NefMoto

These forums have been moving fast lately, and I like it.

Let's start a thread on how to set actual readiness on emission items, setting them as unsupported and also forcing readiness.

I will share a list of maps I use for setting them as unsupported:
SAI
CDSLS - Eurobyte (self explanatory)
CLASLVE - Plug
CLASLPE - Pump plug

EVAP
CDTES - Eurobyte - LDP Diagnosis
CDLDP - Eurobyte - EVAP diagnosis
CLATEVE - EVAP plug
CLALDPE - LDP plug

This is off my notes and the German to English translation I could get.

From the S4 wiki:
Rear O2 Sensors

    CDKAT - Cat diagnosis in OBDII-Mode. Set to zero to disable rear cat DTC

If you want to remove your rear O2s entirely, also set these to zero:

    CDHSH - Post cat O2 heater diagnosis
    CDHSHE - Post cat O2 heater amplifier diagnosis
    CDLSH - Post cat O2 sensor diagnosis
    CLAHSH - Error Class: Bank 1 post cat O2 sensor heater
    CLAHSH2 - Error Class: Bank 2 post cat O2 sensor heater
    CLAHSHE - Error Class: Bank 1 post cat O2 sensor heater amplifier
    CLAHSHE2 - Error Class: Bank 2 post cat O2 sensor heater amplifier

You may also have to change these to disable rear catalyst lambda control (untested)

    CLRHK - Code word for Lambda - Control post cat on/off: set to odd? (original value 72)
    CLRHKA - Code word for Lambda - Control post cat: set to 1? (original value 0)

EGT

If you want to remove your EGT sensors:

    CDATR - Configuration byte diagnosis exhaust gas temperature regulation
    CDATS - Configuration byte diagnosis exhaust gas temperature sensor
    CLAATR - Error class exhaust gas temperature regulation
    CLAATR2 - Error class exhaust gas temperature regulation bank 2
    CLAATS - Error class exhaust gas temperature sensor
    CLAATS2 - Error class exhaust gas temperature sensor bank 2

---------------------------------------------------------------------------------------------

As far as setting readiness, I have a few ideas. There must be lambda maps for SAI. Maybe Tony or someone else that's more knowledgeable than me can pitch in.

I will update my posts with any info you guys share.

Thanks :)

great thread.  we should definitely all coordinate until this is certain information!

let me ask you something about oxygen sensor(s) readiness.

from the 10 codes in the emissions dtc's, i have every one set to zero except two.
currently i have CDHSHE set to 1 and CLRHK set to 72.

a few questions:
a)  if i set CDHSHE to 0 would my readiness come up OK for the oxygen sensor(s)?
i'm not sure why CDHSHE is set to 1 when all of the other values are set to 0, but it currently is--- i should probably just diagnose this myself, but just thought it safest to ask first.
b)  do we know what to do with CLRHK?  a value of 72 seems quite strange.  do you suspect we just set it to an odd value, so 73?  thoughts?

In my experience, to disable anything completely you just set it to 0 ignoring what value it had previously  ;)

^^^Not always true.

I will post what I have changed in my file next time I get on the laptop.

9/10 times  :P

VCDS displays "Passed" for all readiness checks. See below for secondary O2 changes in my file.

All set to zero:
CLAHSH
CLAHSH2
CLAHSHE
CLAHSHE2
CLALSH
CLALSH2
CDHSH
CDHSHE
CDKAT
CDLASH
CDLSH
CDLSHV
CWDLSAHK

After flashing these changes, I ran the readiness checks for the O2 sensors per the Ross tech wiki.
http://wiki.ross-tech.com/wiki/index.php/Readiness_-_APB_Engine_Code

wow... OK this is awesome.

in nyet's most recent XDF i'm not finding definitions for:

CLALSH
CLALSH2
CWLSAHK


also not to nit-pick, but straight from that link - did you run all of these:

O2 sensor heater test
Post-cat O2 sensors readiness test
Pre-cat O2 sensors response time test
O2 sensor control test
Post-cat O2 sensor aging test

These 5 tests?

Cheers!

CWDLSAHK
Code word CWDLSAHK for probe aging after KAT
0x18663

CLALSH
Error Class: Lambda Probe post Kat Bank 1
0x10717

CLALSH2
Error Class: Lambda Probe Post Kat Bank 2
0x10718

Honestly, some of the parameters listed may be overkill, but I don't have time to play around with it too much.

I'm not really sure which tests I ran, I just started with the first one and clicked through them all. I was trying to check if any were failing. All of the post kat tests (everything coded out)should already display "OK" without running them.

i'll send this link to nyet to also add these 3 to his next map-pack...

I was looking into possibly disabling all readiness testing and came across some interesting codewords. I stopped working on it once I had my readiness set, but I am still curious. Has anyone else looked into these?

CWCDCUM
0x1843B
Code word to switch the CDC's on the market
1 = OBDII (NA)
2 = EOBD (EURO)

CWOBD
0x181BE
Codeword for configuration OBD certification has proven
CWOBD in dec:  Certification by:
01                      OBDII-CARB
02                      OBD-EPA
03                      OBDII-CARB + OBD-EPA
04                      OBDI
05                      no OBD requirements
06                      EOBD

CWSCTMDE
0x181BF
Code word to switch off certain scan tool modes / Services (bit = 0 -> OUT)

Scan tool mode codeword actually seemed very promising, but also somewhat dangerous.

Wait a sec.  Is it CWLSAHK like in your earlier post

or

CWDLSAHK
Code word CWDLSAHK for probe aging after KAT
0x18663

like in your most recent post?  Are there actually two things?

Fixed. It's CWDLSAHK.

All that info was available in the S4 Wiki anyways...

False. The SAI & EVAP were not there. Also there is some NOP code floating around that disables all the emissions but that's not in the wiki either :D

Gonzo: thanks for the info btw :)

I'll be updating the wiki and xdf with SAI/EVAP information provided time permitting...

Are the NOPs you refer to required for readiness and rear O2 delete?

NP!

The NOP's disable all the emission codewords altogether.

yea but are they required for readiness?

It just sets all of them to "Not Supported"

I guess my question is, what is the best way to set full readiness if you have completely removed your rear O2s?

modify the dtc function to set readiness?

I don't think the DTC flags directly affect readiness. I think that the CARB flags need to be manipulated.

Correct. Just deleting the DTC's will not get you readiness.

I've done all the tests and coded out tons of stuff.  Still no clue on how to get oxygen sensor readiness to read its OK with my rear o2's removed / coded out properly...  I'm with nyet on this one.

When you run through the readiness test with VCDS, what test is failing? Remember, oxygen sensor readiness includes the front sensors as well.

I'll re-run the full list of things tonight and let you know precisely what works and what doesn't.

Modules DIMC and TC6MOD seem to outline the process of readiness testing.

What I am saying is modify the function that SETS the DTC to actually SET the readiness instead of the DTC.  I'm talking about a code modification, not a calibration change.

I may have a way to pass O2 readiness without having a cat. You must have a rear O2 sensor plugged in though. Let me see if I can find the info and post it.

You can modify the thresholds, but i don't remember exactly how I used to do it. I have since yanked my rear O2 s and used the bungs for my LM2. I will check when I get back to a computer (posting from my phone)

readiness failure with no rear O2s plugged in but coded as described in the s4wiki

Just to confirm here, nobody has tried the CWKONLS renumbering and how it relates to readiness?

Set CWDLSAHK to zero

I am interested in this as well. I will try to look in DIMC tonight to see if the bytes set by CWKONLS are the same ones used to determine the readiness testing for the rear O2's.

It is set to zero, unless I have the wrong address..

0x18663?

No, that is correct.

I don't see CDLSHV or CDLASH on the Wiki. Are those set to zero in your file?

Good eye! No they aren't zero.

They are in my map pack, but not the wiki.

I set those to zero and never got it to work...  Maybe I needed to run the readiness tests with them set to off.

I dont know is that what you are looking for, but I set all my redines passed.
If you unplug some part like lamda you will get code, and you can put resistor on it and all is ok.
But if you get code sai incvorrect flow, you cant disable it mechanically.
So look (551M) 0x18194 there is all your rediness bytes.
Put 0 and rediness says passed and it does not matter if you have faultcodes all is still passed.
 Hope your understand what I mean.
Regards:
Janne

The information below is my understanding on how readiness is set. All the information was obtained from studying the FR. Do NOT blindly disable functions with the code words below, as this may have other affects.

Below is the breakdown of the readiness byte.

The "Init bit" is checked to determine if readiness is required. If the init bit is zero then there is no fault check and the respective readiness bit is set to zero.

If the init bit != zero then the faults listed under "Errors checked" are tested. If no faults are found, then the readiness bit is set to zero.

The "Codeword" listed sets the init bit. If the codeword is set to zero, the init bit is set to zero, no fault check is performed, and the readiness bit is set to zero.

Readiness Byte

Bit 0 : Catalytic Converters
Init bit :             B_katfz
Errors checked : E_kat
                        E_kat2
Codeword :       There is no codeword to set B_katfz, but CDKAT disables creation of the error class.

Bit 1 : Catalyst Heating
Init bit :             B_kath
Errors checked : none
Codeword :        None, B_kath is intialized at 0. This test is not run.

Bit 2 : Evaporative Emissions
Init bit :             B_cdtes
Errors checked : E_tes
Codeword :        CDTES
Init bit :             B_cdldp
Errors checked : E_ldp
                        E_tesf
                        E_tesg
Codeword :        CDLDP

Bit 3 : Secondary Air Injection
Init bit :             B_cdsls
Errors checked : E_sls
                        E_sls2
                        E_slv
                        E_slv2
Codeword :        CDSLS

Bit 4 : Air Conditioning
Init bit :             0
Errors checked : None
Codeword :        None, this test is not run.

Bit 5 : Oxygen Sensors
Init bit :             B_cdlsv
Errors checked : E_lsv
                        E_lsv2
                        E_lsh
                        E_lsh2
                        E_latv
                        E_latv2
                        E_lash
                        E_lash2
                        E_latp
                        E_latp2
Codeword :        CDLSV

Bit 6 : Oxygen Sensor Heating
Init bit :             B_cdhsv
Errors checked : E_hsv
                        E_hsv2
                        E_hsh
                        E_hsh2
                        E_hsvsa
                        E_hsvsa2
Codeword :        CDHSV

Exhaust Gas Recirculation
Init bit :             B_cdagr
Errors checked : E_agrf
Codeword :       CDAGR

This did the trick. Readiness 100% Thanks.

nyet - are your rear o2's still plugged in?  did you have to do any tests?  or just set CWDLSAHK to 0?

Nope. Rear O2s totally disconnected. I was missing CDLSHV and CDLASH.

I ran through readiness with the VCDS wizard (after warming up the car to 80C)

nyet - did you touch CDLSV or leave that alone?

Didn't touch CDLSV

The VCDS readiness worked with what is mentioned here!  This means that the wikis up-to-date.

Quick question, when you guys are modifying these fields, does it set readiness to pass automatically? They have come out with some new equipment in the tri-state area that can detect if a field has been set to pass. My guess is that it checks for readiness=OK and then resets to make sure that PASSED doesn't automatically come back. If it does, it fails that field.

Would these directions get you around that or would the machine have the upper hand?

It would be safest to assume that you can detect these changes. I'd suggest trying to get access to the equipment you are talking about to test it. In theory, it is definitely possible to detect that the fields have been modified to always set readiness.

However, the rear O2 delete is only one part of the O2 readiness. The primaries still have to be run through the readiness process to go from untested to "PASS".

I have stated a million times that this isn't real readiness. All you are doing is disabling emission components and setting them as not supported.

When you go to an inspection station they will read not supported for Oxygen Sensor, SAI, and EVAP and it will run it against the database of vehicle it has. When it does that and it sees that your car came with all those from factory, it fails you. Some states even flag your VIN.

Although ILLEGAL (federal offense to tamper with emissions equipment), to get around these emissions check you can either A. leave O2 sensor plugged in with a spacer or B. still leave them in and change thresholds. I don't frown upon nor condone any of these options. Just throwing them out there for educational purposes.

The only time that I see this being an issue is when the entire function is disabled. If the changes do not disable the test itself and only disable creation of the error class, then I don't see how this can be detected. I believe that this can be done without modifying the code or adjusting the thresholds.

