NefMoto

My little project... It's just a small start, slowing finding maps... Or at least I'm pretty sure they are correct (would be nice for someone to check them).

I also believe the DTC table starts at 0x133A8.

I'm fairly at ease finding maps, but I could use some (a lot) of help with finding codewords.

I'll keep updating as I find more...

Edit:
Updated XDF

Already an update...
Added KFZW maps.

Edit:
See first post for updated XDF

Starting to see the patterns in the ROM, making a little more sense.
Thankfully a lot of the odd stuff is in the same locations (or fairly close) across a few different ECUs.

Added:
MSLUB
NMAXDVG
KFSU/KFSU2
Codewords
And maybe a few more that I forgot.

Edit:
See first post for updated XDF

ESKONF @ 0x010C1F?

Correct.

Awesome, glad to see I'm on the right track. :D

More updates:
KFZWOP/KFZWOP2
KFMIRL
ESKONF
Also categorized entries

Edit:
See first post for updated XDF

This file shares a definition with many S8 files, including 559AA.

Any insight on ESKONF bits? I'm assuming they aren't the same as any known ones...

Added:
KRKTE
LAMFA
PLRHAV
PLRHAV2

Edit:
See first post for updated XDF

I think I found the pedal maps:
0x160AC
0x1622C
0x163AC

But questions:
Where are the axis maps?
Are they the same as KFZW, since those are shared by a few others already?
Why are there 3? I know other ROMs have one normal and one for reverse, but they also have the axis maps associated with the map too.

The axis starts shortly after the last map.

16558=0C 00=16 decimal=RPM
16572=10 00=12 decimal=%

As for the maps, low/medium/high speed IIRC.

I thought I looked there, but I see the bar graphs are a bit odd on them too... Oh well.

3 speeds though, huh... I wonder if there's a map for the switch points.

Lots of stuff added:
KFPED1/KFPED2/KFPED3
KFTATM/KFTATM2
KLATMILAE/KLATMILAE2
KLATMIZWE/KLATMIZWE2
KLATMLAE/KLATMLAE2
KLATMZWE/KLATMZWE2
NTUMTAT
TABGMEX
TASTBFA
TATMKH/TATMKH2
TATMKW
TATMSA
TATMSAE/TATMSAE2
TATMSTI
TATMTMOT
TATMTP
TATMTRKH/TATMTRKH2
TATMWMK
TIKATMOE
TKATMOE
TKSTBFA
TNLATMTM
TNLATMTU
TUMTAIT
VTUMTAT
WMABGKH/WMABGKH2
WMKATKH
ABGMSIGH
TKATMSHU
TMSH
TMSHA
TRSE
TUSMAX
TUSMAX
UBDLS
CWGGLSH
ANZDYNSH
ANZERDYH
ANZERSCH
CIDLSCH/CIDLSCH2
CIDLSDY/CIDLSDY2
CIDSHKF/CIDSHKF2
CIDSHKM/CIDSHKM2
CWDLSAHK
TABGSTG
TFRMB
TLLASH
TSALASH
TUSCHUB
TUSHSMIN
TUSSA
USHLEAN
USHRICH
USHSTGMX
USHSTSOLL
USSCHUB
CWGGLSV
ADKATNF
AHKATMN
AHKATMX
AHKATS
AHKATSB
AHKTMXT
APEKTDX
AVKATFS
CDKATLK
DKATCW
DRLKTDP
DRLKTDPT
FALRKTD
FALRKTT
HYKATA
HYKATR

Most of those should be correct, they were sequential in all my reference ROMs, so I'm just assuming they are here as well (they looked like they are in the ROM), and the axis maps were found nearly in the same area with the same values... So here's hoping!

Edit:
And I didn't translate the descriptions, because my eyes are about to fall out as it is lol
I'll do them later...

Edit:
See first post for updated XDF

Just realized how to update attachments... So I've updated the XDF in the first post.

