the ratio is 3.55, or 4.31 when the ratio is 4:33. It doesn't appear to require much precision.

This is quite interesting. I have the 0da file for my gearbox (ZF6HP19TU) _ have removed the WinKFP tags, so I have a HEX file. I have imported it into WinOLS using IntelHex. Apart from a warning (unexpected end of file IIRC) it imports it just fine. Now let's assume I change WOT shiftpoints, what will recalculate the checksum? (I assume it is stoed in the file, just like any other ECU binary).

Now again, lets assume I manage to recalculate the checksum - I then export it in hex format again, add the WinKfp tags - recalculate the WinKFP checksum - and finally save as *.0da file. WinKFP *should* then be able to write the file to the TCU successfully?

..Now if this is the case, the biggest issue right now is how to re-calculate the checksum. Does EVC make a ZF6HP cheksum dll?


Do you know is the ZF6HP19TU uses an RS bootloader?


The reasons for my questions, my transmission is limiting the torque to 500Nm. :( I'm running an Alpina TCU file right now, that has raised Torquelimit, but it will not change gears @ WOT. (The alpina is for a ptrol, I'm driving a diesel). I'd like to raise the Torque limit to 600Nm.

BTW to TCU file is Motorola 16bit HiLo right?

Do you know the factor for forced shift rpm?

Forced DOWNSHIFT? As in, the torque limiter? Or?

Rather like the rpm limiter which forces upshifts as soon as you hit that limiter.

So could you show us exactly what areas in the Alpina file have been changed relative to the stock configuration?

This is a rare chance to see where the torque limits are altered

From my experience, ~80% if the file is different even if the softwareversion is the same. There are thousands of bytes changed in such a file. Pretty much impossible to find a torque limiter without knowing where to take a look at.

Can you post the alpina file?

I could, but as you know, not everything gets published...

You wanted to know where the torque limiter was. I don't have a bmw. Just offering help.

Comparing file for 2.2L engine and 3L engine probably does the same

The fewer differences to look through, the better. You stated you are using the alpina file, so presumably it's fairly similar to yours. You also stated that you knew the torque limiter on the alpina file. That also makes it easier.

If you want to be snarky about what's shared, feel free to find another forum to post on. I don't have to justify what I share, or don't with anyone. Least of all you.

and why not...?

This site exists only because I never withheld any information I obtained. Ever.

I don't see what the big deal is about.

SP Daten files are freely available online. All the trans flashes are included within, incl. Alpina.
Hardly difficult to decode the hex to bin.

So its 3L against 2.2L


I never said that!


And again, i never said that!


The same goes for me! Don´t try to be prj. If you want to help, like you stated , feel free to do so.
If not, don´t try to fall back into your old behaviour (you know what post i´m talking about!).
Obviously i don´t help much on the Bosch side as thats not my business, again, i´m working with Siemens which is pretty different, and again i´m not a coder, nor a processor specialist like some others here.
There may be people on here that could do the stuff i´m doing in a fraction of the time and hassle, but they aren´t.

BUT, and thats my point again, I`M helping people and share without any arguing (except that single exception which i have good reasons for! [and again, like you, i don´t need to argue about them]).

If you want to get your hands on an alpina file, flash it via WinKFP and read it, its a simple process for clever guys on here and takes just a few minutes. Compare them and tell us about it.

 

I wish much more people would be like you. I tend to think we would already had definition files for the ZF5HP series if all would do the same.


Exactly! Except the E46 and E36 files, but who cares. Basic principle goes from top to down also.

There is no need to flash and read anything.
It is enough to simply decode the flashable file. I wrote a tool to do just that some time ago, because I use WinKFP to flash MSD8x after removing tuning protection from them.
30 sec flash vs 7 min tuning protection bypass flash is a big deal.

I see nothing in either of those bmw files that looks like the gear ratios you mentioned. I spent quite a bit of time on it as well.

Also, for those that wanted them, I have attached the alpina files.

Tony, would be very interested in trying this out if the offer still stands?