A simple test would be to clear codes and run the readiness checks with VCDS. If a readiness bit is not reset initially or an individual test is automatically set to "OK", then we will need to come up with an alternate way to defeat that test.

When I looked into changing thresholds, it looked like this would have collateral affects.

Gonzo, in your past replies, you made it sound like there was some mystery smog test that we were unaware of. You never presented anything concrete or any possible solutions.

If you disable the error class for the plug and the ECU decides to run the test for readiness and the emissions equipment is not there, will it set readiness? No.
Granted I haven't had time to do more testing but the only way to fool emissions is to lower thresholds. Once I get my project car running I'll do intensive testing.

Anyways, open up VCDS and go to the OBD-II module and scan for readiness that way and show me what it says. If any of your deleted emissions equipment says "ready" then you will be my freakin hero <3. Seriously.

http://www.txdps.state.tx.us/vi/misc/faq/faq_obdii.htm#SystemsChecked


NJ has the same rule regarding readiness. Only 1 monitor may be not ready or not supported for cars 2001->
Texas people may get away with setting monitors to not supported but I know the NJ people do not get away with it unless they go to a private inspection station.

If the error class is coded out it will show passed. The test will run, no errors will be found, and the bit will be set to zero.

Do you know of something being checked other than the readiness byte? The bits of the readiness byte only have two states, passed (0) and failed/incomplete(1). There is no unsuppprted. The only way to check if a feature is unsupported would be to clear codes and run the tests individually. If the test is passed without testing then the assumption would be that it is unsupported.

The readiness byte is displayed in the center of of the display on the readiness screen. In the picture below all bits are zero as all tests are passed.
(http://meistergaugefaces.com/vortex_logos/readiness.jpg)

In this picture, two bits are set to one and as a result two test are failed/incomplete.
(http://i56.tinypic.com/rt2wdz.jpg)

I will try to check the OBDII module, but I am almost positive it reads this byte as well.

Check the OBDII module and let me know. Anybody can get "readiness" on VCDS but it doesn't fool inspection.

Someone on this forum sent me NOP code that sets "readiness" on VCDS but what it really does is stop 'evsup1' from initializing. It effectively kills all supported monitors.

Edit: The code still shows all monitors as not supported on OBD-II mode so nothing innovative.

Now that sounds like it would raise serious red flags. All readiness tests would be skipped.

Apparently the OBDII module is not available in 409.1 or VCDS-Lite. Maybe Nyet or Nehalem can give it a shot.

i've been following and would gladly test, but i don't seem to follow your proposal.  what must be done to test this?  be clear please, i'm dumb.

Instead of checking readiness the normal way (select control module, engine, readiness), select ODBII from the initial screen and select readiness. Post your results.

I haven't tried the OBDII thing, but I'm LOOKING at my latest smog cert, and it shows all readiness codes as "PASSED".

YMMV, of course. Your particular smog testing center my do something different than mine, etc. etc.

Good news, I don't think it gets any tougher than Cali.

I wouldn't think that it should be a problem because, unlike the NOP that Gonzo is talking about, the changes we made shouldn't have affected any of the bits of evsup1.

Sorta. CA smog stations themselves are notoriously lax .. and many states have MUCH tougher inspection procedures. I'd hate to make any guarantees to anybody here..

Tell me what bits you wish me to set to 0 on my bench ECU and I'll gladly do it and take a screenshot of the OBD-II module.

Also for the guys that have a VAGCOM 409, just download VCDS Lite and use that for the OBD-II module. Of course, nothing beats an official VCDS interface but this should work :)

These:

Cat heating and AC should be the only ones unsupported.

VCDS-Lite only tests compatability just like 409.1. Unless I need to update it.

I'll do it tomorrow when I get back to the shop. I don't do any tuning on the weekends  :P

But just so you know, I have 0'd out those bits and it gives me unsupported but I'll give it a shot again and show you.

Can you post a shot of the Engine control module readiness screen as well?

Update:

With those bits set to 0, Connecticut emissions computer reads it as 'Unsupported'. However, this did not prevent it from PASSING. YMMV as always, but it works for Connecticut.

^lucky.

And told you guys. It sets it as not supported.

I figured you didn't post your results because they weren't what you were expecting.

I'm not sure why they would show as unsupported because none of those changes should affect evsup.

What bit was unsupported? Oxygen sensors?

Everything that you set to 0 gets set to not supported (specially the 'euro-bytes').

E.g
CDSLS
CDKAT
CDLSV
CDLASH
CDHSH
etc

None of the codewords used are part of evsup...

Homie if you set CDSLS to 0, SAI will show up as unsupported.

Unless my memory is failing me hard right now, which I really really doubt since I do this on a daily basis.

Agreed. I didn't touch CDSLS.

I will try setting to 0 these maps and will let you know if it works:

hey everyone!
Maybe you could tell me where my DTC table begins?

Because I don't have damos file for my specific sw, but bits in 0x18190-0x181C0 range seems to be OK. Now I don't know how to disable actual DTCs:

17526 - Oxygen (Lambda) Sensor Heating; B1 S2: Open Circuit

        P1118 - 35-00 - -

17522 - Oxygen (Lambda) Sensor; B1 S2: Internal Resistance too High

        P1114 - 35-00 - -

Because all the other addresses given are way off... :) I even don't how to recognize DTC table start so I could atleast try Tony's method of DTC error address calculation posted here: http://nefariousmotorsports.com/forum/index.php/topic,567.0title,.html (http://nefariousmotorsports.com/forum/index.php/topic,567.0title,.html) Any help would be appreciated ;)

This thread saved my ass today when it came to getting my car inspected in NY thanks guys !! :)

Add CDLATV to the list. This solved the problem of O2 sensor readiness not completing on it's own.

phila: i didn't need CLATV... what is it? Should I add it to the wiki?

CDLATV not CLATV...

O2 sensor readiness would not finish without forcing the test with VCDS. The conditions to begin the test would never be fulfilled. ATVshould be disabled and it allows the primary sensor testing to complete on its own.

My CDLATV is stock, and I had no problems passing readiness w/o O2 sensors

So I've set my CDTES and CDLDP to 0, but I still get a "Leak detection pump" code.  Does anyone know the addresses of CLATEVE and CLALDPE?  I can't find them anywhere.

I need the same and I haven't been able to find anything yet :(

CLALDPE-0x10712
CLATEVE-0x10747

Thanks!

Wait ... isn't it the other way around?

Ah nevermind I mixed things up :) So to make my P1473 go away I had to zero out CLALDPE. I was confused because
I mixed CLALDPE with CLATEVE and CLATEVE was at 0 already so I was scratching my head :)

I'm sure most people know this, but I don't think I've read it. Each bin may have different "Prokonol" bits in it, but no matter the bits it has they're in alphabetical order. This doesn't necessarily define anyone's bin, but it helped me when I was looking. Just thought I'd throw that in this thread for anyone reading it.

Does anyone know if it is possible to say use a Euro code, and change these settings for use with a NA car?
Essentially recoding it for NA use..?
This would be useful for say 6 speed cars ithat were availabe in the EU but not in NA but someone does a 6 speed swap...

Correct!

Thanks to both of you!

Sure, I think I stared at that section for hours;), days even...

for the past few weeks I was analyzing bunch of funktionsrahmen functions and found that to completely remove cat/sai/post cat o2 isn't that easy... Sure you can easily force READINESS to be PASSED but that doesn't mean that you are actually disabling functions. For starters  cat converter variables control even minimal ignition angle and NW functions.

I'll try to analyze everything and disable CAT/SAI/POSTCAT O2 in EVERY SINGLE FUNCTION....

For starters let's go to PROKONAL and disable all the usual bits:
CDHSH=0
CDHSHE=0
CDKAT=0
CDLASH=0
CDLSA=0
CDLSH=0
CDSLS=0

Now we go and change these maps:
CWKONABG=0
CWKONLS=1 (for 1 bank first o2 only)
CWLSHA=0
CWSLS=54 (gonna upload SLS function schematics later, but for now just leave this val)

Now let's analyze BBKHZ function (please look at the attached schematics). Too bad there's no complete BBKHZ schematics for turbo engine applications...

I don't care about readiness here, because they just don't check that here.

But if you want to disable BBKHZ and SLS, so that they don't get activated, just set CWKONABG to 0.
http://nefariousmotorsports.com/forum/index.php?topic=1788.0title= (http://nefariousmotorsports.com/forum/index.php?topic=1788.0title=)

For me this was the most logical way of doing it, since you are basically telling the ECU that the car has no catalytic converters.

My car does have two catalytic converters, and the only difference now is, that the exhaust smells bad a bit longer on warmup.
But at least it does not dump loads of fuel into the engine and retard the ignition angle. The SAI pump never gets activated anymore either on my car.
My fuel consumption was quite drastically reduced on shorter trips with cold engine as well.

FR:
And:

If you zero CWKONABG then B_katfz is never set, due to that BBKHZ never gets activated, and B_kh is always 0, so SLS never gets activated either.

What about KFNWKHLLE and KFNWKHE from NWSOLLE? Only info I found about these is that these are enabled when fnwkhe=1. No info on how fnwkhe is set though...

Yea there is:

If BBKHZ is not activated, it is pretty logical that fnwkhe will be always 0.

I know this might be overkill and you can disable SLS, but for the sake of better understanding and practice I did complete shutdown of function, including every single map...

P.S> Since all the me7 functions are connected to each other, there are more maps to edit. Gonna keep you all posted if there's interest ;)

Additionally revisited BBKHZ

Huge DSLSLRS function

CWDSLSY:
b0   b1   b2   b3   b4   b5   b6   b7
-----------------------------------------------------------
0     0     1     1     X     X     0     1     

CWDSLSA:
b0   b1   b2   b3   b4   b5   b6
---------------------------------------------------
1     0     1     1     1     1     0     

CWDSLSAD:
b0   b1
-----------
1      0

last few shots

Yikes... need some sort of summary when you are all done.. that is a lot to digest

yah, this is an intense amount of stuff to digest.  lets make this easy:  list of tables, list of changes, description of effect.

I'll try to sum up everything, but before that I really need your help in defining some variables to check if my logic is correct... Anyone's good with finding variables in memory using ida?

To completely be sure 100% I need someone to find addresses at least of these conditional variables (to 100% be sure of BBKHZ) (see attached file):
B_DSLA
B_FASLA [me7logger found]
B_KATFZ
B_KH [me7logger found]
B_KHA
B_KHAB [me7logger found]
B_KHLL [me7logger found]
B_KHLLE
B_KHLLMX
B_KHN
B_KW
B_LMSSLOF
B_MSLOFF [me7logger found]
B_SLPOFF [me7logger found]
B_SLSFZ
B_TRKH [me7logger found]

Additionally:
FKHAB
FLAKH [me7logger found]
FLAMKH
FMDKH [me7logger found]
IMLPR [me7logger found]
MLSU
NFSKH
NLLKH [me7logger found]

I don't really see the point in this.
You can shut everything down setting a single bit, why bother changing a million variables that never ever will get accessed?

I started this to better understand logical schemes of FR. Also there are few things I want to do like fixing SAI -100% secondary air in VCDS and bunch of other things that we get when we zero out bits. Additionally I want to accelerate all the checks by setting their minimal active time to 0 ;)

You mean bits in PROKON words?
Unfortunately FR and real life differs sometimes.
Try for example change bits in CWKONLS or CWKONABG according info from FR and you will see interesting side effects on some ECUs...  :)
 

Just to add some confirmation to the rear O2 code out, I just passed PA emissions inspection with flying colors with no rear O2 sensors.

They didn't even bother to visually check? :D lol

What side effects do you mean?

Just a quick report on my experience with CDLATV...

Previously, I ran an OTS APR tune that still had the rear O2's enabled.  I was throwing Warm Up Catalyst/Efficiency Below Threshold codes all the time.  Lately I've been running the NOTORIOUS VR Stage 2++ file which has rear O2's coded out but has CDLATV left on.   

Inspection time rolled around and since I'd been running this file for ~750 miles, I was curious if readiness had set itself.  Both VCDS-lite and a cheap handheld ODB2 scanner showed the O2 test as fail/incomplete.

I then ran through all of the VCDS steps to force running the readiness tests.  The tests all came up clean and all the readiness bits were good, including the O2 one.  The car passed Missouri inspection with no issues.

I was curious about the CDLATV though so I turned it off on the next version that I flashed.  I cleared codes and checked about 50 miles later.  All of the tests had passed on their own, including the O2 one.  All readiness was clean. 

