setzi62
Full Member
Karma: +142/-0
 Offline
Posts: 249
|
 |
« on: October 01, 2010, 07:52:51 AM »
|
|
|
at first, thanks a lot for the big bunch of information here in and
of course for the forum itself. Really great stuff on many different areas.
Probably some of the "reverse-engineers" might be able to help:
analyzing the code of ME7.1 images, I found that there is a second device
besides the eeprom, which is also connected to the SSC (sync serial intf) of the CPU.
This device gets selected via the CS4\ pin and exchanges messages with the CPU
consisting of 96 x 16bit words, the last word is checksum of the previous words.
Could it have something to do with the second CPU on ME7.1? On ME7.5
there's only the eeprom connected to SSC. I have neither a physical ME7.1 nor
any circuit diagrams to verify. So anybody has an idea what's this device?
|
|
|
|
|
Logged
|
|
|
|
Tony@NefMoto
Administrator
Hero Member
Karma: +132/-4
Offline
Posts: 1389
2001.5 Audi S4 Stage 3
|
|
« Reply #1 on: October 03, 2010, 11:54:00 AM »
|
|
|
While reverse engineering my 2001 S4 ECU I found that the serial eprom and the second CPU were both on the SSC bus. I have not taken the time to determine what the second CPU is doing. I know that it only has internal ROM, and is not connected to the external RAM or flash memory. My guess is that it is a watch dog for the main CPU.
|
|
|
|
|
Logged
|
|
|
|
turboskipper
Jr. Member
Karma: +3/-0
Offline
Posts: 40
|
|
« Reply #2 on: October 03, 2010, 04:58:30 PM »
|
|
|
This may also be a second CPU for ETC monitoring. Normally keeps an eye on basic driver inputs and key sensors for a load estimation and can take control of the electronic throttle for safety.
|
|
|
|
|
Logged
|
|
|
|
setzi62
Full Member
Karma: +142/-0
Offline
Posts: 249
|
|
« Reply #3 on: October 04, 2010, 12:16:39 AM »
|
|
|
thanks for the answers, helps a lot to save the time digging into wrong direction.
Just for curiosity: has anybody ever read out the internal ROM of the second CPU?
Shure that reading would not work straightforward and most probably need some
HW-modification ...
|
|
|
|
|
Logged
|
|
|
|
spen
Full Member
Karma: +43/-0
Offline
Posts: 112
|
|
« Reply #4 on: October 04, 2010, 07:53:37 AM »
|
|
|
Does anyone have a handle on where the knock sensor input signal goes?, other ECUs I've worked on used a DSP to transform the knock signal before doing a DMA type transfer to memory for the main CPU.
which ram addresses do the 96 words get written?
|
|
|
|
|
Logged
|
|
|
|
Tony@NefMoto
Administrator
Hero Member
Karma: +132/-4
Offline
Posts: 1389
2001.5 Audi S4 Stage 3
|
|
« Reply #5 on: October 04, 2010, 08:52:00 AM »
|
|
|
thanks for the answers, helps a lot to save the time digging into wrong direction.
Just for curiosity: has anybody ever read out the internal ROM of the second CPU?
Shure that reading would not work straightforward and most probably need some
HW-modification ...