Considering you can count Tony's visits to the site since 2011 on one hand, I don't think it does.

GE: Gangeinlegen gear engagement
DRS: Doppel rueck schalt, double down shift
DSP: Dynamic shift program
AIST   vehicle acceleration depending on overall
tractional resistance
COUNT   driver-type evaluation meter
FastOff   spontaneous gas/pedal release
FFO   flag for upshift block
GFW   overall tractional resistance
acceleration potential
(mountain detection/tractional resistance)
KF_PSTG   pedal gradient threshold, f(PST, COUNT)
KL_AFZG   threshold for vehicle acceleration/deceleration
KL_ZS   push-pull characteristic line, f(NMO)
KW_NABMIN   minimum output rotational speed in FastOff
KW_PSTGNEG   negative pedal position gradient threshold
KW_PSTGPOS   positive pedal position gradient threshold
KW_PSTO1   offset value to detect with certainty traction operation
KW_PSTO2   offset value to eliminate increase of the pedal
position value
KW_ZSO   throttle valve offset to exit from FastOff
MMM   actual engine torque
NAB   transmission output rotational speed
NAB_MIN   minimum transmission output rotational speed
NMO   engine rotational speed
PST   pedal position
PST1   pedal position value, throttle valve value when
detecting FastOff
PST2   pedal position value, throttle valve value
PSTG   pedal position gradient
Tipp-Betrieb: tapping mode, manual mode
M-Gasse: shift gate/channel for manual selection
PSP the reacting of a selected gear position sensors
RSZ downshift function
ZUG push
SCHUB pull
nab output shaft rotational speed
DKL drive type (shifter position)
TUF powertrain transfer function Triebstrang Uebertragungsfunktion
Dki throttle angle
Dki_gradient throttle angle gradient
Dki_max maximum throttle angle
Dki_min minimum throttle angle
dn_soll nominal slip
E_Verlust amount of energy loss
GW_1 limit
GW_2 limit
GW_3 limit
GW_4 limit
GW_5 limit
GW_6 limit
GW_7 limit
GWK regulated torque converter lockup clutch
n_Mot engine speed
n_T turbine speed
S1 discriminant function
S2 processing function
S3 processing function
S4 discriminant function
S5 processing function
S6 discriminant function
S7 processing function
?_Öl oil temperature
T_MOT motor torque
T_sperr_1 blocking time since a last activation of the target slip modification
T_sperr_2 blocking time since a last crossing of an allowable amount of energy loss
LIMP HOME
Control bit of the electronic transmission control
device
NOT_G
Control bit of the transmission independent Steuermo
module "emergency operation of the electronic Getriebesteu
versal controller "
NOT_M
Control bit of the transmission independent Steuermo
module "engine-side support functions"
M_mot
Motor torque
dn_mot / dt
Engine speed gradient
dn_mot-o / dt
upper tolerance value of the motor speed
gradient
dn_mot_u / dt
lower tolerance value of the motor speed
gradient
ki
Accelerator pedal angle or throttle angle
i_gang_not
Gear ratios in the emergency operation of the
Transmission
i_not
Gear ratio in the emergency
Transmission
n_ab
Output speed
n_mot
Engine speed
n_synchron
Synchronous speed of the Anfahrschaltelementes
?
Speed ??ratio at the starting element
v_Fzg
Driving speed

Coming though with the WIN....

Friends sorry to ask you about this little off-topic question, but here is: I understand tL-lastsignal in German as "LOAD" if I am right, but anyone can tell what means tLw in Motronic documents?

Sorry for the very late reply to this thread. The RSA has been broken on the BMW and soo wewill be able to flash custom tunes. :)

..I have a lot of maps identified, but I am missing the most crucial one - the per gear torque limiter.. I know it is a 6x1, but I do not know if it is an 8 bit or 16bit map. Also I do not know the factor. :/ I do know it is supposed to be 504Nm..

Can you help me in the right direction?