This supports that CDLATV should be turned off to allow the tests to complete in the most hands-off and natural way but with this left on, the ross-tech method still works.

My guess is that a few of us are running versions of the stage 2++ file.  If you are and have an inspection coming up, make sure that you check your readiness.  If O2 isn't setting you can zero out CDLATV or run the ross-tech steps. 

SRY* thresholds

I have been meaning to test and confirm this for a while now before posting, but I haven't gotten the opportunity and I don't see myself getting to it anytime soon, so I figured that I will post it up now.

After analyzing DIMC, it appears that readiness can be set regardless of error flags by setting the SRY* threshold to zero. With the threshold set to zero, the only requirement for readiness is for the cycle Z_* flags to be set. The error E_* flags will be ignored.

I can post up the M box locations of all the SRY* thresholds if anyone is interested.

For sure. I can give it a shot this weekend and report back.

SRYAGR 0x810974 Threshold for Readiness formation EGR diagnosis (unused)
SRYHS   0x810975 Threshold for Readiness formation O2 sensor heating diagnosis (ready bit 6)
SRYKAT 0x810976 Threshold for Readiness formation catalyst diagnosis (ready bit 0)
SRYLS   0x810977 Threshold for Readiness formation lambda sensor diagnosis (ready bit 5)
SRYSLS 0x810978 Threshold for Readiness formation SAI diagnosis (ready bit 3)
SRYTES 0x810979 Threshold for Readiness formation canister purge diagnosis (ready bit 2)

ready bits 1,4, and 7 are not tested and automatic.
 

Thank you, very useful intel :)

BTW: Almost everyone now has disabled postcat o2, cat and sai... So, I want to ask you all if you found any downside to this? I mean, we disable error classes, readliness checks, but in the end diagnostic functions are still there and they set certain variables and ecu still knows that there are problems with these components (like missing post cat o2 sensor for example). Doesn't that mean that even we see no dtcs and readliness checks we still get emergency/secondary operation (same as just disconnecting components minus DTC)?

Does these zeroed out maps

CDKAT - Cat diagnosis in OBDII-Mode.
CWDLSAHK (0x18663) - Code word for probe aging after KAT[23]
CDHSH - Post cat O2 heater diagnosis
CDHSHE - Post cat O2 heater amplifier diagnosis
CDLATV - Lambda sensor aging diagnosis (tv) in OBDII-Mode (inverse: EURO-Mode)
CDLASH - Lambda sensor aging diagnosis (SHK) in OBDII-Mode (inverse: EURO-Mode)
CDLSH - Post cat O2 sensor diagnosis
CDLSHV - Lambda sensor sensor interchange recognition
CLAHSH - Error Class: Bank 1 post cat O2 sensor heater
CLAHSH2 - Error Class: Bank 2 post cat O2 sensor heater
CLAHSHE - Error Class: Bank 1 post cat O2 sensor heater amplifier
CLAHSHE2 - Error Class: Bank 2 post cat O2 sensor heater amplifier

actually prevent ecu from editing trims due to these non existant components (cat, postcat o2)?

The codewords shut down entire functions for project specific configuration, so they are there so that the same software can be used with/without certain components. The error classes shouldn't even be necessary because the actual diagnosis is shut down.

I have been meaning to take another look to confirm that we have everything outlined correctly, but I always get sidetracked into something elses and all signs are good on my car, so it isn't a very high priority atm.

Reason I'm asking this is because with everything done I can't pass readliness for Oxygen Sensors, unless I zero out both front and postcat sensors. Other problem is crazy front sensor control.... It feels like car is needing way more fuel, but front o2 doesn't enrich mixture. Even tried to disconnect MAF to eliminate this possibility but then car literally ran like shit (and before that even with disconnected MAF I could drive pretty good because my front o2 always seemed to work 100%). Right now I see only leaning procedure from front o2, very rarely going up to +5%. And my front sensor is brand new bosch (I even changed it because I thought that my o2 died).  One more thing: me7logger on idle shows me that AirFuelRatioCurrent is 0.75 that means it is dead basically (+-25% o2 limits)! Don't know what could be wrong...

I've attached some idle logs (don't know if I should try full throttle due to possible lean problem) and my bin and finally definition file... Would you care to take a look?

btw, in ME7.1, improperly coding out EGTs when you don't have any plugged in results in req AFR .75

Could it be related to your problem?

Have you changed CLRHK?

I set mine to 5 to disable post cat lambda control and reset atv.

Edit: glanced at your log on my phone...wtf is up with your rear O2 voltage!? Front sensor voltage looks ok and definitely not reporting 0.75 Lambda.

I have no EGT sensors... And looking from prokonal there were no EGT sensors originally too (this is converted ECU SW from 4B0906018DC). I've transfered most of the maps from old ecu sw but maybe there are more that could lead to 0.75 requesting? Which functions could lead to this AFR? Anyway to test which is responsible by disabling one by one?

 lamsoni_w -> 0.75V
Also  mdverl_w is loosing torque even on idle...

Now about rear o2... Are you speaking about  ushk? Because it is completely disconnected...

I have no CLRHK only CLRSHK and I have tried to set it to 5 (originally it was set 16 (bit4 => 1)), but still nothing...

UPDATE: I dug deeper and found out that lamsoni is mainly set by lamsonb from GGLSU1 subfunction. Map responsible for this is LALIUS. Looks like I haven't copied over linearization from old soft...

I've looked into whole GGLSU function and copied over maps from old soft - the only few maps that were different:
CWGGLSU, KFBBLSU, FLAMPA and LALIUS :)

Gonna try new version now and report results... :D

I could be wrong, but I'm pretty sure that lamsoni_w is actual lambda. LR on ME7.5 is governed by lamsoni_w vs lamsbg_w, no?


Nothing to do with fueling and it was my understanding that mdverl_w will usually  be > 0. I've gone through MDVER, but I have not logged it yet.


Mine are disconnected and read 0.44v.


CLRHK (ME7.1) == CLRSHK (ME7.5)

Set CWKONLS to correct number of your o2 sensors ;) And you will see ~0V as it should be with disconnected sensor... :)

As usual, if you guys find things i need to add to the s4wiki, PLEASE pm me or edit the page yourself :)

Sounds like you found the problem in LALIUS.


Ahh...gotcha. It shouldn't make any difference anyway as nothing should be using it since everything is disabled. I think I had a reason for not changing CWKONLS, but now I will have to go back over it and see exactly everything it affects.

Please do... I haven't scanned through whole FR for this

CWKONLS set/clears B_lsv (B1S1), B_lsv2 (B2S1), B_lsh (B1S2), and B_lsh2 (B2S2).

They get directly referenced as follows:

TC1MOD : all four
DLSSA    : all four
GGLSH    : all four
GGLSV    : B_lsv and B_lsv2

I haven't gone through and determined exactly all of the effects but from what I can tell, nothing but good can come from clearing B_lsh and B_lsh2 with CWKONLS.

I think my original concern was this possibly affecting readiness, but even if it does we should be able to overcome that by setting SRYLS to 0.

masterj had to bring this up and it forced me to reevalute the post cat O2 sensor codeout, but I think that I finally have it nailed down.

Yesterday, I went through everything decided to change a few things. First, I turned the error classes back on because if everything is done correctly then they shouldn't be a factor. I also change CWKONLS from 51 to 17. I was not happy to find that after flashing, I was now throwing P1118 and P1122 O2 sensor heating open circuit sensor 2 banks 1 and 2.

I spent a few hours searching before I finally narrowed it down to ESKONF and a few more hours to figure out exactly what need to be done. Bits 6 and 7 need to be set at 10C7A and bits 2 and 3 need to be set at 10C7B to disable post cat O2 sensor heater amplifiers.

Parameter		Location		Original(hex)		Original(dec)		New(hex)		New(dec)
ESKONF		10C7A		00		0		C0		192
ESKONF (M box)		10C7B		F3		243		FF		255
ESKONF (L box)		10C7B		C3		195		CF		207

After flashing the file with this being the only change, the codes are now gone.

See below for my current settings for rear O2 sensor removal:

CDKAT = 0
CWDLSAHK = 0
CDHSH = 0
CDHSHE = 0
CDLATV = 0
CDLASH = 0
CDLSH = 0
CDLSHV = 0
CLRHK = 5
CWKONLS = 17
ESKONF - as described above

I have not blocked any error classes, because there is no diagnosis.

Phila: thanks for the info! I will update the s4 wiki time permitting.

Untested nugget:

SLS and SLV appear to be bits 4 and 5 at 10C79 and bits 4 and 5 at 10C7B

Thank you! I'm going to try this and report back

UPDATE: Can't find ESKONF on my bin nowhere... at 10C7A there's axis for KFKHFM. Could you take a look?

Maybe ESKONF in my bin is @ 10C4F & 10C50?? Confused here...  :-\

LSHHK should be bits 6 and 7 at 10C50.

Edit: You would want to change it from 48 to 240 (dec).

Thank you! Gonna test this

So i removed via ESKONF N249, N112, N75, SAI but in readiness i get FAILED on oxygen sensor(s) and SAI.
Fuel trims are working ok (-0.2, -3.1), on oxygen sensors only cat DTC is out.
Weird since all were passed before doing those changes.

You must have done something wrong.

I turned off just post cat O2 sensor heater with ESKONF and associated codewords and it had no effect on readiness.

Have you changed the codewords for SAI also, or just ESKONF?

No only CWKONABG = 0 (no cat) and CDKAT.
CLASLV, CLASLVE, CDSLS which one should i touch?
I read what you have wrote but my rear O2 is in position and its new.

With all this set, do your fuel trims still learn?

Yes, but just to be clear, I have only done post cat O2's.

Thanks phila, so setting both bits set 00 (slp/slv/etc) leaves it untested/skipped is the way the way I understand it? Thanks for your clarification. Previous statements imply that setting bits to 01 and not 00 would leave it tested, but no faults set...

Thanks goes to elRey too, I know he's been preaching ESKONF for a while now...

I haven't looked into SAI, but if done properly you do not need the error classes.

I will have to double-check, but IIRC CWKONABG and CDSLS will affect evsup1.

Anyway, in my last post I was trying to say that it sounded like you got some bits wrong when you modified ESKONF.

You need to set the bit pair to 11 to disable it. The ME7.5 FR describes setting a whole block (one byte or four bit pairs) to 10 to skip the block, but from what I can tell setting the bit pair (11) is the way to go. The hard part is to accurately identify the bit pairs.

Oh i see allow me to describe my way of disabling it:

According to documentation:
5 / .. 920 / 1 | NC | NC | ERP 65 | SLP 66 | 11 11 10 11 = 251

032RP eskonf:
170   255   0   48   207   248   48
So 248 == 11 11 10 00 meaning SLP has 00 -> active diagnosis.
Then to disable it since is not connected SLP == 01 so: 11 11 10 01 == 249.

Is there something miscalculated?

The bit locations are ECU specific, so unless your ECU is specifically described in the FR then the layout of ESKNOF may be different.

Why are you using 01 vice 11?

I see. 248 value can be analysed only this way i wrote. No other combination can give as result 248 dec value. So those bits are self explanatory in every ECU.
I use 01 instead of 11 since i dont want diagnosis to start in any stage.
Same philosophy i used for remove N75, N249, N112 and works as should be.
Always i am open to read and understand something new, so i am so eager to read your approach.

By layout, I am talking about what functions the bit pairs represent. I have compared 5 different binaries, and none of them exactly matched any of the layouts decribed in either FR.

AFAIK, the only way to completely disable diagnosis is with 11, which represents component not included. The nc fields are represented as 11 in binary.

I think he means that there is only one contiguous '00' in 248... and that must be SLP

I've tried solution as phila_dot suggested, but no luck... What is extremely weird is that over time my o2 sensor shows richer and richer mixture while leaning it....
After about 10 minutes of driving i see this even in idle (idle.xls)

READLINESS STILL NOT PASSED  ???

Additionally I did some logging with me7logger (lambda_20121009_184254.csv)

Lats file attached: my current bin...

Yes, but that is only one of seven bytes.

I would log the cycle (Z_) and error (E_) flags associated with whichever readiness test is failing. That will show you the root of the failure. Also evsup1, but I can't provide the location for his ECU.

I'll check CWKONABG, but IIRC that should only affect ready.0.

professor, if you post our bin, I will try to check it out sometime.