Added:
IGESGA
CWGGFGRH
CWBWEEN
DUPW12
DUPW12TG
DUPW12VG
NWPMBBR
THOPP1
THOPP2
TUPWBWV
TUPWG12
TUPWG1O
TUPWG1U
TUPWG2O
TUPWG2U
TWPMBBR
UPW1BE
UPW1LLMX
UPWG12U
UPWG1O
UPWG1U
UPWG2O
UPWG2U
UPWGO
UPWGTG
UPWGTL
UPWGU
UPWGUBF
UPWGUR
UPWGVG
VWPMBBR
WPMXNOT
ZBWF
CWBBKD
TKD
DWDK12O
DWDK13O
DWDK23O
WDKPMXN
MLOFS
DZWOLA
DMVERLMN
DNMAX
DNMAXDZ
DNMAXH
ITNMAXP
ITNMAXH
NMAX
NMAXDV
NMAXDZ
NMAXNL
NMAXOG
NMXDKPU
TMOTNMX
TNMAXP
TNMXH
TNSC
NLLM

I also think that MSLBAS @ 0x183BA, with other secondary air related constants.

Nice work! Keep it up! Don't get discouraged by the lack of feedback.

I posted abunch of 1.8t stuff no one seemed to care about - randomly getting a thankyou email made it worth it ;)

No worries, I know "no one tuned that POS", but someone has to take care of the odd ones, right? ;D
Also, when my combi valves give up, this will come in very handy!

Plus it's kinda fun, I just wish I knew how to get IDA working correctly so I can dig even more.

What He said. This is great information for anyone interested in these, I believe it was: "worthless POS engines" :)

I'll be sure to use this to update the ME7.1 4.2 xdf when I get the chance.

Updated the first post with new XDF.

A few more additions...
TASLSO
TASLSU
TDDSLA
TDSLKT
TLMSSLAB
TLMSSLMX
TMFASLMN
TMSSLO
TMSSLSTO
TMSSLSTU
TMSSLU
TSLABB
TSLPMN
TSLUBST
TVDSLOFF
TVSLVOFF
TVSLVON
VSLS
ZFLMSSL
ZKSLPOFF
ZKSLPON
CWDSLSA
CWDSLSY
DSLVFZMN
FMSLAMN
FMSLAMX
IMLDSL
MSLBAS
NDSLMN
NDSLMX
RLDSLMN
RLDSLMX
RMSLADA
RMSLMN
RMSLMNK
RMSLTMN
TABGMSLAD
TANDSLMN
TANDSLMX
TC6CSL
TC6CSL2
TC6CSLK
TC6CSLK2
TC6CSLN
TC6CSLN2
TC6CSLV
TC6CSLV2
TDDMSLIFT
TDFRDSLS
TDMES4OFF
TDMSLMN1
TDMSLMN4
TDMSLMNK
TDMSLOF3
TDMSLOF5
TDMSLOFK
TDMSLV
TDMSLVK
TDPH2SLOF
TDPHSLOF
TDSLMVBA
TFIMSLI
TFIMSLIK
TFIMSLO
TFIMSLOK
TFIMSLV
TFIMSLVK
TKATDSL
TMDSLAMN
TMDSLMN
TMDSLMX
TNOMF2
TNOMF3
TNOMF5
TWHLSLP
TWMLFE
TWMSLMIN
ZDSLAMX
AIMVM
DVFZBEG
VFZMN
VFZR1O
VFZR1U
VFZR2O
VFZR2U
VRFGRMN
ZFBFZGL
ZFCNT1
ZFCNT2
ZFV

Some changes...
I was going over some of the values and noticed that these didn't make sense:
WMKATKH
ABGMSIGH
TKATMSHU
TMSH
TMSHA
TRSE
TUSMAX
TUSMAX
UBDLS
CWGGLSH
ANZDYNSH
ANZERDYH
ANZERSCH
CIDLSCH/CIDLSCH2
CIDLSDY/CIDLSDY2
CIDSHKF/CIDSHKF2
CIDSHKM/CIDSHKM2
CWDLSAHK
TABGSTG
TFRMB
TLLASH
TSALASH
TUSCHUB
TUSHSMIN
TUSSA
USHLEAN
USHRICH
USHSTGMX
USHSTSOLL
USSCHUB
CWGGLSV
ADKATNF
AHKATMN
AHKATMX
AHKATS
AHKATSB
AHKTMXT
APEKTDX
AVKATFS
CDKATLK
DKATCW
DRLKTDP
DRLKTDPT
FALRKTD
FALRKTT
HYKATA
HYKATR

So I had to remove them, which unfortuantly blows rear O2 removal out (AHKATMN/AHKATMX/AHKATS/AHKATSB), I'll have to review those and dig a little harder.

