|
terminator
|
 |
« on: September 29, 2021, 02:42:47 PM »
|
|
|
I know it's some kind of Top Secret information but maybe someone could give me a hint how can I change tacho needle position?
I read FR and found the following variable:
NEngInd_nOpt anzeigeoptimierte Drehzahlanzeige die an den CAN verschickt wird
But seems this is not what I'm looking for. I've found only one reference and nop it. Nothing changed.
|
|
|
|
|
Logged
|
|
|
|
kuebk
Jr. Member
Karma: +3/-0
 Offline
Posts: 47
|
|
« Reply #1 on: September 29, 2021, 04:38:49 PM »
|
|
|
It is what you are looking for.
|
|
|
|
|
Logged
|
VAG immo solutions (clone, immo off, repair) MEDC17, SIMOS, SDI, BCM2, ELV, DQ/DL/VL gearboxes, INVCON, MED9.x crypto
|
|
|
|
terminator
|
|
« Reply #2 on: September 29, 2021, 04:55:53 PM »
|
|
|
Thanks, gonna try it tomorrow one more time.
|
|
|
|
|
Logged
|
|
|
|
|
terminator
|
|
« Reply #3 on: September 30, 2021, 03:24:18 AM »
|
|
|
Seems it's not. I changed it to 0x7FFF and still nothing. Tacho works as always.
|
|
|
|
|
Logged
|
|
|
|
kuebk
Jr. Member
Karma: +3/-0
Offline
Posts: 47
|
|
« Reply #4 on: September 30, 2021, 06:57:00 AM »
|
|
|
AFAIR it depends on ECU configuration, not every ECU sends it over CAN to the cluster.
|
|
|
|
|
Logged
|
VAG immo solutions (clone, immo off, repair) MEDC17, SIMOS, SDI, BCM2, ELV, DQ/DL/VL gearboxes, INVCON, MED9.x crypto
|
|
|
|
terminator
|
|
« Reply #5 on: September 30, 2021, 07:35:35 AM »
|
|
|
But somehow Tacho shows RPM...
|
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #6 on: September 30, 2021, 10:40:17 AM »
|
|
|
But somehow Tacho shows RPM...
On many tachos it reads message 1 and gets the RPM from there. You can change it of course but then every module on the car sees the wrong RPM so you get a lot of warning lights if you try to do it like that. |
|
|
|
|
Logged
|
|
|
|
|
terminator
|
|
« Reply #7 on: September 30, 2021, 12:31:49 PM »
|
|
|
I see, thanks. I've just tried to zero Epm_nEngRaw Rohdrehzahl f¨ur OBD Tester and now diagnostic tool shows 0. Tacho shows RPM just fine.
|
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #8 on: September 30, 2021, 12:37:54 PM »
|
|
|
Diagnostic tool is irrelevant, open the FR and look what goes into Engine 1. You need to patch it on CAN level.
|
|
|
|
|
Logged
|
|
|
|
jacktfsi
Jr. Member
Karma: +18/-0
Offline
Posts: 44
|
|
« Reply #9 on: September 30, 2021, 01:05:47 PM »
|
|
|
On some Bosch ecu’s it may be a better idea to modify the value before it goes to the message buffer (if it indeed has one in your case) rather than directly trying to modify the tach signal variable. So intercept it before it writes to the buffer with your register. This may still cause issues though as your sending a modified CAN message that other modules may be dependent on.
Still a noob on the subject though so take my advice with a pinch of salt.
|
|
|
|
|
Logged
|
|
|
|
|
terminator
|
|
« Reply #10 on: October 01, 2021, 03:45:34 AM »
|
|
|
As I understand the variable is called Epm_nEng.
CAN ID is 0x280 but I believe it's only for TP20.
|
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #11 on: October 01, 2021, 03:53:41 AM »
|
|
|
TP2.0 has nothing whatsoever to do with inter-module communication.
The more you write the more it seems you have absolutely no idea what you are doing. All the information is already in this thread, no more empty talk is required.
|
|
|
|
|
Logged
|
|
|
|
|
terminator
|
|
« Reply #12 on: October 01, 2021, 05:39:59 AM »
|
|
|
MED17 UDS has no 0x280 ID, MED17 TP20 has.
If I had idea I wouldn't ask.
|
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #13 on: October 01, 2021, 06:18:31 AM »
|
|
|
Again UDS and TP2.0 does not have anything to do with it.
CAN ID is also not important. Try to read what was written to you, by people who did what you are trying a long long time ago.
|
|
|
|
|
Logged
|
|
|
|
Herleybob
Newbie
Karma: +5/-0
Offline
Posts: 11
|
|
« Reply #14 on: October 01, 2021, 09:24:36 AM »
|
|
|
How i did it on my ME17. Monitor canbus messages, change rpm and find the value that changes directly inline with engine RPM, now search for that message ID in the disassembly. Heres how my canbus messages work, and you can see D0003425-D000342B are 0x-1 or 0xFF. Once you find the one that sends the RPM, you now know you need to modify that one. I would find the function that writes to the rpm parameter, change the store to a call/jump to your own small piece of code that outputs a value depending on if you want your rpm to display or the engine rpm to display. then return it as normal (if that made sense). See below for my canbus message generation and the actual canbus message on my ecm. D0003424-D000342B contain the 8 bytes for the message with ID D5 (at the bottom). Only the first byte of this message contains anything, the rest are just 0xFF. This also allows me to add my own monitored values via canbus if i need to, just overwrite one of the unused byte positions.   |
|
|
|
|
Logged
|
|
|
|
|