The bit pair that I provided should only remove diagnosis of the post cat O2 heater amplifier.

That looks like the same ME7L log posted the other day. Did you get those other issues sorted?

My only real issue atm is with front o2 sensor freaking out over time... I mean it goes from 1V to ~0.7 in 10 minutes (at idle)... Sensor is brand new, I've tried also with maf unplugged just to be sure, but same result...

BTW: Log is taken today and is brand new...

Also I'll try tommorow to drive a bit longer and see maybe it needs more km to actually pass the readliness...

phila_dot one question pls: The order of the amplifiers, not its bin values,  inside FR is strictly followed by all ECU's or can be reverted in any order?
p.e.  032RP and 032HN can have SLP,SLV etc amplifier's location on different block/line? Or all amplifiers are located on same block's locations, different ECU pin isnt a problem, but with different bin values / per amplifier? This is what i have understood.

Also stock 032RP is attached.

Which binaries?

Have you  looked at any 1.8t binaries? I've looked at some of them. Everything matches in every block except for block 5 (assuming you number them 1-7 and not 0-6). I can't imagine the layout being different from one another, so would it be safe to say that they are as described in the first layout in the German FR?

I may not understand your question, but the order of the amplifiers is different among binaries and only a few are defined in the FR (none of the binaries I have looked at match either FR).

Just based on the bit patterns, I do think that you have the correct bit pair for SLP. It looks like SLP would be bits 0 and 1 in block 5 and SLV is bits 2 and 3 block 6.

Mostly S4 binaries.

The 1.8T binaries I looked at do start with ZUE and EV as described, but how did you settle on the first one in the FR?

The ones that you looked at match every bit pair to the FR? Must be nice.

The S4 binaries were all laid out the same, but are completely different than the FR. masterj and professor's binaries are nearly identical except block 4 and do not match exactly the FR.

I was identifying blocks 0-6 as numbered in the FR.

Maybe I'm wording it wrong. I only settled on the first layout in the FR based off it's heading "Configuration for projects Audi 1.8l 5V sucker longitudinal installation and Turbo"; this is just an assumption (and not at all tested...)

What I mean when I say that they match is not that they match the layout in the FR, but rather each other...

MY 2001 A4 170 255 000 048 255 248 048
masterj       170 255 000 048 255 248 048
professor     170 255 000 048 207 248 048

(fwiw; I was refering to block 5 what you called block 4)

The other 3 1.8t binaries that I looked at all were the same; except in some cases block 4.

Gotcha.

Except block 4 according to me?  ;D

Do you happen to know what hardware differences exist between these cars? What is professor's car equipped with that the other two aren't?

I was counting from the hex when I typed, forgot to start with 0 instead of 1... :o

At any rate, I'm unaware of the hardware differences, although my bin is US and masterj is EURO. As far as I can tell from our conversations; identical hardware. Both binaries are almost identical. As for professor, I'm not sure. Hopefully, he'll chime in....

Not to switch gears too much, but I wanted to go back to CWKONABG and evsup1 for a minute.

evsup1.0 == B_katfz (CWKONABG.0) "Catalytic Converter"
evsup1.1 == B_kath  (CWKONABG.1) "Catalyst Heating"
evsup1.2 == B_cdtes (CDTES.0) or B_cdldp (CDLDP.0) "Evaporative Emissions"
evsup1.3 == B_cdsls (CDSLS.0) "Secondary Air Injection"
evsup1.5 == B_cdlsv (CDLSV.0) "Oxygen Sensor(s)"
evsup1.6 == B_cdhsv (CDHSV.0) "Oxygen Sensor Heating"
 
This is what you see when you reset codes. The set bits of evsup1 become the failed/incomplete readiness tests (set bits of ready byte). If any of the bits of evsup1 are clear, disabled via codeword, then the corresponding ready bit will automatically be clear and no diagnosis is performed (automatic pass). Whether this is a good thing or not will depend on your emissions testing. Some people say that they not only check the ready byte for passing tests, but also evsup1 to ensure that the supported testing for the vehicle (based on VIN?) is what is being reported via the ready byte.

It is kinda strange that B_kath is used for ready bit 1, but this bit is automatically cleared during readiness testing with no diagnosis. As stated previously ready bit 4 (air conditioning?) and ready bit 7 (EGR) are automatically cleared as well.

Just something to keep in mind when using the codewords used in the formation of evsup1.

As I understand it, in some places when they test emissions, they first check, make sure everything is passed.
After this they clear codes, and make sure that some things are no longer passed.

Personally, I think all that is needed is a small ASM code snippet to mimic this behavior regardless of what is going on in the car, and be done with it.

@rob.:
4 / .. 920 / 1 | BKV 22 | NC 24 | AAV 116 | MIL 47 | 11 11 11 00 = 252

207 means only that: 11 00 11 11 so i can only guess that MIL is located second and the others mixed up.
255  means 11 11 11 11 so all are not active at this stage of check or amplifiers are mixed up too since as phila_dot said can be placed in any order.

032RP has ESP and VVT dont know if that can effect block 4 amplifiers.

@phila_dot:
So CDSLS, CDSLV to 0 will force readiness to pass and ll not stop fuel trims with the help of ESKONF.

I ll check it out when i have the time.

So during readliness checks only precat sensor matters? :O CDLSV & CDHSV are both for precat...

One more thing what is this CDHSVSA map? It is also some kind of heater diagnostics...

CDSLS, CDLSV and all readiness tests shows PASSED  :)

It wouldn't be hard, but there is many ways to accomplish this. We just need to find the best way.


I'm pretty sure that the block and bit pair layout of ESKONF is directly related to the ECU pinout.

If CDSLS is cleared (0) then the corresponding ready bit will never get set and always show PASSED. Depending on how emissions testing is conducted, this could be an issue. To answer your question though, yes, CDSLS, CDSLV, and ESKONF should allow removal of SAI components without any adverse effect.


No, only pre-cat is used for evsup1. Post cat sensors are still considered for the ready bit.

I am not familiar with that codeword off the top of my head, but HSV tells me it is pre-cat.

Is oxygen sensors passed now as well?

Yes, SAI and oxygen sensor(s) PASSED now.
LTFT's working, STFT's not sure since i tested these and some other SW modifications on idle atm. I ll know later this day or tomorrow, although i am pretty sure they ll work too.

Whats the way to clarify its ECU ESKONF amplifier order per block? Can you point out the procedure?
Thanks  :)

professor, when you verify everything is working, can you write up a summary I can post on the s4wiki...

thanks!

Yes I think we need renew wiki on emission system removal...

But only problem now is ESKONF, because like phila_dot said it is not same for all the ecus...

In the end we can have these scenarios:
No CAT(s) + no post CAT o2 sensor(s)
No SAI
No EVAP

Honestly, I don't have a foolproof procedure. I just try to use every bit of information available, disassembly, comparing binaries, bit patterns, and referencing the FR.

I am thinking that there might be a relationship or pattern at least in the pins used in many different binaries.

If all else fails, then there is always trial and error.

how bout an m-box specific list? that would be a good start for the wiki. I can always add a disclaimer to say what things are box specific and not just by memory offset (but also bit position)

Rear O2's and EGT's are the only ones that I am satisfied with our current solution.

Rear O2's are posted on page 9.

EGT is just CATR, CDATR, and CDATS for complete removal. Solution to run one EGT for both banks here:
http://nefariousmotorsports.com/forum/index.php?topic=2668.0title=

I don't like SAI and evap because of the effect on evsup1. If I get a chance I will try to figure something out.

SAI ESKONF bits are on page 9 as well.

Hmm... I've tried ESKONF that phila_dot suggested, but readliness still shows incomplete or failed on both o2 sensors tests and also evap... by setting ESKONF do we instantly see passed on o2 heaters or we have to drive for a bit?  ???

No, the only way that you should have an instant pass is from the evsup1 bits, for O2 heaters CDHSV.

Have you changed all of the codewords for rear O2's that I outlined on page 9. Obviously, with CDKONLS and ESKONLS specific for your car.

Here's what I did (dec values):
CWKONLS => 1
CWKONABG => 0
CDSLS => 0
CDLSH => 0
CDLATV => 0
CDLASH => 0
CDKAT => 0
CDHSHE => 0
CDHSH => 0
CLRSHK => 5
CWDLSAHK => 0
ESKONF => 240

I have only one bank with front sensor and EVAP. No sai, no cat, no post cat o2 sensor... ME7.5 :)

Maybe I should do something with the following maps:
CDHSVSA (cur_val: 1), CDLSA (cur_val: 1), CWDLSU (cur_val: 0)... Haven't checked FR on these maps though, just see them in prokonal section...

Oh, BTW: Is precat o2 sensor heater still diagnosed with such ESKONF configuration (I mean will ECU still detect DTCs if there should be any for precat o2 heater)? :o

Any reason you didn't do CDLSHV?

I'm not sure about those other codewords.

Front O2 sensor heater should have it's own seperate ESKONF bit pair.

I can post the cycle and error flags that get checked when I get home. ME7Info outputs most of them. You can take a quick log at idle to see what's causing the problem.

Have you driven the car since last clearing codes or removing power?

There's no CDLSHV map in my file that I know of... I have CDLSV though, but that's for front sensor, no?

No I haven't driven yet after clearing out dtcs... But I did with same flash before that... I can try again ofcourse for few kilometers...

Fuel trims working.

So in order to disable SAI/EGR (total remove, electrical connectors not connected) without catalytic converter you have to make appropriate changes to the ESKONF map according to your ECU pattern for the SAI (SLP) and set CDSLS, CDLSV &  CWKONABG to zero (0).
SAI and oxygen sensor(s) now have readiness PASSED.

This is emissions related question so I'm posting it here... How variable B_FAKAT is set inside ecu? I see that it should be set in TKMWL function but I can't find any definition on how it is set to TRUE or FALSE. Anyone care to explain this to me? Thanks

Verified today that phila_dot's method works perfectly with no sensors even connected.

Does this mean that if you make those modifications (mbox), none of the settings listed for rear O2 delete in the s4 wiki are needed?

I'm assuming for RS4 K/Q box no changes will be needed since there are no rear O2s on the RS4?

yea for ESKONF

Uhm, yes there are. At least on K-box.
My RS4 has (or had) rear O2's, cats, SAI and so on.

So we'll need to figure out ESKONF bits if we want to use K/Q then.. :/

May I ask why? And they are probably exactly the same as M-Box, because the hardware is the same.
matchew pointed out that removal of SAI does not affect learning of fuel trims on K-Box.

hehe... tried to generate path of how variables affect each other.... Final variables are important output variables from main functions, while top is reserved for maps and still undefined variables... :) I know that most people will find this silly but at least to me this is way easier to see what's going on with variables when we zero out maps

These functions have been analyzed:
ATM
BBKHZ
DHLSHK
DHLSHKE
DIMC
DKATLRS
DLSAHK
DLSH
DLSSA
DSLSLRS
KHMD
LAKH
LRSHK
SLS
TC1MOD
TC6MOD


By the way, I think that it is useful to force b_sbbhk = 1 because that way we enable auto clear of precat o2 sensor errors when we change sensor or it is back to normal readings (more info in DLSU)

One more thing: After studying ATM (exhaust gas temp model) I've found a way to update it for test pipes/decats.

First we have to set B_trkh = 0, B_kh =0, B_kw = 0 to fix tatmsta.

CWKONABG.0 = 0 >>> B_katfz = 0 >>> B_kha = 0 >>> B_trkh = 0
CWKONABG.0 = 0  >>> B_katfz = 0 >>> B_kh =0
TKATW = F(max) >>> B_kw = 0

Now we have to fix two subfunctions for TIKATM and TKATM variables by setting these values:
ZATMIKML = 1 && ZATMIKKML = 1 && texoikm_w = 0 (TABGMEX = F(max) && TIKATMOE = 0) >>> tikatm_w = tabgm

ZATMKML = 1 && ZATMKKML = 1 && texom_w = 0 (TABGMEX = F(max) && TKATMOE = 0) >>> tkatm_w = tabgm

UPDATE: One more interesting thing with these models that I found is that until start up timer passes all these variables are preset to TATMTP map, which in most files is set to 60 C. That means, that for some time after starting engine ecu will think that your EGTs are 60 degrees...