..also in order to improve shift times - less torque reduction, faster ongoing/outgoing clutch periods? Or how can I improve on the shifttimes?

Clutch periods - you need valve body modifications.
Less torque reduction can destroy the trans.

There is nearly nothing you can do to make it shift faster. You can bump the fillrates which will decrease shift lag - meaning for example kickdown can be faster.
But when going through the gears this won't translate to really anything much.

Which gearbox version are you working with? 5HP or 6HP?

Well only if I'm running so short periods that the hardware is becoming a limitation? Right now clutch periods are much longer in D than in S. I suppose they can be lowered to the same levels as in S with out hardware modifications?


Yes.


ZF6HP19TÜ (What somebody calls ZF6HP21, basically it is an updated version of the HP19)

As for the fill rates - are they defined in the binary? What do I need to look for in order to find them? Those are the ones that will make paddle shifts happen with a shorter delay right?

Has anyone been successful in reading the flash thru OBD yet? I have been able to connect to address 0x02 (TCU) but can't figure out the timing. Nefmoto has quite a few variables to play with in the setup. It connects, then fails to read and disconnects.

Cheers

You can increase the pressure on the incoming clutch. That will get you pretty much to the same speed as the S. But you can't go past that speed.
The shift will just be harsher, but not faster.

There is a book from Bosch on how these work, unfortunately I think it is only available in German.
Without that book I don't think you will get very far... and I don't intend to spoon feed the info either, sorry.

No Worries, I'm not expecting to be spoon fed. :) Much more reward in learning. Do you by any chance know where I can find that Bosch Book? Reading German is not an issue.

Hello everybody,

Please if someone has it, I need the original file from Boxster TCU 0260 002 840. I need it because I changed the engine and the engine ECU from ME 7.2 to ME7.8min on a boxster. I cannot obtain more than 50% torque and I think it is limited by the old version of TCU ECU (0260 002 561 - made for ME7.2). I can easily write it by desoldering the memory. The hardware of the two ECU's is the same.

I opened a thread on this (http://nefariousmotorsports.com/forum/index.php?topic=12429.0title=) but no one seems to know the answer.

Thanks a lot for your help!

Your problem is not TCU, but ECU. You are grasping at straws.
You need to bring the car to someone who understands ME7 properly, and they will figure it out in a day at most.

Can't really suggest anyone in Romania. I have some people I sometimes do work for there, but no one I know that is well versed enough in ME7 to help you.

Thanks a lot for your answer. But you can understand that in this situation I am forced to try and fix it myself, with the knowledge I have and some help from others which know much more than me.
If you have any idea of what I can try or log or change the ecu firmware to better diagnosing the problem, I will be very grateful. I have winols with all data about this ecu and I am familiar with reading/writing/checksum of the ecu.
Thanks again.

Start by logging ignition advance and throttle opening.
If the throttle is wide open and the timing is decent, your problem is mechanical.

You can find attached the log I made. It includes the items you requested. Besides throttle angle and timing advance seems ok, the torque is limited at 50%. That is why I thought that the problem may come from external limiter, like the TCU.

Thanks.

That's a joke not a log. You pushed pedal WOT for 1000 rpm.
Anyway there is no problem in ECU. Your engine does not have any flow at WOT, that's what the problem is.

Ok, thanks a lot. I will check thoroughly all the air admission system and let you know.

Hello again,

Today I worked all day to check the air intake system. Removed completely all the parts, up to the cylinder entrance. Found nothing at all to consider as a problem. Checked again all gaskets, changed MAF for testing, checked the parts codes. All are pair with the engine ECU, no air restrictions, no leaks.

Tried to disconnect MAF and reset the adaptation values. Tried also to disconnect all tubes before throttle plate and let the engine work without air filter and MAF (electrically disconnected also). Besides the normal CEL, the engine has the same restriction in torque.

I really don't know what I can do next. Any help would be appreciated...

Also again, if someone has the flash for TCU 0260 002 840 please give it to me. Even it is not a TCU problem, this is the software that is designed to work with my engine ECU and I would like to try it.

