Pages: [1] 2
Author Topic: B5 Audi S4 8D0907551M 002 RAM Variables  (Read 24064 times)
Tony@NefMoto
Administrator
Hero Member
*****

Karma: +132/-4
Offline Offline

Posts: 1389


2001.5 Audi S4 Stage 3


« on: March 18, 2011, 03:36:16 PM »

Attached is a document of all of the variables in RAM that I have documented. These have all come from my ECU disassembly in IDA of the 8D0907551M 002 binary. I documented all of these originally for use in my data logger. They have all been tested via my data logger, but there may still be errors. I have attached the reference ECU binary as well.

Update, here are a few more variables:
wkrdy 0xF9B4 byte unsigned degrees 0.75
etazws 0x380D96 Percent byte unsigned 0.5
dzws 0x380D95 Degrees byte signed 0.75
zwopt 0x380CB6 Degrees byte signed 0.75
zwsol 0x380D97 Degrees byte signed 0.75
« Last Edit: September 16, 2011, 04:07:23 PM by Tony@NefMoto » Logged

Remember you have to log in if you want to see the file attachments!
Info or questions, please add to the wiki: http://www.nefariousmotorsports.com/wiki
Follow NefMoto developments on Twitter: http://twitter.com/nefmoto
nyet
Administrator
Hero Member
*****

Karma: +607/-168
Offline Offline

Posts: 12270


WWW
« Reply #1 on: March 18, 2011, 04:10:03 PM »

Attached is a document of all of the variables in RAM that I have documented. These have all come from my ECU disassembly in IDA of the 8D0907551M 002 binary. I documented all of these originally for use in my data logger. They have all been tested via my data logger, but there may still be errors. I have attached the reference ECU binary as well.

thanks tony!

direct download here (hopefully mime type plain/text and not BIN)

http://nyet.org/cars/files/8D0907551M_0002%20RAM%20Variables.txt
Logged

ME7.1 tuning guide
ECUx Plot
ME7Sum checksum
Trim heatmap tool

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your ex
nyet
Administrator
Hero Member
*****

Karma: +607/-168
Offline Offline

Posts: 12270


WWW
« Reply #2 on: March 18, 2011, 04:27:12 PM »

Wow. Just goes to show how little APR cares (cared?) about PID tuning. I always wondered why ECUx never included any of those (CRITICAL!) values.

Also, of note:

Max spec MAP is 0xff*10 = 2550 mBar
Max measured MAP is 0xffff/25.6 = 2559.9609375 mBar *BEFORE DSLOFS*

AFTER DSLOFS, max measure MAP is 2559.9609375 - 16.4065 = 2543.55... bad news Smiley
« Last Edit: March 18, 2011, 05:09:44 PM by nyet » Logged

ME7.1 tuning guide
ECUx Plot
ME7Sum checksum
Trim heatmap tool

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your ex
iznogoud
Full Member
***

Karma: +13/-0
Offline Offline

Posts: 104

Learning junkie


« Reply #3 on: March 19, 2011, 05:15:02 PM »

Wow, good work Tony. I have some questions:

1. where did yo uget the naming conventions?
2. when you say "address" witihin the RAM, does it just mean that if one were to be picking up data she'd have to probe at that address with her own Motronic routines, or is it just a simple request via their protocol/API and you just provide the address and size where probing is desired?

(Displaimer: I may not know enough about the logging infrastructure to be asking the right questions.)

Nyet try and explain what you mean by bad news. As I understand it, we have an 8-byte integer limitation on the maximum requested boost. Yeah... but what do we know about the sensor itself and the voltage-signal interpretation? There are some 16-byte integers in there for measured boost! Isn't that good news in some sense? OK, so for the purpose of controlling boost with PID and such internally (closed-loop with ECU PID functions), doesn't that mean that the sensor may be providing accurate readings for higher boost, and then it would work just fine?

(I am thinking out loud and could be dead-wrong here.)
Logged

Audi S4 B5 2000 6sp Cactus Green
Audi A4 B6 Avant 1.8T 2001.5 5sp Santorin Blue
nyet
Administrator
Hero Member
*****

Karma: +607/-168
Offline Offline

Posts: 12270


WWW
« Reply #4 on: March 19, 2011, 05:26:29 PM »

First off: byte != bit

The accuracy isn't really relevant. I was pointing out that the maximum measured value is lower than the maximum possible set-point if you use the stock DSLOFS.

Not good.
Logged

ME7.1 tuning guide
ECUx Plot
ME7Sum checksum
Trim heatmap tool

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your ex
iznogoud
Full Member
***

Karma: +13/-0
Offline Offline

Posts: 104

Learning junkie


« Reply #5 on: March 19, 2011, 05:29:51 PM »

First off: byte != bit

Yes, sorry, I mean bit.

I still do not understand -- and that may be fine. If there were a way to bypass the specified boost (since it is all load based other than component protection), couldn't we just do PID with the existing sensor? (Provided it can physically read accurately boost higher than 2550 or so mbar.)
Logged

Audi S4 B5 2000 6sp Cactus Green
Audi A4 B6 Avant 1.8T 2001.5 5sp Santorin Blue
setzi62
Full Member
***

Karma: +142/-0
Offline Offline

Posts: 249


« Reply #6 on: March 21, 2011, 05:04:59 AM »

Attached is a document of all of the variables in RAM that I have documented. These have all come from my ECU disassembly in IDA of the 8D0907551M 002 binary. I documented all of these originally for use in my data logger. They have all been tested via my data logger, but there may still be errors. I have attached the reference ECU binary as well.
Great collection. Lots of these variables have not been prepared for logging even by Bosch.
Just two minor things I saw:
(Address=0x380984, DataType=UINT8, Scale=(1.0 / 1.25), Offset=(0.0), Name="Vehicle Speed", Units="km/h")

I think it must be Scale=(1.25) instead.