SUMMARY:
CWKONABG.0 = 0
TKATW = F(max)
TABGMEX = F(max)
TIKATMOE = 0
TKATMOE = 0
ZATMIKML = 1
ZATMIKKML = 1
ZATMKML = 1
ZATMKKML = 1


Here's hoping there won't be any problems in other functions (haven't looked through all of them yet) :)

Small suggestion to people who fixed ATM (exhaust gas temp model) like I said earlier:
I know this might be a childs play, but I like to set my LAMBTS to work properly and there are few things to check regarding decat...

First thing here is to check if CWLAMBTS.2 = 1. That way we tell ecu to use tabgkrm_w (temp in exhaust manifold) for FBSTABGM instead of modelled temp before cat. Technically it isn't needed and that almost makes no difference, but most of the time you want to set FBSTABGM multiplier based on exhaust manifold temp instead of precat (which it isn't here anyway) temp.

CWLAMBTS.2 = 1 >>> tabgkrm_w in FBSTABGM

Finally, you have option to disable cat and precat temp enrichments (if you haven't fixed ATM!). To do this just FF TKATBTS & TIKATBTS. Or if you fixed ATM you can do it like me:
TKATBTS = TABGBTS >>> fix B_tkatbts && TIKATBTS = TABGBTS >>> fix B_tikatbts

SUMMARY:
CWLAMBTS.2 = 1
TKATBTS = TABGBTS
TIKATBTS = TABGBTS

I have started (again) to gather info on variables that we change with map changes. At the moment I have written PROKONAL, LRSHK, LRSKA functions variables, but I will add more when I'll have time :)

LEFT SIDE - sorted by functions
RIGHT SIDE - all variables sorted by variable name

Now If you wan't to generate graph out of this data then just use yEd Graph Editor and feed the right side ;)

If anyone has some free time and want to play with dissassembly then it would be a good idea to check if variables are really created and read like FR doc shows us.. Also there are some variables with ? ? ? - that means I haven't found out what happends to these variables after ouput from ori function (FR document)

Also, I'll delete some of these maps when I check all the functions and find out that they can be overwritten by other maps to keep the map list as short as possible.

Another thing: This isn't same list as at the end of FR document, because this includes EVERY single functions that mentions said variables, for example DIMC function isn't shown in the end as few others :)

Some more new info on my analysis here:
ATM:
After complete checking of this function I've realized that some of my suggestions here can be skipped, in particular variables TIKATM_W, TIKATM, TKATM_W, TKATM can be ignored when diagnostic functions DLSH, DLSAHK, DHLSHK, DSLSLRS, DKATLRS are disabled AND LAMBTS, LRSKA, BBSAWE, LRSHK are fixed as shown further down on this post.
Although TIKATM_W, TIKATM, TKATM_W, TKATM can be ignored I choose to leave my previous temperature model fix in my file, if you want to do same (just for the sake of "correct" value ;)) check this out:
ZATMIKML = 1 && ZATMIKKML = 1 && texoikm_w = 0 (TABGMEX = F(max) && TIKATMOE = 0) >>> tikatm_w = tabgm
ZATMKML = 1 && ZATMKKML = 1 && texom_w = 0 (TABGMEX = F(max) && TKATMOE = 0) >>> tkatm_w = tabgm

Now second part of my suggestion was to fix TATMSTA and this still applies after complete function check:
CWKONABG.0 = 0 >>> B_katfz = 0 >>> B_kha = 0 >>> B_trkh = 0
CWKONABG.0 = 0 >>> B_katfz = 0 >>> B_kh =0
TKATW = F(max) >>> B_kw = 0


LAMBTS:
Some corrections here too:
CWLAMBTS.2 = 1 (result: TABGBTS_W = tabgkrm_w)
TKATBTS = FF && DTBTS = 0 (result: B_TKATBTS = 0)
TIKATBTS = FF && DTBTS = 0 (result: B_TIKATBTS = 0)


LRSHK:
So far I've chosen to set CLRSHK.0 = 1 && CLRSHK.1 = 1 to get B_LRHK = 0 && DLAHI_W = 0 && DLAHP_W = 0. Still no idea what to do with output variables LAMSOLH_W, LAMSONH_W, USRHK  ???
 

LRSKA:
In my file originally CLRSKA  was set to 0. After looking at the FR I've decided to leave CLRSKA = 0 (CLRSKA.0 = 0 in particular), to get B_LRKA = 0 && LAMKA_W = 8.


BBSAWE:
Finally I have came to fuel cut-off function to check for tkatm variable. To disable unneeded cat related cut-off latency (TVSAKAT=0) I've set KFTVSAKAT = 0. Also in BTATMSA subfunction I've decided to max out TKATSA, TAVHKSAO, TKIHKSAO so fuel cut-off couldn't be stopped from kicking in due to cat (I know that I could leave TAVHKSAO & TKIHKSAO since those are for precat/maincat systems, but for the sake of clean analysis I FF'd them too ;)):
TKATSA = FF
TAVHKSAO = FF
TKIHKSAO = FF



Currently, I think I have done ATM and LAMBTS 100%, while other functions might need some fine tuning. Also please keep in mind that I'm doing this all on FR level and do not check if FR doc == ASM code :)

P.S> More info in attached files

Update  :)

OK, added new functions to the list:
BBDLS
BBKHZ
DIMC
GGLSH
KHMD
PROKONAL
SLS
TC1MOD
TC6MOD
TEMPKON

Problem with DEKON function. I have no idea what variables (names?) goes out of ESKONF map and to which functions these variables go (maybe DEVE, DECJ?). Any input on this map would be appreciated ;)

Everything I do know is recorded in excel file attached below

I started trying to correctly code out my rear o2s and SAI. I have set the various codeworts from phila_dots post on page 9, and have found ESKONF at 10D27 in my bin (018ch). I set all the codewords, but did not change ESKONF, then went for a drive. I threw a code for open circuit sensor 2, but the MIL was not lit up. So I went back and changed ESKONF, the 3rd bit. It was originally 048, but I changed it to 240. The DTC is now gone, but the readiness shows incomplete or not ready. The post-cat o2 sensor heater is still being activated, I can see the request through measuring blocks in VAGCOM.

This is what I have done:

CDKAT = 0
CWDLSAHK = 0
CDHSH = 0
CDHSHE = 0
CDLATV = 0
CDLASH = 0
CDLSH = 0
CLRSHK = 5
CWKONLS = 1
ESKONF - as described above

Could CDLSHV cause this problem? That is the only codeword I can't find in my XDF/.kp. I see CDLSHV in the FR but I couldn't find what it does.

Hello, question.  I am just starting to get into understanding how to code out DTCs. Mine will be work a 4.2 V8. I understand that the locations will be different (and I still don't really understand how to find them with that equation but I will keep at it). But my question is will the nomenclatures or parameters be the same.

IE:

CDKAT, CWDLSAHK, CDHSH, CDHSHE, CDLATV, CDLASH, CDLSH, CLRSHK, CWKONLS, ESKONF...etc etc. for the various items I will be coding out? I wouldn't imagine that would change.

Wideband ECU?

What are you seeing in VCDS? B_hshe?

What isn't passing readiness O2 sensors or O2 heaters?

Log the cycle and error flags listed in DIMC to see exactly why readiness isn't complete.

CDLSHV is the codeword for function DLSHV which tests if the post cat O2's are interchanged/swapped between B1 and B2. The only outputs are lamlshv_w to %LAMKO and DTC P3262. This doesn't affect readiness.

For the most part.

One difference you will see is LRS vs LR. You listed CLRSHK, but I would list CLRHK.

Wideband is continuous lambda regulation (LRS), narrowband is not (LR).

Yes, wideband ECU. I am not quite sure of the name of the value in VCDS, but I believe it was block 041. The o2 sensors were not passing readiness, but I just put more miles on it and checked again and they all read PASSED!   :D But now I'm throwing a code for b1s1 malfunction in circuit, though I believe that is unrelated. Now the question is if Jersey will pass inspection on my car.  ::)

Can you post addresses for those values? I am working with 018cg which is very close to 018ch. I cant get B1 S2 heater fault code go away even if i have changed those values. I think problem is in my map pack. I am using "masterj"'s .ols file for 018dc.

Sure thing.

CDKAT = 0 --> 181A1
CWDLSAHK = 0 --> 18613
CDHSH = 0 --> 1819C
CDHSHE = 0 --> 1819D
CDLATV = 0 --> 181A7
CDLASH = 0 --> 181A5
CDLSH = 0 --> 181AB
CLRSHK = 5 --> 12109
CWKONLS = 1 --> 181BB
ESKONF --> 10D27

Did you set any bit pairs in ESKONF? That sounds like it might be your problem.


Also, give this map pack a try: http://nefariousmotorsports.com/forum/index.php?topic=1204.0title= (http://nefariousmotorsports.com/forum/index.php?topic=1204.0title=)

I try those and still same problem:
17526 - O2S Heating: B1 S2: Open Circuit
35-00 - -

ESKONF is defined to 10D3E on that "masterj" map pack. Could somebody check is it right. Also not sure CDHSH/CDHSHE 1819C/1819D  because some map pack shows 1819E/1819F for those.

I had the same problem before I modified ESKONF. I will take a look in your bin when I am at my computer.

ESKONF fix that problem. It was defined wrong on my map pack. 

I have now same problem. B1S1 malfunktion code appears after every cold start to warm cycle. If i remove fault coded with warm engine i can drive how much i like without that code.

Interesting. So now it seems we altered code for the front o2 as well. I just got back from a long weekend in canada so I haven't had time to mess around with it, but I will take a look at ESKONF in the FR and see if I can find anything. Any others willing to take a look would be appreciated.

I have some new info on DLSAHK function :) Finished analyzing it and have few notes for you:
Basically, we need to zero out these bits:

now B_nolash we can ignore, because it only cleans DTC if it is set previously.

Here are the results:
So to set all these we need to change:
Last problem that is left is SigError (Signal Error). If someone could explain to me how these are set I would be very happy :)

And here's my current diagram :)

So in a effort to track down my B1S1 Malfunction in circuit error, I have reverted ESKONF bit pair 3 back to the stock value of 048 from 240. The B1S1 Malfunction in circuit DTC is still present, along with B1S2 Open circuit. So it would appear in my eyes that my B1S1 DTC and ESKONF bit pairs are indeed unrelated.

I haven't been able to put much though into this because I had to deal with my coils blowing, but I believe I have remedied that problem. If anybody has any suggestions on where to look now, it would be greatly appreciated.

I think my malfunction issue was with fuel not setting right... I have disabled adaptation and at idle lambda was -25%, i think that was problem. Now I have fixed krkte to be at idle ~0%, but My readiness for oxygen sensor is never set. I did log with z values and came up with this:
Z_kat = 0
Z_lsv = 0

Any ideas? ;)

By fuel not setting right I assume you mean your krkte/tvub values were off? My idle trim is -.8 % and partial is -1%.

What does that z-value mean? FR says cycle flag, but I'm not quite sure what that means?

Basically it has to be 1 for no error condition...

Cycle flag means that the test has been completed regardless of the outcome.

It seems i can not finish sensor aging test. I have tried to amnually set it. when the test conditions are met test goes ON, but unless i depress gas pedal test can stay that way for 10mins without any othe message. And after depressing gas pedal it goes back to TEST OFF

Are you sure that all of your codewords are correct?

What's up with your fuel trims?

Ok, some updates. I changed the ESKONF bit pairs back, and b1s2 code is now gone, just like before. I logged the z values and they are all 1, including Z_lsv, except for Z_tm, Z_rkat, Z_nwkw.

Block 034 in VCDS shows that the b1s1 aging test is not ok, and readiness is not passed for o2s.

Philla, which codeword is for aging test? Because I am almost certain i have done everything ok...

P.S> I have disabled adaptation (fuel trims) to calibrate my fueling at the moment

So do we know a way to overcome this S1B1 malfunction in the circuit DTC? It seems i'm not the only one getting it... All I see that I can't finish aging test for front sensor...

I haven't had much time to look at it, but my front sensor does not pass aging test either.

got a way to remove sai system and the readiness pass. :)

Why would you disable CDLSV? If I understand this then this map is responsible for precat o2 sensor diagnostics, no?

gunny thing is that in group 001 i get 11111111 (meaning everything is ok?)

and readiness still not pasing oxygen sensor(s). aging test never completes...

