Pages: [1] 2 3 ... 6
Author Topic: Tip TCU Hack  (Read 56281 times)
AARDQ
Sr. Member
****

Karma: +11/-0
Offline Offline

Posts: 338


« on: February 03, 2013, 03:02:37 PM »

Continuing from the Tip thread in Original ECU Files, as that wasn't the right place for this.

Progress on reverse-engineering the Audi TCU operating code has been slow, so in the meantime I've taken to hacking the EDS valves' operating current.  This can be done by modifying the shunt voltage measurement used by the controller as proxy for current. At 1 ohm, amperage value is the same as the voltage value. By modifying the resistance, for a given measured voltage, the current will be different than what the controller thinks it is.

EDS 1, 2 and 3 are reverse-acting; lower current = increased operating pressure.  EDS 1 is overall line pressure, and 2 and 3 control shift sequence timing and firmness.  EDS 4 is direct acting and controls torque converter regulate and lock-up.

After some experimentation, I took line pressure measured voltage up by 10% by replacing the original 1 ohm EDS 1 resistor with a combination totaling 1.1 ohm, which again makes the controller operate at a lower current than it thinks.  I eventually also did the same for EDS 2 and 3.

This has totally transformed shift behavior, more firm but not jarring by any means.  If you can solder even somewhat, this is any easy and quick project.  Of course, your mileage may vary and don't blame me if you blow something up. blah blah blah.

To solve a problem with my TC occasionally going P0741, I also decreased EDS 4 resistor value to 0.8 ohms.  This also worked in my case (but probably will not if you have a torn seal.)

« Last Edit: February 05, 2013, 01:44:56 PM by AARDQ » Logged
NOTORIOUS VR
Administrator
Hero Member
*****

Karma: +58/-7
Offline Offline

Posts: 1056


« Reply #1 on: February 06, 2013, 03:54:21 PM »

nice!
Logged

SCHNELL ENGINEERING BLOG ·  STANDALONE ECUS · TUNING · DYNO · WIRING · PARTS · VEMS
Google Talk: NOTORIOUS.VR
n00bs start here: http://s4wiki.com/wiki/Tuning
AARDQ
Sr. Member
****

Karma: +11/-0
Offline Offline

Posts: 338


« Reply #2 on: February 06, 2013, 04:24:50 PM »

Why, thanks.

I can also add that a fairly cheap and plentiful 4BO927156DJ (from an '01 I believe) will stand in for a considerably more expensive and rare 4B0927156FE ('03) for experimentation purposes.  The shift lever has to be in S; the DJ is not configured for Sport mode, and D position has it shifting back and forth between D and 1 once a second or so.  Other than the loss of manual control it operates perfectly normally otherwise.

At some point I want to see if it will take the FE bin and function properly.  It looks otherwise identical.
Logged
jibberjive
Hero Member
*****

Karma: +23/-2
Offline Offline

Posts: 536


« Reply #3 on: February 08, 2013, 06:58:39 PM »

I am also curious about TCU behavior and modification.  How close do you think we are to start doing hacks via software, rather than hardware?

Does anyone have any Funktionsrahmen or info/documentation for any of the Bosch TCU's?
Logged
AARDQ
Sr. Member
****

Karma: +11/-0
Offline Offline

Posts: 338


« Reply #4 on: February 08, 2013, 08:32:23 PM »

I am also curious about TCU behavior and modification.  How close do you think we are to start doing hacks via software, rather than hardware?

Does anyone have any Funktionsrahmen or info/documentation for any of the Bosch TCU's?

Hopefully we're not too far off.  There are some clues from this thread http://nefariousmotorsports.com/forum/index.php?topic=453.msg3346#msg3346 that I just remembered that I plan to look at.

I wasted waaaay too much time at work today looking for a copy of the book referenced above  (the gent who responded earlier offering an address to ship never responded).  I finally found a(n overpriced) copy; should be here in a week or two.  Hopefully there will be some specific info of use.

I also spent a lot of time trying to figure out a BDM set-up.  The hardware seems simple enough, but I have no clue on the software.  Would love to hear anybody's views.

I wish Tony would pop up and release the Nefmoto version he spoke some time ago of that allows reading and writing to different controllers.
Logged
ddillenger
Hero Member
*****

Karma: +641/-21
Offline Offline

Posts: 5640


« Reply #5 on: February 09, 2013, 07:21:33 AM »

I don't think BDM would be required-the dealerships can flash them via the k-line, I'd think it would just be a matter of connecting to the module and entering specific addresses for flashing. Either that, or pull eprom and write it that way. I'll be happy to do it for the cause, I just don't have a tip.
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
AARDQ
Sr. Member
****

Karma: +11/-0
Offline Offline

Posts: 338


« Reply #6 on: February 09, 2013, 09:26:05 AM »

I was thinking BDM for purposes of reverse engineering.  Ultimately it may not be necessary... The off-the-shelf flashing options I've seen so far are relatively expensive for a hobbyist -- if they even have the capability to write to a specific address.  All of the ones I've seen so far are capable of writing to an ECU but not TCU.  If anybody can add any info as to a product that can do it, I think there are a few of us who would be grateful.