(Address=0x380F88, DataType=INT16, Scale=(1.0 / 256.0), Offset=(0.0), Name="Bank 1 Intake Camshaft Adjustment", Units="Degrees")
(Address=0x380F8A, DataType=INT16, Scale=(1.0 / 256.0), Offset=(0.0), Name="Bank 2 Intake Camshaft Adjustment", Units="Degrees")

Here Bank 1 and Bank 2 must be exchanged.
« Last Edit: May 17, 2011, 12:07:47 AM by Tony@NefMoto » Logged
spen
Full Member
***

Karma: +43/-0
Offline Offline

Posts: 112


« Reply #7 on: March 28, 2011, 03:27:55 PM »

Tony

Great stuff this.  Good work!

Just so you can cross ref with Bosch docs:

0xf878 is called nmot
0xf9fc is called zw_out
0x380c76 is called ldtvm

You've noted 0x380bbe as intake temp, Bosch use 0x380bbf called tans in their docs.  Tans is copied from 0x380bbf post sensor error check I think, at program counter 0x85deb8.

0x380b43 is called plsol, it is created at program counter 0x852A0A  from 0x382284 which is plsol_w, by what looks like a cast to uint8. plsol_w is used more frequently.

I think actual boost is at 0x382214, called pvdk_w (pressure in front of the throttle plate is the translation).  It's a word.

I'll write something to pull these out of other S4 roms.




Logged
nyet
Administrator
Hero Member
*****

Karma: +607/-168
Offline Offline

Posts: 12270


WWW
« Reply #8 on: March 28, 2011, 04:02:20 PM »

Here is what I have for Bosch translations:

http://s4wiki.com/wiki/Motronic_abbreviations
Logged

ME7.1 tuning guide
ECUx Plot
ME7Sum checksum
Trim heatmap tool

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your ex
spen
Full Member
***

Karma: +43/-0
Offline Offline

Posts: 112


« Reply #9 on: March 28, 2011, 04:16:03 PM »

I think we should work in some of the variables nyet lists on the translation. 
Logged
setzi62
Full Member
***

Karma: +142/-0
Offline Offline

Posts: 249


« Reply #10 on: March 29, 2011, 10:28:06 AM »

You've noted 0x380bbe as intake temp, Bosch use 0x380bbf called tans in their docs.  Tans is copied from 0x380bbf post sensor error check I think, at program counter 0x85deb8.

I think actual boost is at 0x382214, called pvdk_w (pressure in front of the throttle plate is the translation).  It's a word.

I'll write something to pull these out of other S4 roms.

0x380bbe is tanslin.
For Boost values: pvdkds_w is at 0x382216 and pvdks_w at 0x38221A.

I was working since some time on a tool that extracts information about variables out of ME7 images.
The list of RAM cells that Spen gave me once inspired me to dig further ...
Basically the list of variables in section TKMWL of the Funktionsrahmen is processed, as far as possible.
I hope to get this finished in the near future.
Logged
spen
Full Member
***

Karma: +43/-0
Offline Offline

Posts: 112


« Reply #11 on: March 30, 2011, 06:44:49 AM »

Ahh, ok, I won't duplicate effort! Good luck.
Logged
setzi62
Full Member
***

Karma: +142/-0
Offline Offline

Posts: 249


« Reply #12 on: April 21, 2011, 10:23:28 AM »

Well, I'm still continuing work on the tool to discover variables and other things in ME7 images
as far as time allows. At this point I wanted to give a first impression of the results for review.

I prepared output for the M-Box as example, as this is most widely used here.
At first there is an overview which variables get logged in the measurement groups
when using KWP1285 (e.g. with VCDS):
  -> see attached file 8D0907551M.grp
Might be usefull if you are wondering which internal variables you see in VCDS logs.
This list is not fully correct when a result consists of multiple variables or bitmasks,
but for single values it is fine.

Then there is the list of variables that are detected from the image:
  -> see attached file 8D0907551M.ecu
In this file, the alias names are just at the starting point and definitely it's needed to add more of them.
The comments in the file are derived from damos/asap2 files, so they are in German ...  Tongue.
I checked the data for correctness as far as possible using all images with matching damos
files I have on my hands.

The .ecu file in the current format is used as logger input. In the meantime I had successful runs   
with my ECU and my serial interface cable, but I could not gather experience besides this setup.
Next step on this will be to check with other ECUs/cables, but I won't distribute tools to public
before having some basic functionality working also with other setups.
Would one or two be willing to act as beta tester?

Happy Easter!  Smiley
Logged
gremlin
Hero Member
*****

Karma: +196/-9
Offline Offline

Posts: 654


« Reply #13 on: April 23, 2011, 03:12:24 PM »

Attached is a document of all of the variables in RAM that I have documented.

Maybe interested to somebody...
Here is full RAM locations list for

Audi Allroad 2.7T
4Z7907551S  0020
0261208288
Sw: 1037368391

Variables names are in Bosch abbreviations.
Legend text in German



Logged
DJGonzo
Guest
« Reply #14 on: May 11, 2011, 10:15:55 PM »

setzi, if the offer is still up, I would caan test out your tool with various ECU's Smiley
Logged
Pages: [1] 2
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.023 seconds with 16 queries. (Pretty URLs adds 0s, 0q)