Bringing this back, maybe phila can chime in here. Cdlatv controls the rear sensor mixture control, but what about cdlatp? The FR says it controls the cycling tests, but if I understand it correctly it is not started if b_lrhk = 0, which is what we have done by setting clrshk to 1 in my case. Is that correct?

I have decided to not worry about readiness for now, I just want that damn CEL off without removing the dtc. My z-values are 1 and I was able to pass readiness before somehow, even with my b1s1 malfunction code. How is that possible? Can I turn off o2 aging with CDLSA?

Ok, so everyone having problems with b1s1 malfunction, make sure your warm-up fueling is dialed in. Both masterj and I had the DTC go away after tweaking KFFWL maps. I had to set FKHABMN to zero in my file as well to correct warm up. But the DTC is now gone. Readiness is still not ready though.

Hi guys!

Could you check if my suspicions are correct?

(http://s22.postimage.org/ev4hm7cn1/second_lambda_disable.jpg) (http://postimage.org/image/ev4hm7cn1/)

I want to remove CAT and second o2 sensor

What file are you using? The locations look correct but I'm not sure about the values. How are you viewing the hex dump? Codewords are 8bit.

So I discovered yesterday that my prokonal module of my map pack is incorrect. I fixed it all and set the right codewords so as soon as I can put some miles on it ill report back.

CDHSH 8bit 1 => 0
CDHSHE 8bit 1 => 0
CDKAT 8bit 3=> ????????????
CLASH 8bit 1 => 0
CDLATV 8bit 1 => 0
CDLSH 8bit 1 => 0

Only CDKAT is "3" in 8bit, should i change it also to 0?

CDKAT = 0  ;)

i removed o2 sensor from catalyst, unfortunately 2 dtc occurs

2 Faults Found:

17526 - Oxygen (Lambda) Sensor Heating; B1 S2: Open Circuit
        P1118 - 004 - No Signal/Communication
17522 - Oxygen (Lambda) Sensor; B1 S2: Internal Resistance too High
        P1114 - 004 - No Signal/Communication


i changed to 0:
1819E CDHSH
1819F CDHSHE
181A3 CDKAT
181A5 CDLASH
181A7 CDLATV
181AB CDLSH


Is there anybody who can help me with finding ESKONF? i read that is my last option...without disabling DTC's

maybe this:
170   255   0   48   227   248   48

started 10ED1

and i can't find CWDLSAHK...doesn't exist on 18773/18663// please help.

Change 10ED4 to F0, or 240 decimal.


And I believe CWDLSAHK is loc @ 18902.

Thanks everybody for suggestions, after 50km check and faults haven't occured...

I noticed enrichment via lamka which prompted me to clear CLRKA.

Might want to add this to your rear O2 codeout procedures.

So, just to clarify, you've coded out your O2's by doing the traditional things listed in the S4wiki, plus ESKONF, plus now CLRKA, correct?

Yup, everything I summarized on page 9 (I think) plus now the addition of CLRKA.

what about b_kw? I also disable it in my file... :)

Additional info/clarification:  (for those not running the most commonly referenced ecu/car here)
Depending on what you have in your file, CLRHK or CLRSHK should be set to uneven. (set bit0 to disable rear o2 control) Example: value 24, add 1 to get an uneven value of 25.
CDLSHV does not exist on some stereo WB cars and ofcourse not on single cat vehicles.

It might be common knowledge.  But if you are struggling to get ready bits set then do a search for B_fa = 1 in FR you will see that cat and evap diag (possibly more) are blocked when diag tools are connected.

CLRSHK or CLRHK and CLRSKA or CLRKA are different. Phila_dot is talking about CLRKA, or CLRSKA in wideband cars. I'm sure you knew that, just mixing up names.

FWIW, CLRSKA is 0 already in my 018CH file.

My post was meant as additional info to phila_dots summary on page 9. Not related to his statement of  CLRKA (which as you say in WB care is CLRSKA)

hello..good thread ,

i need to delete the SAI n112 and evap canister solenoid valve 2 n115 from my 8n0906018Q .

what are the adresses for:
Disable Secondary Air Injection DTC
-CDSLS - Eurobyte
-CLASLVE - Plug
-CLASLPE - Pump plug

Disable Evaporation DTC:
-CDTES - Eurobyte - LDP Diagnosis
-CDLDP - Eurobyte - EVAP diagnosis
-CLATEVE - EVAP plug
-CLALDPE - LDP plug

thanks!

also..only those needed to be modified?

5 Faults Found:

17526 - Oxygen (Lambda) Sensor Heating: B1 S2: Open Circuit

P1118 - 35-00 - -

17841 - Secondary Air Pump Relay (J299): Open Circuit

P1433 - 35-00 - -

17840 - Secondary Air Injection Solenoid Valve (N112): Open Circuit

P1432 - 35-00 - -

17522 - Oxygen (Lambda) Sensor: B1 S2: Internal Resistance too High

P1114 - 35-00 - -

16524 - Oxygen (Lambda) Sensor B1 S2: No Activity

P0140 - 35-00 - -

---------------------------------------------------------------------------


pleasee....i really need to remove the
 17840 - Secondary Air Injection Solenoid Valve (N112): Open Circuit dtc
                     
                     and the

17526 - Oxygen (Lambda) Sensor Heating: B1 S2: Open Circuit
17522 - Oxygen (Lambda) Sensor: B1 S2: Internal Resistance too High
 ....can someone share the map pack for 8n0 906 018 Q with ONLY those adresses...that i need to delete the dtc's...

thanks!!!....

I can't seem to find the address for CLRKA.  What's the best resource for looking these up?

S4 M box

0x11A72

Thanks!

Same location for the L-box (8D0907551L 02612047004) as well.

I'ld like to know why we should have to tweak KFFWL.
I've ran without rear o2 for years with rear o2 faultcodes and have never seen b1s1 malfunction.
But now after coding out rear o2 I get the B1S1 malfunction.
I've triple checked everything. I can run readiness test and get full readiness set.
Is there anything in FR (or Alfa FR) that indicate why a tweak of KFFWL would help? And why would the B1S1 problem show only after I did fix for cat and rear o2?

You don't have to touch it. It "helps" because it prevents certain diagnosis conditions from having an effect.

Ok, i do not want to hide a problem. But what you're saying is that phila_dots summary on post127 in this thread thrashes the b1s1 signal diagnostic on a wideband ecu? Those are the things i've done.(with a couple of obvious mods due to wb) without phila_dots suggested things i do not get b1s1 dtc.

What's the P code?

I think it is p0130. Btw i got same dtc. Until this code isnt set readliness gor oxygen sensor isnt passed too. Once dtc is stored readliness becomes passed. Strange

            P0134 - 35-00 - No Activity

I can tell you that you're both having problems in DLSU.

Can you specify subfuction of dlsu that checks conditions for my dtc? And how can readliness be passed with front o2 dtc?:o

Dunno. Masterj told me about it, and it "fixed" my DTC too. I'd be interested in a proper fix too.

FWIW, the code I have is p0130 as well. I'll take a look in DLSU when I get some time

Everything in the S4 wiki DTC section below:

"To fix up the EGT model:
ATM:
ZATMIKML = 1
ZATMIKKML = 1
TABGMEX = F(max)
..."

needs intense cleanup.  Should we start a new thread for this?
I can't find some of the addresses, tables, conversion values & other stuff.
My XDF has alot of stuff in it and I'd like to upload it, but we should work on fixing this stuff first.
Who can help to properly clean this up with me?

Every time I look at the wiki I get anxious. Just thinking about cleaning it up gives me nightmares.

However, I agree. The EGT model info is in the wrong section, and terribly convoluted.

yes and yes... i could use a big assist here

masterj got the closest to fixing this, but i don't think we have mandate-like clarity on what exactly needs to be changed.  for instance he uses a few variables which i can't find & then he refers to variables which are vectors - by variables which appear to be scalars.  idk, i'm a programmer, so perhaps i'm a bit retentive - but i think we really need to fix this up.  the rear o2 stuff is close.  i think the big issue we have here is that there are so many different flavors of what has been removed and thus what needs to be changed based on that...

Edit:
I'll update later about my p0134 dtc. I thought i had found something in cdlash but i was wrong.

hello...please help..

032HN ecu i coded out n112 , n80 and rear 02

however...i have the following code

17939 - Camshshaft Timing Adjustment: Open Circuit

        P1531 - 35-00 - -


how do  i code out the vvt?

thanks!

http://s4wiki.com/wiki/Tuning#ESKONF

NWS is VVT. Since you didn't post your ESKONF configuration I can't tell you exactly what value, but set the last byte (byte 6, which is technically the 7th byte), bits 0&1.

here is my eskonf..i think:)...what shall i do next?

thanks!

http://s4wiki.com/wiki/Tuning#ESKONF

Would you please show location (offset) of the code in M-box which loads/uses the CLRKA constant? Or show related hex sequence or asm listing. I'm trying to find its location in 06A906032* boxes, like those mentined few posts above.

The function is not even remotely similar.

CLRSKA is at 0x19F04 in the HS box

Thanks! Your answer saved a lot of time. Would you please also confirm, is there really shift +1 byte in offset for CDL* constants in HS box in comparing with M-box. For instance, CDLASH has offset 181A4 in M-box, but defined as 181A5 in HS-box. I thought these sections should have been be similar by offset.

Comparing ME7.1 with ME7.5 is a waste of time.

I agree with you. I used M-box because it is like a standard on this forum, it is most discussed and new map locations are confirmed by pro tuners like you 8), so I can trust them. Many locations in 032* provided here are shifted or wrong. Maybe I have to switch to another box like CB which is also such well defined and can be trusted, or start disassembling myself to verify locations. Another option is try to change, flash and observe result. Since in CB-box location is also shifted in comparing with M-box I hope locations are correct. Thanks!

Please help me to find/confirm location of CLRHK in ME7.5. Instead I've found CLRSHK at offset 11DB4 in HS-box (it's also at 11D4B in CB-box). I hope on wideband these names are LRS, which means continious regulation, according to Funktionsrahmen LRSHK is Lambdaregelung (stetig) hinter Katalysator

ME7.5 -> CLRSHK

So I coded out Rear O2s, EGT, SAI, and EVAP on my A6 2.7t L-box fine..
but I cannot find 4B0906018M (ATW) XDF file to use with my Tunerpro  :-[

Maybe it sounds silly. ???
How to find ESKONF to 2.0t fsi MED9?
Any hint
Thank you.

Downstream cat heater is still switching on/off in diagnostic channel 41. Any ideas how to switch it off forever?

function HLSHK or HLS

Didn't want to start a new topic, since I figured my question may contribute to this thread. I finally got my car back on the road with the new exhaust manifold and the time has come to get my car passed NJ emissions. I want to plug in at the free state inspection center and hopefully get my sticker there.

The only emissions related hardware I have deleted is the cat and SAI system. I have a resistor on the n112 plug and the pump relay is still there. I plan on modifying MSLUB to take care of the improper flow and hopefully the SAI part of readiness. My only real concern is secondary o2. I want to make a file only for inspection, and revert to my normal 02 deleted file after I get inspected. The secondary o2 is plugged back in and is in the downpipe, but I am assuming I will have a cat efficiency code. Is there any way to modify the efficiency parameters similar to MSLUB? Or is there another way to show supported o2 but not pass right away?

I have been searching and reading for the past few hours, but have not found anything concrete. TIA

AHKATMN
AHKATMX

Should there be a s4wiki section for this kind of thing?

thanks daz, I'll look into it.

Guys, can someone with ME 7.5 confirm that they have passed all readiness checks on everything? I can not pass LSV (precat o2 sensor) after removing postcat o2. I get no errors but z_lsv is never set. So i started analyzing DLSU and found that if b_sbbhk = 0 then whole DLSU can be set only via b_cdlsv = 0. And that is extremely weird because not every single test that precat has to pass (OFFSET1, PLAUS1, HEATER1, DYNAMIK1) is checked via postcat o2. So, I have logged b_sbbhk and it is really never set to 1. b_hsha is set to 1, b_adsh = 0, b_risgh = 0, b_trsah = 0. ushk_w === 0 so that might be a problem here, but I'm suprised that others have had no problems...

I have all readiness pass and z_lsv set to 1.
4B0906018CG ECU

I use to have same problem but find out that PROKONAL was wrong defined in your map pack. After fixing that and proper change all work fine.

Which map was wrongly defined?

There are several maps wrong in that map pack (or at least axis data are wrong).
But the one that was causing that problem is in prokonal bits.