But yeah, writing directly is always an option.  I'm set up to do it; it's a bit of a pain but oh well.

Separately, the security seed table listed in the other thread I linked to shows up where it is supposed to in the .bin posted by K0mpresd, so that's encouraging.  Segmenting as described doesn't seem to buy anything; disassembly turns out vastly better without it.  My ignorance probably showing...  One thing I finally recognized is that Ida Pro 5.2 (don't know about later versions) isn't going to find instructions related to the CAN module, since this is a relatively custom part. 
Logged
ddillenger
Hero Member
*****

Karma: +641/-21
Offline Offline

Posts: 5640


« Reply #7 on: February 09, 2013, 09:30:43 AM »

Another point-does anyone have OLS816.dll in their winols? All the reading I've done leads me to believe this is the necessary checksum module...
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
Gonzo
Sr. Member
****

Karma: +21/-30
Offline Offline

Posts: 483


« Reply #8 on: March 13, 2013, 07:17:01 PM »

I wish Tony would pop up and release the Nefmoto version he spoke some time ago of that allows reading and writing to different controllers.
Don't quote me on this but Nefmoto does let you change the address you connect to....
Unless maybe only my version let me do that.
Logged
AARDQ
Sr. Member
****

Karma: +11/-0
Offline Offline

Posts: 338


« Reply #9 on: March 13, 2013, 08:28:59 PM »

It does indeed.  You can connect just fine with Nefmoto, as it turns out.  Just can't get it to meet prerequisites to read.

I screwed up my experimentation TCU so haven't played with this for a while.

Logged
MyTunes
Full Member
***

Karma: +9/-5
Offline Offline

Posts: 83


« Reply #10 on: October 07, 2013, 08:15:26 AM »

It does indeed.  You can connect just fine with Nefmoto, as it turns out.  Just can't get it to meet prerequisites to read.

I screwed up my experimentation TCU so haven't played with this for a while.


I'm kind of updating similar posts, but AARDQ did you get the bosch book?

I'm willing to chip in a few $$ to help cover the costs of this.

I'd love to help any way that I can.
Logged
AARDQ
Sr. Member
****

Karma: +11/-0
Offline Offline

Posts: 338


« Reply #11 on: October 08, 2013, 07:48:03 PM »

Yes, I have it.  Unfortunately it is more of an overview than anything in-depth.

I've been diverted a dozen different ways so haven't spent much time on anything Audi recently.
Logged
MyTunes
Full Member
***

Karma: +9/-5
Offline Offline

Posts: 83


« Reply #12 on: November 03, 2013, 08:07:07 PM »

Yes, I have it.  Unfortunately it is more of an overview than anything in-depth.

I've been diverted a dozen different ways so haven't spent much time on anything Audi recently.

I can understand that, life gets in the way sometimes.  Wink

I've been re-reading your first post and trying to apply it to the 5hp24fla which is similar but yet different at the same time.

It has 5 EDS relays. EDS 1 is also for line pressure, EDS2,3, and 5 are for shifting, and EDS4 is for tcc.

What caught my attention was the fact that the atsg 5hp24 manual states that EDS2,3,4, and 5 are all reverse acting of EDS1.

So I was browsing the good old interwebs tonight for an atsg 5hp19 manual, and oddly enough it also states that EDS2,3, and 4 are reverse acting of EDS1 which seems to contradict what you had in the first post if my thinking is correct.
Or maybe the manual I have is incorrect as it does say preliminary info and seems pretty old.

Both manuals basically say that when EDS1 is off pressure is high, and that for the rest of them when the solenoid is on pressure is high, the exact opposite of EDS1.

But if it is in fact correct would that mean that you are applying less pressure to EDS2, and 3 by increasing the current?
I'm trying to wrap my head around this seeing that they are also pwm controlled by the TCU.

I'm probably missing something very obvious LOL
Logged
Jerry Tunin
Full Member
***

Karma: +4/-1
Offline Offline

Posts: 121



WWW
« Reply #13 on: May 08, 2015, 09:53:34 AM »




Do you happen to have a higher resolution image by chance?
Logged

AARDQ
Sr. Member
****

Karma: +11/-0
Offline Offline

Posts: 338


« Reply #14 on: May 29, 2015, 01:17:07 PM »

I'm sorry, I don't.
Logged
Pages: [1] 2 3 ... 6
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.024 seconds with 17 queries. (Pretty URLs adds 0s, 0q)