Added FKVA and KVB

Added:
TBLRH/TBLRH2
TKATMLRH/TKATMLRH2
CFRA
FLRM
FRIPDSL1/FRIPDSL4/FRIPDTES
FRIPTES
TSPERN/TSPERN2
USR
CLSDKH
NDLSO
NDLSU
NACHANZ
ZWAPPL
DZWETA
CWKHZW
DNTIPDYN
FZWKHMX
KFZWMS
KFFDLBTS
KFLBTS
MSNPCV

Needs load axis for LBTS maps, it wasn't jumping out at me, so I'll have to update later. I need to recategorize anyway.

Still looking for AHKATMN/AHKATMX/AHKATS/AHKATSB, but none of the other 4.2 or 4D09* ECUs seem to have those mapped, so I don't have a good reference.

Should be 1D520

:)

Ah, didn't think to look for a 16bit axis. lol Thanks

Updated again, added:
AHKATMN
AHKATMX
AHKATS
AHKATSB
AHKTMXT

I'm only 90% sure on those, they seem correct to me though.

Did a few translations, also added:
FNSSTM
KFNLLNST

Currently looking for some insight on ESKONF, obviously only info available is for the 4-cylinder...
I know the 560CE is very similar to the 558 (RS6), but there's no public info for that either.
I can take a guess and say that the two blocks of 0x00's are probably injectors, the one block of 0xAA is probably coils, then the two 0xFA's might be the other 4 coils (the 0xA part of 0xFA)... But beyond that, I have no reference and no other way to figure them out, other than doing MANY reflashes and brute force testing.

I used the many flashes/brute forcing. I did this on multiple cars in order to find bitpairs that were only present in certain binaries. Probably did 100 flashes to map it all. What I can say is this:

NEARLY All ME7.1.1 is the same (the later ST10 files appear to differ)
All ME7.1 is the same
All ME7.5 is the same

Get SOMETHING figured out, I'll fill you in. My advice, unplug EVERYTHING that throws a circuit code, and flash with ONE bitpair changed at a time and see what turns off. Remember, motormounts are part of it.

I figured you weren't just gonna give me the info... lol

But anyway, that's what I was planning on... I think the next step is to build/buy a bench harness, that would make life easier for this.

Any info about ME7.1.1 ESKONF bytes? :)

What info are you after?

I would be happy with the two SAI items, I don't really care about anything else (no point in removing EVAP stuff IMO)... I already got rear O2's from an old ROM you posted before the tuned ROMs forum went away.

0 (value 00, address 10C1F)
1
2
3 x x x J299
4 x N112 x x
5
6
7
8
9
10
11
12 (value CC, address 10C2B)

Thanks :)

Added:
CLRKA
CLRHK
CWKONLS
CWDLSAHK
KFMIZUOF
KFMIZUNS
KFMIZUFIL

Question though, according to CLRKA and CLRHK, rear lamda control is disabled?
So does this mean that they don't do rear lamda control on these engines, and only use it for cat efficiency check?
They're set the same way on the RS6 ROM that I have too...

Added:
ETADZW
ETALAM
FZWWLRLN
KFZWWLNM
KFZWWLRL
TZSUDYN
ZDBTMN

A few more:
FTSDRLW
FMSTMOT
FSWTM
FSZTM
KFSZDUB
KFSZT
KFTSRL

I think I have a few more items sitting in WinOLS that I haven't moved to the XDF yet as well, I need to go back over it all and check...

There's also 8 mystery maps (10x10, 16bit) starting @ 0x1C0EA, I suspect that they are cylinder filling characteristics, but the values are way different than my reference (which is a flat map), though they seem to match other NA V8 mappings (turbo engines don't use them maybe?)

1C0EA is KFPRGE. I found this explanation: Internal exhaust gas partial pressure of N-dependent adjustment (basic KF) at inlet NWS

How sure are you on that?
I only have one reference with KFPRGE defined and it's a 2x24 map, also the thread on this forum that references it says it's boost load related...

I was pretty sure... Not anymore, I found it in the same place on a RS6 binary.

Yeah, I've noticed a lot of inconsistency in some of the RS6 defs, at least with WinOLS defs anyway.
So far the XDF's haven't been too bad.