Here is my set up starting from 18194 (4B0906018CG 360306):  00 00 00 00 00 00 00 01 00 00 01 01 01 00 00 00 01 00 00 00 00 01 00 00 00 00 01 02 00 01 01 04 0F 00 01 00 01 00 00 01 00 00 06 00 00 00 04 7D AF 15

Have you done this before?
 
These should be modified as well, yeah?

AHKATS added-up threshold value (stereo 1. and 2.bank)
AHKATSB adding range threshold value (stereo)

These are the locations I have for the M-box:

AHKATMN  0x18672
AHKATMX  0x18673
AHKATS    0x18674
AHKATSB  0x18675

I'm likely going to have to do this this week, as I got called down to the big official enforcement division after my new car showed unsupported on SAI and rear O2's after having shown them equipped for the previous owner for the last 5 years :D

It'll work. I have just done MN and MX along with AHKATS.

Guys, please help me to find CLRSKA in 4B0906018DC. It is different from 06A906032HN in ida and I am unable to find it.

I am attaching ida screenshots from both files and my suspect address of CLRSKA. Also bin is attached

121D4

So I have something to add here. DLSU will NEVER set z_lsv = 1 IF b_sbbhk = 0! OR at least on 06...HN file with fully defined ols. It is almost complete single bank copy of FR file we all have here. Problem lies within DLSH. So I would like you to consider the following mods to the "current" community emissions delete process:
CDLSH.0 = 1
USMIN = -1
TANHKMMN = -273
THSHA = 0
TRSE = 0

When we leave DLSH enabled we can finally set b_sbbhk and thus enable diagnostics of DLSU. I can confirm that now finally I have z_lsv set and all readiness passed.

Of course it would be way nicer to fix everything with codewords, but I see no other way to set b_sbbhk other than keep DLSH enabled.

masterj, what is the high level summary of this issue you are trying to address?

z_lsv is never set to 1 due to b_sbbhk = 0

I have checked FR and quadruple checked dissasembled me7.5 file.

higher level. why do u want sbbhk set?

laymans terms plz

I think he was having problems setting O2 Sensor readiness.

I thought that might be it. masterj, I believe what you're looking for is SRYLS and reduce it by how many o2 sensors you have deleted/disabled.

Its this restricted to ME7.5?

All my experience is with ME7.5. So, I can't say. Sorry.

Readiness is set if the counter (cry*) is greater than the SRY threshold.

The SRY thresholds are evaluated when any of the applicable error flags are set.

The counter is initialized with 0 and incremented only when all of the applicable cycle flags are set and also a condition bit. The condition bit is set at initialization and cleared when the counter is incremented. It is also set when the codeword bits are evaluated.

It is my understanding, that the counter is only incremented once because of the condition bit, so the cry counters will never be greater than 1 and the SRY thresholds are all set to 2.

Setting the SRY thresholds to 0 would force readiness when both the cycle and error flag are set.

Not restricted to ME7.5

Or just reduce it to 1 to still have front o2 sensors required to set readiness.

Can I replace all of the S4wiki section that deals with rear O2 removal with the advice to set SRYLS to 0 or 1 (depending on what the person wants, no O2s required, or 2 O2s required)?

Can you explain the logic?

Not doubting you, just trying to figure out what I missed. The counter and threshold doesn't really make functional sense from what I see, but I didn't see anything that supports your logic.

If the codeout is done properly, then the threshold doesn't need to be touched.

I would recommend a proper codeout to ensure no unwanted influences.

He's saying that two properly working O2 sensors (but no rear O2s) should result in the counter ending up as 2, so SRYLS=1 should be sufficient to allow readiness to be set.

I assume, anyway.

I mean per the code because I didn't see any evaluation seperating sensors or anything allowing it to increment based on codewords or anything other than right after reset and possibly one other time.

I think it is important to set z_lsv, because most of the precat o2 checks are done in a z_lsv & !e_lsv manner

It was a while ago I did this. I could be recalling wrong. I'll look over the code again.

What I do remember is that on the 1.8T with only 2 sensors (1 pre / 1 post), only reducing SRYLS by one allowed readiness bit b_lsrdy to be set even though rear O2 was correctly coded out. (ESKONF, CWKONLS, CDKAT, and CDs related to rear o2)

I believe when I saw "cryls + 1" I assumed it was incrementing on rising edge.

Ah, so what I propose does get z_lsv set then. It seems to bypass it. Bummer.



Then why not change your jmpr cc_NZ to jmpr cc_UC where it checks for b_sbbhk in DLSU. Should be a one byte change. Or change it to check #1 instead if b_sbbhk.


Also, masterj - how did you name each bit in IDA?

Yes it is possible to create such a hack, but I'm interested in native solution :)

To name bits you have to create enum in ida and apply it to selected word or byte

At some point it is easier to just add a ASM hack location to the .xdf and call it a day :)

I agree

So you both agree that a rear o2 sensor that no longer exists has to be checked (even pseudo checked) in order for another valid o2 sensor check to pass?

I'd prefer not to.

No, my preference would be to delete it as designed by modifying the right combination of codewords and parameters.

All of the variables and condition bits need to be accounted for.

But it looks like the code never intended (designed) to set z_lvs without checking the rear o2 (b_sbbhk) as masterj has discovered. I guess I'm saying they never designed it to delete the rear o2 without deleting front also. So, if you were to be true to your statement, you would either run rear o2 or delete both rear and front. No?

I'd bet that something is being overlooked.

This car had a rear O2 sensor in all markets?

That I don't know.

I think that all wideband me7.5s has a minimum of two sensors no?

In the words of elRey, that I don't know.

I can't imagine that it's required in all markets and Audi typically takes advantage to save a few bucks.

The way I read the FR agrees with masterj. b_sbbhk is required to set z_lvs. And the only way to set b_sbbhk is by checking rear o2 sensor. There's no CD to bypass and automatically set b_sbbhk.

It really shouldn't take much digging to sort it out in the disassembly.

Just look at everywhere B_sbbbk is set and cleared. If there isn't a native solution then determine the best exploit. If you are going to apply some sort of hack, make sure you root out all of the repercussions.

One more thing I have noticed with EVAP. If you delete EVAP and set CDTES, CDLDP and ESKONF then in GK rkte_w is NOT always zero (as it should be). I'll try to investigate more.

UPDATE: After logging for a while I have disabled TEB completely by setting TMTE = FF (max temp). Now rkte_w = 0 always :) Could not find any codeword to disable TEB the other way.

hello
any one help identified CDSLS, CLASLVE , CLASLPE  attached file

i try find eskonf and disable sai
but not work, eskonf address corrtect or not ? 0x10ED1

no one ? :(

I think for this purpose they have compile-time constant (for example SY_LSHK).
That's why it is not so easy to set readiness via code words.

Hi, guys!
Please help me, i want to remove my SAI system, but dont understand whats mean "plug" and "pump plug" in CLASLVE and CLASLPE. I should set this parameters to zero?

masterj did you happen to find these lines of code?

I've changed the bclr b_sbbhk to bset now. From what I can see in FR and code there is no problem having b_sbbhk set permanently when rear O2 are completely coded out.

I disconnected O2, control of the catalyst and GAI. Be checks please everything that I correctly made?

Yes , you found it!

Not sure if its mentioned in this topic further on already but for the EGT you also need to disable CATR. I my case it was pig rich at idle and low rpm, it wasnt using lambda and big oscilations at idle sometimes. Also the boost was limited so I guess it turned into limp mode. I did not got any DTC because I disabled everything already.

Thanks for the info, got my wideband ecu running on S3 APY! ;D

This looks really similar to a PLC Language. Edit, searched and found an answer.

So Im doing rear o2 delete on 551r and im trying to make sense of the wiki's instructions.
at first it states:
CLRHK (0x11A87) - Code word for Lambda - Control post cat on/off: set to 5 (00000101b)[58] or set to 73 (0x49/01001001b)? (original value 72 0x48/01001000b)
Wideband vehicles use CLRSHK. In these the default value is typically 16. Set bit 0 to disable (Increment value shown by 1)

LRSHK (to disable postcat o2 correction):
CLRSHK.0 = 1
CLRSHK.1 = 1
LRSKA (to disable "cat cleaning" function):
CLRSKA.0 = 0

From what i can gather, wideband cars have clrshk and clrska. but narrowband have clrhk clrka instead. So to do a proper code out im confused whether clrhk should be set as 5 or 1 to remove rear o2 influence. Just wanna be sure because Im going to feed a wideband o2 through the post cat signal wire and I dont want to have any unwanted effects. Thanks

I wish I could answer this conclusively, but I believe if you have CLRHK, set it from 72 to 5, if you have CLRSHK, set it from 16 to 5. What is your stock values for CLRHK and CLRSHK?

BTW i just edited the wiki in the hopes it is more clear.

551r stock
CLRHK: 72
CLRKA: 3

CLRSHK doesnt exist in my 4 def files.

If you wanna add ESKONF for 551r it starts at 0x10C86   bytes 5 and 6 change from 33 and F0 to F3(byte5) and FC(Byte 6). for rear o2 removal.

AFAIK, set CLRHK to 5 and CLRKA to 0

Just came across this thread, and just want everyone to know just how the OBDII "smog" testing really works...
CA actually has the toughest OBDII standards, and the other 7 "green" states follow suit (NY, MA, CT, RI, NH, NJ, ME)
I am a RI state inspector and have helped systech (now called opus) develop the standard for the OBDII data for RI.
This system is currently in use in the 15 states that opus technologies builds state inspection machines for..

it asks your ECU a series of mode $01, $03, and $09 questions.  NOTHING is reset.
mode $01 - RPM, O2 sensor locations, current DTCs (if any), supported monitors, monitor readiness, command MIL (is it on, and does it work), and ECU address (2 digit hex code)

Mode $03 (not many vehicles support this mode) - OBDII standard (US, CARB, Euro, JPN), calibration ID, software ID
(mode $03 is more for the EPA's database)

Mode $09 - Calibration id, ecu checksum, vehicle VIN

the machine will, however go back and forth between reading DTCs, command MIL, and monitor readiness (due to a few devices that were out there to defeat inspection machines - the back and forth would make them crash)

running the basic setting tests, you can get a VW to 'correctly' (as far as the inspection machine is concerned) set all the monitors, and pass state inspection without moving the car a single inch...

as long as only 2 monitors are not set for 2001 and older vehicles, and 1 monitor not set for 2002+ vehicles, you will pass.

changing the values so it just shows a monitor as being 'not supported' is fine as well..

the machine WILL pass a vehicle that shows all the monitors as being 'not supported' - it really doesn't care..  as long as there aren't too many 'not ready', you get a sticker....

and the other sad thing is you can have a whole bunch of current DTC's as well - just as long as the CEL isn't on!  (there are vehicles that the ECU doesn't have seperate current / pending flags, so any code either current or not, all show up as current...)

Pure gold post turboneoffroad! Thanks very much for that info. I don't live anywhere that tests, but that may change in the future...

It also depends which monitors. Cat eff wont pass even if it's the only one not complete. This has been my experience. I was told by someone high up that certain monitors carry more weight than others, and it's not just the number of passed to incomplete.

I have a very similar issue in ME7.1.1 and logging has shown that B_sbbhk and B_sbbhk2 are never set to 1.
I tried the above 5 codewords with no avail.

Could I just change B_sbbhk to cc_UC and call it a day?

Any help here is much appreciated :)


More details here for reference:
http://nefariousmotorsports.com/forum/index.php?topic=8764.msg90946#msg90946

I just got back from passing my emissions tests and have a little info that might be useful to someone. Before I had the idea of deleting all my emissions components I was already throwing code p0420. For whatever reason I ended up deleting EVAP, n249, vacuum reservoir, SAI and also coded out my rear o2 sensor. After I had everything deleted I was still having trouble setting readiness for my catalyst and EVAP. The way I was able to get all readiness set was to reflash with the stock bin file and let everything run through the tests and fail, I then flashed the modified bin file without resetting the CEL and everything immediately showed as passed with vcds and also the android torque application.


All set to "0"

For EVAP - CDTES, CDLDP
for rear 02 - CDKAT, CDKATSPF, CWDLSAHK
for SAI - MSLUB
   

Doing any of that without touching ESKONF is not advisable.