Thanks to prj and to all!

Hello prj,

You were right! There was not enough air for the engine. But the cause was that the Variocam Plus was not working well, the valve lift is not enabled in the software version I have. Now I am trying to find a method of enabling it.
I started a new topic for this at
http://nefariousmotorsports.com/forum/index.php?topic=12564.0title=

Thanks again, you were the one which gave me the hint for diagnosing the problem.

Hello,

I joined the forum for this specific topic. Then it took me a while to locate the topic again before I could talk with you guys.

I have a project I'm planning for.
I'm using a 5sp Tiptronic (ZF 5HP19) A87.21 from a 3.4L Cayman. in another car with a LS Motor and doing it as a mid-engine.  The trans will work fine with the stock Chevy LS1. 

I have a Bosch TCM and the engine/trans wiring harness.
I was planning to replace the Bosch TCM with a stand alone unit from PCS (Powertrain Control Solutions) but they couldn't supply me with the firmware that Porsche uses due to licensing agreements. So then the plan was to pull the firmware off the TCM I had and put that on the PCS TCM2800.

I'm full of questions...  Is there a reason I couldn't use the Bosch TCM I already have?  I know the 3.4L was a 6 cylinder but the tans doesn't know that. What I don't know is what engine inputs are supplied to the TCM so it knows what it needs to work correctly. 

I also Plan to use a stand alone ECU with the LS1 that has connections for the TCM to connect into it so they can talk nice-nice to each other. There again I need to know what the TCM needs to see from the engine/ECU so I can make sure  That is what it gets.

Any assistance would be a huge help..

Thx,
Kevin

Hi Kevin,
I would suggest at a minimum to use the 5HP24 trans versus the 5HP19. The 24 has more robust components inside versus the 19.

In order to use the stock bosch TCM you would have to be able to send and receive can bus communication with the stand alone controller that you are using for the LS.
As I don't think that is possible a stand alone trans controller is probably your only option.

No room in there for say a 6l80 from a corvette with the rear dif?
That would be much much easier from a programming stand point with HP tuners and would probably also eliminate the need of the stand alone ECU as you could just use a newer LS controller like an E38

Hello Kevin,

could you upload the flash content of that porsche tcu? i´ve tried pretty much to get my hands on one of these without success and i would like to give it a go in IDA.

For reference, here´s what gets broadcasted from the ecu to the tcu over can bus.

Huge thread bump, but was there much more progress after this?  My E39 525D has a bad habit of downshifting when torque/load increases at hills.  I'd like to try and keep the torque converter locked up so that it remains in 5th gear, but I'm not too sure how.

Does anyone have any advice for this?  I've read through the EDC15 funk but there's not too much in it.  Do I need to flash the TCU or am I able to trick the TCU about the engine torque? 

What trans is in it?

I believe it's a ZF 5HP24 but I'd need to check.  Small green sticker on the base.  Software number is 7518307 in INPA.

According to BMW Fans info i´d say it´s the 5L50 GM gearbox, which uses a GS20.
You´re lucky, there is currently progress in the MS4x dev team ;-)

Will take sometime until a get a test mule, but there is high hope :)

I think you might be correct and it's the GM box.  I'll get it on a ramp soon and check.  I've downloaded the flashing software from MS4x but it cannot find my ECU.  I'll have a play later tonight!

made a little progress on my own pictured is a trans control unit from a usdm 2005 auto bew tdi. the tcu tune file is located on a am29f101a plcc32 chip. dumped the file and so far have found requested torque relief from trans, and shift times. anyway heres some pictures and location if anyone else is interested

There are no "shift time" maps in any ZF trans. Only adaptation targets for GLS, but GLS is not active on WOT.

It´s currently under limited access.

Do you have an idea when it won't be?  I'd have wanted to download the flash, but I can't, let alone even see that the software sees the ECU.

I don't mind paying for this (if it's cheap), but I ain't forking out hundreds on a £500 car.