More added:
KFMSNWDK
KLAF
KFWDKSMX
KFDZWKG
KFAFTE
KFWKSTN
TVUB
ZDBTMN
DZWOLA

Anyone know how cam changeover handled on these engines?
I know it's only used for internal EGR and cat warmup, but how is it done?

I'm pretty confident that there aren't any NW maps, the closest is KFSU (same size as 551M KFNW), but those are intake flap staging.

So, is that code actually stripped out (or repurposed for intake flaps?), or is there any way to enable it and make it useful, maybe tweak changeover switch point somewhere (simple on/off???)

RS6 ROMs seem to be a special case, NWS maps are in the 0x2AXXX range... If I had to guess, I would say code was added on? (that region on my ROM is all 0xFF)

I really wish there was an FR available for this thing. lol

You would be wrong. At the risk of spoiling you:

KFNWSE, NWKHE, NWWLE, NWKHLLE, NWLLE, NWWLLE all exist in these binaries, and vvt is very much used on WOT pulls.

KFNWSE: 19F4E, 8x12, 8 bit (factor .5*x) axis are 1A02E upm (40*x) and 1A041 % (.75*x).

:P

Hmm, interesting... Values in those maps are NOT what I would have expected, nothing like any of the other examples I have (the areas are shaded differently, as if WinOLS thinks no checksum in that area?)

Thanks for the info, I'm no expert on these things obviously, so it's ok if I'm wrong. ;)
Just seems odd that every example I have is a little bit different.

0=at rest
11=transitional
22=advanced/vvt active

Sorta like KFSU and the 0, 1, 2 values....

8D0907551M, it's 8bit and 0x00 or 0x80...
4D1907558, it's 16bit and 0x0A00 or 0xFF00...
8N0906018CB, it's 16bit and 0x0900 or 0xFE00...

Nothing good for me to reference! lol

Edit:
Though I do have another question...
If NWS is indeed used on this engine, why does CDNWS = 0?

Update:
FNSA_0_A
FNSA_1_A
FKKVS_0_A
FKKVS_1_A

I think I have the correct temperature axis for FNSA, though there is another possibility at 0x1830D... So not 100% there.

Need help with KFLF though, I've scoured the ROM looking for it, but closest I can find is 0x188B8, but where are the axis?
Should KFLF be flat, or should it be populated? I've seen both on turbo engines so far, but that's all I have for examples.

i believe KFLF on that should be all 1.001?

Thats how it is in the ones i played with.

That's kinda what I figured (what I meant by "flat", filled with 0x80), but again... Where are the axis for the map?
All the other ME7's I've looked at had X/Y axis scales preceding the map, but once again, the V8 just HAS to be different. lol

Added:
KLMIGENL
CWMSRCAN
KLDMASRL
RAMPASR
KFNWSE

(mostly spurred on by Nyet's post about ESP/ASR torque intervention)

Thanks for keeping us updated.  :)

Can You verify KFZWMS in the definition file found at first post. I think the axis values are tits up. The addresses seem to be right but the conversion factors and some other values are wrong. I just looked the values up from KFZW.

It totally possible I fudged something, I haven't actually looked at it in months (don't have the car anymore), but I'll take a peek when I get home.

Forgot to transfer the axis definitions, they were all wrong. I've update the first post with the new XDF, it should be correct now.

Yep, that's what I figured. Thank You for keeping this thing updated. I'll keep bugging You if I find something else :)

Feel free to use my 560A B6 S4 4.2 V8 file as a reference, hope it helps. 

One (very very minor) contribution from me:
KFVOFFS at 1457E, 16b 8x6

And one question: how is the map with ID at 1CCFC called?
It's 6x1 16bit, with included axis data, and is related to the variable intake.

By the way, any chance you could put your maps in a Winols useable format.

I would love to cross reference what you've done against my work. Also, please feel free to give me your 2 bits on my 4.2 S4 project if you get some time to look at it.

Keep up the good work, glad to see that someone else is into the oddball engines too :)

BTW, I finally got around to checking your .xdf in Tunerpro, outstanding work, thank you :)

have you found CSAWE in this? I'm looking to try to make some afterrun gargle and popping from the v8. vette and Camaro guys have it and I want it too lol.

Where would someone find this me7.1 4.2 xdf?  :)

Is this file for Auto or Manual?