I have all relays still plugged in so I don't get any MIL's. I might end up reverting some components back to factory but I haven't decided 100% which ones yet. If I wanted to remove N249, N112, N80 and P299 relays I think this would be the solution:

Factory 518ak: AA   FF   00   30   E3   F8   30
Modified:          AA   FF   00   33   E3   FB   FC

Got it. Wasn't sure what your hardware situation was. Carry on!

Hello ! Help me find the address USMIN ?

Thanks for the help!) Solved the problem in a different way.

Address still searching USMIN

Used a "hipeka" friend's code and decoded

00 00 00 00 00 00 00 01 00 00 01 01 01 00 00 00 01 00 00 00 00 01 00 00 00 00 01 02 00 01 01 04 0F 00 01 00 01 00 00 01 00 00 06 00 00 00 04 7D AF 15

Been working closely with someone else from the forum on this matter for some time.

Basically setting readiness is quite easy with a little bit of custom code. 

Check in the FR for EVSUP_1.  If you would like to find it in IDA then with ME7info you will find the RAM address for readiness byte.  One byte back will be EVSUP_1 every time.  Now with this RAM address you will be able to replace the instructions for this with a call that points to your code.  In the FR you will see how to appropriately set your bits to get whatever readiness you would want.  Simply move EVSUP_1 to an open registry (in this case it would likely be rL4) and set rL4 to whatever combination you need.  I.E if you want to set every monitor to ready then you would put all 1's (11111111) or FF in hex.  With some basic understanding of asm you will in short time with 3 lines or less be able to set evsup_1 to whatever you like. 

Happy Hunting :)

D

That's exactly what i did. Someone asked me to set readiness, and instead that complicated way, i just searched for ready_byte and evsup1 and set it to whatever i want.
But a small hint, evsup1 isn't the byte before ready-byte, its  2 bytes before.
If readiness = 0x380123, evsup 1 would be 0x380121

Br

can anyone walk me through how to find these two in my m-box so i can set them to zero? Or is there a reference guide anywhere on how to find these addresses in the hex editor?

CLALDPE is 0x10712
CLATEVE is 0x10746

First address is correct, second is not in what you have posted. 

This is for an MBOX.

ME7.1
8D0907551M
0002

I have a problem that's kind of the opposite of what most people are doing.  I'm finishing up an AWD conversion on a 1.8T Jetta using TT/R32 parts and there is an extra EVAP solenoid on the charcoal canister I need to get working.  All the mk1 TT quattros have this extra valve and I either have to enable it in my ECU or just buy a TT one I guess.  There's no mention of the N115 valve in the S4 wiki at all, just the N80.  Anyone know if there is another bit pair somewhere to enable/disable the N115 valve?

I think I found it, in my ECU (06A906032DL) ESKONF is:
AA FF 00 30 FF F8 30

In the ECU for the TT 180q AWP (8N0906018AL) ESKONF is:
AA FF 00 30 F3 F8 30

The BEA TT225q ECUs I found on here have the same values too.

There's one extra thing enabled and that has to be it.  I'll give it a shot when my spare ECU comes in the mail this week.

So that modification to ESKONF got me halfway there.  That just enabled the DTC which I was afraid of, but it does confirm that I have the right pin!  If I connect the valve to that pin it clears the codes, but it doesn't turn it on the valve during the leak test.  I found a bit called CLATEVE2 in the 06A906032DR XDF on here (at 0x10792) and tried setting that to 3 just like CLATEVE.  That also didn't work.

I guess the next step is to try a TT ECU file or something...

Edit: Tried a TT file from an AWP 8N0906018L (it was way more similar than the AL), works perfectly now!  Thanks for all the help on this forum!

Hello ! I encountered such a problem by changing the code as I wrote earlier , Swim idle speed on a warm car .
If I turn off the air mass meter then everything is fine . the flowmeter is 100% reliable.
tell me what I could do wrong, could I get the code wrong.

Hi all.
I want to remove rear o2 sensor but i don't understand something from WIKI.
I have me7.5 and the eskonf is AA FF 00 30 FF F8 30

    Byte 0 AA= 10 10 10 10
    Byte 1 FF= 11 11 11 11
    Byte 2 00= 00 00 00 00
    Byte 3 30= 00 11 00 00
    Byte 4 FF= 11 11 11 11
    Byte 5 F8= 11 11 10 00
    Byte 6 30= 00 11 00 00
and only thing about o2 is in byte 3 = LSHHK EFLA LDR TEV where i must change LSHHK , CORRECT?

But after i read wiki page there wrote (but i think this is for ME7.1 ??):
"Finally if you intend to disconnect the sensors, configure ESKONF (13 bytes starting at 0x10C75):[60]. If you intend to leave the sensors installed and connected, there is no need to disable circuit diagnosis.
    ESKONF[5] (0x10C7A) - set to 0xC0 (set bits 6 and 7)
    ESKONF[6] (0x10C7B) - set from 0xF3 to 0xFF (M-box) (set bits 2 and 3)
    ESKONF[6] (0x10C7B) - set to 0xC3 to 0xCF (L-box) (set bits 2 and 3)"

Please give me your advice what i must change in eskonf?

THANKS

Byte 03 - 00110000 >> 11110000

THANKS.
I made change FOR rear O2 and cat remove in ESKONF and modified all like in WIKI page .

Have 2 issuse some variables not found and other are other things (not variable are maps)

I don't find  in xdf next variables/maps(my engine is 1.8t AUQ with 032HN ecu - i have xdf from this site):
-CDLSHV - but understand for 2 sensor it not exist
-CLRHK (0x11A87) - not find in xdf at this addres is B4 hex value - please tell me what must i change
-CLRKA (0x11A72) - not find in xdf at this addres is 00 hex value

CLRSHK - found in xdf with 16  value , but please tell me what value must put
CWKONLS  - i modified in 1 - please tell me if is CORRECT
LRSHK  - after search tunerpro give me other variabkes find CLRSHK  - please tell me what must do here

For next in wiki said  ZATMIKML = 1    ZATMIKKML = 1    ZATMKML = 1    ZATMKKML = 1 but i found
ZATMIKML_1_A - are map
ZATMIKML_0_A - are map
ZATMIKKML_0_A - are map
ZATMIKKML_1_A - are map
etc
WHAT must do here ?? MUST PUT ALL VALUES ON 0 in all maps

For this FKHABMN  is find in file at address 99 hex value but in tunner pro after search i find
FKHABMN_0_A - 0.80
FKHABMN_1_A - 0.05

WHAT must i change here too?

MANY MANY THANKS in advance for your help.

Can anyone help me with setting Secondary air t o Complete?

I've been driving the car for 2 months and can't get it registered and would like to be done with this nightmare

With all the info available here in nef, you should be able to sort that out pretty easily.

Also it would help if you mentioned what box code you're trying to do this for.  I'll try to help.


Sent from my Pixel XL using Tapatalk

Sorry for the lack of details, this is for an ME7.5 2004 VW Jetta 2.0 automatic


I have replaced every component related to the secondary air, I have checked passages, even replaced the ECU to test and nothing. I have no clue what's going on. I am able to run the secondary air test, but when I try to complete readiness it never completes the secondary air, everything else is completed including evap which can be tricky sometimes.


Here is the full dump

If it works I am willing to compensate you for you saving me the time, I just don't have the time to be experimenting and if someonoe could help and I could go for an inspection that would be ideal. It's been a frustrating ordeal.

Sorry. Wrong version uploaded download THIS one...

I know this is an old thread but I've recently had to fully reverse and document the DIMC function from an ME7.3H4. This matches up to the FRE0700.PDF function and datasheet documentation that's also available on here.

If your familiar with C167 assembly its so much easier to read the code... (attached).

If you find it useful let me know...

Ofcourse you can quite easily make a universal patcher (I think I will add the feature into my Swiss Army Knife tool) to automatically find DIMC and force readiness regardless of any other settings. If this is useful let me know and I will do other variants than this

removed o2 sensor from catalyst, unfortunately 2 dtc occurs

2 Faults Found:

17526 - Oxygen (Lambda) Sensor Heating; B1 S2: Open Circuit
        P1118 - 004 - No Signal/Communication
17522 - Oxygen (Lambda) Sensor; B1 S2: Internal Resistance too High
        P1114 - 004 - No Signal/Communication


i changed to 0:
1819E CDHSH
1819F CDHSHE
181A3 CDKAT
181A5 CDLASH
181A7 CDLATV
181AB CDLSH


Is there anybody who can help me with finding ESKONF?

10c61

Thanks for helping ;D

I have another error p0140 why what I did wrong?

Hello, all.

...i try make passed monitors on MED9
what yours think about "Linie der Klassentabelle"?

Some one found ESKONF in 8N0906019Q Audi TT file ?

ESKONF is not part in A2L of 019Q, does it may named differend ?

If ESKONF shood be right befor KFKHFM, like S4Wiki tells, I found 7 non definied bytes.
But they do not make sense IMO:

255 000 000 255 248 051
(FF 00 00 FF F8 33)

I would expact some like AA FF 00 30 FF F8 30 or simular..
When I search for AA FF 00 I cannot find anything that fits.

Can someone help or give a hint ?

Thanks Jochen 

Nyet can you add this to the Wiki for Rear O2 full removal. I chased my tail for MONTHS... Ask Gremlin... I read so much then started turning off the codes 1 by 1 because i knew either CDLSH or CDLASH was causing the front O2s to not pass. for ME7.1.1 on ST10 i needed to change these settings like above and "FINALLY" passes with no rear O2 plugged in at all and all systems passing.

Hello.
Can me any help to find in this ecu ME7.1.1 4F0 907 559 - 4F0 910 560 C.
Its AUDI A6 4F 4,2i .

SRYAGR
SRYHS   
SRYKAT 
SRYLS   
SRYSLS 
SRYTES 

probably looking for CDKAT and CDHSH / CDHSHE not SRYHS... But maybe im wrong.

Thanks.
I solved it with CDKAT and so.

Hello :) I have a little problem. I tried remove SAI and rear O2 sensor in my .bin file but I do it first time and I don't want brick my ECU. I can't find ESKONF so I didn't do that. Can do it anyone?
Can you check this .bin file and compare check sum with my ori .bin file ?

Audi A6 C5 2.7T 2003 BES

I tried 2nd time

ESKONF is @ 10C86

Try again and post up your update.

Now is it all Okay ?

Sorry for the noob question but in relation to the opening post, what does Eurobyte mean?

i may be wrong and corrected

DEC 128 HEX 80 is a EUROBYTE if u look in the ANSCII code u will also see a euro sign

Thanks for the clarification.

P1469  N115 open circuit
How to get rid this DTC on ME7.5?

find the DTC and zero it if it not actually a fault

TEV in ESKONF?

It looks like it is not in ESKONF, I try to FF all last 4 bytes. DTC still there

I didn't learned that ASM skill yet
 

What car? Isnt that code related to N80?
On my Golf mk4 ME7.5 with complete EVAP delete i just set last 2 of byte 3 to 11.

Audi TT
018 CL
No it is not N80 it is N115. First time i see this on ME7.5

Have a look at this thread; http://nefariousmotorsports.com/forum/index.php?action=printpage;topic=8898.0
I realize its ME7.1.1 but it might be similar

Can you post .bin and .kp? I'd like to look at eskonf

DONT NEED ASM to do it

How to find DTC and zero it?

EXAMPLE: P1523
1070F is the start of your error class table.
Hint: There's almost always a 01 7F in front of it. A lot of times 01 7F 0F 00, where 00 is the start of
the table. Some files this is 01 7F 50 00. (again, 00 is the start of the table).P1523: The first occurrence is at 1361D. Scroll up until you see four blocks of 0000. The address of
the first block is the start of the VAG specific DTC table. In this file this is 1327A.Now: USE WINDOWS CALC IN PROGRAMMER MODE
1361C - 1327A = 3A2
3A2 / 8 = 74
Now find the start of the error class table 1070F
1070F + 74 = 10783
00 the byte at 10783

i have a PDF with pics if needed

Thank you I get it  ;)

Just an update/clarification: I can confirm on ME7.5 018CA and many other ecu's/ME7's it will not pass readiness on Oxygen Sensors if DLSH is completely disabled because Z_lsv wont be set as 1.

Even if the checked error flags are 0 - E_lsv , E_lsh, E_latv etc. the Z flags must be set aswell or it will not pass readiness.

Solution is in masterJ's post or you can modify the code directly in asm, either force b_sbbhk to the required value, or change the jump command.