It will be published when we are confident. When will that be you ask? Not totally shure. At least a few weeks.

Hello ! help me with the choice, now I drive a passat b5 + 2001 (awt 4B0906018DF (ST2)) manual gearbox, front-wheel drive, I want to buy a passat b5 + 2001 4 motion (2.8 amx) me 7.1.1 automatic transmission (FAR) 8D0 927 156 DK, I want to put my charged 1.8t (220+ horsepower) instead of the AMX 2.8 engine, most likely I will get an error ((18249 - Engine Control Module / Transmission Control Module Incompatible P1841 - 35-00 -)), tell me if there is the ability to adapt the 1.8t engine to work with the FAR transmission (2.8)

Hello all ,I’m read a long time this tread,I’m request tu read Tcu for GS 8.61xxx on OBD port?
Car ist 2,5 v6 Tdi 4 motion 5hp19 gearbox year 2001.
Have anything information?
Thanks in advance


Gesendet von iPhone mit Tapatalk

Yeah, you can't do that.

Hello can tell me what I’m need for this job,hardware and software.
Thanks in aadvance


Gesendet von iPhone mit Tapatalk

Are you trolling me/us here? Can't you read what I've written above? Also why do you have to PM me as well when I have literally spelled it out for you white on black: YOU CANNOT DO THAT. There are no tools that will read your TCU through OBD. Is this more clear?

Hello I’m not can send pm,you can contact to my email Adress turrremoffo@gmx.de
Thanks in advance


Gesendet von iPhone mit Tapatalk

I have 2 PM's from you and I'll keep repeating what I've already said. YOU CANNOT read your TCU through OBD.
Du kannst dein getriebe nicht uber OBD auslesen, is this more clear?

Alles klar das ist doch mal eine Aussage;-)
Mein Englisch ist nicht so prickelnd,habe was nicht ganz verstanden und der Post.
Erstmal danke für deine Antwort.


Gesendet von iPhone mit Tapatalk

Dump Flash & eeprom TCU 4B0927156BG 0260002724 Audi 2.5 V6 AKE index FEF,FAU.
Anyone has a tuning/mod version of any of these TCU 4B0927156X*?

Sorry for bringing up this pretty old thread.

At the moment I work on my 4HP24A of my Audi C4 S6 V8. I recognized that this TCU seems to be a littl ebit uncommon because of the dynamic shifting stuff.
Does somebody has some 5HP24 transmission maps available to show? (location I won't care if this is secret)
Converter clutch, shifting stuff (eco, sport etc) etc?

In this thread or via PM - as you would share something. Thanks!

I'm looking for GBA_8AB4.drt ( ECM Titanium ) driver.

just question i have been racking my brain i have pulled my TCU file off my 03 A6 2.7t Quattro but i Cannot find a .xfd file for audi i have found for RS6 5hp24 and the Bmw 5hp19 but none match up does anyone have one for the Audi 5hp19fla i just wanna see what maps are on it and also possibly try to tune my TCU alittle. id really appreciat the help... please no Flaming or being an asshole its just a question thanks

Hi! Can you share the xdfs which you found?

Edit: Found it in my Google
There is a .XDF on here for a RS6 5hp24 in the definition section, if you can't find it let me know and I'll repost Definition here once I get on my Computer

Anyone have any def for 6hp19?

I don't remember but I'm sure this is Audi, if it is BMW the Maps are offset by a few  space don't remember how many but you can see by going in XDF perimeters and viewing
raw .bin file

Edit I uploaded from my Google account not my Computer  so I couldn't open it to recall haven't looked at it in a few years lol

Have you this original?

Hello friends!

I was so excited to see this THREAD that has been going on for ten years.

Coincidentally, I bought a allroad 2.7 and I read out the TCM bin. Besides, I have another B6 3.0 TCM.

Now I uploaded and share you.

BTW, could anybody provide some imformations to help me to change the TCM diff ratio?  I have swaped a different code tranny but TCM throw into Limp mode (4th gear).

Thanks in advance. :)  ;)