You can read out the internal ROM in boot mode. But you need to use a real tool for boot mode like Minimon to do it. |
|
|
|
|
Logged
|
|
|
|
setzi62
Full Member
Karma: +142/-0
Offline
Posts: 249
|
|
« Reply #6 on: October 04, 2010, 08:57:46 AM »
|
|
|
I think knock voltages are processed by a separate Bosch-IC. For the ME7.5, this is most probably the CC650 as stated by Camden in http://nefmoto.com/wiki/index.php?title=Reverse_Engineering_ME7.5The SSC data buffer is located in XRAM at E42E. PECC-Transfer is used to send/receive from/into this buffer (sent via PECC0 and received via PECC4). To use the boot mode/minimon, the async serial line would needed. Probably you have first to connect the RX/TX pins of the second CPU manually to some line driver to make boot mode working  . |
|
|
|
|
Logged
|
|
|
|
Tony@NefMoto
Administrator
Hero Member
Karma: +132/-4
Offline
Posts: 1389
2001.5 Audi S4 Stage 3
|
|
« Reply #7 on: October 04, 2010, 09:11:01 AM »
|
|
|
To use the boot mode/minimon, the async serial line would needed. Probably you have first to connect the RX/TX pins of the second CPU manually to some line driver to make boot mode working . For the main CPU you can read the internal ROM through the K-line interface. For the secondary CPU, I soldered some wires to the TX/RX lines of the CPU and then ran that through a max232 to convert TTL to RS232. |
|
|
|
|
Logged
|
|
|
|
spen
Full Member
Karma: +43/-0
Offline
Posts: 112
|
|
« Reply #8 on: October 04, 2010, 06:41:52 PM »
|
|
|
 impressive work with the iron! Are you willing to post the binary? |
|
|
|
|
Logged
|
|
|
|
Tony@NefMoto
Administrator
Hero Member
Karma: +132/-4
Offline
Posts: 1389
2001.5 Audi S4 Stage 3
|
|
« Reply #9 on: October 05, 2010, 12:55:51 PM »
|
|
|
I think I used some 25 gauge wire to make the connections. It was a couple years ago when I was figuring out the ECU circuitry. I attached the two files I have from the second processors internal ROM. One is from my 2001.5 Audi S4, and the other is from an Audi A6. I think the memory range 0 to 7FFF is the total range of the internal ROM for this CPU.
|
|
|
|
|
Logged
|
|
|
|
setzi62
Full Member
Karma: +142/-0
Offline
Posts: 249
|
|
« Reply #10 on: October 06, 2010, 01:44:57 AM »
|
|
|
 wow, is there anything you have not already done with these ECUs Tony? The A6 rom looks at first glance like a standard bootrom with ercos kernel, but its a version 05.32 which I not saw before (saw 05.12, 06.02, and 06.05 up to now). The S4 rom is different and will need a closer look ...
|
|
|
|
|
Logged
|
|
|
|
Tony@NefMoto
Administrator
Hero Member
Karma: +132/-4
Offline
Posts: 1389
2001.5 Audi S4 Stage 3
|
|
« Reply #11 on: October 06, 2010, 10:32:10 AM »
|
|
|
I haven't finished tuning my own car, or actually finished an ECU tuning product yet.  Not to mention I seem to incapable of replying to all my emails, or adding useful info to the wiki.  It's nice to finally find some people that know what ERCOS is. You guys are pretty good at hiding. One thing I haven't done is figured out the code that sends and receives messages over the CAN bus. I would like to do that one day... |
|
|
|
« Last Edit: October 06, 2010, 10:37:52 AM by Tony@NefMoto »
|
Logged
|
|
|
|
setzi62
Full Member
Karma: +142/-0
Offline
Posts: 249
|
|
« Reply #12 on: October 07, 2010, 07:50:36 AM »
|
|
|
Oh yes, about the motor CAN there is not much information flowing around. From code
inspection it is very hard to find out which IDs contain which kind of information and how
the 8 data bytes in each CAN message are used.
But for tuning there is not much you can do with the CAN if you have one of the older ECUs.
Better to spend the energy on tools using the K-Line ...
|
|
|
|
|
Logged
|
|
|
|
thom337
Full Member
Karma: +15/-1
Offline
Posts: 81
|
|
« Reply #13 on: October 07, 2010, 08:01:42 AM »
|
|
|
Oh yes, about the motor CAN there is not much information flowing around. From code
inspection it is very hard to find out which IDs contain which kind of information and how
the 8 data bytes in each CAN message are used.
But for tuning there is not much you can do with the CAN if you have one of the older ECUs.
Better to spend the energy on tools using the K-Line ...
There is a LOT of very good information flowing around...IAT, boost, HFM, clutch switch, rpm, coolant temp, asr status, signed rpm derivative, torque before reduction, torque after external reduction request and also a lot more than I can remember off the top of my head...and its flowing at 500 kbytes/s |
|
|
|
|
Logged
|
|
|
|
Tony@NefMoto
Administrator
Hero Member
Karma: +132/-4
Offline
Posts: 1389
2001.5 Audi S4 Stage 3
|
|
« Reply #14 on: October 07, 2010, 05:12:51 PM »
|
|
|
My interest in the CAN bus is to figure out the information being sent around for traction control, and the display on the instrument cluster.
|
|
|
|
|
Logged
|
|
|
|
|
